diff --git a/apps/edr-freight-api/data/audit-endpoints.js b/apps/edr-freight-api/data/audit-endpoints.js
new file mode 100644
index 000000000..2c11ea95b
--- /dev/null
+++ b/apps/edr-freight-api/data/audit-endpoints.js
@@ -0,0 +1,639 @@
+/**
+ * Freight API — every state-changing endpoint (POST / PUT / PATCH / DELETE).
+ *
+ * Shape:  "<METHOD> <path>": [title, method, entity]
+ *
+ * Keyed by method + path rather than path alone: 50 paths serve more than one
+ * method (PATCH and DELETE on /api/contracts/:id, for example), so a path-only
+ * key would collide and drop those endpoints.
+ *
+ * Paths include the global prefix `api` (see app.setGlobalPrefix in src/main.ts).
+ * Titles come from each route's @ApiOperation summary, falling back to a
+ * humanized handler name where a route has none.
+ *
+ * Excludes the AI Assist and Account entities.
+ * Generated from the controllers under src/ — 488 endpoints.
+ */
+const AUDIT_ENDPOINTS = {
+  // Approval Rule
+  "POST /api/approval-rules": ["Create an approval rule step", "POST", "Approval Rule"],
+  "PATCH /api/approval-rules/:id": ["Update an approval rule", "PATCH", "Approval Rule"],
+  "DELETE /api/approval-rules/:id": ["Soft-delete an approval rule", "DELETE", "Approval Rule"],
+  "POST /api/approval-rules/:id/move-order": ["Move an approval step up or down within its chain", "POST", "Approval Rule"],
+  "POST /api/approval-rules/reorder": ["Bulk reorder approval steps within a chain", "POST", "Approval Rule"],
+
+  // Booking
+  "POST /api/bookings": ["Create a new freight booking (DRAFT)", "POST", "Booking"],
+  "POST /api/bookings/:bookingId/allocate-containers": ["Allocate containers to vehicles", "POST", "Booking"],
+  "PATCH /api/bookings/:id": ["Update booking", "PATCH", "Booking"],
+  "DELETE /api/bookings/:id": ["Soft-delete DRAFT booking", "DELETE", "Booking"],
+  "POST /api/bookings/:id/cancel": ["Cancel booking", "POST", "Booking"],
+  "POST /api/bookings/:id/cancel-hold": ["Customer cancels an unpaid hold (SELECTED_FOR_BATCH → CANCELLED);", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/declaration": ["GL ET uploads customs declaration on booking (GENERAL customs)", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/delivery-order": ["Upload Booking Delivery Order", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/documents": ["Customer uploads clearance documents (fieldname = document key)", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/draft-declaration": ["GL ET sends a draft customs declaration (multi-file) with an estimated price for the customer to review", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/draft-declaration/accept": ["Customer accepts the draft customs declaration — unlocks the real customs declaration step for GL Ethiopia", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/draft-declaration/change": ["Customer requests a change to the draft customs declaration with a reason — GL Ethiopia sends a corrected draft (repeatable)", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/duty": ["GL ET sets duty/tax on booking with notice attachment", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/duty-slip": ["Customer uploads duty/tax payment slip on booking", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/export-release": ["Confirm Booking Export Release", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/finalize": ["GL finalizes clearance (requires 100% approved) → CLEARANCE_READY", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/finalize-pre-clearance": ["GL ET finalizes import pre-clearance on booking", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/output-documents": ["GL uploads customs output documents (IM4/EX3/…)", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/proceed": ["Customer requests operation with a schedule day", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/release-order": ["Upload Booking Release Order", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/review": ["GL reviews a clearance document (Approve | Query)", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/ro-amendment": ["Request Booking RO Amendment", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/transit-assignee/assign": ["GL Djibouti picks the transit officer from the roster — unblocks the customs declaration; calling again reassigns", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/transit-assignee/request": ["GL ET asks GL Djibouti to name the transit officer — required before the import customs declaration", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/transit-permit": ["Upload Booking Transit Permit", "POST", "Booking"],
+  "POST /api/bookings/:id/confirm-submit": ["Confirm submit after price change", "POST", "Booking"],
+  "POST /api/bookings/:id/consolidation": ["Request freight consolidation", "POST", "Booking"],
+  "DELETE /api/bookings/:id/consolidation": ["Remove consolidation pairing", "DELETE", "Booking"],
+  "POST /api/bookings/:id/contract/generate": ["Generate contract PDF from template", "POST", "Booking"],
+  "POST /api/bookings/:id/contract/sign": ["Apply digital signature (customer or staff)", "POST", "Booking"],
+  "POST /api/bookings/:id/customer-cancel": ["Customer cancels their own booking before payment — no cancellation fee", "POST", "Booking"],
+  "POST /api/bookings/:id/customer-truck-assignment": ["Customer assigns external truck and driver for terminal pickup", "POST", "Booking"],
+  "POST /api/bookings/:id/customer-trucks": ["Add a customer self-haul truck carrying 1–2 of the booking containers", "POST", "Booking"],
+  "PATCH /api/bookings/:id/customer-trucks/:assignmentId": ["Edit a not-yet-arrived customer truck (plate/driver/type + containers)", "PATCH", "Booking"],
+  "DELETE /api/bookings/:id/customer-trucks/:assignmentId": ["Remove a not-yet-arrived customer truck from a booking", "DELETE", "Booking"],
+  "POST /api/bookings/:id/customer-trucks/:assignmentId/depart": ["Register an import truck leaving: containers loaded + weighed gross (staff)", "POST", "Booking"],
+  "POST /api/bookings/:id/customer-trucks/:assignmentId/load": ["Truck_dispatch: load selected containers onto a truck (staff)", "POST", "Booking"],
+  "POST /api/bookings/:id/customer-trucks/bulk": ["Bulk add customer trucks from array payload (Excel parsed)", "POST", "Booking"],
+  "POST /api/bookings/:id/customer/sign": ["Customer digital signature (deprecated — use POST contract/sign)", "POST", "Booking"],
+  "POST /api/bookings/:id/documents": ["Upload documents for a booking (DRAFT only)", "POST", "Booking"],
+  "PATCH /api/bookings/:id/export-handover-mode": ["Export only: choose direct truck-to-train (no warehouse, no GRN) or warehouse first", "PATCH", "Booking"],
+  "POST /api/bookings/:id/generate-grn": ["Generate a GRN over the received containers (all received, or a subset) — one GRN per batch", "POST", "Booking"],
+  "POST /api/bookings/:id/generate-price": ["Generate price preview (DRAFT or CHANGES_REQUESTED)", "POST", "Booking"],
+  "POST /api/bookings/:id/government-expedite": ["Expedite government booking to PAID / ELIGIBLE for scheduling", "POST", "Booking"],
+  "POST /api/bookings/:id/marketing/approve": ["Staff contract signature and fully execute (use contract/sign STAFF preferred)", "POST", "Booking"],
+  "POST /api/bookings/:id/operation/review": ["Operations reviews an operation request: ACCEPT (→ batch pool),", "POST", "Booking"],
+  "POST /api/bookings/:id/operations/complete": ["Mark completed", "POST", "Booking"],
+  "POST /api/bookings/:id/operations/start-transit": ["Mark in transit", "POST", "Booking"],
+  "POST /api/bookings/:id/reject": ["Customer reject price estimate", "POST", "Booking"],
+  "POST /api/bookings/:id/staff/accept": ["Staff accept intake → set contract validity window + start approval chain", "POST", "Booking"],
+  "POST /api/bookings/:id/staff/reject": ["Staff final reject", "POST", "Booking"],
+  "POST /api/bookings/:id/staff/request-changes": ["Staff return booking for customer updates", "POST", "Booking"],
+  "POST /api/bookings/:id/submit": ["Customer submit booking", "POST", "Booking"],
+  "POST /api/bookings/:id/wagon-cancellations": ["Request a partial wagon cancellation on a PAID booking — opens the cancellation-fee invoice; wagons are released only once the fee settles", "POST", "Booking"],
+  "POST /api/bookings/:id/wagon-cancellations/preview": ["Preview the fee/credit of a partial wagon cancellation (no writes)", "POST", "Booking"],
+  "POST /api/bookings/wagon-cancellations/:cancellationId/rebook": ["Rebook a wagon-cancellation credit: pick a shipment day only — the new booking is created under the contract and marked PAID (freight already paid; contract must still be valid)", "POST", "Booking"],
+  "POST /api/bookings/wagon-cancellations/:cancellationId/withdraw": ["Withdraw a fee-pending wagon cancellation (owner, or staff with the void permission)", "POST", "Booking"],
+
+  // Cargo
+  "POST /api/cargoes": ["Create a new cargo", "POST", "Cargo"],
+  "PATCH /api/cargoes/:id": ["Update a cargo", "PATCH", "Cargo"],
+  "DELETE /api/cargoes/:id": ["Delete a cargo", "DELETE", "Cargo"],
+  "POST /api/cargoes/:id/deliver": ["Mark cargo as delivered", "POST", "Cargo"],
+  "POST /api/cargoes/:id/load": ["Load cargo into a container", "POST", "Cargo"],
+  "POST /api/cargoes/:id/unload": ["Unload cargo from container", "POST", "Cargo"],
+
+  // Cargo Type
+  "POST /api/cargo-types": ["Create a cargo type", "POST", "Cargo Type"],
+  "PATCH /api/cargo-types/:id": ["Update a cargo type", "PATCH", "Cargo Type"],
+  "DELETE /api/cargo-types/:id": ["Soft-delete a cargo type", "DELETE", "Cargo Type"],
+  "POST /api/cargo-types/:id/move-order": ["Move a cargo type up or down in display order", "POST", "Cargo Type"],
+  "POST /api/cargo-types/reorder": ["Bulk reorder cargo types by ID list", "POST", "Cargo Type"],
+
+  // Company
+  "POST /api/companies": ["Create a new company (customer, freight_forwarder, dj_freight_forwarder, transporter)", "POST", "Company"],
+  "POST /api/companies/:companyId/documents": ["Upload documents for a company (onboarding)", "POST", "Company"],
+  "POST /api/companies/:companyId/profiles": ["Add a profile (employee) to a company", "POST", "Company"],
+  "PATCH /api/companies/:id": ["Update a company", "PATCH", "Company"],
+  "DELETE /api/companies/:id": ["Soft-delete a company", "DELETE", "Company"],
+  "POST /api/companies/change-requests/:id/approve": ["Approve a pending profile change request (applies the changes)", "POST", "Company"],
+  "POST /api/companies/change-requests/:id/reject": ["Reject a pending profile change request with a note", "POST", "Company"],
+  "POST /api/companies/change-requests/:id/request-changes": ["Ask for specific changes on a pending request without rejecting it (row stays open, next edit appends to it)", "POST", "Company"],
+  "POST /api/companies/company-profile": ["Create a single operational profile for the current user's company. The role starts pending and does not become the active mode", "POST", "Company"],
+  "POST /api/companies/company-profiles": ["Add operational profile(s) (importer/exporter/forwarder) to the current user's company", "POST", "Company"],
+  "POST /api/companies/company-profiles/:profileId/license": ["Add business-license document(s) to a profile. For an approved company", "POST", "Company"],
+  "DELETE /api/companies/company-profiles/:profileId/license/:fileId": ["Remove a business-license file (staged for review on an approved company)", "DELETE", "Company"],
+  "POST /api/companies/company-profiles/:profileId/license/:fileId/replace": ["Replace a business-license file with a newly uploaded one (staged for", "POST", "Company"],
+  "POST /api/companies/company-profiles/:profileId/reapply": ["Resubmit a rejected operational role for approval (→ pending)", "POST", "Company"],
+  "PATCH /api/companies/company-profiles/:profileId/status": ["Update a company profile's approval status", "PATCH", "Company"],
+  "POST /api/companies/create": ["Create a company with its associated external profile (onboarding)", "POST", "Company"],
+  "POST /api/companies/documents/:fileId/request-change": ["Ask the customer to correct one uploaded document", "POST", "Company"],
+  "POST /api/companies/fetch-etrade-info": ["Fetch company info from eTrade by TIN", "POST", "Company"],
+  "POST /api/companies/identity/fayda/complete": ["Bind a completed Fayda verification to the company's owner or Power of Attorney", "POST", "Company"],
+  "DELETE /api/companies/identity/fayda/poa": ["Remove the company's Power of Attorney — the verified identity, its details and the delegation paper together", "DELETE", "Company"],
+  "DELETE /api/companies/identity/gm": ["Clear the General Manager's identity — the \\\"same as owner\\\" declaration or a verification, and the details either wrote", "DELETE", "Company"],
+  "POST /api/companies/identity/gm/same-as-owner": ["Declare the General Manager is the company's owner, copying the owner's verified identity across", "POST", "Company"],
+  "POST /api/companies/identity/poa/same-as-owner": ["Declare the Power of Attorney is the company's owner, copying the owner's identity across", "POST", "Company"],
+  "DELETE /api/companies/identity/poa/same-as-owner": ["Undo the Power of Attorney \\\"same as owner\\\" declaration and the identity it copied, leaving the representative open to be verified in their own right", "DELETE", "Company"],
+  "PATCH /api/companies/onboarding-step": ["Persist the user's current onboarding wizard step", "PATCH", "Company"],
+  "POST /api/companies/onboarding/complete": ["Mark the current user's onboarding as complete", "POST", "Company"],
+  "POST /api/companies/onboarding/start": ["Begin onboarding: create a draft company + profile + role(s) so later steps can save incrementally", "POST", "Company"],
+  "POST /api/companies/poa-delegation": ["Upload the Power of Attorney delegation letter, replacing any existing one", "POST", "Company"],
+  "DELETE /api/companies/poa-delegation/:fileId": ["Remove the Power of Attorney delegation letter (staged for review on an approved company)", "DELETE", "Company"],
+  "PATCH /api/companies/profile": ["Update profile (flattened settings page)", "PATCH", "Company"],
+
+  // Compliance
+  "POST /api/compliance": ["Create a compliance record", "POST", "Compliance"],
+  "PATCH /api/compliance/:id": ["Update a compliance record", "PATCH", "Compliance"],
+  "DELETE /api/compliance/:id": ["Soft-delete a compliance record", "DELETE", "Compliance"],
+
+  // Consignment
+  "POST /api/consignments": ["Create a new consignment", "POST", "Consignment"],
+
+  // Container
+  "POST /api/containers": ["Create a new container", "POST", "Container"],
+  "PATCH /api/containers/:id": ["Update a container", "PATCH", "Container"],
+  "DELETE /api/containers/:id": ["Delete a container", "DELETE", "Container"],
+  "POST /api/containers/:id/assign-wagon": ["Assign container to a wagon", "POST", "Container"],
+  "POST /api/containers/:id/unassign-wagon": ["Unassign container from wagon", "POST", "Container"],
+
+  // Container Type
+  "POST /api/container-types": ["Create a container type", "POST", "Container Type"],
+  "PATCH /api/container-types/:id": ["Update a container type", "PATCH", "Container Type"],
+  "DELETE /api/container-types/:id": ["Soft-delete a container type", "DELETE", "Container Type"],
+  "POST /api/container-types/:id/move-order": ["Move a container type up or down in display order", "POST", "Container Type"],
+  "POST /api/container-types/reorder": ["Bulk reorder container types by ID list", "POST", "Container Type"],
+
+  // Contract
+  "POST /api/contracts": ["Create a new contract (DRAFT) with routes + cargo scope", "POST", "Contract"],
+  "PATCH /api/contracts/:id": ["Update contract", "PATCH", "Contract"],
+  "DELETE /api/contracts/:id": ["Soft-delete DRAFT contract", "DELETE", "Contract"],
+  "POST /api/contracts/:id/approval-steps/:stepId/approve": ["Approve one approval step in sequence", "POST", "Contract"],
+  "POST /api/contracts/:id/approval-steps/:stepId/reject": ["Reject one approval step — to the customer (terminal → REJECTED) or, via returnToStepId, back to an earlier approver (chain re-runs from there)", "POST", "Contract"],
+  "POST /api/contracts/:id/booking-requests": ["Customer submits a shipment request on a GENERAL customs contract", "POST", "Contract"],
+  "POST /api/contracts/:id/bookings": ["Create a shipment booking under a contract — Path A (customer) or Path B (GL Ethiopia)", "POST", "Contract"],
+  "POST /api/contracts/:id/bookings/:bookingId/complete": ["Complete an initiated booking after Operations finalized its clearance — cargo + binding day, window and departure checks, pricing and invoicing", "POST", "Contract"],
+  "POST /api/contracts/:id/bookings/initiate": ["Initiate a bare booking instance under an import/export contract (ONE_TIME or GENERAL) — no cargo, no date; enters per-booking clearance (AWAITING_DOCUMENTS). ONE_TIME customs instances are opened by the customer (or GL); GENERAL customs comes from a shipment request", "POST", "Contract"],
+  "POST /api/contracts/:id/cancel": ["Customer cancels their own contract (blocked while a booking is live)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/declaration": ["GL ET uploads customs declaration documents (multi-file)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/delivery-order": ["GL DJ uploads Delivery Order (import) with vessel arrival + DO collected dates", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/documents": ["Customer uploads clearance documents (fieldname = document key)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/documents/:fileKey/replace": ["GL replaces a clearance document in place (reason required) — the previous version is kept in the file history and the new one needs approving", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/duty": ["GL ET sets duty/tax requirement and advises amount with notice attachment", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/duty-slip": ["Customer uploads duty/tax payment slip on contract", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/duty/dispute": ["Customer disputes the advised duty/tax with a reason — reopens the step so GL Ethiopia can re-advise (repeatable)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/export-release": ["GL ET confirms export release after declaration", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/finalize": ["GL ET finalizes clearance → CLEARANCE_READY_FOR_BOOKING (legacy)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/finalize-export-clearance": ["GL ET finalizes export clearance after post-booking transit permit upload", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/finalize-pre-clearance": ["GL ET finalizes import pre-clearance — unlocks Djibouti DO upload", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/ops-finalize": ["Operations finalizes self-clearance → customer may create the booking", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/ops-review": ["Operations reviews a customer self-clearance document (Approve | Query)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/output-documents": ["GL uploads customs output documents (IM4/EX3/…) pre-booking", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/release-order": ["GL DJ uploads Release Order + vessel departure date (export)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/review": ["GL ET reviews a clearance document (Approve | Query)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/ro-amendment": ["GL DJ requests port amendment when RO vessel window is too short", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/transit-assignee/assign": ["GL Djibouti picks the transit officer from the roster — unblocks the customs declaration; calling again reassigns", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/transit-assignee/request": ["GL ET asks GL Djibouti to name the transit officer — required before the customs declaration", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/transit-permit": ["GL ET uploads import transit permit documents (multi-file)", "POST", "Contract"],
+  "POST /api/contracts/:id/confirm-submit": ["Confirm submit after a price change", "POST", "Contract"],
+  "POST /api/contracts/:id/contract/generate": ["Generate contract document → CONTRACT_READY", "POST", "Contract"],
+  "POST /api/contracts/:id/contract/send-signing-otp": ["Send the sudo-mode signing OTP to the contract company's registered phone (server picks the number)", "POST", "Contract"],
+  "POST /api/contracts/:id/contract/sign": ["Apply digital signature (customer or staff/director/ceo)", "POST", "Contract"],
+  "PUT /api/contracts/:id/document/articles": ["Edit this contract\\'s document articles only (per-contract; never touches the six shared templates)", "PUT", "Contract"],
+  "POST /api/contracts/:id/documents": ["Upload intake documents for a contract (DRAFT only)", "POST", "Contract"],
+  "POST /api/contracts/:id/generate-price": ["Generate unit-rate breakdown (no totals at contract phase)", "POST", "Contract"],
+  "POST /api/contracts/:id/milestones/:code/complete": ["GL marks a pre-booking (contract) milestone complete", "POST", "Contract"],
+  "POST /api/contracts/:id/renew": ["Create a renewal draft linked via renewalOfId", "POST", "Contract"],
+  "POST /api/contracts/:id/resume": ["Staff lift a suspension — contract returns to its prior status", "POST", "Contract"],
+  "POST /api/contracts/:id/staff/accept": ["Staff accept → set validity window + start approval chain", "POST", "Contract"],
+  "POST /api/contracts/:id/staff/reject": ["Staff reject contract", "POST", "Contract"],
+  "POST /api/contracts/:id/staff/request-changes": ["Staff return contract for customer updates", "POST", "Contract"],
+  "POST /api/contracts/:id/submit": ["Customer submit contract (freezes contract_rate_snapshots)", "POST", "Contract"],
+  "POST /api/contracts/:id/suspend": ["Staff freeze a signed contract (reversible, any post-signature step)", "POST", "Contract"],
+  "POST /api/contracts/:id/validate-shipment": ["Pre-create validation + authoritative price preview: full booking price breakdown (rail, first/last mile, surcharges), overweight lines and 20ft weight-pairing errors for a shipment payload (no booking created)", "POST", "Contract"],
+  "POST /api/contracts/booking-requests/:reqId/accept": ["GL marks a shipment request accepted + links the created booking", "POST", "Contract"],
+  "POST /api/contracts/booking-requests/:reqId/cancel": ["Customer cancels their own pending shipment request", "POST", "Contract"],
+  "POST /api/contracts/booking-requests/:reqId/reject": ["GL rejects a shipment request", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/documents": ["GL uploads post-booking operational documents (DO/RO/T1/…)", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/duty": ["GL ET advises duty & tax amount + declaration serial", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/duty-slip": ["Customer uploads the duty/tax payment slip", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/final-invoice": ["GL DJ raises the post-offload final invoice (amount + invoice document)", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/final-invoice-slip": ["Customer attaches the payment slip for the final invoice", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/final-invoice/approve": ["Customer approves the drafted final invoice — unlocks the payment slip", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/final-invoice/confirm": ["GL (ET or DJ) confirms the payment slip — settles the final invoice", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/incidents": ["GL DJ logs a cargo exception with photo evidence", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/milestones/:code/complete": ["GL / Ops / Terminal marks a post-booking milestone complete", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/risk": ["GL ET assigns a customs risk level (GREEN/YELLOW/RED)", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/second-duty": ["GL ET advises (or skips) the post-arrival additional duty/tax round (import)", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/second-duty-slip": ["Customer attaches the additional duty/tax payment slip", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/station-assign": ["GL station manager routes the shipment + binds staff", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/t1-close": ["Close (accept) the T1 set — GL ET after arrival (import) / GL DJ after gate pass (export)", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/t1-documents": ["GL Djibouti uploads T1 transit documents (multi-file) after wagon allocation; locked once the train departs", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/transport-document": ["GL ET uploads export transit permit documents (multi-file)", "POST", "Contract"],
+  "POST /api/gl-exchange/:entityId": ["Share a document with the other GL desk", "POST", "Contract"],
+  "PATCH /api/gl-exchange/documents/:documentId": ["Uploader edits a shared document (title, visibility, file)", "PATCH", "Contract"],
+  "DELETE /api/gl-exchange/documents/:documentId": ["Uploader removes a shared document", "DELETE", "Contract"],
+
+  // Contract Template
+  "POST /api/contract-templates": ["Create a bulk contract template for a (cargo type, customs option) pair", "POST", "Contract Template"],
+  "PATCH /api/contract-templates/:code": ["Update template metadata (name, title, recitals, active flag)", "PATCH", "Contract Template"],
+  "DELETE /api/contract-templates/:code": ["Delete a staff-created bulk template (system templates refuse)", "DELETE", "Contract Template"],
+  "POST /api/contract-templates/:code/articles": ["Add an article to the template", "POST", "Contract Template"],
+  "PUT /api/contract-templates/:code/articles": ["Replace the full ordered article list (used for reorder)", "PUT", "Contract Template"],
+  "PATCH /api/contract-templates/:code/articles/:articleId": ["Update an article's title or body", "PATCH", "Contract Template"],
+  "DELETE /api/contract-templates/:code/articles/:articleId": ["Remove an article from the template", "DELETE", "Contract Template"],
+  "POST /api/contract-templates/:code/preview": ["Render an HTML preview of the template against mock contract data", "POST", "Contract Template"],
+
+  // Driver
+  "POST /api/drivers": ["Create a new driver", "POST", "Driver"],
+  "PATCH /api/drivers/:id": ["Update a driver", "PATCH", "Driver"],
+  "DELETE /api/drivers/:id": ["Delete a driver", "DELETE", "Driver"],
+  "POST /api/drivers/:id/documents": ["Upload driver documents (code driver_docs)", "POST", "Driver"],
+  "DELETE /api/drivers/:id/documents/:fileId": ["Delete a driver document", "DELETE", "Driver"],
+
+  // Dropdown Setting
+  "POST /api/dropdown-settings": ["Create a new dropdown setting", "POST", "Dropdown Setting"],
+  "PATCH /api/dropdown-settings/:id": ["Update a dropdown setting's metadata", "PATCH", "Dropdown Setting"],
+  "DELETE /api/dropdown-settings/:id": ["Soft-delete a dropdown setting", "DELETE", "Dropdown Setting"],
+  "POST /api/dropdown-settings/:id/options": ["Append a single option to a setting", "POST", "Dropdown Setting"],
+  "PUT /api/dropdown-settings/:id/options": ["Replace the full option list for a setting", "PUT", "Dropdown Setting"],
+  "PATCH /api/dropdown-settings/options/:optionId": ["Update a single option", "PATCH", "Dropdown Setting"],
+  "DELETE /api/dropdown-settings/options/:optionId": ["Soft-delete a single option", "DELETE", "Dropdown Setting"],
+
+  // EIMS Invoice
+  "POST /api/invoices/:id/eims/register": ["Register the invoice with MoR EIMS. Idempotent — an invoice that already has an IRN is returned unchanged", "POST", "EIMS Invoice"],
+  "POST /api/invoices/:id/eims/resolve": ["Resolve an unacknowledged submission: record the IRN confirmed with MoR, or discard it. Clears the system-wide block", "POST", "EIMS Invoice"],
+  "POST /api/invoices/:id/eims/verify": ["Verify the invoice's stored IRN against EIMS", "POST", "EIMS Invoice"],
+
+  // Exchange Setting
+  "PATCH /api/exchange-settings": ["Set the USD→ETB fallback by hand (used only while CBE is unreachable)", "PATCH", "Exchange Setting"],
+
+  // Facility
+  "POST /api/facilities": ["Create a new facility", "POST", "Facility"],
+  "PATCH /api/facilities/:id": ["Update a facility", "PATCH", "Facility"],
+  "DELETE /api/facilities/:id": ["Delete a facility (soft delete)", "DELETE", "Facility"],
+
+  // Fayda Verification
+  "POST /api/fayda/verification/start": ["Start a VeriFayda 2.0 verification session", "POST", "Fayda Verification"],
+
+  // File Upload Setting
+  "POST /api/file-upload-settings": ["Create a new file upload setting", "POST", "File Upload Setting"],
+  "PATCH /api/file-upload-settings/:id": ["Update a file upload setting's metadata", "PATCH", "File Upload Setting"],
+  "DELETE /api/file-upload-settings/:id": ["Soft-delete a file upload setting", "DELETE", "File Upload Setting"],
+  "POST /api/file-upload-settings/:id/fields": ["Append a single field to a setting", "POST", "File Upload Setting"],
+  "PUT /api/file-upload-settings/:id/fields": ["Replace the full field list for a setting", "PUT", "File Upload Setting"],
+  "PATCH /api/file-upload-settings/fields/:fieldId": ["Update a single field", "PATCH", "File Upload Setting"],
+  "DELETE /api/file-upload-settings/fields/:fieldId": ["Soft-delete a single field", "DELETE", "File Upload Setting"],
+
+  // First Mile
+  "POST /api/first-mile": ["Create a first-mile leg", "POST", "First Mile"],
+  "PATCH /api/first-mile/:id": ["Update a first-mile leg", "PATCH", "First Mile"],
+  "DELETE /api/first-mile/:id": ["Soft-delete a first-mile leg", "DELETE", "First Mile"],
+  "POST /api/first-mile/:id/distances": ["Set per-vehicle actual distances (does not generate an invoice)", "POST", "First Mile"],
+  "POST /api/first-mile/:id/invoice": ["Generate the first-mile delivery-fee invoice", "POST", "First Mile"],
+  "POST /api/first-mile/:id/vehicles": ["Set the vehicles assigned to a first-mile pickup (multi-truck)", "POST", "First Mile"],
+  "POST /api/first-mile/accept/:reference": ["Accept a paid booking and create a first-mile leg", "POST", "First Mile"],
+
+  // Fuel
+  "POST /api/fuel/purchases": ["Record fuel purchase", "POST", "Fuel"],
+
+  // GPS Tracking
+  "POST /api/gps/devices": ["Register a GPS tracker", "POST", "GPS Tracking"],
+  "PATCH /api/gps/devices/:id": ["Update a GPS tracker (name / assigned vehicle)", "PATCH", "GPS Tracking"],
+  "DELETE /api/gps/devices/:id": ["Delete a GPS tracker", "DELETE", "GPS Tracking"],
+
+  // Import Operation
+  "POST /api/import-operations/customs/:bookingId/declaration": ["Batch 12: record declaration serial number", "POST", "Import Operation"],
+  "POST /api/import-operations/customs/:bookingId/documents": ["Batch 12: upload IM4/IM5/T1/permit/payment-slip documents", "POST", "Import Operation"],
+  "POST /api/import-operations/customs/:bookingId/duties-taxes-paid": ["Batch 12: mark duties and taxes paid", "POST", "Import Operation"],
+  "POST /api/import-operations/customs/:bookingId/notify-duties-taxes": ["Batch 12: notify duties and taxes", "POST", "Import Operation"],
+  "POST /api/import-operations/customs/:bookingId/release-permitted": ["Batch 12: mark import release permitted", "POST", "Import Operation"],
+  "POST /api/import-operations/customs/:bookingId/risk": ["Batch 12: assign customs risk", "POST", "Import Operation"],
+  "POST /api/import-operations/djibouti-incidents": ["Batch 8: report a Djibouti import incident / exception", "POST", "Import Operation"],
+  "POST /api/import-operations/empty-container-returns": ["Batch 16: create an empty container return record", "POST", "Import Operation"],
+  "POST /api/import-operations/empty-container-returns/:id/status": ["Batch 16: advance empty container return workflow", "POST", "Import Operation"],
+
+  // Incident
+  "POST /api/incidents": ["Report an incident", "POST", "Incident"],
+  "PATCH /api/incidents/:id": ["Update an incident", "PATCH", "Incident"],
+  "DELETE /api/incidents/:id": ["Delete an incident", "DELETE", "Incident"],
+
+  // Interchange Document
+  "PATCH /api/interchange-documents/:id/acknowledge": ["Acknowledge an interchange document", "PATCH", "Interchange Document"],
+  "PATCH /api/interchange-documents/:id/dispute": ["Dispute an interchange document", "PATCH", "Interchange Document"],
+  "POST /api/interchange-documents/generate-from-schedule": ["Generate interchange document from a train schedule handover", "POST", "Interchange Document"],
+
+  // Last Mile
+  "POST /api/last-mile": ["Create a last-mile leg", "POST", "Last Mile"],
+  "PATCH /api/last-mile/:id": ["Update a last-mile leg", "PATCH", "Last Mile"],
+  "DELETE /api/last-mile/:id": ["Soft-delete a last-mile leg", "DELETE", "Last Mile"],
+  "POST /api/last-mile/:id/detention-times": ["Set each truck\\'s own detention window (arrived at destination / returned)", "POST", "Last Mile"],
+  "POST /api/last-mile/:id/distances": ["Set per-vehicle actual distances (does not generate an invoice)", "POST", "Last Mile"],
+  "POST /api/last-mile/:id/invoice": ["Generate the delivery-fee invoice for a last-mile leg", "POST", "Last Mile"],
+  "POST /api/last-mile/:id/proof-of-delivery": ["Record proof of delivery (signature + photos) and complete the leg", "POST", "Last Mile"],
+  "POST /api/last-mile/:id/vehicles": ["Set the vehicles assigned to a last-mile delivery (multi-truck)", "POST", "Last Mile"],
+  "POST /api/last-mile/:id/warehouse-gate-times": ["Set each truck\\'s warehouse gate arrival/departure times", "POST", "Last Mile"],
+  "POST /api/last-mile/accept/:reference": ["Accept a paid booking and create a last-mile leg", "POST", "Last Mile"],
+
+  // Last Mile Request
+  "POST /api/last-mile-requests/:id/approve": ["Truck & Machinery chief approves the request — the advance defaults to the live last-mile rate; LM contract becomes signable and the advance invoice follows the customer signature", "POST", "Last Mile Request"],
+  "POST /api/last-mile-requests/:id/contract/sign": ["Customer agrees and signs the LM contract — then the advance invoice is issued", "POST", "Last Mile Request"],
+  "POST /api/last-mile-requests/:id/reject": ["Truck & Machinery chief rejects the request with a reason", "POST", "Last Mile Request"],
+  "POST /api/last-mile-requests/:id/submit": ["Customer confirms which containers go via EDR last-mile", "POST", "Last Mile Request"],
+
+  // Locomotive
+  "POST /api/locomotives": ["Create a locomotive", "POST", "Locomotive"],
+  "PATCH /api/locomotives/:id": ["Update a locomotive", "PATCH", "Locomotive"],
+  "POST /api/locomotives/:id/decommission": ["Decommission a locomotive", "POST", "Locomotive"],
+  "DELETE /api/locomotives/:id/permanent": ["Permanently delete a locomotive (irreversible; refused if any train references it)", "DELETE", "Locomotive"],
+
+  // Maintenance
+  "POST /api/maintenance/costs": ["Record maintenance cost", "POST", "Maintenance"],
+  "POST /api/maintenance/intervals": ["Define/adjust a service interval (e.g. oil change every 10,000 km)", "POST", "Maintenance"],
+  "DELETE /api/maintenance/intervals/:id": ["Deactivate a service interval (stops auto-scheduling)", "DELETE", "Maintenance"],
+  "POST /api/maintenance/parts": ["Create part", "POST", "Maintenance"],
+  "PATCH /api/maintenance/parts/:id": ["Update part", "PATCH", "Maintenance"],
+  "DELETE /api/maintenance/parts/:id": ["Delete part", "DELETE", "Maintenance"],
+  "POST /api/maintenance/schedules": ["Schedule maintenance", "POST", "Maintenance"],
+  "PATCH /api/maintenance/schedules/:id": ["Update maintenance schedule", "PATCH", "Maintenance"],
+  "POST /api/maintenance/warranties": ["Create warranty", "POST", "Maintenance"],
+  "DELETE /api/maintenance/warranties/:id": ["Delete warranty", "DELETE", "Maintenance"],
+  "POST /api/maintenance/work-orders": ["Create work order", "POST", "Maintenance"],
+  "PATCH /api/maintenance/work-orders/:id": ["Update work order", "PATCH", "Maintenance"],
+  "DELETE /api/maintenance/work-orders/:id": ["Delete work order", "DELETE", "Maintenance"],
+
+  // Notification Inbox
+  "PATCH /api/notifications/:id/read": ["Mark one of my notifications as read", "PATCH", "Notification Inbox"],
+  "POST /api/notifications/read-all": ["Mark all my notifications as read", "POST", "Notification Inbox"],
+
+  // Organization User
+  "PUT /api/backoffice/organizations/:orgId/employee-users/:userId/roles": ["Replace org-scoped roles assigned to an employee user", "PUT", "Organization User"],
+  "POST /api/backoffice/organizations/:orgId/users": ["Create an organization user without assigning positions", "POST", "Organization User"],
+
+  // OTP
+  "POST /api/otp/send": ["Send OTP", "POST", "OTP"],
+  "POST /api/otp/verify": ["Verify OTP", "POST", "OTP"],
+
+  // Password Reset
+  "POST /api/auth/forgot-password/request": ["Send a password-reset code to the account's email AND phone", "POST", "Password Reset"],
+  "POST /api/auth/forgot-password/resolve-link": ["Validate a staff-issued reset link and return its set-password ticket", "POST", "Password Reset"],
+  "POST /api/auth/forgot-password/verify": ["Exchange a valid reset code for a single-use set-password ticket", "POST", "Password Reset"],
+  "POST /api/backoffice/customers/:companyId/reset-password": ["Send a password-reset link to a customer's primary contact", "POST", "Password Reset"],
+
+  // Payment
+  "POST /api/billing/invoices/:id/confirm-offline": ["Finance confirms a USD invoice paid by bank transfer — slip file required, settles the full balance", "POST", "Payment"],
+  "POST /api/billing/my-invoices/:id/confirm": ["Confirm an OTP-debit payment (CAC Bank) for one of the customer's invoices", "POST", "Payment"],
+  "POST /api/billing/my-invoices/:id/pay": ["Initiate payment for one of the customer's invoices", "POST", "Payment"],
+  "POST /api/internal/payments/bill-query": ["Live still-payable check + payer name for a CBE bill (called while CBE is on the line)", "POST", "Payment"],
+  "POST /api/internal/payments/mark-paid": ["Apply a payment.succeeded / payment.failed event from the payment service (idempotent)", "POST", "Payment"],
+  "POST /api/payments/initiate": ["Initiate payment for an invoice", "POST", "Payment"],
+  "POST /api/payments/redirect-success/:bookingId": ["Success-redirect ack: mark payment processing + invoice PAYMENT_PROCESSING (webhook remains source of truth)", "POST", "Payment"],
+
+  // Priority Config
+  "POST /api/priority-configs": ["Create a priority config", "POST", "Priority Config"],
+  "PATCH /api/priority-configs/:id": ["Update a priority config", "PATCH", "Priority Config"],
+  "DELETE /api/priority-configs/:id": ["Soft-delete a priority config", "DELETE", "Priority Config"],
+  "POST /api/priority-configs/:id/move-order": ["Move a priority config up or down in display order", "POST", "Priority Config"],
+  "POST /api/priority-configs/reorder": ["Bulk reorder priority configs by ID list", "POST", "Priority Config"],
+
+  // Priority Rule Change Request
+  "POST /api/priority-rule-change-requests": ["Submit a priority-rule change for approval", "POST", "Priority Rule Change Request"],
+  "POST /api/priority-rule-change-requests/:id/approve": ["Approve and apply a pending change", "POST", "Priority Rule Change Request"],
+  "POST /api/priority-rule-change-requests/:id/reject": ["Reject a pending change", "POST", "Priority Rule Change Request"],
+
+  // Procurement
+  "POST /api/procurement/acquisitions": ["Create an asset acquisition", "POST", "Procurement"],
+  "PATCH /api/procurement/acquisitions/:id": ["Update an asset acquisition", "PATCH", "Procurement"],
+  "DELETE /api/procurement/acquisitions/:id": ["Delete an asset acquisition", "DELETE", "Procurement"],
+  "POST /api/procurement/disposals": ["Create an asset disposal", "POST", "Procurement"],
+  "DELETE /api/procurement/disposals/:id": ["Delete an asset disposal", "DELETE", "Procurement"],
+  "POST /api/procurement/vendors": ["Create a vendor", "POST", "Procurement"],
+  "PATCH /api/procurement/vendors/:id": ["Update a vendor", "PATCH", "Procurement"],
+  "DELETE /api/procurement/vendors/:id": ["Delete a vendor", "DELETE", "Procurement"],
+
+  // Rate
+  "POST /api/rates": ["Create a rate (DRAFT)", "POST", "Rate"],
+  "PATCH /api/rates/:id": ["Update a DRAFT rate", "PATCH", "Rate"],
+  "DELETE /api/rates/:id": ["Soft-delete a rate", "DELETE", "Rate"],
+  "POST /api/rates/:id/approve": ["CEO approves a rate", "POST", "Rate"],
+  "POST /api/rates/:id/submit": ["Submit rate for CEO approval", "POST", "Rate"],
+
+  // Rate Change Request
+  "POST /api/rate-change-requests": ["Propose a change to a LIVE rate", "POST", "Rate Change Request"],
+  "POST /api/rate-change-requests/:id/approve": ["Approve a rate change and put it into effect", "POST", "Rate Change Request"],
+  "POST /api/rate-change-requests/:id/reject": ["Reject a rate change — the rate keeps its current value", "POST", "Rate Change Request"],
+
+  // Route
+  "POST /api/routes": ["Create route", "POST", "Route"],
+  "PATCH /api/routes/:id": ["Update route", "PATCH", "Route"],
+  "DELETE /api/routes/:id": ["Deactivate route", "DELETE", "Route"],
+  "DELETE /api/routes/:id/permanent": ["Permanently delete a route (irreversible; refused while any train schedule references it)", "DELETE", "Route"],
+
+  // Schedule
+  // NOTE: duplicate route — also declared in modules/scheduling-reschedule/scheduling-reschedule.controller.ts:52.
+  // Two controllers register this same path; Nest serves whichever module loads first.
+  "POST /api/train-scheduling/schedules/:id/maintenance": ["Reschedule train for maintenance (new departure + rebalance)", "POST", "Schedule"],
+  "POST /api/train-scheduling/schedules/:id/reschedule/execute": ["Execute a confirmed reschedule plan", "POST", "Schedule"],
+  "POST /api/train-scheduling/schedules/:id/reschedule/preview": ["Preview reschedule / government preempt plan", "POST", "Schedule"],
+
+  // Service Type
+  "POST /api/service-types": ["Create a service type", "POST", "Service Type"],
+  "PATCH /api/service-types/:id": ["Update a service type", "PATCH", "Service Type"],
+  "DELETE /api/service-types/:id": ["Soft-delete a service type", "DELETE", "Service Type"],
+  "POST /api/service-types/:id/move-order": ["Move a service type up or down in display order", "POST", "Service Type"],
+  "POST /api/service-types/reorder": ["Bulk reorder service types by ID list", "POST", "Service Type"],
+
+  // Shipping Line
+  "POST /api/shipping-lines": ["Create a shipping line", "POST", "Shipping Line"],
+  "PATCH /api/shipping-lines/:id": ["Update a shipping line", "PATCH", "Shipping Line"],
+  "DELETE /api/shipping-lines/:id": ["Soft-delete a shipping line", "DELETE", "Shipping Line"],
+
+  // Signature
+  "PUT /api/me/signature": ["Create or update the reusable saved signature", "PUT", "Signature"],
+
+  // Support Chat
+  "POST /api/support/agent/conversations": ["Start chatting with a company (returns the thread if one exists)", "POST", "Support Chat"],
+  "POST /api/support/agent/conversations/:id/messages": ["Reply as an agent, optionally with attachments", "POST", "Support Chat"],
+  "POST /api/support/agent/conversations/:id/read": ["Mark a thread read (agent side)", "POST", "Support Chat"],
+  "POST /api/support/conversation/messages": ["Send a message as the customer (optionally with attachments), opening the thread if needed", "POST", "Support Chat"],
+  "POST /api/support/conversation/read": ["Mark my company's thread read (customer side)", "POST", "Support Chat"],
+
+  // Support Content
+  "PATCH /api/support-content/documents/:slug": ["Replace a document's payload, recording a new version", "PATCH", "Support Content"],
+  "POST /api/support-content/documents/:slug/versions/:version/restore": ["Restore a version — re-saves it as a new version, never destructive", "POST", "Support Content"],
+  "POST /api/support-content/media": ["Upload an image or video for a help section", "POST", "Support Content"],
+
+  // Train
+  "POST /api/trains": ["Register a new train", "POST", "Train"],
+  "PATCH /api/trains/:id": ["Update a train", "PATCH", "Train"],
+  "DELETE /api/trains/:id": ["Delete a train", "DELETE", "Train"],
+
+  // Train Build
+  "POST /api/train-builder": ["Build a train: code + yard + 2+ locomotives (+ optional wagons)", "POST", "Train Build"],
+  "DELETE /api/train-builder/:id": ["Disband the train (release wagons and locomotives)", "DELETE", "Train Build"],
+  "POST /api/train-builder/:id/activate": ["Reactivate a deactivated train back to AVAILABLE", "POST", "Train Build"],
+  "POST /api/train-builder/:id/deactivate": ["Deactivate the train (park it) — only allowed with no active schedule", "POST", "Train Build"],
+  "PATCH /api/train-builder/:id/details": ["Edit the train's name and fixed import/export run numbers", "PATCH", "Train Build"],
+  "PUT /api/train-builder/:id/locomotives": ["Replace the locomotive set (minimum 1, same yard)", "PUT", "Train Build"],
+  "POST /api/train-builder/:id/reorder-wagons": ["Persist a drag-reorder of the full consist", "POST", "Train Build"],
+  "POST /api/train-builder/:id/wagons": ["Append AVAILABLE wagons from the train's yard to the consist", "POST", "Train Build"],
+  "DELETE /api/train-builder/:id/wagons/:wagonId": ["Detach one wagon from the consist", "DELETE", "Train Build"],
+  "POST /api/train-builder/:id/wagons/:wagonId/maintenance": ["Detach one wagon and move it to MAINTENANCE status", "POST", "Train Build"],
+  "PATCH /api/train-builder/:id/yard": ["Relocate the train — its locomotives and wagons move to the new yard with it", "PATCH", "Train Build"],
+
+  // Train Schedule
+  "POST /api/train-scheduling/bookings/:bookingId/allocate": ["Staff: place a paid booking onto a fitting train (notifies customer on date change)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bookings/:bookingId/expire": ["Staff: expire a reservation and free its capacity", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bookings/:bookingId/mark-paid": ["Staff: mark a reserved booking paid and allocate it now", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bookings/:bookingId/move-schedule": ["Re-point a booking to another OPEN same-route schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bulk/preview": ["Preview a bulk train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bulk/schedules": ["Create a bulk train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bulk/schedules/:id/assign-bookings": ["Assign bulk bookings to a train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bulk/schedules/:id/cancel": ["Cancel bulk train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/container/preview": ["Preview a container train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/container/schedules": ["Create a container train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/container/schedules/:id/assign-bookings": ["Assign container bookings to a train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/container/schedules/:id/cancel": ["Cancel container train schedule", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/global-rules": ["Update global train scheduling rules (singleton)", "PATCH", "Train Schedule"],
+  "POST /api/train-scheduling/preview": ["Preview a mixed-capable train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/adjust-consist": ["Permanently trim free wagons off / couple yard wagons onto the schedule's built train (weight & length limits incl. tolerance enforced, every change logged)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/arrive": ["Mark a dispatched train arrived (move assets to destination yard, free assets)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/assign-bookings": ["Assign bookings to a train schedule (mixed-capable)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/assign-unassigned-booking": ["Assign one linked unallocated booking to wagons (preserves existing assignments)", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/schedules/:id/booking-window": ["Open or close a schedule booking window", "PATCH", "Train Schedule"],
+  "DELETE /api/train-scheduling/schedules/:id/bookings/:bookingId": ["Unassign a booking from a train schedule", "DELETE", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/bookings/:bookingId/load": ["Confirm a booking's cargo loaded at its origin yard (any direction; train must be at that yard)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/bookings/:bookingId/unload": ["Confirm a booking's cargo unloaded at its destination yard — per-booking arrival, may precede the train's final arrival", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/checkpoints": ["Log the train passing a station (final station triggers arrival)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/confirm-loading": ["Confirm cargo loaded on the train (any direction; unblocks import-Djibouti dispatch)", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/schedules/:id/container-items/:itemId": ["Update a container number on a wagon slot", "PATCH", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/dispatch": ["Dispatch a scheduled train", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/doc-review-complete": ["Staff finished document review early — run the batch/payment phase now (applies to the whole route-day group)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/finalize": ["Finalize a draft train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/import-djibouti/depart": ["Depart loaded import train from Djibouti", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/import-djibouti/documents": ["Upload/check an import Djibouti-side document", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/import-djibouti/gatepass-granted": ["Mark import Djibouti gatepass permission granted", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/import-djibouti/load-list": ["Generate import load list / marshalling document summary", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/import-djibouti/loaded-on-train": ["Confirm import cargo loaded on train at Djibouti", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/import-djibouti/ready-for-loading": ["Mark import train ready for loading at Djibouti", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/schedules/:id/import-loading-status": ["Mark import bookings loaded/unloaded on this schedule (tracking only, does not affect dispatch)", "PATCH", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/intercity/:bookingId/load": ["Confirm intercity cargo loaded (train must be at the booking's origin yard)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/intercity/:bookingId/unload": ["Confirm intercity cargo unloaded at the booking's destination yard (completes the booking)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/intercity/accept": ["Accept intercity bookings onto this train (opens their pay window; capacity re-checked per booking)", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/schedules/:id/loading-status": ["Mark bookings loaded/unloaded on this schedule (any direction, pre-dispatch only)", "PATCH", "Train Schedule"],
+  // NOTE: duplicate route — also declared in modules/train-scheduling/controllers/train-scheduling.controller.ts:798.
+  // Two controllers register this same path; Nest serves whichever module loads first.
+  "POST /api/train-scheduling/schedules/:id/maintenance [modules/train-scheduling/controllers/train-scheduling.controller.ts]": ["Maintenance reschedule: move the train to a new departure with every allocated booking aboard — links, wagons and window settings unchanged", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/pin-wagons": ["Pin physical wagons to train set slots", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/run-allocation": ["Run wagon-level allocation for all eligible linked bookings", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/run-batch": ["Manually run the batch fill for a schedule", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/schedules/:id/schedule-date": ["Reschedule a train's departure date — only before the booking window opens, and only if the new date still leaves room for the booking lead window", "PATCH", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/switch-government-booking": ["Switch out commercial bookings to allocate a government booking in their place", "POST", "Train Schedule"],
+  "DELETE /api/train-scheduling/schedules/:id/wagons/:trainSetWagonId": ["Remove an empty wagon slot from a train", "DELETE", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/wagons/:wagonId/move-load": ["Move a wagon's whole load to another wagon (empty → move/repin, loaded → swap loads)", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/schedules/:id/window-rule": ["Override the booking-window rule for one schedule (open/close hour, duration, doc-review, payment, lead days) — only before the window opens", "PATCH", "Train Schedule"],
+
+  // Transit Agent
+  "POST /api/transit-agents": ["Create a transit agent", "POST", "Transit Agent"],
+  "PATCH /api/transit-agents/:id": ["Update a transit agent", "PATCH", "Transit Agent"],
+  "DELETE /api/transit-agents/:id": ["Soft-delete a transit agent", "DELETE", "Transit Agent"],
+
+  // Truck Type
+  "POST /api/truck-types": ["Create a truck type", "POST", "Truck Type"],
+  "PATCH /api/truck-types/:id": ["Update a truck type", "PATCH", "Truck Type"],
+  "DELETE /api/truck-types/:id": ["Soft-delete a truck type", "DELETE", "Truck Type"],
+
+  // User Trade Access
+  "PUT /api/user-trade-access/:userId": ["Set the trade directions a backoffice user may see", "PUT", "User Trade Access"],
+
+  // Vehicle
+  "POST /api/vehicles": ["Create a new vehicle", "POST", "Vehicle"],
+  "PATCH /api/vehicles/:id": ["Update a vehicle", "PATCH", "Vehicle"],
+  "DELETE /api/vehicles/:id": ["Delete a vehicle", "DELETE", "Vehicle"],
+
+  // Wagon
+  "POST /api/wagons": ["Create a new wagon", "POST", "Wagon"],
+  "PATCH /api/wagons/:id": ["Update a wagon", "PATCH", "Wagon"],
+  "DELETE /api/wagons/:id": ["Delete a wagon", "DELETE", "Wagon"],
+  "POST /api/wagons/:id/assign-train": ["Assign wagon to a train", "POST", "Wagon"],
+  "DELETE /api/wagons/:id/permanent": ["Permanently delete a wagon (irreversible; refused if it has movements, containers or train-set slots)", "DELETE", "Wagon"],
+  "POST /api/wagons/:id/unassign-train": ["Unassign wagon from train", "POST", "Wagon"],
+  "POST /api/wagons/bulk-status": ["Set the status of multiple wagons (audited in wagon_status_logs)", "POST", "Wagon"],
+  "POST /api/wagons/bulk-transfer": ["Transfer multiple wagons to a destination yard", "POST", "Wagon"],
+
+  // Wagon Transfer Request
+  "POST /api/wagon-transfer-requests": ["File a count-only wagon-transfer request", "POST", "Wagon Transfer Request"],
+  "POST /api/wagon-transfer-requests/:id/cancel": ["Withdraw a request that has not moved any wagon yet (use close-short once wagons have moved)", "POST", "Wagon Transfer Request"],
+  "POST /api/wagon-transfer-requests/:id/close-short": ["OCC: end the request with fewer wagons than asked for — what moved stays, the requester is told the shortfall", "POST", "Wagon Transfer Request"],
+  "POST /api/wagon-transfer-requests/:id/fulfill": ["OCC: pick wagons and execute the transfer", "POST", "Wagon Transfer Request"],
+  "POST /api/wagon-transfer-requests/bulk-fulfill": ["OCC: accept-and-execute a subset of pending requests (auto-picks available wagons; the rest stay PENDING)", "POST", "Wagon Transfer Request"],
+
+  // Wagon Type
+  "POST /api/wagon-types": ["Create a wagon type", "POST", "Wagon Type"],
+  "PATCH /api/wagon-types/:id": ["Update a wagon type", "PATCH", "Wagon Type"],
+  "DELETE /api/wagon-types/:id": ["Soft-delete a wagon type", "DELETE", "Wagon Type"],
+
+  // Warehouse
+  "POST /api/warehouse-allocation-rules": ["Create a warehouse allocation rule", "POST", "Warehouse"],
+  "PATCH /api/warehouse-allocation-rules/:id": ["Update a warehouse allocation rule", "PATCH", "Warehouse"],
+  "DELETE /api/warehouse-allocation-rules/:id": ["Delete a warehouse allocation rule", "DELETE", "Warehouse"],
+  "POST /api/warehouse-allocation/preview": ["Preview the yard/warehouse/zone a booking would be allocated to", "POST", "Warehouse"],
+  "POST /api/warehouse-fee-rules": ["Create a storage / demurrage fee rule", "POST", "Warehouse"],
+  "PATCH /api/warehouse-fee-rules/:id": ["Update a fee rule", "PATCH", "Warehouse"],
+  "DELETE /api/warehouse-fee-rules/:id": ["Delete a fee rule", "DELETE", "Warehouse"],
+  "POST /api/warehouse-fees/accrual/:inventoryId/acknowledge": ["Acknowledge / snooze an item fee-accrual alert", "POST", "Warehouse"],
+  "DELETE /api/warehouse-fees/accrual/:inventoryId/acknowledge": ["Remove an accrual acknowledgement (re-surface for alerts)", "DELETE", "Warehouse"],
+  "POST /api/warehouses": ["Create warehouse", "POST", "Warehouse"],
+  "PATCH /api/warehouses/:id": ["Update warehouse", "PATCH", "Warehouse"],
+  "POST /api/warehouses/:warehouseId/yards": ["Create a yard within a warehouse", "POST", "Warehouse"],
+
+  // Warehouse Fee Invoice
+  "POST /api/last-mile/:id/generate-truck-detention-invoice": ["Generate a truck-detention invoice for a last-mile leg (per truck per day)", "POST", "Warehouse Fee Invoice"],
+  "PATCH /api/warehouse-fee-invoices/:id/cancel": ["Cancel a warehouse fee invoice", "PATCH", "Warehouse Fee Invoice"],
+  "POST /api/warehouse-fee-invoices/:id/pay": ["Record a payment against a warehouse fee invoice", "POST", "Warehouse Fee Invoice"],
+  "POST /api/warehouse-fee-invoices/:id/pay-online": ["Initiate Telebirr/Waafi payment for a warehouse fee invoice", "POST", "Warehouse Fee Invoice"],
+  "POST /api/warehouse-inventory/:id/generate-fee-invoice": ["Generate a warehouse fee invoice from Batch 5 fee calculation", "POST", "Warehouse Fee Invoice"],
+
+  // Warehouse Inspection Report
+  "PATCH /api/warehouse-inspection-reports/:id": ["Update an inspection report", "PATCH", "Warehouse Inspection Report"],
+  "POST /api/warehouse-inspection-reports/:id/attachments": ["Upload inspection images / documents", "POST", "Warehouse Inspection Report"],
+  "POST /api/warehouse-inventory/:inventoryId/inspection-reports": ["Create an inspection / damage report for an inventory item", "POST", "Warehouse Inspection Report"],
+
+  // Warehouse Inventory
+  "POST /api/warehouse-inventory/:id/deliver": ["Deliver import goods to the customer + capture proof of delivery", "POST", "Warehouse Inventory"],
+  "PATCH /api/warehouse-inventory/:id/dispatch": ["Mark loaded inventory DISPATCHED (left the terminal)", "PATCH", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/gate-clearance": ["Final terminal release / gate clearance (blocked while fees unpaid)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/load": ["Load READY_FOR_LOADING inventory onto a wagon", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/move": ["Move inventory to another warehouse/yard/zone", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/ready-for-loading": ["Mark reserved inventory READY_FOR_LOADING", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/ready-for-pickup": ["Mark inspected IMPORT inventory READY_FOR_PICKUP", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/release": ["Issue a DO / release order for ready-for-pickup inventory", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/store": ["Mark received inventory as STORED (optional explicit warehouse/yard/zone)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/auto-load-ready": ["Auto-load READY_FOR_LOADING inventory with PAID bookings", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/auto-unload-arrived": ["Bulk auto-unload all arrived bookings into the warehouse", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/bookings/:bookingId/approve-delivery": ["Approve delivery — customer records their full name (signature optional)", "POST", "Warehouse Inventory"],
+  "PATCH /api/warehouse-inventory/bookings/:bookingId/double-handling": ["Record Yes/No double handling after unloading (Yes applies the double-handling fee rule)", "PATCH", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/bookings/:bookingId/request-handover-signature": ["Ask the customer to sign the handover (creates one if none, then notifies)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/bookings/:bookingId/unload": ["Unload a single arrived booking into a location", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/bulk-dispatch-export": ["Bulk-dispatch loaded EXPORT inventory (LOADED → DISPATCHED)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/bulk-mark-inspected": ["Bulk mark received inventory inspection PASSED (EXPORT → READY_FOR_LOADING)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/export/auto-unload-at-djibouti": ["Unload all eligible export items assigned to an arrived Djibouti-side train", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/handovers/:handoverId/sign": ["Customer signs one handover (EDR last-mile: one signature per truck)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/import/auto-unload-arrived-bookings": ["Unload all eligible assigned bookings of an ARRIVED import train (→ UNLOADED)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/receive": ["Receive inventory at a warehouse location", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/receive-bulk": ["Bulk-receive selected eligible PAID bookings into a location", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/reserve": ["Reserve stored inventory for a PAID booking", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/train/:scheduleId/load": ["Load selected inventory items onto their allocated wagons for a train", "POST", "Warehouse Inventory"],
+
+  // Warehouse Yard
+  "PATCH /api/warehouse-yards/:id": ["Update warehouse yard", "PATCH", "Warehouse Yard"],
+  "POST /api/warehouse-yards/:yardId/zones": ["Create a zone within a yard", "POST", "Warehouse Yard"],
+
+  // Warehouse Zone
+  "PATCH /api/warehouse-zones/:id": ["Update warehouse zone", "PATCH", "Warehouse Zone"],
+
+  // Weight Limit Rule
+  "POST /api/weight-limit-rules": ["Create a weight limit rule", "POST", "Weight Limit Rule"],
+  "PATCH /api/weight-limit-rules/:id": ["Update a weight limit rule", "PATCH", "Weight Limit Rule"],
+  "DELETE /api/weight-limit-rules/:id": ["Soft-delete a weight limit rule", "DELETE", "Weight Limit Rule"],
+
+  // Yard
+  "POST /api/yards": ["Create a yard", "POST", "Yard"],
+  "PATCH /api/yards/:id": ["Update a yard", "PATCH", "Yard"],
+  "DELETE /api/yards/:id": ["Soft-delete a yard", "DELETE", "Yard"],
+  "POST /api/yards/:id/move-order": ["Move a yard up or down in display order", "POST", "Yard"],
+  "POST /api/yards/reorder": ["Bulk reorder yards by ID list", "POST", "Yard"],
+
+  // Yard Distance
+  "POST /api/yard-distances": ["Create a yard distance", "POST", "Yard Distance"],
+  "PATCH /api/yard-distances/:id": ["Update a yard distance", "PATCH", "Yard Distance"],
+  "DELETE /api/yard-distances/:id": ["Soft-delete a yard distance", "DELETE", "Yard Distance"],
+};
+
+module.exports = AUDIT_ENDPOINTS;
diff --git a/apps/edr-freight-api/docs/audit-endpoints.md b/apps/edr-freight-api/docs/audit-endpoints.md
new file mode 100644
index 000000000..38e89e367
--- /dev/null
+++ b/apps/edr-freight-api/docs/audit-endpoints.md
@@ -0,0 +1,922 @@
+# Freight API — Mutating Endpoints (Audit Surface)
+
+Every state-changing route in `apps/edr-freight-api` — `POST`, `PUT`, `PATCH`, `DELETE`.
+This is the candidate surface for audit logging: each row is an action a user can take
+that changes persisted state and therefore needs a who / what / when trail.
+
+All paths include the global prefix `api` (`app.setGlobalPrefix("api")` in `src/main.ts`).
+Titles come from each route's `@ApiOperation({ summary })`; where a route has none,
+the title is derived from its handler name.
+
+> Generated by reading the `@Post` / `@Put` / `@Patch` / `@Delete` decorators in
+> `src/**/*.controller.ts`. Re-generate after adding routes so this stays complete.
+
+## Summary
+
+| Method | Count |
+| --- | ---: |
+| `POST` | 351 |
+| `PUT` | 8 |
+| `PATCH` | 72 |
+| `DELETE` | 61 |
+| **Total** | **492** |
+
+Across **66** entities.
+
+## Entity index
+
+| Entity | Endpoints |
+| --- | ---: |
+| [Account](#account) | 3 |
+| [AI Assist](#ai-assist) | 1 |
+| [Approval Rule](#approval-rule) | 5 |
+| [Booking](#booking) | 57 |
+| [Cargo](#cargo) | 6 |
+| [Cargo Type](#cargo-type) | 5 |
+| [Company](#company) | 30 |
+| [Compliance](#compliance) | 3 |
+| [Consignment](#consignment) | 1 |
+| [Container](#container) | 5 |
+| [Container Type](#container-type) | 5 |
+| [Contract](#contract) | 68 |
+| [Contract Template](#contract-template) | 8 |
+| [Driver](#driver) | 5 |
+| [Dropdown Setting](#dropdown-setting) | 7 |
+| [EIMS Invoice](#eims-invoice) | 3 |
+| [Exchange Setting](#exchange-setting) | 1 |
+| [Facility](#facility) | 3 |
+| [Fayda Verification](#fayda-verification) | 1 |
+| [File Upload Setting](#file-upload-setting) | 7 |
+| [First Mile](#first-mile) | 7 |
+| [Fuel](#fuel) | 1 |
+| [GPS Tracking](#gps-tracking) | 3 |
+| [Import Operation](#import-operation) | 9 |
+| [Incident](#incident) | 3 |
+| [Interchange Document](#interchange-document) | 3 |
+| [Last Mile](#last-mile) | 10 |
+| [Last Mile Request](#last-mile-request) | 4 |
+| [Locomotive](#locomotive) | 4 |
+| [Maintenance](#maintenance) | 13 |
+| [Notification Inbox](#notification-inbox) | 2 |
+| [Organization User](#organization-user) | 2 |
+| [OTP](#otp) | 2 |
+| [Password Reset](#password-reset) | 4 |
+| [Payment](#payment) | 7 |
+| [Priority Config](#priority-config) | 5 |
+| [Priority Rule Change Request](#priority-rule-change-request) | 3 |
+| [Procurement](#procurement) | 8 |
+| [Rate](#rate) | 5 |
+| [Rate Change Request](#rate-change-request) | 3 |
+| [Route](#route) | 4 |
+| [Schedule](#schedule) | 3 |
+| [Service Type](#service-type) | 5 |
+| [Shipping Line](#shipping-line) | 3 |
+| [Signature](#signature) | 1 |
+| [Support Chat](#support-chat) | 5 |
+| [Support Content](#support-content) | 3 |
+| [Train](#train) | 3 |
+| [Train Build](#train-build) | 11 |
+| [Train Schedule](#train-schedule) | 48 |
+| [Transit Agent](#transit-agent) | 3 |
+| [Truck Type](#truck-type) | 3 |
+| [User Trade Access](#user-trade-access) | 1 |
+| [Vehicle](#vehicle) | 3 |
+| [Wagon](#wagon) | 8 |
+| [Wagon Transfer Request](#wagon-transfer-request) | 5 |
+| [Wagon Type](#wagon-type) | 3 |
+| [Warehouse](#warehouse) | 12 |
+| [Warehouse Fee Invoice](#warehouse-fee-invoice) | 5 |
+| [Warehouse Inspection Report](#warehouse-inspection-report) | 3 |
+| [Warehouse Inventory](#warehouse-inventory) | 24 |
+| [Warehouse Yard](#warehouse-yard) | 2 |
+| [Warehouse Zone](#warehouse-zone) | 1 |
+| [Weight Limit Rule](#weight-limit-rule) | 3 |
+| [Yard](#yard) | 5 |
+| [Yard Distance](#yard-distance) | 3 |
+
+---
+
+## Endpoints by entity
+
+### Account
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Send a verification code to a new email/phone before changing it | `POST` | `/api/me/contact/otp` | `modules/auth/account.controller.ts:26` |
+| Change the account's email or phone, gated by a verification code | `PATCH` | `/api/me/contact` | `modules/auth/account.controller.ts:40` |
+| Change the account's display name | `PATCH` | `/api/me/name` | `modules/auth/account.controller.ts:54` |
+
+### AI Assist
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Mock AI: extract structured booking fields from free-text request | `POST` | `/api/ai/booking/extract` | `modules/ai/ai.controller.ts:16` |
+
+### Approval Rule
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create an approval rule step | `POST` | `/api/approval-rules` | `modules/rule-engine/controllers/approval-rules.controller.ts:66` |
+| Move an approval step up or down within its chain | `POST` | `/api/approval-rules/:id/move-order` | `modules/rule-engine/controllers/approval-rules.controller.ts:51` |
+| Bulk reorder approval steps within a chain | `POST` | `/api/approval-rules/reorder` | `modules/rule-engine/controllers/approval-rules.controller.ts:43` |
+| Update an approval rule | `PATCH` | `/api/approval-rules/:id` | `modules/rule-engine/controllers/approval-rules.controller.ts:73` |
+| Soft-delete an approval rule | `DELETE` | `/api/approval-rules/:id` | `modules/rule-engine/controllers/approval-rules.controller.ts:80` |
+
+### Booking
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a new freight booking (DRAFT) | `POST` | `/api/bookings` | `modules/bookings/bookings.controller.ts:170` |
+| Allocate containers to vehicles | `POST` | `/api/bookings/:bookingId/allocate-containers` | `modules/bookings/booking-allocation.controller.ts:13` |
+| Cancel booking | `POST` | `/api/bookings/:id/cancel` | `modules/bookings/bookings.controller.ts:1544` |
+| Customer cancels an unpaid hold (SELECTED_FOR_BATCH → CANCELLED); | `POST` | `/api/bookings/:id/cancel-hold` | `modules/bookings/bookings.controller.ts:1568` |
+| GL ET uploads customs declaration on booking (GENERAL customs) | `POST` | `/api/bookings/:id/clearance/declaration` | `modules/bookings/bookings.controller.ts:1126` |
+| Upload Booking Delivery Order | `POST` | `/api/bookings/:id/clearance/delivery-order` | `modules/bookings/bookings.controller.ts:1268` |
+| Customer uploads clearance documents (fieldname = document key) | `POST` | `/api/bookings/:id/clearance/documents` | `modules/bookings/bookings.controller.ts:959` |
+| GL ET sends a draft customs declaration (multi-file) with an estimated price for the customer to review | `POST` | `/api/bookings/:id/clearance/draft-declaration` | `modules/bookings/bookings.controller.ts:1175` |
+| Customer accepts the draft customs declaration — unlocks the real customs declaration step for GL Ethiopia | `POST` | `/api/bookings/:id/clearance/draft-declaration/accept` | `modules/bookings/bookings.controller.ts:1200` |
+| Customer requests a change to the draft customs declaration with a reason — GL Ethiopia sends a corrected draft (repeatable) | `POST` | `/api/bookings/:id/clearance/draft-declaration/change` | `modules/bookings/bookings.controller.ts:1211` |
+| GL ET sets duty/tax on booking with notice attachment | `POST` | `/api/bookings/:id/clearance/duty` | `modules/bookings/bookings.controller.ts:1144` |
+| Customer uploads duty/tax payment slip on booking | `POST` | `/api/bookings/:id/clearance/duty-slip` | `modules/bookings/bookings.controller.ts:1238` |
+| Confirm Booking Export Release | `POST` | `/api/bookings/:id/clearance/export-release` | `modules/bookings/bookings.controller.ts:1326` |
+| GL finalizes clearance (requires 100% approved) → CLEARANCE_READY | `POST` | `/api/bookings/:id/clearance/finalize` | `modules/bookings/bookings.controller.ts:1087` |
+| GL ET finalizes import pre-clearance on booking | `POST` | `/api/bookings/:id/clearance/finalize-pre-clearance` | `modules/bookings/bookings.controller.ts:1230` |
+| GL uploads customs output documents (IM4/EX3/…) | `POST` | `/api/bookings/:id/clearance/output-documents` | `modules/bookings/bookings.controller.ts:1071` |
+| Customer requests operation with a schedule day | `POST` | `/api/bookings/:id/clearance/proceed` | `modules/bookings/bookings.controller.ts:979` |
+| Upload Booking Release Order | `POST` | `/api/bookings/:id/clearance/release-order` | `modules/bookings/bookings.controller.ts:1288` |
+| GL reviews a clearance document (Approve | Query) | `POST` | `/api/bookings/:id/clearance/review` | `modules/bookings/bookings.controller.ts:1051` |
+| Request Booking RO Amendment | `POST` | `/api/bookings/:id/clearance/ro-amendment` | `modules/bookings/bookings.controller.ts:1311` |
+| GL Djibouti picks the transit officer from the roster — unblocks the customs declaration; calling again reassigns | `POST` | `/api/bookings/:id/clearance/transit-assignee/assign` | `modules/bookings/bookings.controller.ts:1112` |
+| GL ET asks GL Djibouti to name the transit officer — required before the import customs declaration | `POST` | `/api/bookings/:id/clearance/transit-assignee/request` | `modules/bookings/bookings.controller.ts:1098` |
+| Upload Booking Transit Permit | `POST` | `/api/bookings/:id/clearance/transit-permit` | `modules/bookings/bookings.controller.ts:1251` |
+| Confirm submit after price change | `POST` | `/api/bookings/:id/confirm-submit` | `modules/bookings/bookings.controller.ts:906` |
+| Request freight consolidation | `POST` | `/api/bookings/:id/consolidation` | `modules/bookings/bookings.controller.ts:1583` |
+| Generate contract PDF from template | `POST` | `/api/bookings/:id/contract/generate` | `modules/bookings/bookings.controller.ts:1406` |
+| Apply digital signature (customer or staff) | `POST` | `/api/bookings/:id/contract/sign` | `modules/bookings/bookings.controller.ts:1452` |
+| Customer cancels their own booking before payment — no cancellation fee | `POST` | `/api/bookings/:id/customer-cancel` | `modules/bookings/bookings.controller.ts:1555` |
+| Customer assigns external truck and driver for terminal pickup | `POST` | `/api/bookings/:id/customer-truck-assignment` | `modules/bookings/bookings.controller.ts:460` |
+| Add a customer self-haul truck carrying 1–2 of the booking containers | `POST` | `/api/bookings/:id/customer-trucks` | `modules/bookings/bookings.controller.ts:686` |
+| Register an import truck leaving: containers loaded + weighed gross (staff) | `POST` | `/api/bookings/:id/customer-trucks/:assignmentId/depart` | `modules/bookings/bookings.controller.ts:788` |
+| Truck_dispatch: load selected containers onto a truck (staff) | `POST` | `/api/bookings/:id/customer-trucks/:assignmentId/load` | `modules/bookings/bookings.controller.ts:773` |
+| Bulk add customer trucks from array payload (Excel parsed) | `POST` | `/api/bookings/:id/customer-trucks/bulk` | `modules/bookings/bookings.controller.ts:701` |
+| Customer digital signature (deprecated — use POST contract/sign) | `POST` | `/api/bookings/:id/customer/sign` | `modules/bookings/bookings.controller.ts:1487` |
+| Upload documents for a booking (DRAFT only) | `POST` | `/api/bookings/:id/documents` | `modules/bookings/bookings.controller.ts:869` |
+| Generate a GRN over the received containers (all received, or a subset) — one GRN per batch | `POST` | `/api/bookings/:id/generate-grn` | `modules/bookings/bookings.controller.ts:820` |
+| Generate price preview (DRAFT or CHANGES_REQUESTED) | `POST` | `/api/bookings/:id/generate-price` | `modules/bookings/bookings.controller.ts:882` |
+| Expedite government booking to PAID / ELIGIBLE for scheduling | `POST` | `/api/bookings/:id/government-expedite` | `modules/bookings/bookings.controller.ts:1390` |
+| Staff contract signature and fully execute (use contract/sign STAFF preferred) | `POST` | `/api/bookings/:id/marketing/approve` | `modules/bookings/bookings.controller.ts:1505` |
+| Operations reviews an operation request: ACCEPT (→ batch pool), | `POST` | `/api/bookings/:id/operation/review` | `modules/bookings/bookings.controller.ts:1030` |
+| Mark completed | `POST` | `/api/bookings/:id/operations/complete` | `modules/bookings/bookings.controller.ts:1536` |
+| Mark in transit | `POST` | `/api/bookings/:id/operations/start-transit` | `modules/bookings/bookings.controller.ts:1528` |
+| Customer reject price estimate | `POST` | `/api/bookings/:id/reject` | `modules/bookings/bookings.controller.ts:918` |
+| Staff accept intake → set contract validity window + start approval chain | `POST` | `/api/bookings/:id/staff/accept` | `modules/bookings/bookings.controller.ts:1355` |
+| Staff final reject | `POST` | `/api/bookings/:id/staff/reject` | `modules/bookings/bookings.controller.ts:1374` |
+| Staff return booking for customer updates | `POST` | `/api/bookings/:id/staff/request-changes` | `modules/bookings/bookings.controller.ts:1339` |
+| Customer submit booking | `POST` | `/api/bookings/:id/submit` | `modules/bookings/bookings.controller.ts:894` |
+| Request a partial wagon cancellation on a PAID booking — opens the cancellation-fee invoice; wagons are released only once the fee settles | `POST` | `/api/bookings/:id/wagon-cancellations` | `modules/bookings/bookings.controller.ts:558` |
+| Preview the fee/credit of a partial wagon cancellation (no writes) | `POST` | `/api/bookings/:id/wagon-cancellations/preview` | `modules/bookings/bookings.controller.ts:544` |
+| Rebook a wagon-cancellation credit: pick a shipment day only — the new booking is created under the contract and marked PAID (freight already paid; contract must still be valid) | `POST` | `/api/bookings/wagon-cancellations/:cancellationId/rebook` | `modules/bookings/bookings.controller.ts:638` |
+| Withdraw a fee-pending wagon cancellation (owner, or staff with the void permission) | `POST` | `/api/bookings/wagon-cancellations/:cancellationId/withdraw` | `modules/bookings/bookings.controller.ts:624` |
+| Update booking | `PATCH` | `/api/bookings/:id` | `modules/bookings/bookings.controller.ts:211` |
+| Edit a not-yet-arrived customer truck (plate/driver/type + containers) | `PATCH` | `/api/bookings/:id/customer-trucks/:assignmentId` | `modules/bookings/bookings.controller.ts:716` |
+| Export only: choose direct truck-to-train (no warehouse, no GRN) or warehouse first | `PATCH` | `/api/bookings/:id/export-handover-mode` | `modules/bookings/bookings.controller.ts:761` |
+| Soft-delete DRAFT booking | `DELETE` | `/api/bookings/:id` | `modules/bookings/bookings.controller.ts:861` |
+| Remove consolidation pairing | `DELETE` | `/api/bookings/:id/consolidation` | `modules/bookings/bookings.controller.ts:1590` |
+| Remove a not-yet-arrived customer truck from a booking | `DELETE` | `/api/bookings/:id/customer-trucks/:assignmentId` | `modules/bookings/bookings.controller.ts:732` |
+
+### Cargo
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a new cargo | `POST` | `/api/cargoes` | `modules/cargoes/cargoes.controller.ts:34` |
+| Mark cargo as delivered | `POST` | `/api/cargoes/:id/deliver` | `modules/cargoes/cargoes.controller.ts:81` |
+| Load cargo into a container | `POST` | `/api/cargoes/:id/load` | `modules/cargoes/cargoes.controller.ts:67` |
+| Unload cargo from container | `POST` | `/api/cargoes/:id/unload` | `modules/cargoes/cargoes.controller.ts:74` |
+| Update a cargo | `PATCH` | `/api/cargoes/:id` | `modules/cargoes/cargoes.controller.ts:53` |
+| Delete a cargo | `DELETE` | `/api/cargoes/:id` | `modules/cargoes/cargoes.controller.ts:60` |
+
+### Cargo Type
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a cargo type | `POST` | `/api/cargo-types` | `modules/rule-engine/controllers/cargo-types.controller.ts:51` |
+| Move a cargo type up or down in display order | `POST` | `/api/cargo-types/:id/move-order` | `modules/rule-engine/controllers/cargo-types.controller.ts:36` |
+| Bulk reorder cargo types by ID list | `POST` | `/api/cargo-types/reorder` | `modules/rule-engine/controllers/cargo-types.controller.ts:28` |
+| Update a cargo type | `PATCH` | `/api/cargo-types/:id` | `modules/rule-engine/controllers/cargo-types.controller.ts:58` |
+| Soft-delete a cargo type | `DELETE` | `/api/cargo-types/:id` | `modules/rule-engine/controllers/cargo-types.controller.ts:65` |
+
+### Company
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a new company (customer, freight_forwarder, dj_freight_forwarder, transporter) | `POST` | `/api/companies` | `modules/companies/companies.controller.ts:565` |
+| Upload documents for a company (onboarding) | `POST` | `/api/companies/:companyId/documents` | `modules/companies/companies.controller.ts:728` |
+| Add a profile (employee) to a company | `POST` | `/api/companies/:companyId/profiles` | `modules/companies/companies.controller.ts:843` |
+| Approve a pending profile change request (applies the changes) | `POST` | `/api/companies/change-requests/:id/approve` | `modules/companies/companies.controller.ts:790` |
+| Reject a pending profile change request with a note | `POST` | `/api/companies/change-requests/:id/reject` | `modules/companies/companies.controller.ts:806` |
+| Ask for specific changes on a pending request without rejecting it (row stays open, next edit appends to it) | `POST` | `/api/companies/change-requests/:id/request-changes` | `modules/companies/companies.controller.ts:824` |
+| Create a single operational profile for the current user's company. The role starts pending and does not become the active mode | `POST` | `/api/companies/company-profile` | `modules/companies/companies.controller.ts:272` |
+| Add operational profile(s) (importer/exporter/forwarder) to the current user's company | `POST` | `/api/companies/company-profiles` | `modules/companies/companies.controller.ts:229` |
+| Add business-license document(s) to a profile. For an approved company | `POST` | `/api/companies/company-profiles/:profileId/license` | `modules/companies/companies.controller.ts:290` |
+| Replace a business-license file with a newly uploaded one (staged for | `POST` | `/api/companies/company-profiles/:profileId/license/:fileId/replace` | `modules/companies/companies.controller.ts:311` |
+| Resubmit a rejected operational role for approval (→ pending) | `POST` | `/api/companies/company-profiles/:profileId/reapply` | `modules/companies/companies.controller.ts:165` |
+| Create a company with its associated external profile (onboarding) | `POST` | `/api/companies/create` | `modules/companies/companies.controller.ts:539` |
+| Ask the customer to correct one uploaded document | `POST` | `/api/companies/documents/:fileId/request-change` | `modules/companies/companies.controller.ts:699` |
+| Fetch company info from eTrade by TIN | `POST` | `/api/companies/fetch-etrade-info` | `modules/companies/companies.controller.ts:197` |
+| Bind a completed Fayda verification to the company's owner or Power of Attorney | `POST` | `/api/companies/identity/fayda/complete` | `modules/companies/companies.controller.ts:414` |
+| Declare the General Manager is the company's owner, copying the owner's verified identity across | `POST` | `/api/companies/identity/gm/same-as-owner` | `modules/companies/companies.controller.ts:432` |
+| Declare the Power of Attorney is the company's owner, copying the owner's identity across | `POST` | `/api/companies/identity/poa/same-as-owner` | `modules/companies/companies.controller.ts:461` |
+| Mark the current user's onboarding as complete | `POST` | `/api/companies/onboarding/complete` | `modules/companies/companies.controller.ts:527` |
+| Begin onboarding: create a draft company + profile + role(s) so later steps can save incrementally | `POST` | `/api/companies/onboarding/start` | `modules/companies/companies.controller.ts:246` |
+| Upload the Power of Attorney delegation letter, replacing any existing one | `POST` | `/api/companies/poa-delegation` | `modules/companies/companies.controller.ts:380` |
+| Update a company | `PATCH` | `/api/companies/:id` | `modules/companies/companies.controller.ts:613` |
+| Update a company profile's approval status | `PATCH` | `/api/companies/company-profiles/:profileId/status` | `modules/companies/companies.controller.ts:748` |
+| Persist the user's current onboarding wizard step | `PATCH` | `/api/companies/onboarding-step` | `modules/companies/companies.controller.ts:504` |
+| Update profile (flattened settings page) | `PATCH` | `/api/companies/profile` | `modules/companies/companies.controller.ts:219` |
+| Soft-delete a company | `DELETE` | `/api/companies/:id` | `modules/companies/companies.controller.ts:634` |
+| Remove a business-license file (staged for review on an approved company) | `DELETE` | `/api/companies/company-profiles/:profileId/license/:fileId` | `modules/companies/companies.controller.ts:338` |
+| Remove the company's Power of Attorney — the verified identity, its details and the delegation paper together | `DELETE` | `/api/companies/identity/fayda/poa` | `modules/companies/companies.controller.ts:491` |
+| Clear the General Manager's identity — the \"same as owner\" declaration or a verification, and the details either wrote | `DELETE` | `/api/companies/identity/gm` | `modules/companies/companies.controller.ts:448` |
+| Undo the Power of Attorney \"same as owner\" declaration and the identity it copied, leaving the representative open to be verified in their own right | `DELETE` | `/api/companies/identity/poa/same-as-owner` | `modules/companies/companies.controller.ts:478` |
+| Remove the Power of Attorney delegation letter (staged for review on an approved company) | `DELETE` | `/api/companies/poa-delegation/:fileId` | `modules/companies/companies.controller.ts:401` |
+
+### Compliance
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a compliance record | `POST` | `/api/compliance` | `modules/compliance/compliance.controller.ts:23` |
+| Update a compliance record | `PATCH` | `/api/compliance/:id` | `modules/compliance/compliance.controller.ts:51` |
+| Soft-delete a compliance record | `DELETE` | `/api/compliance/:id` | `modules/compliance/compliance.controller.ts:58` |
+
+### Consignment
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a new consignment | `POST` | `/api/consignments` | `modules/consignments/consignments.controller.ts:29` |
+
+### Container
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a new container | `POST` | `/api/containers` | `modules/container-management/containers.controller.ts:33` |
+| Assign container to a wagon | `POST` | `/api/containers/:id/assign-wagon` | `modules/container-management/containers.controller.ts:66` |
+| Unassign container from wagon | `POST` | `/api/containers/:id/unassign-wagon` | `modules/container-management/containers.controller.ts:73` |
+| Update a container | `PATCH` | `/api/containers/:id` | `modules/container-management/containers.controller.ts:52` |
+| Delete a container | `DELETE` | `/api/containers/:id` | `modules/container-management/containers.controller.ts:59` |
+
+### Container Type
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a container type | `POST` | `/api/container-types` | `modules/rule-engine/controllers/container-types.controller.ts:51` |
+| Move a container type up or down in display order | `POST` | `/api/container-types/:id/move-order` | `modules/rule-engine/controllers/container-types.controller.ts:36` |
+| Bulk reorder container types by ID list | `POST` | `/api/container-types/reorder` | `modules/rule-engine/controllers/container-types.controller.ts:28` |
+| Update a container type | `PATCH` | `/api/container-types/:id` | `modules/rule-engine/controllers/container-types.controller.ts:58` |
+| Soft-delete a container type | `DELETE` | `/api/container-types/:id` | `modules/rule-engine/controllers/container-types.controller.ts:65` |
+
+### Contract
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a new contract (DRAFT) with routes + cargo scope | `POST` | `/api/contracts` | `modules/contracts/contracts.controller.ts:188` |
+| Approve one approval step in sequence | `POST` | `/api/contracts/:id/approval-steps/:stepId/approve` | `modules/contracts/contracts.controller.ts:552` |
+| Reject one approval step — to the customer (terminal → REJECTED) or, via returnToStepId, back to an earlier approver (chain re-runs from there) | `POST` | `/api/contracts/:id/approval-steps/:stepId/reject` | `modules/contracts/contracts.controller.ts:571` |
+| Customer submits a shipment request on a GENERAL customs contract | `POST` | `/api/contracts/:id/booking-requests` | `modules/contracts/contracts.controller.ts:170` |
+| Create a shipment booking under a contract — Path A (customer) or Path B (GL Ethiopia) | `POST` | `/api/contracts/:id/bookings` | `modules/contracts/contracts.controller.ts:1076` |
+| Complete an initiated booking after Operations finalized its clearance — cargo + binding day, window and departure checks, pricing and invoicing | `POST` | `/api/contracts/:id/bookings/:bookingId/complete` | `modules/contracts/contracts.controller.ts:1133` |
+| Initiate a bare booking instance under an import/export contract (ONE_TIME or GENERAL) — no cargo, no date; enters per-booking clearance (AWAITING_DOCUMENTS). ONE_TIME customs instances are opened by the customer (or GL); GENERAL customs comes from a shipment request | `POST` | `/api/contracts/:id/bookings/initiate` | `modules/contracts/contracts.controller.ts:1105` |
+| Customer cancels their own contract (blocked while a booking is live) | `POST` | `/api/contracts/:id/cancel` | `modules/contracts/contracts.controller.ts:526` |
+| GL ET uploads customs declaration documents (multi-file) | `POST` | `/api/contracts/:id/clearance/declaration` | `modules/contracts/contracts.controller.ts:795` |
+| GL DJ uploads Delivery Order (import) with vessel arrival + DO collected dates | `POST` | `/api/contracts/:id/clearance/delivery-order` | `modules/contracts/contracts.controller.ts:957` |
+| Customer uploads clearance documents (fieldname = document key) | `POST` | `/api/contracts/:id/clearance/documents` | `modules/contracts/contracts.controller.ts:734` |
+| GL replaces a clearance document in place (reason required) — the previous version is kept in the file history and the new one needs approving | `POST` | `/api/contracts/:id/clearance/documents/:fileKey/replace` | `modules/contracts/contracts.controller.ts:894` |
+| GL ET sets duty/tax requirement and advises amount with notice attachment | `POST` | `/api/contracts/:id/clearance/duty` | `modules/contracts/contracts.controller.ts:808` |
+| Customer uploads duty/tax payment slip on contract | `POST` | `/api/contracts/:id/clearance/duty-slip` | `modules/contracts/contracts.controller.ts:932` |
+| Customer disputes the advised duty/tax with a reason — reopens the step so GL Ethiopia can re-advise (repeatable) | `POST` | `/api/contracts/:id/clearance/duty/dispute` | `modules/contracts/contracts.controller.ts:918` |
+| GL ET confirms export release after declaration | `POST` | `/api/contracts/:id/clearance/export-release` | `modules/contracts/contracts.controller.ts:1008` |
+| GL ET finalizes clearance → CLEARANCE_READY_FOR_BOOKING (legacy) | `POST` | `/api/contracts/:id/clearance/finalize` | `modules/contracts/contracts.controller.ts:788` |
+| GL ET finalizes export clearance after post-booking transit permit upload | `POST` | `/api/contracts/:id/clearance/finalize-export-clearance` | `modules/contracts/contracts.controller.ts:1018` |
+| GL ET finalizes import pre-clearance — unlocks Djibouti DO upload | `POST` | `/api/contracts/:id/clearance/finalize-pre-clearance` | `modules/contracts/contracts.controller.ts:838` |
+| Operations finalizes self-clearance → customer may create the booking | `POST` | `/api/contracts/:id/clearance/ops-finalize` | `modules/contracts/contracts.controller.ts:1051` |
+| Operations reviews a customer self-clearance document (Approve | Query) | `POST` | `/api/contracts/:id/clearance/ops-review` | `modules/contracts/contracts.controller.ts:1032` |
+| GL uploads customs output documents (IM4/EX3/…) pre-booking | `POST` | `/api/contracts/:id/clearance/output-documents` | `modules/contracts/contracts.controller.ts:776` |
+| GL DJ uploads Release Order + vessel departure date (export) | `POST` | `/api/contracts/:id/clearance/release-order` | `modules/contracts/contracts.controller.ts:978` |
+| GL ET reviews a clearance document (Approve | Query) | `POST` | `/api/contracts/:id/clearance/review` | `modules/contracts/contracts.controller.ts:756` |
+| GL DJ requests port amendment when RO vessel window is too short | `POST` | `/api/contracts/:id/clearance/ro-amendment` | `modules/contracts/contracts.controller.ts:997` |
+| GL Djibouti picks the transit officer from the roster — unblocks the customs declaration; calling again reassigns | `POST` | `/api/contracts/:id/clearance/transit-assignee/assign` | `modules/contracts/contracts.controller.ts:863` |
+| GL ET asks GL Djibouti to name the transit officer — required before the customs declaration | `POST` | `/api/contracts/:id/clearance/transit-assignee/request` | `modules/contracts/contracts.controller.ts:845` |
+| GL ET uploads import transit permit documents (multi-file) | `POST` | `/api/contracts/:id/clearance/transit-permit` | `modules/contracts/contracts.controller.ts:944` |
+| Confirm submit after a price change | `POST` | `/api/contracts/:id/confirm-submit` | `modules/contracts/contracts.controller.ts:380` |
+| Generate contract document → CONTRACT_READY | `POST` | `/api/contracts/:id/contract/generate` | `modules/contracts/contracts.controller.ts:596` |
+| Send the sudo-mode signing OTP to the contract company's registered phone (server picks the number) | `POST` | `/api/contracts/:id/contract/send-signing-otp` | `modules/contracts/contracts.controller.ts:667` |
+| Apply digital signature (customer or staff/director/ceo) | `POST` | `/api/contracts/:id/contract/sign` | `modules/contracts/contracts.controller.ts:680` |
+| Upload intake documents for a contract (DRAFT only) | `POST` | `/api/contracts/:id/documents` | `modules/contracts/contracts.controller.ts:354` |
+| Generate unit-rate breakdown (no totals at contract phase) | `POST` | `/api/contracts/:id/generate-price` | `modules/contracts/contracts.controller.ts:366` |
+| GL marks a pre-booking (contract) milestone complete | `POST` | `/api/contracts/:id/milestones/:code/complete` | `modules/contracts/contracts.controller.ts:1222` |
+| Create a renewal draft linked via renewalOfId | `POST` | `/api/contracts/:id/renew` | `modules/contracts/contracts.controller.ts:705` |
+| Staff lift a suspension — contract returns to its prior status | `POST` | `/api/contracts/:id/resume` | `modules/contracts/contracts.controller.ts:510` |
+| Staff accept → set validity window + start approval chain | `POST` | `/api/contracts/:id/staff/accept` | `modules/contracts/contracts.controller.ts:387` |
+| Staff reject contract | `POST` | `/api/contracts/:id/staff/reject` | `modules/contracts/contracts.controller.ts:476` |
+| Staff return contract for customer updates | `POST` | `/api/contracts/:id/staff/request-changes` | `modules/contracts/contracts.controller.ts:460` |
+| Customer submit contract (freezes contract_rate_snapshots) | `POST` | `/api/contracts/:id/submit` | `modules/contracts/contracts.controller.ts:373` |
+| Staff freeze a signed contract (reversible, any post-signature step) | `POST` | `/api/contracts/:id/suspend` | `modules/contracts/contracts.controller.ts:492` |
+| Pre-create validation + authoritative price preview: full booking price breakdown (rail, first/last mile, surcharges), overweight lines and 20ft weight-pairing errors for a shipment payload (no booking created) | `POST` | `/api/contracts/:id/validate-shipment` | `modules/contracts/contracts.controller.ts:1162` |
+| GL marks a shipment request accepted + links the created booking | `POST` | `/api/contracts/booking-requests/:reqId/accept` | `modules/contracts/contracts.controller.ts:134` |
+| Customer cancels their own pending shipment request | `POST` | `/api/contracts/booking-requests/:reqId/cancel` | `modules/contracts/contracts.controller.ts:160` |
+| GL rejects a shipment request | `POST` | `/api/contracts/booking-requests/:reqId/reject` | `modules/contracts/contracts.controller.ts:149` |
+| GL uploads post-booking operational documents (DO/RO/T1/…) | `POST` | `/api/contracts/bookings/:bookingId/documents` | `modules/contracts/contracts.controller.ts:1441` |
+| GL ET advises duty & tax amount + declaration serial | `POST` | `/api/contracts/bookings/:bookingId/duty` | `modules/contracts/contracts.controller.ts:1260` |
+| Customer uploads the duty/tax payment slip | `POST` | `/api/contracts/bookings/:bookingId/duty-slip` | `modules/contracts/contracts.controller.ts:1455` |
+| GL DJ raises the post-offload final invoice (amount + invoice document) | `POST` | `/api/contracts/bookings/:bookingId/final-invoice` | `modules/contracts/contracts.controller.ts:1332` |
+| Customer attaches the payment slip for the final invoice | `POST` | `/api/contracts/bookings/:bookingId/final-invoice-slip` | `modules/contracts/contracts.controller.ts:1374` |
+| Customer approves the drafted final invoice — unlocks the payment slip | `POST` | `/api/contracts/bookings/:bookingId/final-invoice/approve` | `modules/contracts/contracts.controller.ts:1359` |
+| GL (ET or DJ) confirms the payment slip — settles the final invoice | `POST` | `/api/contracts/bookings/:bookingId/final-invoice/confirm` | `modules/contracts/contracts.controller.ts:1386` |
+| GL DJ logs a cargo exception with photo evidence | `POST` | `/api/contracts/bookings/:bookingId/incidents` | `modules/contracts/contracts.controller.ts:1479` |
+| GL / Ops / Terminal marks a post-booking milestone complete | `POST` | `/api/contracts/bookings/:bookingId/milestones/:code/complete` | `modules/contracts/contracts.controller.ts:1205` |
+| GL ET assigns a customs risk level (GREEN/YELLOW/RED) | `POST` | `/api/contracts/bookings/:bookingId/risk` | `modules/contracts/contracts.controller.ts:1241` |
+| GL ET advises (or skips) the post-arrival additional duty/tax round (import) | `POST` | `/api/contracts/bookings/:bookingId/second-duty` | `modules/contracts/contracts.controller.ts:1399` |
+| Customer attaches the additional duty/tax payment slip | `POST` | `/api/contracts/bookings/:bookingId/second-duty-slip` | `modules/contracts/contracts.controller.ts:1429` |
+| GL station manager routes the shipment + binds staff | `POST` | `/api/contracts/bookings/:bookingId/station-assign` | `modules/contracts/contracts.controller.ts:1276` |
+| Close (accept) the T1 set — GL ET after arrival (import) / GL DJ after gate pass (export) | `POST` | `/api/contracts/bookings/:bookingId/t1-close` | `modules/contracts/contracts.controller.ts:1316` |
+| GL Djibouti uploads T1 transit documents (multi-file) after wagon allocation; locked once the train departs | `POST` | `/api/contracts/bookings/:bookingId/t1-documents` | `modules/contracts/contracts.controller.ts:1301` |
+| GL ET uploads export transit permit documents (multi-file) | `POST` | `/api/contracts/bookings/:bookingId/transport-document` | `modules/contracts/contracts.controller.ts:1289` |
+| Share a document with the other GL desk | `POST` | `/api/gl-exchange/:entityId` | `modules/contracts/gl-exchange.controller.ts:59` |
+| Edit this contract\'s document articles only (per-contract; never touches the six shared templates) | `PUT` | `/api/contracts/:id/document/articles` | `modules/contracts/contracts.controller.ts:441` |
+| Update contract | `PATCH` | `/api/contracts/:id` | `modules/contracts/contracts.controller.ts:327` |
+| Uploader edits a shared document (title, visibility, file) | `PATCH` | `/api/gl-exchange/documents/:documentId` | `modules/contracts/gl-exchange.controller.ts:79` |
+| Soft-delete DRAFT contract | `DELETE` | `/api/contracts/:id` | `modules/contracts/contracts.controller.ts:346` |
+| Uploader removes a shared document | `DELETE` | `/api/gl-exchange/documents/:documentId` | `modules/contracts/gl-exchange.controller.ts:105` |
+
+### Contract Template
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a bulk contract template for a (cargo type, customs option) pair | `POST` | `/api/contract-templates` | `modules/contract-templates/contract-templates.controller.ts:56` |
+| Add an article to the template | `POST` | `/api/contract-templates/:code/articles` | `modules/contract-templates/contract-templates.controller.ts:118` |
+| Render an HTML preview of the template against mock contract data | `POST` | `/api/contract-templates/:code/preview` | `modules/contract-templates/contract-templates.controller.ts:97` |
+| Replace the full ordered article list (used for reorder) | `PUT` | `/api/contract-templates/:code/articles` | `modules/contract-templates/contract-templates.controller.ts:111` |
+| Update template metadata (name, title, recitals, active flag) | `PATCH` | `/api/contract-templates/:code` | `modules/contract-templates/contract-templates.controller.ts:77` |
+| Update an article's title or body | `PATCH` | `/api/contract-templates/:code/articles/:articleId` | `modules/contract-templates/contract-templates.controller.ts:125` |
+| Delete a staff-created bulk template (system templates refuse) | `DELETE` | `/api/contract-templates/:code` | `modules/contract-templates/contract-templates.controller.ts:84` |
+| Remove an article from the template | `DELETE` | `/api/contract-templates/:code/articles/:articleId` | `modules/contract-templates/contract-templates.controller.ts:136` |
+
+### Driver
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a new driver | `POST` | `/api/drivers` | `modules/drivers/drivers.controller.ts:41` |
+| Upload driver documents (code driver_docs) | `POST` | `/api/drivers/:id/documents` | `modules/drivers/drivers.controller.ts:80` |
+| Update a driver | `PATCH` | `/api/drivers/:id` | `modules/drivers/drivers.controller.ts:128` |
+| Delete a driver | `DELETE` | `/api/drivers/:id` | `modules/drivers/drivers.controller.ts:138` |
+| Delete a driver document | `DELETE` | `/api/drivers/:id/documents/:fileId` | `modules/drivers/drivers.controller.ts:121` |
+
+### Dropdown Setting
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a new dropdown setting | `POST` | `/api/dropdown-settings` | `modules/dropdown-settings/dropdown-settings.controller.ts:61` |
+| Append a single option to a setting | `POST` | `/api/dropdown-settings/:id/options` | `modules/dropdown-settings/dropdown-settings.controller.ts:98` |
+| Replace the full option list for a setting | `PUT` | `/api/dropdown-settings/:id/options` | `modules/dropdown-settings/dropdown-settings.controller.ts:88` |
+| Update a dropdown setting's metadata | `PATCH` | `/api/dropdown-settings/:id` | `modules/dropdown-settings/dropdown-settings.controller.ts:68` |
+| Update a single option | `PATCH` | `/api/dropdown-settings/options/:optionId` | `modules/dropdown-settings/dropdown-settings.controller.ts:108` |
+| Soft-delete a dropdown setting | `DELETE` | `/api/dropdown-settings/:id` | `modules/dropdown-settings/dropdown-settings.controller.ts:78` |
+| Soft-delete a single option | `DELETE` | `/api/dropdown-settings/options/:optionId` | `modules/dropdown-settings/dropdown-settings.controller.ts:118` |
+
+### EIMS Invoice
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Register the invoice with MoR EIMS. Idempotent — an invoice that already has an IRN is returned unchanged | `POST` | `/api/invoices/:id/eims/register` | `modules/eims/eims-invoice.controller.ts:32` |
+| Resolve an unacknowledged submission: record the IRN confirmed with MoR, or discard it. Clears the system-wide block | `POST` | `/api/invoices/:id/eims/resolve` | `modules/eims/eims-invoice.controller.ts:49` |
+| Verify the invoice's stored IRN against EIMS | `POST` | `/api/invoices/:id/eims/verify` | `modules/eims/eims-invoice.controller.ts:42` |
+
+### Exchange Setting
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Set the USD→ETB fallback by hand (used only while CBE is unreachable) | `PATCH` | `/api/exchange-settings` | `modules/exchange-settings/exchange-settings.controller.ts:35` |
+
+### Facility
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a new facility | `POST` | `/api/facilities` | `modules/facilities/facilities.controller.ts:22` |
+| Update a facility | `PATCH` | `/api/facilities/:id` | `modules/facilities/facilities.controller.ts:41` |
+| Delete a facility (soft delete) | `DELETE` | `/api/facilities/:id` | `modules/facilities/facilities.controller.ts:48` |
+
+### Fayda Verification
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Start a VeriFayda 2.0 verification session | `POST` | `/api/fayda/verification/start` | `modules/verifayda/verifayda.controller.ts:44` |
+
+### File Upload Setting
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a new file upload setting | `POST` | `/api/file-upload-settings` | `modules/file-upload-settings/file-upload-settings.controller.ts:56` |
+| Append a single field to a setting | `POST` | `/api/file-upload-settings/:id/fields` | `modules/file-upload-settings/file-upload-settings.controller.ts:93` |
+| Replace the full field list for a setting | `PUT` | `/api/file-upload-settings/:id/fields` | `modules/file-upload-settings/file-upload-settings.controller.ts:83` |
+| Update a file upload setting's metadata | `PATCH` | `/api/file-upload-settings/:id` | `modules/file-upload-settings/file-upload-settings.controller.ts:63` |
+| Update a single field | `PATCH` | `/api/file-upload-settings/fields/:fieldId` | `modules/file-upload-settings/file-upload-settings.controller.ts:103` |
+| Soft-delete a file upload setting | `DELETE` | `/api/file-upload-settings/:id` | `modules/file-upload-settings/file-upload-settings.controller.ts:73` |
+| Soft-delete a single field | `DELETE` | `/api/file-upload-settings/fields/:fieldId` | `modules/file-upload-settings/file-upload-settings.controller.ts:113` |
+
+### First Mile
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a first-mile leg | `POST` | `/api/first-mile` | `modules/first-mile/first-mile.controller.ts:84` |
+| Set per-vehicle actual distances (does not generate an invoice) | `POST` | `/api/first-mile/:id/distances` | `modules/first-mile/first-mile.controller.ts:124` |
+| Generate the first-mile delivery-fee invoice | `POST` | `/api/first-mile/:id/invoice` | `modules/first-mile/first-mile.controller.ts:100` |
+| Set the vehicles assigned to a first-mile pickup (multi-truck) | `POST` | `/api/first-mile/:id/vehicles` | `modules/first-mile/first-mile.controller.ts:114` |
+| Accept a paid booking and create a first-mile leg | `POST` | `/api/first-mile/accept/:reference` | `modules/first-mile/first-mile.controller.ts:77` |
+| Update a first-mile leg | `PATCH` | `/api/first-mile/:id` | `modules/first-mile/first-mile.controller.ts:91` |
+| Soft-delete a first-mile leg | `DELETE` | `/api/first-mile/:id` | `modules/first-mile/first-mile.controller.ts:134` |
+
+### Fuel
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Record fuel purchase | `POST` | `/api/fuel/purchases` | `modules/fuel/fuel.controller.ts:22` |
+
+### GPS Tracking
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Register a GPS tracker | `POST` | `/api/gps/devices` | `modules/gps-tracking/gps-tracking.controller.ts:52` |
+| Update a GPS tracker (name / assigned vehicle) | `PATCH` | `/api/gps/devices/:id` | `modules/gps-tracking/gps-tracking.controller.ts:59` |
+| Delete a GPS tracker | `DELETE` | `/api/gps/devices/:id` | `modules/gps-tracking/gps-tracking.controller.ts:66` |
+
+### Import Operation
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Batch 12: record declaration serial number | `POST` | `/api/import-operations/customs/:bookingId/declaration` | `modules/import-operations/import-operations.controller.ts:53` |
+| Batch 12: upload IM4/IM5/T1/permit/payment-slip documents | `POST` | `/api/import-operations/customs/:bookingId/documents` | `modules/import-operations/import-operations.controller.ts:44` |
+| Batch 12: mark duties and taxes paid | `POST` | `/api/import-operations/customs/:bookingId/duties-taxes-paid` | `modules/import-operations/import-operations.controller.ts:71` |
+| Batch 12: notify duties and taxes | `POST` | `/api/import-operations/customs/:bookingId/notify-duties-taxes` | `modules/import-operations/import-operations.controller.ts:62` |
+| Batch 12: mark import release permitted | `POST` | `/api/import-operations/customs/:bookingId/release-permitted` | `modules/import-operations/import-operations.controller.ts:86` |
+| Batch 12: assign customs risk | `POST` | `/api/import-operations/customs/:bookingId/risk` | `modules/import-operations/import-operations.controller.ts:80` |
+| Batch 8: report a Djibouti import incident / exception | `POST` | `/api/import-operations/djibouti-incidents` | `modules/import-operations/import-operations.controller.ts:32` |
+| Batch 16: create an empty container return record | `POST` | `/api/import-operations/empty-container-returns` | `modules/import-operations/import-operations.controller.ts:101` |
+| Batch 16: advance empty container return workflow | `POST` | `/api/import-operations/empty-container-returns/:id/status` | `modules/import-operations/import-operations.controller.ts:107` |
+
+### Incident
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Report an incident | `POST` | `/api/incidents` | `modules/incidents/incidents.controller.ts:36` |
+| Update an incident | `PATCH` | `/api/incidents/:id` | `modules/incidents/incidents.controller.ts:72` |
+| Delete an incident | `DELETE` | `/api/incidents/:id` | `modules/incidents/incidents.controller.ts:79` |
+
+### Interchange Document
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Generate interchange document from a train schedule handover | `POST` | `/api/interchange-documents/generate-from-schedule` | `modules/interchange-documents/interchange-documents.controller.ts:41` |
+| Acknowledge an interchange document | `PATCH` | `/api/interchange-documents/:id/acknowledge` | `modules/interchange-documents/interchange-documents.controller.ts:48` |
+| Dispute an interchange document | `PATCH` | `/api/interchange-documents/:id/dispute` | `modules/interchange-documents/interchange-documents.controller.ts:58` |
+
+### Last Mile
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a last-mile leg | `POST` | `/api/last-mile` | `modules/last-mile/last-mile.controller.ts:97` |
+| Set each truck\'s own detention window (arrived at destination / returned) | `POST` | `/api/last-mile/:id/detention-times` | `modules/last-mile/last-mile.controller.ts:142` |
+| Set per-vehicle actual distances (does not generate an invoice) | `POST` | `/api/last-mile/:id/distances` | `modules/last-mile/last-mile.controller.ts:132` |
+| Generate the delivery-fee invoice for a last-mile leg | `POST` | `/api/last-mile/:id/invoice` | `modules/last-mile/last-mile.controller.ts:179` |
+| Record proof of delivery (signature + photos) and complete the leg | `POST` | `/api/last-mile/:id/proof-of-delivery` | `modules/last-mile/last-mile.controller.ts:166` |
+| Set the vehicles assigned to a last-mile delivery (multi-truck) | `POST` | `/api/last-mile/:id/vehicles` | `modules/last-mile/last-mile.controller.ts:122` |
+| Set each truck\'s warehouse gate arrival/departure times | `POST` | `/api/last-mile/:id/warehouse-gate-times` | `modules/last-mile/last-mile.controller.ts:154` |
+| Accept a paid booking and create a last-mile leg | `POST` | `/api/last-mile/accept/:reference` | `modules/last-mile/last-mile.controller.ts:90` |
+| Update a last-mile leg | `PATCH` | `/api/last-mile/:id` | `modules/last-mile/last-mile.controller.ts:104` |
+| Soft-delete a last-mile leg | `DELETE` | `/api/last-mile/:id` | `modules/last-mile/last-mile.controller.ts:113` |
+
+### Last Mile Request
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Truck & Machinery chief approves the request — the advance defaults to the live last-mile rate; LM contract becomes signable and the advance invoice follows the customer signature | `POST` | `/api/last-mile-requests/:id/approve` | `modules/last-mile-requests/last-mile-requests.controller.ts:119` |
+| Customer agrees and signs the LM contract — then the advance invoice is issued | `POST` | `/api/last-mile-requests/:id/contract/sign` | `modules/last-mile-requests/last-mile-requests.controller.ts:83` |
+| Truck & Machinery chief rejects the request with a reason | `POST` | `/api/last-mile-requests/:id/reject` | `modules/last-mile-requests/last-mile-requests.controller.ts:130` |
+| Customer confirms which containers go via EDR last-mile | `POST` | `/api/last-mile-requests/:id/submit` | `modules/last-mile-requests/last-mile-requests.controller.ts:108` |
+
+### Locomotive
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a locomotive | `POST` | `/api/locomotives` | `modules/locomotives/locomotives.controller.ts:58` |
+| Decommission a locomotive | `POST` | `/api/locomotives/:id/decommission` | `modules/locomotives/locomotives.controller.ts:72` |
+| Update a locomotive | `PATCH` | `/api/locomotives/:id` | `modules/locomotives/locomotives.controller.ts:65` |
+| Permanently delete a locomotive (irreversible; refused if any train references it) | `DELETE` | `/api/locomotives/:id/permanent` | `modules/locomotives/locomotives.controller.ts:82` |
+
+### Maintenance
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Record maintenance cost | `POST` | `/api/maintenance/costs` | `modules/maintenance/maintenance.controller.ts:38` |
+| Define/adjust a service interval (e.g. oil change every 10,000 km) | `POST` | `/api/maintenance/intervals` | `modules/maintenance/maintenance.controller.ts:59` |
+| Create part | `POST` | `/api/maintenance/parts` | `modules/maintenance/maintenance.controller.ts:150` |
+| Schedule maintenance | `POST` | `/api/maintenance/schedules` | `modules/maintenance/maintenance.controller.ts:31` |
+| Create warranty | `POST` | `/api/maintenance/warranties` | `modules/maintenance/maintenance.controller.ts:186` |
+| Create work order | `POST` | `/api/maintenance/work-orders` | `modules/maintenance/maintenance.controller.ts:110` |
+| Update part | `PATCH` | `/api/maintenance/parts/:id` | `modules/maintenance/maintenance.controller.ts:170` |
+| Update maintenance schedule | `PATCH` | `/api/maintenance/schedules/:id` | `modules/maintenance/maintenance.controller.ts:45` |
+| Update work order | `PATCH` | `/api/maintenance/work-orders/:id` | `modules/maintenance/maintenance.controller.ts:134` |
+| Deactivate a service interval (stops auto-scheduling) | `DELETE` | `/api/maintenance/intervals/:id` | `modules/maintenance/maintenance.controller.ts:73` |
+| Delete part | `DELETE` | `/api/maintenance/parts/:id` | `modules/maintenance/maintenance.controller.ts:177` |
+| Delete warranty | `DELETE` | `/api/maintenance/warranties/:id` | `modules/maintenance/maintenance.controller.ts:200` |
+| Delete work order | `DELETE` | `/api/maintenance/work-orders/:id` | `modules/maintenance/maintenance.controller.ts:141` |
+
+### Notification Inbox
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Mark all my notifications as read | `POST` | `/api/notifications/read-all` | `modules/notification-inbox/notification-inbox.controller.ts:53` |
+| Mark one of my notifications as read | `PATCH` | `/api/notifications/:id/read` | `modules/notification-inbox/notification-inbox.controller.ts:44` |
+
+### Organization User
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create an organization user without assigning positions | `POST` | `/api/backoffice/organizations/:orgId/users` | `modules/backoffice/backoffice.controller.ts:24` |
+| Replace org-scoped roles assigned to an employee user | `PUT` | `/api/backoffice/organizations/:orgId/employee-users/:userId/roles` | `modules/backoffice/backoffice.controller.ts:58` |
+
+### OTP
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Send OTP | `POST` | `/api/otp/send` | `modules/otp/otp.controller.ts:41` |
+| Verify OTP | `POST` | `/api/otp/verify` | `modules/otp/otp.controller.ts:62` |
+
+### Password Reset
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Send a password-reset code to the account's email AND phone | `POST` | `/api/auth/forgot-password/request` | `modules/auth/forgot-password.controller.ts:30` |
+| Validate a staff-issued reset link and return its set-password ticket | `POST` | `/api/auth/forgot-password/resolve-link` | `modules/auth/forgot-password.controller.ts:73` |
+| Exchange a valid reset code for a single-use set-password ticket | `POST` | `/api/auth/forgot-password/verify` | `modules/auth/forgot-password.controller.ts:62` |
+| Send a password-reset link to a customer's primary contact | `POST` | `/api/backoffice/customers/:companyId/reset-password` | `modules/auth/customer-reset.controller.ts:49` |
+
+### Payment
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Finance confirms a USD invoice paid by bank transfer — slip file required, settles the full balance | `POST` | `/api/billing/invoices/:id/confirm-offline` | `modules/billing/billing.controller.ts:81` |
+| Confirm an OTP-debit payment (CAC Bank) for one of the customer's invoices | `POST` | `/api/billing/my-invoices/:id/confirm` | `modules/billing/portal-billing.controller.ts:102` |
+| Initiate payment for one of the customer's invoices | `POST` | `/api/billing/my-invoices/:id/pay` | `modules/billing/portal-billing.controller.ts:86` |
+| Live still-payable check + payer name for a CBE bill (called while CBE is on the line) | `POST` | `/api/internal/payments/bill-query` | `modules/payment/internal-payment.controller.ts:56` |
+| Apply a payment.succeeded / payment.failed event from the payment service (idempotent) | `POST` | `/api/internal/payments/mark-paid` | `modules/payment/internal-payment.controller.ts:45` |
+| Initiate payment for an invoice | `POST` | `/api/payments/initiate` | `modules/billing/payment.controller.ts:39` |
+| Success-redirect ack: mark payment processing + invoice PAYMENT_PROCESSING (webhook remains source of truth) | `POST` | `/api/payments/redirect-success/:bookingId` | `modules/payment/payment.controller.ts:89` |
+
+### Priority Config
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a priority config | `POST` | `/api/priority-configs` | `modules/rule-engine/controllers/priority-configs.controller.ts:51` |
+| Move a priority config up or down in display order | `POST` | `/api/priority-configs/:id/move-order` | `modules/rule-engine/controllers/priority-configs.controller.ts:66` |
+| Bulk reorder priority configs by ID list | `POST` | `/api/priority-configs/reorder` | `modules/rule-engine/controllers/priority-configs.controller.ts:58` |
+| Update a priority config | `PATCH` | `/api/priority-configs/:id` | `modules/rule-engine/controllers/priority-configs.controller.ts:74` |
+| Soft-delete a priority config | `DELETE` | `/api/priority-configs/:id` | `modules/rule-engine/controllers/priority-configs.controller.ts:81` |
+
+### Priority Rule Change Request
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Submit a priority-rule change for approval | `POST` | `/api/priority-rule-change-requests` | `modules/rule-engine/controllers/priority-rule-change-requests.controller.ts:34` |
+| Approve and apply a pending change | `POST` | `/api/priority-rule-change-requests/:id/approve` | `modules/rule-engine/controllers/priority-rule-change-requests.controller.ts:52` |
+| Reject a pending change | `POST` | `/api/priority-rule-change-requests/:id/reject` | `modules/rule-engine/controllers/priority-rule-change-requests.controller.ts:65` |
+
+### Procurement
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create an asset acquisition | `POST` | `/api/procurement/acquisitions` | `modules/procurement/procurement.controller.ts:56` |
+| Create an asset disposal | `POST` | `/api/procurement/disposals` | `modules/procurement/procurement.controller.ts:90` |
+| Create a vendor | `POST` | `/api/procurement/vendors` | `modules/procurement/procurement.controller.ts:28` |
+| Update an asset acquisition | `PATCH` | `/api/procurement/acquisitions/:id` | `modules/procurement/procurement.controller.ts:75` |
+| Update a vendor | `PATCH` | `/api/procurement/vendors/:id` | `modules/procurement/procurement.controller.ts:41` |
+| Delete an asset acquisition | `DELETE` | `/api/procurement/acquisitions/:id` | `modules/procurement/procurement.controller.ts:82` |
+| Delete an asset disposal | `DELETE` | `/api/procurement/disposals/:id` | `modules/procurement/procurement.controller.ts:103` |
+| Delete a vendor | `DELETE` | `/api/procurement/vendors/:id` | `modules/procurement/procurement.controller.ts:48` |
+
+### Rate
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a rate (DRAFT) | `POST` | `/api/rates` | `modules/rule-engine/controllers/rates.controller.ts:46` |
+| CEO approves a rate | `POST` | `/api/rates/:id/approve` | `modules/rule-engine/controllers/rates.controller.ts:70` |
+| Submit rate for CEO approval | `POST` | `/api/rates/:id/submit` | `modules/rule-engine/controllers/rates.controller.ts:63` |
+| Update a DRAFT rate | `PATCH` | `/api/rates/:id` | `modules/rule-engine/controllers/rates.controller.ts:56` |
+| Soft-delete a rate | `DELETE` | `/api/rates/:id` | `modules/rule-engine/controllers/rates.controller.ts:82` |
+
+### Rate Change Request
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Propose a change to a LIVE rate | `POST` | `/api/rate-change-requests` | `modules/rule-engine/controllers/rate-change-requests.controller.ts:23` |
+| Approve a rate change and put it into effect | `POST` | `/api/rate-change-requests/:id/approve` | `modules/rule-engine/controllers/rate-change-requests.controller.ts:37` |
+| Reject a rate change — the rate keeps its current value | `POST` | `/api/rate-change-requests/:id/reject` | `modules/rule-engine/controllers/rate-change-requests.controller.ts:48` |
+
+### Route
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create route | `POST` | `/api/routes` | `modules/routes/routes.controller.ts:61` |
+| Update route | `PATCH` | `/api/routes/:id` | `modules/routes/routes.controller.ts:68` |
+| Deactivate route | `DELETE` | `/api/routes/:id` | `modules/routes/routes.controller.ts:90` |
+| Permanently delete a route (irreversible; refused while any train schedule references it) | `DELETE` | `/api/routes/:id/permanent` | `modules/routes/routes.controller.ts:79` |
+
+### Schedule
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Reschedule train for maintenance (new departure + rebalance) | `POST` | `/api/train-scheduling/schedules/:id/maintenance` | `modules/scheduling-reschedule/scheduling-reschedule.controller.ts:52` |
+| Execute a confirmed reschedule plan | `POST` | `/api/train-scheduling/schedules/:id/reschedule/execute` | `modules/scheduling-reschedule/scheduling-reschedule.controller.ts:30` |
+| Preview reschedule / government preempt plan | `POST` | `/api/train-scheduling/schedules/:id/reschedule/preview` | `modules/scheduling-reschedule/scheduling-reschedule.controller.ts:20` |
+
+### Service Type
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a service type | `POST` | `/api/service-types` | `modules/rule-engine/controllers/service-types.controller.ts:51` |
+| Move a service type up or down in display order | `POST` | `/api/service-types/:id/move-order` | `modules/rule-engine/controllers/service-types.controller.ts:36` |
+| Bulk reorder service types by ID list | `POST` | `/api/service-types/reorder` | `modules/rule-engine/controllers/service-types.controller.ts:28` |
+| Update a service type | `PATCH` | `/api/service-types/:id` | `modules/rule-engine/controllers/service-types.controller.ts:58` |
+| Soft-delete a service type | `DELETE` | `/api/service-types/:id` | `modules/rule-engine/controllers/service-types.controller.ts:65` |
+
+### Shipping Line
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a shipping line | `POST` | `/api/shipping-lines` | `modules/rule-engine/controllers/shipping-lines.controller.ts:33` |
+| Update a shipping line | `PATCH` | `/api/shipping-lines/:id` | `modules/rule-engine/controllers/shipping-lines.controller.ts:40` |
+| Soft-delete a shipping line | `DELETE` | `/api/shipping-lines/:id` | `modules/rule-engine/controllers/shipping-lines.controller.ts:47` |
+
+### Signature
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create or update the reusable saved signature | `PUT` | `/api/me/signature` | `modules/signatures/signatures.controller.ts:23` |
+
+### Support Chat
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Start chatting with a company (returns the thread if one exists) | `POST` | `/api/support/agent/conversations` | `modules/support-chat/support-chat-agent.controller.ts:49` |
+| Reply as an agent, optionally with attachments | `POST` | `/api/support/agent/conversations/:id/messages` | `modules/support-chat/support-chat-agent.controller.ts:74` |
+| Mark a thread read (agent side) | `POST` | `/api/support/agent/conversations/:id/read` | `modules/support-chat/support-chat-agent.controller.ts:114` |
+| Send a message as the customer (optionally with attachments), opening the thread if needed | `POST` | `/api/support/conversation/messages` | `modules/support-chat/support-chat.controller.ts:65` |
+| Mark my company's thread read (customer side) | `POST` | `/api/support/conversation/read` | `modules/support-chat/support-chat.controller.ts:102` |
+
+### Support Content
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Restore a version — re-saves it as a new version, never destructive | `POST` | `/api/support-content/documents/:slug/versions/:version/restore` | `modules/support-content/support-content.controller.ts:123` |
+| Upload an image or video for a help section | `POST` | `/api/support-content/media` | `modules/support-content/support-content.controller.ts:55` |
+| Replace a document's payload, recording a new version | `PATCH` | `/api/support-content/documents/:slug` | `modules/support-content/support-content.controller.ts:93` |
+
+### Train
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Register a new train | `POST` | `/api/trains` | `modules/trains/trains.controller.ts:33` |
+| Update a train | `PATCH` | `/api/trains/:id` | `modules/trains/trains.controller.ts:52` |
+| Delete a train | `DELETE` | `/api/trains/:id` | `modules/trains/trains.controller.ts:59` |
+
+### Train Build
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Build a train: code + yard + 2+ locomotives (+ optional wagons) | `POST` | `/api/train-builder` | `modules/trains/train-builder.controller.ts:50` |
+| Reactivate a deactivated train back to AVAILABLE | `POST` | `/api/train-builder/:id/activate` | `modules/trains/train-builder.controller.ts:158` |
+| Deactivate the train (park it) — only allowed with no active schedule | `POST` | `/api/train-builder/:id/deactivate` | `modules/trains/train-builder.controller.ts:149` |
+| Persist a drag-reorder of the full consist | `POST` | `/api/train-builder/:id/reorder-wagons` | `modules/trains/train-builder.controller.ts:142` |
+| Append AVAILABLE wagons from the train's yard to the consist | `POST` | `/api/train-builder/:id/wagons` | `modules/trains/train-builder.controller.ts:109` |
+| Detach one wagon and move it to MAINTENANCE status | `POST` | `/api/train-builder/:id/wagons/:wagonId/maintenance` | `modules/trains/train-builder.controller.ts:131` |
+| Replace the locomotive set (minimum 1, same yard) | `PUT` | `/api/train-builder/:id/locomotives` | `modules/trains/train-builder.controller.ts:78` |
+| Edit the train's name and fixed import/export run numbers | `PATCH` | `/api/train-builder/:id/details` | `modules/trains/train-builder.controller.ts:88` |
+| Relocate the train — its locomotives and wagons move to the new yard with it | `PATCH` | `/api/train-builder/:id/yard` | `modules/trains/train-builder.controller.ts:100` |
+| Disband the train (release wagons and locomotives) | `DELETE` | `/api/train-builder/:id` | `modules/trains/train-builder.controller.ts:165` |
+| Detach one wagon from the consist | `DELETE` | `/api/train-builder/:id/wagons/:wagonId` | `modules/trains/train-builder.controller.ts:120` |
+
+### Train Schedule
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Staff: place a paid booking onto a fitting train (notifies customer on date change) | `POST` | `/api/train-scheduling/bookings/:bookingId/allocate` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:880` |
+| Staff: expire a reservation and free its capacity | `POST` | `/api/train-scheduling/bookings/:bookingId/expire` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:845` |
+| Staff: mark a reserved booking paid and allocate it now | `POST` | `/api/train-scheduling/bookings/:bookingId/mark-paid` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:835` |
+| Re-point a booking to another OPEN same-route schedule | `POST` | `/api/train-scheduling/bookings/:bookingId/move-schedule` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:855` |
+| Preview a bulk train schedule | `POST` | `/api/train-scheduling/bulk/preview` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:302` |
+| Create a bulk train schedule | `POST` | `/api/train-scheduling/bulk/schedules` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:316` |
+| Assign bulk bookings to a train schedule | `POST` | `/api/train-scheduling/bulk/schedules/:id/assign-bookings` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:349` |
+| Cancel bulk train schedule | `POST` | `/api/train-scheduling/bulk/schedules/:id/cancel` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:976` |
+| Preview a container train schedule | `POST` | `/api/train-scheduling/container/preview` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:295` |
+| Create a container train schedule | `POST` | `/api/train-scheduling/container/schedules` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:309` |
+| Assign container bookings to a train schedule | `POST` | `/api/train-scheduling/container/schedules/:id/assign-bookings` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:335` |
+| Cancel container train schedule | `POST` | `/api/train-scheduling/container/schedules/:id/cancel` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:969` |
+| Preview a mixed-capable train schedule | `POST` | `/api/train-scheduling/preview` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:288` |
+| Permanently trim free wagons off / couple yard wagons onto the schedule's built train (weight & length limits incl. tolerance enforced, every change logged) | `POST` | `/api/train-scheduling/schedules/:id/adjust-consist` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:197` |
+| Mark a dispatched train arrived (move assets to destination yard, free assets) | `POST` | `/api/train-scheduling/schedules/:id/arrive` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:915` |
+| Assign bookings to a train schedule (mixed-capable) | `POST` | `/api/train-scheduling/schedules/:id/assign-bookings` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:323` |
+| Assign one linked unallocated booking to wagons (preserves existing assignments) | `POST` | `/api/train-scheduling/schedules/:id/assign-unassigned-booking` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:423` |
+| Confirm a booking's cargo loaded at its origin yard (any direction; train must be at that yard) | `POST` | `/api/train-scheduling/schedules/:id/bookings/:bookingId/load` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:564` |
+| Confirm a booking's cargo unloaded at its destination yard — per-booking arrival, may precede the train's final arrival | `POST` | `/api/train-scheduling/schedules/:id/bookings/:bookingId/unload` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:577` |
+| Log the train passing a station (final station triggers arrival) | `POST` | `/api/train-scheduling/schedules/:id/checkpoints` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:903` |
+| Confirm cargo loaded on the train (any direction; unblocks import-Djibouti dispatch) | `POST` | `/api/train-scheduling/schedules/:id/confirm-loading` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:662` |
+| Dispatch a scheduled train | `POST` | `/api/train-scheduling/schedules/:id/dispatch` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:514` |
+| Staff finished document review early — run the batch/payment phase now (applies to the whole route-day group) | `POST` | `/api/train-scheduling/schedules/:id/doc-review-complete` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:824` |
+| Finalize a draft train schedule | `POST` | `/api/train-scheduling/schedules/:id/finalize` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:507` |
+| Depart loaded import train from Djibouti | `POST` | `/api/train-scheduling/schedules/:id/import-djibouti/depart` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:675` |
+| Upload/check an import Djibouti-side document | `POST` | `/api/train-scheduling/schedules/:id/import-djibouti/documents` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:622` |
+| Mark import Djibouti gatepass permission granted | `POST` | `/api/train-scheduling/schedules/:id/import-djibouti/gatepass-granted` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:632` |
+| Generate import load list / marshalling document summary | `POST` | `/api/train-scheduling/schedules/:id/import-djibouti/load-list` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:685` |
+| Confirm import cargo loaded on train at Djibouti | `POST` | `/api/train-scheduling/schedules/:id/import-djibouti/loaded-on-train` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:652` |
+| Mark import train ready for loading at Djibouti | `POST` | `/api/train-scheduling/schedules/:id/import-djibouti/ready-for-loading` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:642` |
+| Confirm intercity cargo loaded (train must be at the booking's origin yard) | `POST` | `/api/train-scheduling/schedules/:id/intercity/:bookingId/load` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:590` |
+| Confirm intercity cargo unloaded at the booking's destination yard (completes the booking) | `POST` | `/api/train-scheduling/schedules/:id/intercity/:bookingId/unload` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:602` |
+| Accept intercity bookings onto this train (opens their pay window; capacity re-checked per booking) | `POST` | `/api/train-scheduling/schedules/:id/intercity/accept` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:541` |
+| Maintenance reschedule: move the train to a new departure with every allocated booking aboard — links, wagons and window settings unchanged | `POST` | `/api/train-scheduling/schedules/:id/maintenance` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:798` |
+| Pin physical wagons to train set slots | `POST` | `/api/train-scheduling/schedules/:id/pin-wagons` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:500` |
+| Run wagon-level allocation for all eligible linked bookings | `POST` | `/api/train-scheduling/schedules/:id/run-allocation` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:747` |
+| Manually run the batch fill for a schedule | `POST` | `/api/train-scheduling/schedules/:id/run-batch` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:739` |
+| Switch out commercial bookings to allocate a government booking in their place | `POST` | `/api/train-scheduling/schedules/:id/switch-government-booking` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:439` |
+| Move a wagon's whole load to another wagon (empty → move/repin, loaded → swap loads) | `POST` | `/api/train-scheduling/schedules/:id/wagons/:wagonId/move-load` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:402` |
+| Update global train scheduling rules (singleton) | `PATCH` | `/api/train-scheduling/global-rules` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:124` |
+| Open or close a schedule booking window | `PATCH` | `/api/train-scheduling/schedules/:id/booking-window` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:756` |
+| Update a container number on a wagon slot | `PATCH` | `/api/train-scheduling/schedules/:id/container-items/:itemId` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:391` |
+| Mark import bookings loaded/unloaded on this schedule (tracking only, does not affect dispatch) | `PATCH` | `/api/train-scheduling/schedules/:id/import-loading-status` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:474` |
+| Mark bookings loaded/unloaded on this schedule (any direction, pre-dispatch only) | `PATCH` | `/api/train-scheduling/schedules/:id/loading-status` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:487` |
+| Reschedule a train's departure date — only before the booking window opens, and only if the new date still leaves room for the booking lead window | `PATCH` | `/api/train-scheduling/schedules/:id/schedule-date` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:784` |
+| Override the booking-window rule for one schedule (open/close hour, duration, doc-review, payment, lead days) — only before the window opens | `PATCH` | `/api/train-scheduling/schedules/:id/window-rule` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:770` |
+| Unassign a booking from a train schedule | `DELETE` | `/api/train-scheduling/schedules/:id/bookings/:bookingId` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:363` |
+| Remove an empty wagon slot from a train | `DELETE` | `/api/train-scheduling/schedules/:id/wagons/:trainSetWagonId` | `modules/train-scheduling/controllers/train-scheduling.controller.ts:378` |
+
+### Transit Agent
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a transit agent | `POST` | `/api/transit-agents` | `modules/transit-agents/transit-agents.controller.ts:66` |
+| Update a transit agent | `PATCH` | `/api/transit-agents/:id` | `modules/transit-agents/transit-agents.controller.ts:73` |
+| Soft-delete a transit agent | `DELETE` | `/api/transit-agents/:id` | `modules/transit-agents/transit-agents.controller.ts:80` |
+
+### Truck Type
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a truck type | `POST` | `/api/truck-types` | `modules/truck-types/truck-types.controller.ts:58` |
+| Update a truck type | `PATCH` | `/api/truck-types/:id` | `modules/truck-types/truck-types.controller.ts:65` |
+| Soft-delete a truck type | `DELETE` | `/api/truck-types/:id` | `modules/truck-types/truck-types.controller.ts:72` |
+
+### User Trade Access
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Set the trade directions a backoffice user may see | `PUT` | `/api/user-trade-access/:userId` | `modules/user-trade-access/user-trade-access.controller.ts:45` |
+
+### Vehicle
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a new vehicle | `POST` | `/api/vehicles` | `modules/vehicles/vehicles.controller.ts:37` |
+| Update a vehicle | `PATCH` | `/api/vehicles/:id` | `modules/vehicles/vehicles.controller.ts:78` |
+| Delete a vehicle | `DELETE` | `/api/vehicles/:id` | `modules/vehicles/vehicles.controller.ts:88` |
+
+### Wagon
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a new wagon | `POST` | `/api/wagons` | `modules/wagons/wagons.controller.ts:39` |
+| Assign wagon to a train | `POST` | `/api/wagons/:id/assign-train` | `modules/wagons/wagons.controller.ts:100` |
+| Unassign wagon from train | `POST` | `/api/wagons/:id/unassign-train` | `modules/wagons/wagons.controller.ts:107` |
+| Set the status of multiple wagons (audited in wagon_status_logs) | `POST` | `/api/wagons/bulk-status` | `modules/wagons/wagons.controller.ts:121` |
+| Transfer multiple wagons to a destination yard | `POST` | `/api/wagons/bulk-transfer` | `modules/wagons/wagons.controller.ts:114` |
+| Update a wagon | `PATCH` | `/api/wagons/:id` | `modules/wagons/wagons.controller.ts:71` |
+| Delete a wagon | `DELETE` | `/api/wagons/:id` | `modules/wagons/wagons.controller.ts:93` |
+| Permanently delete a wagon (irreversible; refused if it has movements, containers or train-set slots) | `DELETE` | `/api/wagons/:id/permanent` | `modules/wagons/wagons.controller.ts:82` |
+
+### Wagon Transfer Request
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| File a count-only wagon-transfer request | `POST` | `/api/wagon-transfer-requests` | `modules/wagons/wagon-transfer-requests.controller.ts:50` |
+| Withdraw a request that has not moved any wagon yet (use close-short once wagons have moved) | `POST` | `/api/wagon-transfer-requests/:id/cancel` | `modules/wagons/wagon-transfer-requests.controller.ts:167` |
+| OCC: end the request with fewer wagons than asked for — what moved stays, the requester is told the shortfall | `POST` | `/api/wagon-transfer-requests/:id/close-short` | `modules/wagons/wagon-transfer-requests.controller.ts:153` |
+| OCC: pick wagons and execute the transfer | `POST` | `/api/wagon-transfer-requests/:id/fulfill` | `modules/wagons/wagon-transfer-requests.controller.ts:142` |
+| OCC: accept-and-execute a subset of pending requests (auto-picks available wagons; the rest stay PENDING) | `POST` | `/api/wagon-transfer-requests/bulk-fulfill` | `modules/wagons/wagon-transfer-requests.controller.ts:73` |
+
+### Wagon Type
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a wagon type | `POST` | `/api/wagon-types` | `modules/wagon-types/wagon-types.controller.ts:53` |
+| Update a wagon type | `PATCH` | `/api/wagon-types/:id` | `modules/wagon-types/wagon-types.controller.ts:60` |
+| Soft-delete a wagon type | `DELETE` | `/api/wagon-types/:id` | `modules/wagon-types/wagon-types.controller.ts:67` |
+
+### Warehouse
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a warehouse allocation rule | `POST` | `/api/warehouse-allocation-rules` | `modules/warehouses/warehouse-rules.controller.ts:33` |
+| Preview the yard/warehouse/zone a booking would be allocated to | `POST` | `/api/warehouse-allocation/preview` | `modules/warehouses/warehouse-rules.controller.ts:55` |
+| Create a storage / demurrage fee rule | `POST` | `/api/warehouse-fee-rules` | `modules/warehouses/warehouse-rules.controller.ts:70` |
+| Acknowledge / snooze an item fee-accrual alert | `POST` | `/api/warehouse-fees/accrual/:inventoryId/acknowledge` | `modules/warehouses/warehouse-rules.controller.ts:106` |
+| Create warehouse | `POST` | `/api/warehouses` | `modules/warehouses/warehouses.controller.ts:51` |
+| Create a yard within a warehouse | `POST` | `/api/warehouses/:warehouseId/yards` | `modules/warehouses/warehouses.controller.ts:78` |
+| Update a warehouse allocation rule | `PATCH` | `/api/warehouse-allocation-rules/:id` | `modules/warehouses/warehouse-rules.controller.ts:40` |
+| Update a fee rule | `PATCH` | `/api/warehouse-fee-rules/:id` | `modules/warehouses/warehouse-rules.controller.ts:77` |
+| Update warehouse | `PATCH` | `/api/warehouses/:id` | `modules/warehouses/warehouses.controller.ts:64` |
+| Delete a warehouse allocation rule | `DELETE` | `/api/warehouse-allocation-rules/:id` | `modules/warehouses/warehouse-rules.controller.ts:47` |
+| Delete a fee rule | `DELETE` | `/api/warehouse-fee-rules/:id` | `modules/warehouses/warehouse-rules.controller.ts:84` |
+| Remove an accrual acknowledgement (re-surface for alerts) | `DELETE` | `/api/warehouse-fees/accrual/:inventoryId/acknowledge` | `modules/warehouses/warehouse-rules.controller.ts:119` |
+
+### Warehouse Fee Invoice
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Generate a truck-detention invoice for a last-mile leg (per truck per day) | `POST` | `/api/last-mile/:id/generate-truck-detention-invoice` | `modules/warehouses/warehouse-invoice.controller.ts:28` |
+| Record a payment against a warehouse fee invoice | `POST` | `/api/warehouse-fee-invoices/:id/pay` | `modules/warehouses/warehouse-invoice.controller.ts:109` |
+| Initiate Telebirr/Waafi payment for a warehouse fee invoice | `POST` | `/api/warehouse-fee-invoices/:id/pay-online` | `modules/warehouses/warehouse-invoice.controller.ts:116` |
+| Generate a warehouse fee invoice from Batch 5 fee calculation | `POST` | `/api/warehouse-inventory/:id/generate-fee-invoice` | `modules/warehouses/warehouse-invoice.controller.ts:20` |
+| Cancel a warehouse fee invoice | `PATCH` | `/api/warehouse-fee-invoices/:id/cancel` | `modules/warehouses/warehouse-invoice.controller.ts:102` |
+
+### Warehouse Inspection Report
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Upload inspection images / documents | `POST` | `/api/warehouse-inspection-reports/:id/attachments` | `modules/warehouses/warehouse-inspection.controller.ts:68` |
+| Create an inspection / damage report for an inventory item | `POST` | `/api/warehouse-inventory/:inventoryId/inspection-reports` | `modules/warehouses/warehouse-inspection.controller.ts:37` |
+| Update an inspection report | `PATCH` | `/api/warehouse-inspection-reports/:id` | `modules/warehouses/warehouse-inspection.controller.ts:61` |
+
+### Warehouse Inventory
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Deliver import goods to the customer + capture proof of delivery | `POST` | `/api/warehouse-inventory/:id/deliver` | `modules/warehouses/warehouse-inventory.controller.ts:594` |
+| Final terminal release / gate clearance (blocked while fees unpaid) | `POST` | `/api/warehouse-inventory/:id/gate-clearance` | `modules/warehouses/warehouse-inventory.controller.ts:219` |
+| Load READY_FOR_LOADING inventory onto a wagon | `POST` | `/api/warehouse-inventory/:id/load` | `modules/warehouses/warehouse-inventory.controller.ts:384` |
+| Move inventory to another warehouse/yard/zone | `POST` | `/api/warehouse-inventory/:id/move` | `modules/warehouses/warehouse-inventory.controller.ts:359` |
+| Mark reserved inventory READY_FOR_LOADING | `POST` | `/api/warehouse-inventory/:id/ready-for-loading` | `modules/warehouses/warehouse-inventory.controller.ts:373` |
+| Mark inspected IMPORT inventory READY_FOR_PICKUP | `POST` | `/api/warehouse-inventory/:id/ready-for-pickup` | `modules/warehouses/warehouse-inventory.controller.ts:391` |
+| Issue a DO / release order for ready-for-pickup inventory | `POST` | `/api/warehouse-inventory/:id/release` | `modules/warehouses/warehouse-inventory.controller.ts:402` |
+| Mark received inventory as STORED (optional explicit warehouse/yard/zone) | `POST` | `/api/warehouse-inventory/:id/store` | `modules/warehouses/warehouse-inventory.controller.ts:366` |
+| Auto-load READY_FOR_LOADING inventory with PAID bookings | `POST` | `/api/warehouse-inventory/auto-load-ready` | `modules/warehouses/warehouse-inventory.controller.ts:125` |
+| Bulk auto-unload all arrived bookings into the warehouse | `POST` | `/api/warehouse-inventory/auto-unload-arrived` | `modules/warehouses/warehouse-inventory.controller.ts:118` |
+| Approve delivery — customer records their full name (signature optional) | `POST` | `/api/warehouse-inventory/bookings/:bookingId/approve-delivery` | `modules/warehouses/warehouse-inventory.controller.ts:470` |
+| Ask the customer to sign the handover (creates one if none, then notifies) | `POST` | `/api/warehouse-inventory/bookings/:bookingId/request-handover-signature` | `modules/warehouses/warehouse-inventory.controller.ts:509` |
+| Unload a single arrived booking into a location | `POST` | `/api/warehouse-inventory/bookings/:bookingId/unload` | `modules/warehouses/warehouse-inventory.controller.ts:209` |
+| Bulk-dispatch loaded EXPORT inventory (LOADED → DISPATCHED) | `POST` | `/api/warehouse-inventory/bulk-dispatch-export` | `modules/warehouses/warehouse-inventory.controller.ts:195` |
+| Bulk mark received inventory inspection PASSED (EXPORT → READY_FOR_LOADING) | `POST` | `/api/warehouse-inventory/bulk-mark-inspected` | `modules/warehouses/warehouse-inventory.controller.ts:202` |
+| Unload all eligible export items assigned to an arrived Djibouti-side train | `POST` | `/api/warehouse-inventory/export/auto-unload-at-djibouti` | `modules/warehouses/warehouse-inventory.controller.ts:294` |
+| Customer signs one handover (EDR last-mile: one signature per truck) | `POST` | `/api/warehouse-inventory/handovers/:handoverId/sign` | `modules/warehouses/warehouse-inventory.controller.ts:493` |
+| Unload all eligible assigned bookings of an ARRIVED import train (→ UNLOADED) | `POST` | `/api/warehouse-inventory/import/auto-unload-arrived-bookings` | `modules/warehouses/warehouse-inventory.controller.ts:244` |
+| Receive inventory at a warehouse location | `POST` | `/api/warehouse-inventory/receive` | `modules/warehouses/warehouse-inventory.controller.ts:322` |
+| Bulk-receive selected eligible PAID bookings into a location | `POST` | `/api/warehouse-inventory/receive-bulk` | `modules/warehouses/warehouse-inventory.controller.ts:140` |
+| Reserve stored inventory for a PAID booking | `POST` | `/api/warehouse-inventory/reserve` | `modules/warehouses/warehouse-inventory.controller.ts:330` |
+| Load selected inventory items onto their allocated wagons for a train | `POST` | `/api/warehouse-inventory/train/:scheduleId/load` | `modules/warehouses/warehouse-inventory.controller.ts:184` |
+| Mark loaded inventory DISPATCHED (left the terminal) | `PATCH` | `/api/warehouse-inventory/:id/dispatch` | `modules/warehouses/warehouse-inventory.controller.ts:602` |
+| Record Yes/No double handling after unloading (Yes applies the double-handling fee rule) | `PATCH` | `/api/warehouse-inventory/bookings/:bookingId/double-handling` | `modules/warehouses/warehouse-inventory.controller.ts:556` |
+
+### Warehouse Yard
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a zone within a yard | `POST` | `/api/warehouse-yards/:yardId/zones` | `modules/warehouses/warehouse-yards.controller.ts:50` |
+| Update warehouse yard | `PATCH` | `/api/warehouse-yards/:id` | `modules/warehouses/warehouse-yards.controller.ts:36` |
+
+### Warehouse Zone
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Update warehouse zone | `PATCH` | `/api/warehouse-zones/:id` | `modules/warehouses/warehouse-zones.controller.ts:37` |
+
+### Weight Limit Rule
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a weight limit rule | `POST` | `/api/weight-limit-rules` | `modules/rule-engine/controllers/weight-limit-rules.controller.ts:32` |
+| Update a weight limit rule | `PATCH` | `/api/weight-limit-rules/:id` | `modules/rule-engine/controllers/weight-limit-rules.controller.ts:39` |
+| Soft-delete a weight limit rule | `DELETE` | `/api/weight-limit-rules/:id` | `modules/rule-engine/controllers/weight-limit-rules.controller.ts:46` |
+
+### Yard
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a yard | `POST` | `/api/yards` | `modules/rule-engine/controllers/yards.controller.ts:53` |
+| Move a yard up or down in display order | `POST` | `/api/yards/:id/move-order` | `modules/rule-engine/controllers/yards.controller.ts:38` |
+| Bulk reorder yards by ID list | `POST` | `/api/yards/reorder` | `modules/rule-engine/controllers/yards.controller.ts:30` |
+| Update a yard | `PATCH` | `/api/yards/:id` | `modules/rule-engine/controllers/yards.controller.ts:60` |
+| Soft-delete a yard | `DELETE` | `/api/yards/:id` | `modules/rule-engine/controllers/yards.controller.ts:67` |
+
+### Yard Distance
+
+| Title | Method | Endpoint | Source |
+| --- | --- | --- | --- |
+| Create a yard distance | `POST` | `/api/yard-distances` | `modules/rule-engine/controllers/yard-distances.controller.ts:42` |
+| Update a yard distance | `PATCH` | `/api/yard-distances/:id` | `modules/rule-engine/controllers/yard-distances.controller.ts:49` |
+| Soft-delete a yard distance | `DELETE` | `/api/yard-distances/:id` | `modules/rule-engine/controllers/yard-distances.controller.ts:56` |
+
diff --git a/apps/edr-freight-api/package.json b/apps/edr-freight-api/package.json
index fb6a0bd31..f3ba897a0 100644
--- a/apps/edr-freight-api/package.json
+++ b/apps/edr-freight-api/package.json
@@ -60,7 +60,6 @@
     "@nestjs/typeorm": "^11.0.1",
     "@nestjs/websockets": "^11.1.27",
     "@tria-plc/api-common": "file:../../local-packages/tria-plc-api-common-1.6.0.tgz",
-    "@tria-plc/auditlog": "file:../../local-packages/tria-plc-auditlog-1.1.2.tgz",
     "@tria-plc/iamapi-common": "file:../../local-packages/tria-plc-iamapi-common-1.0.0.tgz",
     "amqp-connection-manager": "^5.0.0",
     "amqplib": "^2.0.1",
diff --git a/apps/edr-freight-api/src/app.module.ts b/apps/edr-freight-api/src/app.module.ts
index c1b890719..3bab613fb 100644
--- a/apps/edr-freight-api/src/app.module.ts
+++ b/apps/edr-freight-api/src/app.module.ts
@@ -16,7 +16,6 @@ import {
 import { IamBaselineSeeder, IamSeedModule } from "@edr/iam-seed";
 import { IamModule } from "@tria-plc/iamapi-common";
 import { SharedAuthModule } from "@tria-plc/api-common/modules/auth/shared-auth.module";
-import { MezgebModule } from "@tria-plc/auditlog";
 
 import appConfig from "./config/app.config";
 import databaseConfig from "./config/database.config";
@@ -49,6 +48,7 @@ import { SupportChatModule } from "./modules/support-chat/support-chat.module";
 import { FileUploadSettingsModule } from "./modules/file-upload-settings/file-upload-settings.module";
 import { DropdownSettingsModule } from "./modules/dropdown-settings/dropdown-settings.module";
 import { ExchangeSettingsModule } from "./modules/exchange-settings/exchange-settings.module";
+import { StampSettingsModule } from "./modules/stamp-settings/stamp-settings.module";
 import { ContractTemplatesModule } from "./modules/contract-templates/contract-templates.module";
 import { SupportContentModule } from "./modules/support-content/support-content.module";
 import { OtpModule } from "./modules/otp/otp.module";
@@ -112,8 +112,7 @@ import { LastMileRequestsModule } from "./modules/last-mile-requests/last-mile-r
 import { InterchangeDocumentsModule } from "./modules/interchange-documents/interchange-documents.module";
 import { ImportOperationsModule } from "./modules/import-operations/import-operations.module";
 import { AiModule } from "./modules/ai/ai.module";
-import { AuditModule } from "./modules/audit/audit.module";
-import { LoggerMiddleware } from "./logger.middleware";
+import { RequestLogMiddleware } from "@edr/api-common";
 import { LoginAudienceMiddleware } from "./modules/auth/login-audience.middleware";
 import { PositionTypePermissionsCache } from "./common/position-type-permissions.cache";
 
@@ -169,19 +168,6 @@ if (!process.env.APPLICATION_NAME) {
         return dataSource;
       },
     }),
-    // Request + entity-level audit logging over RabbitMQ (@tria-plc/auditlog).
-    // Must come after TypeOrmModule above so it picks up this app's DataSource.
-    // rmqUrl falls back the same way notifications.module.ts's RABBITMQ_URL
-    // does: the dev broker only provisions the `edr` user on the `payment`
-    // vhost (docker-compose's RABBITMQ_DEFAULT_USER/VHOST), so an unset
-    // RABBITMQ_URL must land there too, not on guest@'/' (403 ACCESS_REFUSED).
-    MezgebModule.forRoot({
-      applicationName: "freight-api",
-      rmqUrl:
-        process.env.RABBITMQ_URL ??
-        process.env.PAYMENT_RABBITMQ_URL ??
-        "amqp://localhost:5672",
-    }),
     SharedAuthModule,
     IamModule.forRoot({
       applications: [EDR_FREIGHT_APPLICATION],
@@ -221,6 +207,7 @@ if (!process.env.APPLICATION_NAME) {
     FileUploadSettingsModule,
     DropdownSettingsModule,
     ExchangeSettingsModule,
+    StampSettingsModule,
     ContractTemplatesModule,
     SupportContentModule,
     OtpModule,
@@ -257,7 +244,6 @@ if (!process.env.APPLICATION_NAME) {
     EimsModule,
     FleetHistoryModule,
     AiModule,
-    AuditModule,
   ],
   providers: [
     EdrOrgSeeder,
@@ -390,7 +376,9 @@ export class AppModule implements OnApplicationBootstrap {
   }
 
   configure(consumer: MiddlewareConsumer) {
-    consumer.apply(LoggerMiddleware).forRoutes("*");
+    // FIRST: opens the request log context every later middleware/guard/service
+    // writes into via logCtx(). Anything applied above it logs into the void.
+    consumer.apply(RequestLogMiddleware).forRoutes("*");
     consumer
       .apply(LoginAudienceMiddleware)
       .forRoutes(
diff --git a/apps/edr-freight-api/src/common/booking-guards.ts b/apps/edr-freight-api/src/common/booking-guards.ts
index d1b5364c3..36ed7ae74 100644
--- a/apps/edr-freight-api/src/common/booking-guards.ts
+++ b/apps/edr-freight-api/src/common/booking-guards.ts
@@ -90,6 +90,10 @@ export const TrainSchedulingReschedule = () =>
 export const TrainSchedulingRulesManage = () =>
   BookingStaff(FREIGHT_PERMS.trainScheduling.rulesManage);
 
+/** Edit a schedule's operational run numbers (train + voyage) before dispatch. */
+export const TrainSchedulingEditTrainNumber = () =>
+  BookingStaff(FREIGHT_PERMS.trainScheduling.editTrainNumber);
+
 /**
  * Fleet guards take an optional granular per-resource key (locomotives:create,
  * wagons:delete, …). The legacy coarse fleet:view / fleet:manage keys remain
diff --git a/apps/edr-freight-api/src/common/request-log-context.spec.ts b/apps/edr-freight-api/src/common/request-log-context.spec.ts
new file mode 100644
index 000000000..403b1a137
--- /dev/null
+++ b/apps/edr-freight-api/src/common/request-log-context.spec.ts
@@ -0,0 +1,146 @@
+import { Logger } from "@nestjs/common";
+import type { Repository } from "typeorm";
+import {
+  BaseRepository,
+  RequestLogMiddleware,
+  getLogContext,
+  logCtx,
+  runWithLogContext,
+} from "@edr/api-common";
+
+describe("logCtx", () => {
+  it("is a no-op outside a request", () => {
+    expect(() => logCtx({ bookingId: "b1" })).not.toThrow();
+    expect(getLogContext()).toBeUndefined();
+  });
+
+  it("collects data points across the request and isolates concurrent ones", async () => {
+    const collect = async (id: string) =>
+      runWithLogContext({ requestId: id }, async () => {
+        logCtx({ bookingId: id });
+        await Promise.resolve();
+        logCtx({ from: "DRAFT", to: "SUBMITTED" }, { path: "booking.status" });
+        logCtx({ wagonId: "w1" }, { path: "wagons", mode: "push" });
+        logCtx({ wagonId: "w2" }, { path: "wagons", mode: "push" });
+        logCtx(1, { path: "smsSent", mode: "count" });
+        logCtx(1, { path: "smsSent", mode: "count" });
+        logCtx("PAID", { path: "payment.state", mode: "set" });
+        logCtx({ ignored: true }, (ctx) => {
+          ctx.custom = "yes";
+        });
+        return getLogContext();
+      });
+
+    const [a, b] = await Promise.all([collect("r1"), collect("r2")]);
+
+    expect(a).toEqual({
+      requestId: "r1",
+      bookingId: "r1",
+      booking: { status: { from: "DRAFT", to: "SUBMITTED" } },
+      wagons: [{ wagonId: "w1" }, { wagonId: "w2" }],
+      smsSent: 2,
+      payment: { state: "PAID" },
+      custom: "yes",
+    });
+    expect(b?.requestId).toBe("r2");
+    expect(b?.bookingId).toBe("r2");
+  });
+});
+
+describe("RequestLogMiddleware", () => {
+  it("emits one canonical JSON line carrying the collected context", () => {
+    // Raw stdout, not the Nest logger — the line must be parsable JSON with no
+    // "[Nest] … LOG [request]" prefix in front of it.
+    const lines: string[] = [];
+    jest.spyOn(process.stdout, "write").mockImplementation((chunk) => {
+      lines.push(String(chunk));
+      return true;
+    });
+    jest.spyOn(Logger.prototype, "log").mockImplementation(() => undefined);
+
+    const listeners: Record<string, () => void> = {};
+    const req = {
+      method: "POST",
+      url: "/api/bookings/1/submit",
+      originalUrl: "/api/bookings/1/submit?dry=1",
+      baseUrl: "/api/bookings",
+      route: { path: "/:id/submit" },
+      headers: { "user-agent": "jest", "x-request-id": "req-42" },
+      ip: "10.0.0.1",
+      query: { dry: "1" },
+      user: { id: "u-7" },
+    };
+    const res = {
+      statusCode: 409,
+      writableEnded: true,
+      setHeader: jest.fn(),
+      on: (event: string, fn: () => void) => {
+        listeners[event] = fn;
+      },
+    };
+
+    new RequestLogMiddleware().use(req, res, () => {
+      logCtx({ bookingId: "b-1" });
+      logCtx("REJECTED", { path: "booking.outcome", mode: "set" });
+    });
+    listeners.finish();
+    listeners.close(); // aborts/close after finish must not double-log
+
+    expect(lines).toHaveLength(1);
+    expect(lines[0].endsWith("\n")).toBe(true);
+    expect(lines[0].startsWith("{")).toBe(true);
+    expect(JSON.parse(lines[0])).toMatchObject({
+      level: "warn",
+      logger: "request",
+      type: "http_request",
+      requestId: "req-42",
+      method: "POST",
+      route: "/api/bookings/:id/submit",
+      url: "/api/bookings/1/submit?dry=1",
+      status: 409,
+      userId: "u-7",
+      ip: "10.0.0.1",
+      userAgent: "jest",
+      query: { dry: "1" },
+      bookingId: "b-1",
+      booking: { outcome: "REJECTED" },
+    });
+    expect(res.setHeader).toHaveBeenCalledWith("x-request-id", "req-42");
+    jest.restoreAllMocks();
+  });
+});
+
+describe("BaseRepository write trail", () => {
+  class TestRepo extends BaseRepository<{ id: string; status?: string }> {
+    constructor(repo: Repository<{ id: string; status?: string }>) {
+      super(repo);
+    }
+  }
+
+  const typeormRepo = {
+    metadata: { tableName: "booking" },
+    create: (data: unknown) => data,
+    save: async (data: unknown) => data,
+    update: async () => undefined,
+    findOne: async () => ({ id: "b-1", status: "SUBMITTED" }),
+    softDelete: async () => undefined,
+    delete: async () => undefined,
+  } as unknown as Repository<{ id: string; status?: string }>;
+
+  it("records creates, status changes and deletes without any service opting in", async () => {
+    const ctx = await runWithLogContext({}, async () => {
+      const repo = new TestRepo(typeormRepo);
+      await repo.create({ id: "b-1" });
+      await repo.update("b-1", { status: "SUBMITTED" });
+      await repo.update("b-1", { id: "b-1" }); // no status → no transition entry
+      await repo.softDelete("b-1");
+      return getLogContext();
+    });
+
+    expect(ctx).toEqual({
+      db: { created: { booking: 1 }, updated: { booking: 2 } },
+      statusChanges: [{ entity: "booking", id: "b-1", status: "SUBMITTED" }],
+      deleted: [{ entity: "booking", id: "b-1" }],
+    });
+  });
+});
diff --git a/apps/edr-freight-api/src/config/database.config.ts b/apps/edr-freight-api/src/config/database.config.ts
index af4a5b017..77f4b37e4 100644
--- a/apps/edr-freight-api/src/config/database.config.ts
+++ b/apps/edr-freight-api/src/config/database.config.ts
@@ -56,11 +56,6 @@ import { EmployeePositionActivePeriod } from "@tria-plc/iamapi-common/entities/i
 import { UnitConfiguration } from "@tria-plc/iamapi-common/entities/iam/organization-structure/unit-configuration.entity";
 import { Site } from "@tria-plc/iamapi-common/entities/iam/site/site.entity";
 import { SiteSetting } from "@tria-plc/iamapi-common/entities/iam/site/site-setting.entity";
-import { AuditLog, AuditLogCommand } from "@tria-plc/auditlog";
-
-// @tria-plc/auditlog's entities live in node_modules, same as the iam ones —
-// the glob below only matches this app's own src/**/*.entity.ts.
-const auditEntities = [AuditLog, AuditLogCommand];
 
 const iamEntities = [
   UnitSetting,
@@ -185,7 +180,6 @@ export function buildDataSourceOptions(): DataSourceOptions {
     entities: [
       __dirname + "/../**/*.entity.{ts,js}",
       ...iamEntities,
-      ...auditEntities,
     ],
     migrations: [],
   };
diff --git a/apps/edr-freight-api/src/contracts/contract-provider-stamp.spec.ts b/apps/edr-freight-api/src/contracts/contract-provider-stamp.spec.ts
new file mode 100644
index 000000000..023e4ac8c
--- /dev/null
+++ b/apps/edr-freight-api/src/contracts/contract-provider-stamp.spec.ts
@@ -0,0 +1,99 @@
+import { ContractViewModelBuilder, ContractSignatureView } from "./contract-view-model.builder";
+
+/**
+ * The EDR side of a contract is sealed with the ONE global company stamp, read
+ * live at render time; the client side keeps whatever stamp the customer
+ * uploaded. These specs pin that asymmetry — the standing rule is that
+ * centralizing the EDR seal must not touch customer stamps.
+ */
+describe("ContractViewModelBuilder.attachProviderStamp", () => {
+  const STAMP = "data:image/png;base64,RURS";
+
+  const build = (stampImageUrl: string | null = STAMP) => {
+    const getStampImageUrl = jest.fn().mockResolvedValue(stampImageUrl);
+    const builder = Object.create(
+      ContractViewModelBuilder.prototype,
+    ) as ContractViewModelBuilder;
+    Object.assign(builder, { stampSettings: { getStampImageUrl } });
+    return { builder, getStampImageUrl };
+  };
+
+  const sig = (role: "STAFF" | "CUSTOMER", extra: Partial<ContractSignatureView> = {}) =>
+    ({
+      role,
+      signerDisplayName: `${role} signer`,
+      signedAt: "1 January 2026",
+      signatureImageUrl: "https://minio.local/sig.png",
+      ...extra,
+    }) as ContractSignatureView;
+
+  it("stamps the EDR side with the global stamp", async () => {
+    const { builder } = build();
+    const signatures = [sig("STAFF")];
+
+    await builder.attachProviderStamp(signatures);
+
+    expect(signatures[0]!.stampImageUrl).toBe(STAMP);
+  });
+
+  it("leaves the customer side untouched", async () => {
+    const { builder } = build();
+    const customerStamp = "data:image/png;base64,Q1VTVA==";
+    const signatures = [
+      sig("CUSTOMER", { stampImageUrl: customerStamp }),
+      sig("STAFF"),
+    ];
+
+    await builder.attachProviderStamp(signatures);
+
+    expect(signatures[0]!.stampImageUrl).toBe(customerStamp);
+    expect(signatures[1]!.stampImageUrl).toBe(STAMP);
+  });
+
+  it("does not read the stamp at all when EDR has not signed yet", async () => {
+    const { builder, getStampImageUrl } = build();
+    const signatures = [sig("CUSTOMER")];
+
+    await builder.attachProviderStamp(signatures);
+
+    expect(getStampImageUrl).not.toHaveBeenCalled();
+    expect(signatures[0]!.stampImageUrl).toBeUndefined();
+  });
+
+  it("renders unstamped rather than failing when no stamp is configured", async () => {
+    const { builder } = build(null);
+    const signatures = [sig("STAFF")];
+
+    await expect(builder.attachProviderStamp(signatures)).resolves.toBeUndefined();
+    expect(signatures[0]!.stampImageUrl).toBeNull();
+  });
+
+  it("reads the stamp once for every EDR signature row", async () => {
+    const { builder, getStampImageUrl } = build();
+    const signatures = [sig("STAFF"), sig("STAFF")];
+
+    await builder.attachProviderStamp(signatures);
+
+    expect(getStampImageUrl).toHaveBeenCalledTimes(1);
+    expect(signatures.map((s) => s.stampImageUrl)).toEqual([STAMP, STAMP]);
+  });
+
+  it("is applied by loadSignatures, so the HTML view and the PDF agree", async () => {
+    const { builder } = build();
+    Object.assign(builder, {
+      bookingsRepository: {
+        findContractSignatures: jest.fn().mockResolvedValue([
+          { signerRole: "STAFF", signerDisplayName: "EDR", signedAt: new Date() },
+        ]),
+      },
+    });
+
+    const views = await (
+      builder as unknown as {
+        loadSignatures(id: string): Promise<ContractSignatureView[]>;
+      }
+    ).loadSignatures("b-1");
+
+    expect(views[0]!.stampImageUrl).toBe(STAMP);
+  });
+});
diff --git a/apps/edr-freight-api/src/contracts/contract-view-model.builder.ts b/apps/edr-freight-api/src/contracts/contract-view-model.builder.ts
index d1158d035..94a6809e6 100644
--- a/apps/edr-freight-api/src/contracts/contract-view-model.builder.ts
+++ b/apps/edr-freight-api/src/contracts/contract-view-model.builder.ts
@@ -9,6 +9,7 @@ import {
 import { ContractPricingScheduleBuilder, PricingSchedule } from './contract-pricing-schedule.builder';
 import { ContractRateScheduleBuilder, RateSchedule } from './contract-rate-schedule.builder';
 import { ContractTemplateResolver } from './contract-template.resolver';
+import { StampSettingsService } from '../modules/stamp-settings/stamp-settings.service';
 import { ContractTemplateMeta, getTemplateMeta } from './contract-template.registry';
 
 export interface ContractSignatureView {
@@ -16,6 +17,11 @@ export interface ContractSignatureView {
   signerDisplayName: string;
   signedAt: string;
   signatureImageUrl?: string | null;
+  /**
+   * Round company seal shown beside the signature. Populated for the EDR
+   * (STAFF) side only, from the single global stamp — see attachProviderStamp.
+   */
+  stampImageUrl?: string | null;
 }
 
 /**
@@ -114,6 +120,7 @@ export class ContractViewModelBuilder {
     private readonly templateResolver: ContractTemplateResolver,
     private readonly pricingBuilder: ContractPricingScheduleBuilder,
     private readonly rateScheduleBuilder: ContractRateScheduleBuilder,
+    private readonly stampSettings: StampSettingsService,
   ) {}
 
   async build(bookingId: string): Promise<{ booking: Booking; view: ContractViewModel }> {
@@ -194,7 +201,30 @@ export class ContractViewModelBuilder {
 
   private async loadSignatures(bookingId: string): Promise<ContractSignatureView[]> {
     const rows = await this.bookingsRepository.findContractSignatures(bookingId);
-    return rows.map((s) => this.toSignatureView(s));
+    const views = rows.map((s) => this.toSignatureView(s));
+    await this.attachProviderStamp(views);
+    return views;
+  }
+
+  /**
+   * Stamp the EDR side of the contract with the ONE global company stamp
+   * (StampSettingsService) — staff never upload or pick a stamp, so nothing is
+   * stored per signature and the seal is read live at render time. The client
+   * side is left alone: a customer's own stamp is their business.
+   *
+   * Read live and deliberately not snapshotted, so replacing the company stamp
+   * re-seals contracts on their next render. `getStampImageUrl()` never throws
+   * and returns a data URL, which `signatures_block.hbs` renders as-is and the
+   * signature inliner skips.
+   */
+  async attachProviderStamp(signatures: ContractSignatureView[]): Promise<void> {
+    const staff = signatures.filter((s) => s.role === 'STAFF');
+    if (staff.length === 0) return;
+
+    const stampImageUrl = await this.stampSettings.getStampImageUrl();
+    for (const sig of staff) {
+      sig.stampImageUrl = stampImageUrl;
+    }
   }
 
   toSignatureView(row: BookingContractSignature): ContractSignatureView {
diff --git a/apps/edr-freight-api/src/logger.middleware.ts b/apps/edr-freight-api/src/logger.middleware.ts
deleted file mode 100644
index dd7532ec8..000000000
--- a/apps/edr-freight-api/src/logger.middleware.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-import { Injectable, NestMiddleware, Logger } from "@nestjs/common";
-import { Request, Response, NextFunction } from "express";
-
-@Injectable()
-export class LoggerMiddleware implements NestMiddleware {
-  private readonly logger = new Logger("HTTP");
-
-  use(req: Request, res: Response, next: NextFunction) {
-    const start = Date.now();
-
-    res.on("finish", () => {
-      const duration = Date.now() - start;
-
-      this.logger.log(
-        `${req.method} ${req.originalUrl} ${res.statusCode} ${duration}ms`,
-      );
-    });
-
-    next();
-  }
-}
diff --git a/apps/edr-freight-api/src/main.ts b/apps/edr-freight-api/src/main.ts
index f26cd19e7..98fed950e 100644
--- a/apps/edr-freight-api/src/main.ts
+++ b/apps/edr-freight-api/src/main.ts
@@ -10,15 +10,17 @@ import {
   ResponseTransformInterceptor,
   createValidationPipe,
 } from "@edr/api-common";
-import { getAuditLoggerConfig } from "@tria-plc/auditlog";
 
 import { AppModule } from "./app.module";
 
 /**
- * JSON body ceiling. Signing posts the signature AND the company stamp as
- * base64 in one JSON body, and base64 inflates bytes by ~4/3 — a 50MB asset is
- * ~67MB on the wire. Express defaults to 100kb, which rejected any real stamp
- * image with a 413 "request entity too large".
+ * JSON body ceiling. Customer signing posts the signature AND the customer's
+ * own company stamp as base64 in one JSON body, and base64 inflates bytes by
+ * ~4/3 — a 50MB asset is ~67MB on the wire. Express defaults to 100kb, which
+ * rejected any real stamp image with a 413 "request entity too large".
+ * (Staff signing posts only a signature: EDR's seal is the one global stamp,
+ * read server-side. Uploading that stamp under Settings goes through this same
+ * ceiling, so the headroom is still needed on both counts.)
  *
  * Sized to clear the 50MB per-document ceiling
  * (`DOCUMENT_UPLOAD_MAX_BYTES`) after base64 inflation, with room for the
@@ -167,11 +169,6 @@ export async function createFreightApp(): Promise<NestExpressApplication> {
   app.useGlobalFilters(new HttpExceptionFilter());
   app.useGlobalInterceptors(new ResponseTransformInterceptor());
 
-  // Audit listener: consumes the RMQ events MezgebModule's client interceptor
-  // (app.module.ts) emits and persists them via the AuditLogController /
-  // AuditLogCommandController @EventPattern handlers. Same queue config the
-  // client side uses, reused from the package so the two never drift apart.
-  app.connectMicroservice(getAuditLoggerConfig());
   await app.startAllMicroservices();
 
   const config = new DocumentBuilder()
diff --git a/apps/edr-freight-api/src/migrations/3390000000000-CreateAuditLogs.ts b/apps/edr-freight-api/src/migrations/3390000000000-CreateAuditLogs.ts
new file mode 100644
index 000000000..b5b865ad7
--- /dev/null
+++ b/apps/edr-freight-api/src/migrations/3390000000000-CreateAuditLogs.ts
@@ -0,0 +1,81 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/**
+ * Backoffice audit trail for every state-changing freight endpoint.
+ *
+ * No `updated_at` / `deleted_at` columns, unlike every other table here: audit
+ * rows are insert-only evidence. A soft-delete column would let an actor erase
+ * their own trail and TypeORM would then hide those rows from default queries
+ * silently — see the entity comment.
+ *
+ * `user_id` intentionally carries NO foreign key to the `iam` schema.
+ * Cross-schema FKs are forbidden platform-wide, and one here would let user
+ * deletion cascade away the record of what that user did.
+ *
+ * DDL is idempotent (`IF NOT EXISTS`) because watch-mode API instances race
+ * `migrationsRun` against each other on the shared dev database.
+ */
+export class CreateAuditLogs3390000000000 implements MigrationInterface {
+  name = "CreateAuditLogs3390000000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      CREATE TABLE IF NOT EXISTS freight.audit_logs (
+        id            uuid         NOT NULL DEFAULT gen_random_uuid(),
+        title         varchar(255) NOT NULL,
+        method        varchar(10)  NOT NULL,
+        url           text         NOT NULL,
+        route_path    varchar(255),
+        type          varchar(50)  NOT NULL,
+        is_success    boolean      NOT NULL,
+        user_id       uuid,
+        resource_id   varchar(64),
+        request       jsonb,
+        status_code   smallint,
+        error_message text,
+        user_name     varchar(150),
+        user_role     varchar(100),
+        ip_address    inet,
+        user_agent    text,
+        request_id    varchar(64),
+        duration_ms   integer,
+        created_at    timestamptz  NOT NULL DEFAULT now(),
+        CONSTRAINT "PK_audit_logs" PRIMARY KEY (id)
+      )
+    `);
+
+    // Every audit query is time-bounded, so created_at leads each index.
+    // DESC matches the "newest first" read path the controller exposes.
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS "IDX_audit_logs_created_at"
+        ON freight.audit_logs (created_at DESC)
+    `);
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS "IDX_audit_logs_user_id_created_at"
+        ON freight.audit_logs (user_id, created_at DESC)
+    `);
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS "IDX_audit_logs_type_created_at"
+        ON freight.audit_logs (type, created_at DESC)
+    `);
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS "IDX_audit_logs_type_resource_id"
+        ON freight.audit_logs (type, resource_id)
+    `);
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS "IDX_audit_logs_route_path_created_at"
+        ON freight.audit_logs (route_path, created_at DESC)
+    `);
+    // Failures are a small slice of the table but carry the security signal
+    // (403s especially), so they get their own partial index.
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS "IDX_audit_logs_failures"
+        ON freight.audit_logs (created_at DESC)
+        WHERE is_success = false
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`DROP TABLE IF EXISTS freight.audit_logs`);
+  }
+}
diff --git a/apps/edr-freight-api/src/migrations/3390000000000-RemoveGeneralManager.ts b/apps/edr-freight-api/src/migrations/3390000000000-RemoveGeneralManager.ts
new file mode 100644
index 000000000..055c3771b
--- /dev/null
+++ b/apps/edr-freight-api/src/migrations/3390000000000-RemoveGeneralManager.ts
@@ -0,0 +1,210 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/**
+ * Onboarding revamp: one company, one verified identity.
+ *
+ * The general manager is removed outright — it named who to talk to and gated
+ * nothing — and the company's people become its **owner** (whoever the eTrade
+ * licence names as the business's manager) and its **Power of Attorney**.
+ * Exactly one of them is identity-verified, chosen by the company's own answer
+ * to "does anyone hold power of attorney for you?", stored as
+ * `attributes.poaDeclared`.
+ *
+ * The order below matters — each step depends on data a later step destroys:
+ *
+ * 1. Rescue notification addresses. `companyNotifyEmailExpr` used to fall
+ *    through to `attributes->>'generalManagerEmail'`, and `companies.email` was
+ *    only ever written for a Fayda-verified owner — so every foreign company
+ *    had none and was reached solely through that fallback. Promote it to the
+ *    column before the key is stripped, or those companies stop receiving mail
+ *    in silence.
+ * 2. Backfill the owner. `ownerName`/`ownerEmail`/`ownerPhone` are now required
+ *    onboarding fields; without this every already-onboarded company would
+ *    report three missing fields the moment it opened its settings page.
+ * 3. Resolve `poaSameAsOwner`. That flag waived the DARS delegation paper. It
+ *    is gone, so the companies holding it must be re-expressed:
+ *      - NOT a freight forwarder → "no PoA" (the owner represents themselves,
+ *        nothing to delegate). Their PoA details are cleared.
+ *      - A freight forwarder → "yes" and details KEPT. A forwarder signs on
+ *        other companies' behalf, so a representative is non-negotiable and the
+ *        waiver no longer exists. These companies will be asked for a
+ *        delegation paper they were previously excused — an intentional,
+ *        visible consequence, not an oversight. Count them before deploying.
+ * 4. Derive the declaration for everyone else, from whether PoA details exist.
+ * 5. Move drafts off the deleted "personnel" wizard step.
+ * 6. Only now drop the columns and strip the retired attribute keys.
+ *
+ * Irreversible by design: `down()` restores the columns' shape but cannot
+ * recover the values, and re-deriving `poaSameAsOwner` from `poaDeclared` would
+ * be a guess.
+ */
+export class RemoveGeneralManager3390000000000 implements MigrationInterface {
+  name = "RemoveGeneralManager3390000000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    // 1. Rescue the notification address before the key it lives under is gone.
+    await queryRunner.query(`
+      UPDATE freight.companies
+      SET email = COALESCE(
+        NULLIF(email, ''),
+        NULLIF(attributes->>'ownerEmail', ''),
+        NULLIF(attributes->>'generalManagerEmail', ''),
+        NULLIF(attributes->>'contactPersonEmail', '')
+      )
+      WHERE COALESCE(email, '') = ''
+    `);
+
+    // 2. Backfill the owner from the best source each company actually has:
+    // its Fayda-verified owner claims (already under owner*), then the general
+    // manager it named, then its contact person. A company with none of these
+    // never finished onboarding, and will be asked on its next visit.
+    await queryRunner.query(`
+      UPDATE freight.companies
+      SET attributes = attributes
+        || jsonb_strip_nulls(jsonb_build_object(
+             'ownerName', COALESCE(
+               NULLIF(attributes->>'ownerName', ''),
+               NULLIF(attributes->>'generalManagerName', ''),
+               NULLIF(attributes->>'contactPersonName', '')
+             ),
+             'ownerEmail', COALESCE(
+               NULLIF(attributes->>'ownerEmail', ''),
+               NULLIF(attributes->>'generalManagerEmail', ''),
+               NULLIF(attributes->>'contactPersonEmail', ''),
+               NULLIF(email, '')
+             ),
+             'ownerPhone', COALESCE(
+               NULLIF(attributes->>'ownerPhone', ''),
+               NULLIF(attributes->>'generalManagerPhone', ''),
+               NULLIF(attributes->>'contactPersonPhone', ''),
+               NULLIF(phone, '')
+             )
+           ))
+      WHERE attributes IS NOT NULL
+    `);
+
+    // 2b. Capture eTrade's manager for the owner-vs-licence check the
+    // backoffice now makes. Nothing stored it before, so the best we have is
+    // the owner name itself — which makes existing companies read as "matches"
+    // rather than as a false mismatch on data nobody ever compared. The value
+    // is refreshed for real on the company's next eTrade lookup.
+    await queryRunner.query(`
+      UPDATE freight.companies
+      SET attributes = jsonb_set(
+            attributes, '{etradeManagerName}', to_jsonb(attributes->>'ownerName')
+          )
+      WHERE COALESCE(attributes->>'ownerName', '') <> ''
+        AND attributes->>'etradeManagerName' IS NULL
+        AND COALESCE(licence_number, '') <> ''
+    `);
+
+    // 3a. Owner-represents-themselves, and NOT a forwarder → "no PoA".
+    await queryRunner.query(`
+      UPDATE freight.companies c
+      SET attributes = (c.attributes - 'poaName' - 'poaPhone' - 'poaEmail'
+                        - 'poaLocation' - 'poaAddress' - 'poaFaydaSub'
+                        - 'poaFaydaVerifiedAt' - 'poaBirthdate' - 'poaGender')
+                       || jsonb_build_object('poaDeclared', 'no')
+      WHERE (c.attributes->>'poaSameAsOwner')::boolean IS TRUE
+        AND NOT EXISTS (
+          SELECT 1 FROM freight.company_profiles cp
+          WHERE cp.company_id = c.id
+            AND cp.type = 'freight_forwarder'
+            AND cp.deleted_at IS NULL
+        )
+    `);
+
+    // 3b. Forwarders keep their representative and lose the waiver.
+    await queryRunner.query(`
+      UPDATE freight.companies c
+      SET attributes = c.attributes || jsonb_build_object('poaDeclared', 'yes')
+      WHERE (c.attributes->>'poaSameAsOwner')::boolean IS TRUE
+        AND EXISTS (
+          SELECT 1 FROM freight.company_profiles cp
+          WHERE cp.company_id = c.id
+            AND cp.type = 'freight_forwarder'
+            AND cp.deleted_at IS NULL
+        )
+    `);
+
+    // 4. Everyone else: "yes" if a representative was named or the company is a
+    // forwarder, "no" if it finished onboarding without one. A company still
+    // mid-onboarding is left unanswered — it will be asked, which is the point.
+    await queryRunner.query(`
+      UPDATE freight.companies c
+      SET attributes = COALESCE(c.attributes, '{}'::jsonb)
+                       || jsonb_build_object('poaDeclared', 'yes')
+      WHERE c.attributes->>'poaDeclared' IS NULL
+        AND (
+          COALESCE(c.attributes->>'poaName', '') <> ''
+          OR COALESCE(c.attributes->>'poaPhone', '') <> ''
+          OR COALESCE(c.attributes->>'poaEmail', '') <> ''
+          OR COALESCE(c.attributes->>'poaLocation', '') <> ''
+          OR COALESCE(c.attributes->>'poaAddress', '') <> ''
+          OR EXISTS (
+            SELECT 1 FROM freight.company_profiles cp
+            WHERE cp.company_id = c.id
+              AND cp.type = 'freight_forwarder'
+              AND cp.deleted_at IS NULL
+          )
+        )
+    `);
+    await queryRunner.query(`
+      UPDATE freight.companies c
+      SET attributes = COALESCE(c.attributes, '{}'::jsonb)
+                       || jsonb_build_object('poaDeclared', 'no')
+      WHERE c.attributes->>'poaDeclared' IS NULL
+        AND EXISTS (
+          SELECT 1 FROM freight.external_profiles ep
+          WHERE ep.company_id = c.id
+            AND ep.onboarding_completed = true
+            AND ep.deleted_at IS NULL
+        )
+    `);
+
+    // 5. The "personnel" (general manager) wizard step no longer exists; a
+    // draft resting on it would fall back to the very first step and make the
+    // customer walk the whole wizard again.
+    await queryRunner.query(`
+      UPDATE freight.external_profiles
+      SET onboarding_step = 'owner'
+      WHERE onboarding_step = 'personnel'
+    `);
+
+    // 6. Retire the general manager and the flag it shared the model with.
+    await queryRunner.query(`
+      UPDATE freight.companies
+      SET attributes = attributes - 'generalManagerName' - 'generalManagerEmail'
+                       - 'generalManagerPhone' - 'gmSameAsOwner' - 'gmFaydaSub'
+                       - 'gmFaydaVerifiedAt' - 'gmName' - 'gmEmail' - 'gmPhone'
+                       - 'gmAddress' - 'gmBirthdate' - 'gmGender'
+                       - 'poaSameAsOwner'
+      WHERE attributes IS NOT NULL
+    `);
+    await queryRunner.query(`
+      ALTER TABLE freight.companies
+        DROP COLUMN IF EXISTS general_manager_name,
+        DROP COLUMN IF EXISTS general_manager_email,
+        DROP COLUMN IF EXISTS general_manager_phone
+    `);
+  }
+
+  /**
+   * Restores the columns' shape only. The values, the `gm*` attributes and the
+   * `poaSameAsOwner` flag are not recoverable — this migration folded them into
+   * `ownerEmail` / `poaDeclared`, and there is no way back that isn't a guess.
+   */
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      ALTER TABLE freight.companies
+        ADD COLUMN IF NOT EXISTS general_manager_name varchar(100),
+        ADD COLUMN IF NOT EXISTS general_manager_email varchar(150),
+        ADD COLUMN IF NOT EXISTS general_manager_phone varchar(20)
+    `);
+    await queryRunner.query(`
+      UPDATE freight.external_profiles
+      SET onboarding_step = 'personnel'
+      WHERE onboarding_step = 'owner'
+    `);
+  }
+}
diff --git a/apps/edr-freight-api/src/migrations/3400000000000-StampSettings.ts b/apps/edr-freight-api/src/migrations/3400000000000-StampSettings.ts
new file mode 100644
index 000000000..9556318f9
--- /dev/null
+++ b/apps/edr-freight-api/src/migrations/3400000000000-StampSettings.ts
@@ -0,0 +1,28 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/**
+ * Single-row table holding the one company stamp/seal image stamped onto
+ * generated invoice/receipt PDFs (see StampSettingsService /
+ * InvoiceDocumentService). Same single-row shape as exchange_settings; the
+ * app never inserts more than one row.
+ */
+export class StampSettings3400000000000 implements MigrationInterface {
+  name = "StampSettings3400000000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      CREATE TABLE IF NOT EXISTS freight.stamp_settings (
+        id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+        stamp_file_id uuid REFERENCES freight.files(id),
+        updated_by_id uuid,
+        created_at timestamptz NOT NULL DEFAULT now(),
+        updated_at timestamptz NOT NULL DEFAULT now(),
+        deleted_at timestamptz
+      );
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`DROP TABLE IF EXISTS freight.stamp_settings;`);
+  }
+}
diff --git a/apps/edr-freight-api/src/migrations/3400000000000-TransferRequestPreferredWagons.ts b/apps/edr-freight-api/src/migrations/3400000000000-TransferRequestPreferredWagons.ts
new file mode 100644
index 000000000..b86327147
--- /dev/null
+++ b/apps/edr-freight-api/src/migrations/3400000000000-TransferRequestPreferredWagons.ts
@@ -0,0 +1,29 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+/**
+ * Wagons the requester specifically asked for. A transfer request stays
+ * count-driven (`quantity` is what must be delivered), but a requester who
+ * picked wagons off the yard desk now records WHICH ones — OCC sees the numbers
+ * on the queue and the fulfil picker pre-selects them.
+ *
+ * Stored as a uuid[] column rather than a join table: the list is read and
+ * written whole, never queried by wagon, and a preference carries no lifecycle
+ * of its own (no FK — a purged wagon simply drops out of the display).
+ */
+export class TransferRequestPreferredWagons3400000000000
+  implements MigrationInterface
+{
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      ALTER TABLE freight.wagon_transfer_requests
+        ADD COLUMN IF NOT EXISTS preferred_wagon_ids uuid[]
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      ALTER TABLE freight.wagon_transfer_requests
+        DROP COLUMN IF EXISTS preferred_wagon_ids
+    `);
+  }
+}
diff --git a/apps/edr-freight-api/src/migrations/3410000000000-ScheduleVoyageNumber.ts b/apps/edr-freight-api/src/migrations/3410000000000-ScheduleVoyageNumber.ts
new file mode 100644
index 000000000..dd62276d8
--- /dev/null
+++ b/apps/edr-freight-api/src/migrations/3410000000000-ScheduleVoyageNumber.ts
@@ -0,0 +1,28 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+/**
+ * Voyage number for one departure.
+ *
+ * `train_number` already exists on a schedule (the run number), but operations
+ * also quote a VOYAGE number — the sailing/run identifier yards and customs use
+ * for a specific departure. It belongs on the schedule, not the built train: one
+ * train serves many departures and each carries its own voyage.
+ *
+ * Nullable and un-indexed: it is display/reference data typed by staff, not a
+ * lookup key, and older schedules simply have none.
+ */
+export class ScheduleVoyageNumber3410000000000 implements MigrationInterface {
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      ALTER TABLE freight.train_schedules
+        ADD COLUMN IF NOT EXISTS voyage_number varchar(20)
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      ALTER TABLE freight.train_schedules
+        DROP COLUMN IF EXISTS voyage_number
+    `);
+  }
+}
diff --git a/apps/edr-freight-api/src/modules/audit/audit-actor.ts b/apps/edr-freight-api/src/modules/audit/audit-actor.ts
new file mode 100644
index 000000000..f89a7ee26
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/audit/audit-actor.ts
@@ -0,0 +1,84 @@
+/**
+ * Who acted, and does this API audit them?
+ *
+ * The staff/customer split reuses the exact discriminator the permission guards
+ * already apply (`freight-permission.guard.ts`): `userType === 'employee'` is
+ * backoffice, `individual` / `external_organization` are customers. Restating
+ * the rule instead of importing it would let the two drift apart silently.
+ */
+
+const EMPLOYEE_USER_TYPE = 'employee';
+const SUPER_ADMIN_ROLE = 'super_admin';
+
+/** The subset of the JWT payload this module reads. */
+export interface AuditActorSource {
+  id?: string;
+  sub?: string;
+  userType?: string;
+  username?: string;
+  name?: string | { en?: string; am?: string };
+  firstName?: string;
+  lastName?: string;
+  email?: string;
+  roles?: { key?: string; name?: string }[];
+  employee?: unknown;
+}
+
+export interface AuditActor {
+  userId: string | null;
+  userName: string | null;
+  userRole: string | null;
+}
+
+function isSuperAdmin(user: AuditActorSource): boolean {
+  return Boolean(user.roles?.some((role) => role.key === SUPER_ADMIN_ROLE));
+}
+
+/**
+ * Is this caller a backoffice user whose actions are audited?
+ *
+ * Only employees qualify. Customers are excluded by request, and unauthenticated
+ * callers are excluded too — which means failed logins, OTP sends and password
+ * resets produce no audit rows. That was a deliberate call: those endpoints are
+ * not backoffice actions. Note the trade-off, since failed-auth attempts are
+ * often what an incident review looks for first.
+ */
+export function isAuditableActor(user: AuditActorSource | null | undefined): boolean {
+  if (!user) return false;
+  // Super admins may not carry an `employee` userType on every token, but are
+  // unambiguously staff — the permission guards treat them the same way.
+  return user.userType === EMPLOYEE_USER_TYPE || isSuperAdmin(user);
+}
+
+/** Best-effort display name, tolerating the several shapes tokens use. */
+function resolveUserName(user: AuditActorSource): string | null {
+  if (typeof user.name === 'string' && user.name.trim()) return user.name.trim();
+
+  if (user.name && typeof user.name === 'object') {
+    const localized = user.name.en ?? user.name.am;
+    if (localized?.trim()) return localized.trim();
+  }
+
+  const composed = [user.firstName, user.lastName].filter(Boolean).join(' ').trim();
+  if (composed) return composed;
+
+  return user.username?.trim() || user.email?.trim() || null;
+}
+
+/**
+ * Snapshot the actor at the moment of the action.
+ *
+ * Name and role are copied, never referenced: resolving them from IAM at read
+ * time would rewrite history whenever someone is renamed, changes role or is
+ * deleted. An audit row from last year must still say who acted and with what
+ * authority *then*.
+ */
+export function resolveAuditActor(user: AuditActorSource): AuditActor {
+  const roleKey = user.roles?.[0]?.key ?? user.roles?.[0]?.name ?? null;
+
+  return {
+    userId: user.id ?? user.sub ?? null,
+    userName: resolveUserName(user),
+    userRole: roleKey,
+  };
+}
diff --git a/apps/edr-freight-api/src/modules/audit/audit-endpoint-matcher.ts b/apps/edr-freight-api/src/modules/audit/audit-endpoint-matcher.ts
new file mode 100644
index 000000000..75ae51fa6
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/audit/audit-endpoint-matcher.ts
@@ -0,0 +1,140 @@
+import { AUDIT_ENDPOINTS, type AuditEndpointMeta } from './audit-endpoints';
+
+/** What a matched request resolved to. */
+export interface MatchedAuditEndpoint {
+  /** Human-readable action, e.g. "Approve contract". */
+  title: string;
+  /** Primary entity, e.g. "Contract". */
+  type: string;
+  /** The route template, e.g. `/api/contracts/:id/cancel`. */
+  routePath: string;
+  /** First path parameter of the template, when the route has one. */
+  resourceId: string | null;
+}
+
+interface CompiledRoute {
+  regex: RegExp;
+  /** Param names in capture-group order, e.g. ['id', 'stepId']. */
+  paramNames: string[];
+  routePath: string;
+  meta: AuditEndpointMeta;
+  /** Literal (non-parameter) segment count — used to rank specificity. */
+  staticSegments: number;
+}
+
+const ESCAPE_REGEX = /[.*+?^${}()|[\]\\]/g;
+
+/**
+ * Two keys in AUDIT_ENDPOINTS point at the same path: one route is declared by
+ * two different controllers, so the generator suffixed the second with
+ * ` [modules/...controller.ts]` to keep both entries. Only the path itself is
+ * matchable, so the suffix is stripped here.
+ */
+function stripSourceSuffix(key: string): string {
+  const bracket = key.indexOf(' [');
+  return bracket === -1 ? key : key.slice(0, bracket);
+}
+
+/**
+ * Compile one `"/api/contracts/:id/cancel"` template into an anchored regex.
+ *
+ * A parameter matches a single path segment only (`[^/]+`), so
+ * `/api/contracts/:id` cannot swallow `/api/contracts/:id/cancel`.
+ */
+function compileTemplate(path: string): { regex: RegExp; paramNames: string[] } {
+  const paramNames: string[] = [];
+  const pattern = path
+    .split('/')
+    .map((segment) => {
+      if (!segment.startsWith(':')) {
+        return segment.replace(ESCAPE_REGEX, '\\$&');
+      }
+      paramNames.push(segment.slice(1));
+      return '([^/]+)';
+    })
+    .join('/');
+
+  return { regex: new RegExp(`^${pattern}$`), paramNames };
+}
+
+/**
+ * Method-bucketed lookup table for the audited routes.
+ *
+ * A direct `AUDIT_ENDPOINTS[url]` lookup cannot work: the keys are templates
+ * with `:params` while a live request carries real ids and a query string, so
+ * every parameterized route — most of the 488 — would miss. Templates are
+ * compiled to regexes once at module load and matched per request.
+ *
+ * Within a method, routes are ordered by literal-segment count descending, so
+ * a specific route always wins over a parameterized one that could also match
+ * (`/api/routes/:id/permanent` before `/api/routes/:id`).
+ */
+class AuditEndpointMatcher {
+  private readonly byMethod = new Map<string, CompiledRoute[]>();
+
+  constructor() {
+    for (const [key, meta] of Object.entries(AUDIT_ENDPOINTS)) {
+      const [method, rawPath] = stripSourceSuffix(key).split(' ');
+      if (!method || !rawPath) continue;
+
+      const { regex, paramNames } = compileTemplate(rawPath);
+      const bucket = this.byMethod.get(method) ?? [];
+      bucket.push({
+        regex,
+        paramNames,
+        routePath: rawPath,
+        meta,
+        staticSegments: rawPath
+          .split('/')
+          .filter((s) => s && !s.startsWith(':')).length,
+      });
+      this.byMethod.set(method, bucket);
+    }
+
+    for (const bucket of this.byMethod.values()) {
+      bucket.sort((a, b) => b.staticSegments - a.staticSegments);
+    }
+  }
+
+  /**
+   * Resolve a live request to its audit metadata, or null when the route is
+   * not audited (every GET, and anything absent from AUDIT_ENDPOINTS).
+   *
+   * `url` may include a query string; it is ignored for matching.
+   */
+  match(method: string, url: string): MatchedAuditEndpoint | null {
+    const bucket = this.byMethod.get(method.toUpperCase());
+    if (!bucket) return null;
+
+    const path = stripQuery(url);
+
+    for (const route of bucket) {
+      const result = route.regex.exec(path);
+      if (!result) continue;
+
+      const [title, , type] = route.meta;
+      return {
+        title,
+        type,
+        routePath: route.routePath,
+        // The first path parameter is the affected record in this API's
+        // conventions (`/api/contracts/:id/...`). Routes with no parameter
+        // (a create) legitimately have no resource id yet.
+        resourceId: route.paramNames.length > 0 ? result[1] : null,
+      };
+    }
+
+    return null;
+  }
+}
+
+/** Strip query string and hash from a URL, leaving the path. */
+export function stripQuery(url: string): string {
+  const queryIndex = url.indexOf('?');
+  const path = queryIndex === -1 ? url : url.slice(0, queryIndex);
+  const hashIndex = path.indexOf('#');
+  return hashIndex === -1 ? path : path.slice(0, hashIndex);
+}
+
+/** Compiled once at module load and shared by the interceptor. */
+export const auditEndpointMatcher = new AuditEndpointMatcher();
diff --git a/apps/edr-freight-api/src/modules/audit/audit-endpoints.ts b/apps/edr-freight-api/src/modules/audit/audit-endpoints.ts
new file mode 100644
index 000000000..0526636ff
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/audit/audit-endpoints.ts
@@ -0,0 +1,641 @@
+/**
+ * Freight API — every state-changing endpoint (POST / PUT / PATCH / DELETE).
+ *
+ * Shape:  "<METHOD> <path>": [title, method, entity]
+ *
+ * Keyed by method + path rather than path alone: 50 paths serve more than one
+ * method (PATCH and DELETE on /api/contracts/:id, for example), so a path-only
+ * key would collide and drop those endpoints.
+ *
+ * Paths include the global prefix `api` (see app.setGlobalPrefix in src/main.ts).
+ * Titles come from each route's @ApiOperation summary, falling back to a
+ * humanized handler name where a route has none.
+ *
+ * Excludes the AI Assist and Account entities.
+ * Generated from the controllers under src/ — 488 endpoints.
+ */
+/** [title, method, entity] for one auditable route. */
+export type AuditEndpointMeta = readonly [title: string, method: string, entity: string];
+
+export const AUDIT_ENDPOINTS: Readonly<Record<string, AuditEndpointMeta>> = {
+  // Approval Rule
+  "POST /api/approval-rules": ["Create an approval rule step", "POST", "Approval Rule"],
+  "PATCH /api/approval-rules/:id": ["Update an approval rule", "PATCH", "Approval Rule"],
+  "DELETE /api/approval-rules/:id": ["Soft-delete an approval rule", "DELETE", "Approval Rule"],
+  "POST /api/approval-rules/:id/move-order": ["Move an approval step up or down within its chain", "POST", "Approval Rule"],
+  "POST /api/approval-rules/reorder": ["Bulk reorder approval steps within a chain", "POST", "Approval Rule"],
+
+  // Booking
+  "POST /api/bookings": ["Create a new freight booking (DRAFT)", "POST", "Booking"],
+  "POST /api/bookings/:bookingId/allocate-containers": ["Allocate containers to vehicles", "POST", "Booking"],
+  "PATCH /api/bookings/:id": ["Update booking", "PATCH", "Booking"],
+  "DELETE /api/bookings/:id": ["Soft-delete DRAFT booking", "DELETE", "Booking"],
+  "POST /api/bookings/:id/cancel": ["Cancel booking", "POST", "Booking"],
+  "POST /api/bookings/:id/cancel-hold": ["Customer cancels an unpaid hold (SELECTED_FOR_BATCH → CANCELLED);", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/declaration": ["GL ET uploads customs declaration on booking (GENERAL customs)", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/delivery-order": ["Upload Booking Delivery Order", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/documents": ["Customer uploads clearance documents (fieldname = document key)", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/draft-declaration": ["GL ET sends a draft customs declaration (multi-file) with an estimated price for the customer to review", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/draft-declaration/accept": ["Customer accepts the draft customs declaration — unlocks the real customs declaration step for GL Ethiopia", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/draft-declaration/change": ["Customer requests a change to the draft customs declaration with a reason — GL Ethiopia sends a corrected draft (repeatable)", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/duty": ["GL ET sets duty/tax on booking with notice attachment", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/duty-slip": ["Customer uploads duty/tax payment slip on booking", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/export-release": ["Confirm Booking Export Release", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/finalize": ["GL finalizes clearance (requires 100% approved) → CLEARANCE_READY", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/finalize-pre-clearance": ["GL ET finalizes import pre-clearance on booking", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/output-documents": ["GL uploads customs output documents (IM4/EX3/…)", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/proceed": ["Customer requests operation with a schedule day", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/release-order": ["Upload Booking Release Order", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/review": ["GL reviews a clearance document (Approve | Query)", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/ro-amendment": ["Request Booking RO Amendment", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/transit-assignee/assign": ["GL Djibouti picks the transit officer from the roster — unblocks the customs declaration; calling again reassigns", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/transit-assignee/request": ["GL ET asks GL Djibouti to name the transit officer — required before the import customs declaration", "POST", "Booking"],
+  "POST /api/bookings/:id/clearance/transit-permit": ["Upload Booking Transit Permit", "POST", "Booking"],
+  "POST /api/bookings/:id/confirm-submit": ["Confirm submit after price change", "POST", "Booking"],
+  "POST /api/bookings/:id/consolidation": ["Request freight consolidation", "POST", "Booking"],
+  "DELETE /api/bookings/:id/consolidation": ["Remove consolidation pairing", "DELETE", "Booking"],
+  "POST /api/bookings/:id/contract/generate": ["Generate contract PDF from template", "POST", "Booking"],
+  "POST /api/bookings/:id/contract/sign": ["Apply digital signature (customer or staff)", "POST", "Booking"],
+  "POST /api/bookings/:id/customer-cancel": ["Customer cancels their own booking before payment — no cancellation fee", "POST", "Booking"],
+  "POST /api/bookings/:id/customer-truck-assignment": ["Customer assigns external truck and driver for terminal pickup", "POST", "Booking"],
+  "POST /api/bookings/:id/customer-trucks": ["Add a customer self-haul truck carrying 1–2 of the booking containers", "POST", "Booking"],
+  "PATCH /api/bookings/:id/customer-trucks/:assignmentId": ["Edit a not-yet-arrived customer truck (plate/driver/type + containers)", "PATCH", "Booking"],
+  "DELETE /api/bookings/:id/customer-trucks/:assignmentId": ["Remove a not-yet-arrived customer truck from a booking", "DELETE", "Booking"],
+  "POST /api/bookings/:id/customer-trucks/:assignmentId/depart": ["Register an import truck leaving: containers loaded + weighed gross (staff)", "POST", "Booking"],
+  "POST /api/bookings/:id/customer-trucks/:assignmentId/load": ["Truck_dispatch: load selected containers onto a truck (staff)", "POST", "Booking"],
+  "POST /api/bookings/:id/customer-trucks/bulk": ["Bulk add customer trucks from array payload (Excel parsed)", "POST", "Booking"],
+  "POST /api/bookings/:id/customer/sign": ["Customer digital signature (deprecated — use POST contract/sign)", "POST", "Booking"],
+  "POST /api/bookings/:id/documents": ["Upload documents for a booking (DRAFT only)", "POST", "Booking"],
+  "PATCH /api/bookings/:id/export-handover-mode": ["Export only: choose direct truck-to-train (no warehouse, no GRN) or warehouse first", "PATCH", "Booking"],
+  "POST /api/bookings/:id/generate-grn": ["Generate a GRN over the received containers (all received, or a subset) — one GRN per batch", "POST", "Booking"],
+  "POST /api/bookings/:id/generate-price": ["Generate price preview (DRAFT or CHANGES_REQUESTED)", "POST", "Booking"],
+  "POST /api/bookings/:id/government-expedite": ["Expedite government booking to PAID / ELIGIBLE for scheduling", "POST", "Booking"],
+  "POST /api/bookings/:id/marketing/approve": ["Staff contract signature and fully execute (use contract/sign STAFF preferred)", "POST", "Booking"],
+  "POST /api/bookings/:id/operation/review": ["Operations reviews an operation request: ACCEPT (→ batch pool),", "POST", "Booking"],
+  "POST /api/bookings/:id/operations/complete": ["Mark completed", "POST", "Booking"],
+  "POST /api/bookings/:id/operations/start-transit": ["Mark in transit", "POST", "Booking"],
+  "POST /api/bookings/:id/reject": ["Customer reject price estimate", "POST", "Booking"],
+  "POST /api/bookings/:id/staff/accept": ["Staff accept intake → set contract validity window + start approval chain", "POST", "Booking"],
+  "POST /api/bookings/:id/staff/reject": ["Staff final reject", "POST", "Booking"],
+  "POST /api/bookings/:id/staff/request-changes": ["Staff return booking for customer updates", "POST", "Booking"],
+  "POST /api/bookings/:id/submit": ["Customer submit booking", "POST", "Booking"],
+  "POST /api/bookings/:id/wagon-cancellations": ["Request a partial wagon cancellation on a PAID booking — opens the cancellation-fee invoice; wagons are released only once the fee settles", "POST", "Booking"],
+  "POST /api/bookings/:id/wagon-cancellations/preview": ["Preview the fee/credit of a partial wagon cancellation (no writes)", "POST", "Booking"],
+  "POST /api/bookings/wagon-cancellations/:cancellationId/rebook": ["Rebook a wagon-cancellation credit: pick a shipment day only — the new booking is created under the contract and marked PAID (freight already paid; contract must still be valid)", "POST", "Booking"],
+  "POST /api/bookings/wagon-cancellations/:cancellationId/withdraw": ["Withdraw a fee-pending wagon cancellation (owner, or staff with the void permission)", "POST", "Booking"],
+
+  // Cargo
+  "POST /api/cargoes": ["Create a new cargo", "POST", "Cargo"],
+  "PATCH /api/cargoes/:id": ["Update a cargo", "PATCH", "Cargo"],
+  "DELETE /api/cargoes/:id": ["Delete a cargo", "DELETE", "Cargo"],
+  "POST /api/cargoes/:id/deliver": ["Mark cargo as delivered", "POST", "Cargo"],
+  "POST /api/cargoes/:id/load": ["Load cargo into a container", "POST", "Cargo"],
+  "POST /api/cargoes/:id/unload": ["Unload cargo from container", "POST", "Cargo"],
+
+  // Cargo Type
+  "POST /api/cargo-types": ["Create a cargo type", "POST", "Cargo Type"],
+  "PATCH /api/cargo-types/:id": ["Update a cargo type", "PATCH", "Cargo Type"],
+  "DELETE /api/cargo-types/:id": ["Soft-delete a cargo type", "DELETE", "Cargo Type"],
+  "POST /api/cargo-types/:id/move-order": ["Move a cargo type up or down in display order", "POST", "Cargo Type"],
+  "POST /api/cargo-types/reorder": ["Bulk reorder cargo types by ID list", "POST", "Cargo Type"],
+
+  // Company
+  "POST /api/companies": ["Create a new company (customer, freight_forwarder, dj_freight_forwarder, transporter)", "POST", "Company"],
+  "POST /api/companies/:companyId/documents": ["Upload documents for a company (onboarding)", "POST", "Company"],
+  "POST /api/companies/:companyId/profiles": ["Add a profile (employee) to a company", "POST", "Company"],
+  "PATCH /api/companies/:id": ["Update a company", "PATCH", "Company"],
+  "DELETE /api/companies/:id": ["Soft-delete a company", "DELETE", "Company"],
+  "POST /api/companies/change-requests/:id/approve": ["Approve a pending profile change request (applies the changes)", "POST", "Company"],
+  "POST /api/companies/change-requests/:id/reject": ["Reject a pending profile change request with a note", "POST", "Company"],
+  "POST /api/companies/change-requests/:id/request-changes": ["Ask for specific changes on a pending request without rejecting it (row stays open, next edit appends to it)", "POST", "Company"],
+  "POST /api/companies/company-profile": ["Create a single operational profile for the current user's company. The role starts pending and does not become the active mode", "POST", "Company"],
+  "POST /api/companies/company-profiles": ["Add operational profile(s) (importer/exporter/forwarder) to the current user's company", "POST", "Company"],
+  "POST /api/companies/company-profiles/:profileId/license": ["Add business-license document(s) to a profile. For an approved company", "POST", "Company"],
+  "DELETE /api/companies/company-profiles/:profileId/license/:fileId": ["Remove a business-license file (staged for review on an approved company)", "DELETE", "Company"],
+  "POST /api/companies/company-profiles/:profileId/license/:fileId/replace": ["Replace a business-license file with a newly uploaded one (staged for", "POST", "Company"],
+  "POST /api/companies/company-profiles/:profileId/reapply": ["Resubmit a rejected operational role for approval (→ pending)", "POST", "Company"],
+  "PATCH /api/companies/company-profiles/:profileId/status": ["Update a company profile's approval status", "PATCH", "Company"],
+  "POST /api/companies/create": ["Create a company with its associated external profile (onboarding)", "POST", "Company"],
+  "POST /api/companies/documents/:fileId/request-change": ["Ask the customer to correct one uploaded document", "POST", "Company"],
+  "POST /api/companies/fetch-etrade-info": ["Fetch company info from eTrade by TIN", "POST", "Company"],
+  "POST /api/companies/identity/fayda/complete": ["Bind a completed Fayda verification to the company's owner or Power of Attorney", "POST", "Company"],
+  "DELETE /api/companies/identity/fayda/poa": ["Remove the company's Power of Attorney — the verified identity, its details and the delegation paper together", "DELETE", "Company"],
+  "DELETE /api/companies/identity/gm": ["Clear the General Manager's identity — the \\\"same as owner\\\" declaration or a verification, and the details either wrote", "DELETE", "Company"],
+  "POST /api/companies/identity/gm/same-as-owner": ["Declare the General Manager is the company's owner, copying the owner's verified identity across", "POST", "Company"],
+  "POST /api/companies/identity/poa/same-as-owner": ["Declare the Power of Attorney is the company's owner, copying the owner's identity across", "POST", "Company"],
+  "DELETE /api/companies/identity/poa/same-as-owner": ["Undo the Power of Attorney \\\"same as owner\\\" declaration and the identity it copied, leaving the representative open to be verified in their own right", "DELETE", "Company"],
+  "PATCH /api/companies/onboarding-step": ["Persist the user's current onboarding wizard step", "PATCH", "Company"],
+  "POST /api/companies/onboarding/complete": ["Mark the current user's onboarding as complete", "POST", "Company"],
+  "POST /api/companies/onboarding/start": ["Begin onboarding: create a draft company + profile + role(s) so later steps can save incrementally", "POST", "Company"],
+  "POST /api/companies/poa-delegation": ["Upload the Power of Attorney delegation letter, replacing any existing one", "POST", "Company"],
+  "DELETE /api/companies/poa-delegation/:fileId": ["Remove the Power of Attorney delegation letter (staged for review on an approved company)", "DELETE", "Company"],
+  "PATCH /api/companies/profile": ["Update profile (flattened settings page)", "PATCH", "Company"],
+
+  // Compliance
+  "POST /api/compliance": ["Create a compliance record", "POST", "Compliance"],
+  "PATCH /api/compliance/:id": ["Update a compliance record", "PATCH", "Compliance"],
+  "DELETE /api/compliance/:id": ["Soft-delete a compliance record", "DELETE", "Compliance"],
+
+  // Consignment
+  "POST /api/consignments": ["Create a new consignment", "POST", "Consignment"],
+
+  // Container
+  "POST /api/containers": ["Create a new container", "POST", "Container"],
+  "PATCH /api/containers/:id": ["Update a container", "PATCH", "Container"],
+  "DELETE /api/containers/:id": ["Delete a container", "DELETE", "Container"],
+  "POST /api/containers/:id/assign-wagon": ["Assign container to a wagon", "POST", "Container"],
+  "POST /api/containers/:id/unassign-wagon": ["Unassign container from wagon", "POST", "Container"],
+
+  // Container Type
+  "POST /api/container-types": ["Create a container type", "POST", "Container Type"],
+  "PATCH /api/container-types/:id": ["Update a container type", "PATCH", "Container Type"],
+  "DELETE /api/container-types/:id": ["Soft-delete a container type", "DELETE", "Container Type"],
+  "POST /api/container-types/:id/move-order": ["Move a container type up or down in display order", "POST", "Container Type"],
+  "POST /api/container-types/reorder": ["Bulk reorder container types by ID list", "POST", "Container Type"],
+
+  // Contract
+  "POST /api/contracts": ["Create a new contract (DRAFT) with routes + cargo scope", "POST", "Contract"],
+  "PATCH /api/contracts/:id": ["Update contract", "PATCH", "Contract"],
+  "DELETE /api/contracts/:id": ["Soft-delete DRAFT contract", "DELETE", "Contract"],
+  "POST /api/contracts/:id/approval-steps/:stepId/approve": ["Approve one approval step in sequence", "POST", "Contract"],
+  "POST /api/contracts/:id/approval-steps/:stepId/reject": ["Reject one approval step — to the customer (terminal → REJECTED) or, via returnToStepId, back to an earlier approver (chain re-runs from there)", "POST", "Contract"],
+  "POST /api/contracts/:id/booking-requests": ["Customer submits a shipment request on a GENERAL customs contract", "POST", "Contract"],
+  "POST /api/contracts/:id/bookings": ["Create a shipment booking under a contract — Path A (customer) or Path B (GL Ethiopia)", "POST", "Contract"],
+  "POST /api/contracts/:id/bookings/:bookingId/complete": ["Complete an initiated booking after Operations finalized its clearance — cargo + binding day, window and departure checks, pricing and invoicing", "POST", "Contract"],
+  "POST /api/contracts/:id/bookings/initiate": ["Initiate a bare booking instance under an import/export contract (ONE_TIME or GENERAL) — no cargo, no date; enters per-booking clearance (AWAITING_DOCUMENTS). ONE_TIME customs instances are opened by the customer (or GL); GENERAL customs comes from a shipment request", "POST", "Contract"],
+  "POST /api/contracts/:id/cancel": ["Customer cancels their own contract (blocked while a booking is live)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/declaration": ["GL ET uploads customs declaration documents (multi-file)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/delivery-order": ["GL DJ uploads Delivery Order (import) with vessel arrival + DO collected dates", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/documents": ["Customer uploads clearance documents (fieldname = document key)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/documents/:fileKey/replace": ["GL replaces a clearance document in place (reason required) — the previous version is kept in the file history and the new one needs approving", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/duty": ["GL ET sets duty/tax requirement and advises amount with notice attachment", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/duty-slip": ["Customer uploads duty/tax payment slip on contract", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/duty/dispute": ["Customer disputes the advised duty/tax with a reason — reopens the step so GL Ethiopia can re-advise (repeatable)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/export-release": ["GL ET confirms export release after declaration", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/finalize": ["GL ET finalizes clearance → CLEARANCE_READY_FOR_BOOKING (legacy)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/finalize-export-clearance": ["GL ET finalizes export clearance after post-booking transit permit upload", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/finalize-pre-clearance": ["GL ET finalizes import pre-clearance — unlocks Djibouti DO upload", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/ops-finalize": ["Operations finalizes self-clearance → customer may create the booking", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/ops-review": ["Operations reviews a customer self-clearance document (Approve | Query)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/output-documents": ["GL uploads customs output documents (IM4/EX3/…) pre-booking", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/release-order": ["GL DJ uploads Release Order + vessel departure date (export)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/review": ["GL ET reviews a clearance document (Approve | Query)", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/ro-amendment": ["GL DJ requests port amendment when RO vessel window is too short", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/transit-assignee/assign": ["GL Djibouti picks the transit officer from the roster — unblocks the customs declaration; calling again reassigns", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/transit-assignee/request": ["GL ET asks GL Djibouti to name the transit officer — required before the customs declaration", "POST", "Contract"],
+  "POST /api/contracts/:id/clearance/transit-permit": ["GL ET uploads import transit permit documents (multi-file)", "POST", "Contract"],
+  "POST /api/contracts/:id/confirm-submit": ["Confirm submit after a price change", "POST", "Contract"],
+  "POST /api/contracts/:id/contract/generate": ["Generate contract document → CONTRACT_READY", "POST", "Contract"],
+  "POST /api/contracts/:id/contract/send-signing-otp": ["Send the sudo-mode signing OTP to the contract company's registered phone (server picks the number)", "POST", "Contract"],
+  "POST /api/contracts/:id/contract/sign": ["Apply digital signature (customer or staff/director/ceo)", "POST", "Contract"],
+  "PUT /api/contracts/:id/document/articles": ["Edit this contract\\'s document articles only (per-contract; never touches the six shared templates)", "PUT", "Contract"],
+  "POST /api/contracts/:id/documents": ["Upload intake documents for a contract (DRAFT only)", "POST", "Contract"],
+  "POST /api/contracts/:id/generate-price": ["Generate unit-rate breakdown (no totals at contract phase)", "POST", "Contract"],
+  "POST /api/contracts/:id/milestones/:code/complete": ["GL marks a pre-booking (contract) milestone complete", "POST", "Contract"],
+  "POST /api/contracts/:id/renew": ["Create a renewal draft linked via renewalOfId", "POST", "Contract"],
+  "POST /api/contracts/:id/resume": ["Staff lift a suspension — contract returns to its prior status", "POST", "Contract"],
+  "POST /api/contracts/:id/staff/accept": ["Staff accept → set validity window + start approval chain", "POST", "Contract"],
+  "POST /api/contracts/:id/staff/reject": ["Staff reject contract", "POST", "Contract"],
+  "POST /api/contracts/:id/staff/request-changes": ["Staff return contract for customer updates", "POST", "Contract"],
+  "POST /api/contracts/:id/submit": ["Customer submit contract (freezes contract_rate_snapshots)", "POST", "Contract"],
+  "POST /api/contracts/:id/suspend": ["Staff freeze a signed contract (reversible, any post-signature step)", "POST", "Contract"],
+  "POST /api/contracts/:id/validate-shipment": ["Pre-create validation + authoritative price preview: full booking price breakdown (rail, first/last mile, surcharges), overweight lines and 20ft weight-pairing errors for a shipment payload (no booking created)", "POST", "Contract"],
+  "POST /api/contracts/booking-requests/:reqId/accept": ["GL marks a shipment request accepted + links the created booking", "POST", "Contract"],
+  "POST /api/contracts/booking-requests/:reqId/cancel": ["Customer cancels their own pending shipment request", "POST", "Contract"],
+  "POST /api/contracts/booking-requests/:reqId/reject": ["GL rejects a shipment request", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/documents": ["GL uploads post-booking operational documents (DO/RO/T1/…)", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/duty": ["GL ET advises duty & tax amount + declaration serial", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/duty-slip": ["Customer uploads the duty/tax payment slip", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/final-invoice": ["GL DJ raises the post-offload final invoice (amount + invoice document)", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/final-invoice-slip": ["Customer attaches the payment slip for the final invoice", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/final-invoice/approve": ["Customer approves the drafted final invoice — unlocks the payment slip", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/final-invoice/confirm": ["GL (ET or DJ) confirms the payment slip — settles the final invoice", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/incidents": ["GL DJ logs a cargo exception with photo evidence", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/milestones/:code/complete": ["GL / Ops / Terminal marks a post-booking milestone complete", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/risk": ["GL ET assigns a customs risk level (GREEN/YELLOW/RED)", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/second-duty": ["GL ET advises (or skips) the post-arrival additional duty/tax round (import)", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/second-duty-slip": ["Customer attaches the additional duty/tax payment slip", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/station-assign": ["GL station manager routes the shipment + binds staff", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/t1-close": ["Close (accept) the T1 set — GL ET after arrival (import) / GL DJ after gate pass (export)", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/t1-documents": ["GL Djibouti uploads T1 transit documents (multi-file) after wagon allocation; locked once the train departs", "POST", "Contract"],
+  "POST /api/contracts/bookings/:bookingId/transport-document": ["GL ET uploads export transit permit documents (multi-file)", "POST", "Contract"],
+  "POST /api/gl-exchange/:entityId": ["Share a document with the other GL desk", "POST", "Contract"],
+  "PATCH /api/gl-exchange/documents/:documentId": ["Uploader edits a shared document (title, visibility, file)", "PATCH", "Contract"],
+  "DELETE /api/gl-exchange/documents/:documentId": ["Uploader removes a shared document", "DELETE", "Contract"],
+
+  // Contract Template
+  "POST /api/contract-templates": ["Create a bulk contract template for a (cargo type, customs option) pair", "POST", "Contract Template"],
+  "PATCH /api/contract-templates/:code": ["Update template metadata (name, title, recitals, active flag)", "PATCH", "Contract Template"],
+  "DELETE /api/contract-templates/:code": ["Delete a staff-created bulk template (system templates refuse)", "DELETE", "Contract Template"],
+  "POST /api/contract-templates/:code/articles": ["Add an article to the template", "POST", "Contract Template"],
+  "PUT /api/contract-templates/:code/articles": ["Replace the full ordered article list (used for reorder)", "PUT", "Contract Template"],
+  "PATCH /api/contract-templates/:code/articles/:articleId": ["Update an article's title or body", "PATCH", "Contract Template"],
+  "DELETE /api/contract-templates/:code/articles/:articleId": ["Remove an article from the template", "DELETE", "Contract Template"],
+  "POST /api/contract-templates/:code/preview": ["Render an HTML preview of the template against mock contract data", "POST", "Contract Template"],
+
+  // Driver
+  "POST /api/drivers": ["Create a new driver", "POST", "Driver"],
+  "PATCH /api/drivers/:id": ["Update a driver", "PATCH", "Driver"],
+  "DELETE /api/drivers/:id": ["Delete a driver", "DELETE", "Driver"],
+  "POST /api/drivers/:id/documents": ["Upload driver documents (code driver_docs)", "POST", "Driver"],
+  "DELETE /api/drivers/:id/documents/:fileId": ["Delete a driver document", "DELETE", "Driver"],
+
+  // Dropdown Setting
+  "POST /api/dropdown-settings": ["Create a new dropdown setting", "POST", "Dropdown Setting"],
+  "PATCH /api/dropdown-settings/:id": ["Update a dropdown setting's metadata", "PATCH", "Dropdown Setting"],
+  "DELETE /api/dropdown-settings/:id": ["Soft-delete a dropdown setting", "DELETE", "Dropdown Setting"],
+  "POST /api/dropdown-settings/:id/options": ["Append a single option to a setting", "POST", "Dropdown Setting"],
+  "PUT /api/dropdown-settings/:id/options": ["Replace the full option list for a setting", "PUT", "Dropdown Setting"],
+  "PATCH /api/dropdown-settings/options/:optionId": ["Update a single option", "PATCH", "Dropdown Setting"],
+  "DELETE /api/dropdown-settings/options/:optionId": ["Soft-delete a single option", "DELETE", "Dropdown Setting"],
+
+  // EIMS Invoice
+  "POST /api/invoices/:id/eims/register": ["Register the invoice with MoR EIMS. Idempotent — an invoice that already has an IRN is returned unchanged", "POST", "EIMS Invoice"],
+  "POST /api/invoices/:id/eims/resolve": ["Resolve an unacknowledged submission: record the IRN confirmed with MoR, or discard it. Clears the system-wide block", "POST", "EIMS Invoice"],
+  "POST /api/invoices/:id/eims/verify": ["Verify the invoice's stored IRN against EIMS", "POST", "EIMS Invoice"],
+
+  // Exchange Setting
+  "PATCH /api/exchange-settings": ["Set the USD→ETB fallback by hand (used only while CBE is unreachable)", "PATCH", "Exchange Setting"],
+
+  // Facility
+  "POST /api/facilities": ["Create a new facility", "POST", "Facility"],
+  "PATCH /api/facilities/:id": ["Update a facility", "PATCH", "Facility"],
+  "DELETE /api/facilities/:id": ["Delete a facility (soft delete)", "DELETE", "Facility"],
+
+  // Fayda Verification
+  "POST /api/fayda/verification/start": ["Start a VeriFayda 2.0 verification session", "POST", "Fayda Verification"],
+
+  // File Upload Setting
+  "POST /api/file-upload-settings": ["Create a new file upload setting", "POST", "File Upload Setting"],
+  "PATCH /api/file-upload-settings/:id": ["Update a file upload setting's metadata", "PATCH", "File Upload Setting"],
+  "DELETE /api/file-upload-settings/:id": ["Soft-delete a file upload setting", "DELETE", "File Upload Setting"],
+  "POST /api/file-upload-settings/:id/fields": ["Append a single field to a setting", "POST", "File Upload Setting"],
+  "PUT /api/file-upload-settings/:id/fields": ["Replace the full field list for a setting", "PUT", "File Upload Setting"],
+  "PATCH /api/file-upload-settings/fields/:fieldId": ["Update a single field", "PATCH", "File Upload Setting"],
+  "DELETE /api/file-upload-settings/fields/:fieldId": ["Soft-delete a single field", "DELETE", "File Upload Setting"],
+
+  // First Mile
+  "POST /api/first-mile": ["Create a first-mile leg", "POST", "First Mile"],
+  "PATCH /api/first-mile/:id": ["Update a first-mile leg", "PATCH", "First Mile"],
+  "DELETE /api/first-mile/:id": ["Soft-delete a first-mile leg", "DELETE", "First Mile"],
+  "POST /api/first-mile/:id/distances": ["Set per-vehicle actual distances (does not generate an invoice)", "POST", "First Mile"],
+  "POST /api/first-mile/:id/invoice": ["Generate the first-mile delivery-fee invoice", "POST", "First Mile"],
+  "POST /api/first-mile/:id/vehicles": ["Set the vehicles assigned to a first-mile pickup (multi-truck)", "POST", "First Mile"],
+  "POST /api/first-mile/accept/:reference": ["Accept a paid booking and create a first-mile leg", "POST", "First Mile"],
+
+  // Fuel
+  "POST /api/fuel/purchases": ["Record fuel purchase", "POST", "Fuel"],
+
+  // GPS Tracking
+  "POST /api/gps/devices": ["Register a GPS tracker", "POST", "GPS Tracking"],
+  "PATCH /api/gps/devices/:id": ["Update a GPS tracker (name / assigned vehicle)", "PATCH", "GPS Tracking"],
+  "DELETE /api/gps/devices/:id": ["Delete a GPS tracker", "DELETE", "GPS Tracking"],
+
+  // Import Operation
+  "POST /api/import-operations/customs/:bookingId/declaration": ["Batch 12: record declaration serial number", "POST", "Import Operation"],
+  "POST /api/import-operations/customs/:bookingId/documents": ["Batch 12: upload IM4/IM5/T1/permit/payment-slip documents", "POST", "Import Operation"],
+  "POST /api/import-operations/customs/:bookingId/duties-taxes-paid": ["Batch 12: mark duties and taxes paid", "POST", "Import Operation"],
+  "POST /api/import-operations/customs/:bookingId/notify-duties-taxes": ["Batch 12: notify duties and taxes", "POST", "Import Operation"],
+  "POST /api/import-operations/customs/:bookingId/release-permitted": ["Batch 12: mark import release permitted", "POST", "Import Operation"],
+  "POST /api/import-operations/customs/:bookingId/risk": ["Batch 12: assign customs risk", "POST", "Import Operation"],
+  "POST /api/import-operations/djibouti-incidents": ["Batch 8: report a Djibouti import incident / exception", "POST", "Import Operation"],
+  "POST /api/import-operations/empty-container-returns": ["Batch 16: create an empty container return record", "POST", "Import Operation"],
+  "POST /api/import-operations/empty-container-returns/:id/status": ["Batch 16: advance empty container return workflow", "POST", "Import Operation"],
+
+  // Incident
+  "POST /api/incidents": ["Report an incident", "POST", "Incident"],
+  "PATCH /api/incidents/:id": ["Update an incident", "PATCH", "Incident"],
+  "DELETE /api/incidents/:id": ["Delete an incident", "DELETE", "Incident"],
+
+  // Interchange Document
+  "PATCH /api/interchange-documents/:id/acknowledge": ["Acknowledge an interchange document", "PATCH", "Interchange Document"],
+  "PATCH /api/interchange-documents/:id/dispute": ["Dispute an interchange document", "PATCH", "Interchange Document"],
+  "POST /api/interchange-documents/generate-from-schedule": ["Generate interchange document from a train schedule handover", "POST", "Interchange Document"],
+
+  // Last Mile
+  "POST /api/last-mile": ["Create a last-mile leg", "POST", "Last Mile"],
+  "PATCH /api/last-mile/:id": ["Update a last-mile leg", "PATCH", "Last Mile"],
+  "DELETE /api/last-mile/:id": ["Soft-delete a last-mile leg", "DELETE", "Last Mile"],
+  "POST /api/last-mile/:id/detention-times": ["Set each truck\\'s own detention window (arrived at destination / returned)", "POST", "Last Mile"],
+  "POST /api/last-mile/:id/distances": ["Set per-vehicle actual distances (does not generate an invoice)", "POST", "Last Mile"],
+  "POST /api/last-mile/:id/invoice": ["Generate the delivery-fee invoice for a last-mile leg", "POST", "Last Mile"],
+  "POST /api/last-mile/:id/proof-of-delivery": ["Record proof of delivery (signature + photos) and complete the leg", "POST", "Last Mile"],
+  "POST /api/last-mile/:id/vehicles": ["Set the vehicles assigned to a last-mile delivery (multi-truck)", "POST", "Last Mile"],
+  "POST /api/last-mile/:id/warehouse-gate-times": ["Set each truck\\'s warehouse gate arrival/departure times", "POST", "Last Mile"],
+  "POST /api/last-mile/accept/:reference": ["Accept a paid booking and create a last-mile leg", "POST", "Last Mile"],
+
+  // Last Mile Request
+  "POST /api/last-mile-requests/:id/approve": ["Truck & Machinery chief approves the request — the advance defaults to the live last-mile rate; LM contract becomes signable and the advance invoice follows the customer signature", "POST", "Last Mile Request"],
+  "POST /api/last-mile-requests/:id/contract/sign": ["Customer agrees and signs the LM contract — then the advance invoice is issued", "POST", "Last Mile Request"],
+  "POST /api/last-mile-requests/:id/reject": ["Truck & Machinery chief rejects the request with a reason", "POST", "Last Mile Request"],
+  "POST /api/last-mile-requests/:id/submit": ["Customer confirms which containers go via EDR last-mile", "POST", "Last Mile Request"],
+
+  // Locomotive
+  "POST /api/locomotives": ["Create a locomotive", "POST", "Locomotive"],
+  "PATCH /api/locomotives/:id": ["Update a locomotive", "PATCH", "Locomotive"],
+  "POST /api/locomotives/:id/decommission": ["Decommission a locomotive", "POST", "Locomotive"],
+  "DELETE /api/locomotives/:id/permanent": ["Permanently delete a locomotive (irreversible; refused if any train references it)", "DELETE", "Locomotive"],
+
+  // Maintenance
+  "POST /api/maintenance/costs": ["Record maintenance cost", "POST", "Maintenance"],
+  "POST /api/maintenance/intervals": ["Define/adjust a service interval (e.g. oil change every 10,000 km)", "POST", "Maintenance"],
+  "DELETE /api/maintenance/intervals/:id": ["Deactivate a service interval (stops auto-scheduling)", "DELETE", "Maintenance"],
+  "POST /api/maintenance/parts": ["Create part", "POST", "Maintenance"],
+  "PATCH /api/maintenance/parts/:id": ["Update part", "PATCH", "Maintenance"],
+  "DELETE /api/maintenance/parts/:id": ["Delete part", "DELETE", "Maintenance"],
+  "POST /api/maintenance/schedules": ["Schedule maintenance", "POST", "Maintenance"],
+  "PATCH /api/maintenance/schedules/:id": ["Update maintenance schedule", "PATCH", "Maintenance"],
+  "POST /api/maintenance/warranties": ["Create warranty", "POST", "Maintenance"],
+  "DELETE /api/maintenance/warranties/:id": ["Delete warranty", "DELETE", "Maintenance"],
+  "POST /api/maintenance/work-orders": ["Create work order", "POST", "Maintenance"],
+  "PATCH /api/maintenance/work-orders/:id": ["Update work order", "PATCH", "Maintenance"],
+  "DELETE /api/maintenance/work-orders/:id": ["Delete work order", "DELETE", "Maintenance"],
+
+  // Notification Inbox
+  "PATCH /api/notifications/:id/read": ["Mark one of my notifications as read", "PATCH", "Notification Inbox"],
+  "POST /api/notifications/read-all": ["Mark all my notifications as read", "POST", "Notification Inbox"],
+
+  // Organization User
+  "PUT /api/backoffice/organizations/:orgId/employee-users/:userId/roles": ["Replace org-scoped roles assigned to an employee user", "PUT", "Organization User"],
+  "POST /api/backoffice/organizations/:orgId/users": ["Create an organization user without assigning positions", "POST", "Organization User"],
+
+  // OTP
+  "POST /api/otp/send": ["Send OTP", "POST", "OTP"],
+  "POST /api/otp/verify": ["Verify OTP", "POST", "OTP"],
+
+  // Password Reset
+  "POST /api/auth/forgot-password/request": ["Send a password-reset code to the account's email AND phone", "POST", "Password Reset"],
+  "POST /api/auth/forgot-password/resolve-link": ["Validate a staff-issued reset link and return its set-password ticket", "POST", "Password Reset"],
+  "POST /api/auth/forgot-password/verify": ["Exchange a valid reset code for a single-use set-password ticket", "POST", "Password Reset"],
+  "POST /api/backoffice/customers/:companyId/reset-password": ["Send a password-reset link to a customer's primary contact", "POST", "Password Reset"],
+
+  // Payment
+  "POST /api/billing/invoices/:id/confirm-offline": ["Finance confirms a USD invoice paid by bank transfer — slip file required, settles the full balance", "POST", "Payment"],
+  "POST /api/billing/my-invoices/:id/confirm": ["Confirm an OTP-debit payment (CAC Bank) for one of the customer's invoices", "POST", "Payment"],
+  "POST /api/billing/my-invoices/:id/pay": ["Initiate payment for one of the customer's invoices", "POST", "Payment"],
+  "POST /api/internal/payments/bill-query": ["Live still-payable check + payer name for a CBE bill (called while CBE is on the line)", "POST", "Payment"],
+  "POST /api/internal/payments/mark-paid": ["Apply a payment.succeeded / payment.failed event from the payment service (idempotent)", "POST", "Payment"],
+  "POST /api/payments/initiate": ["Initiate payment for an invoice", "POST", "Payment"],
+  "POST /api/payments/redirect-success/:bookingId": ["Success-redirect ack: mark payment processing + invoice PAYMENT_PROCESSING (webhook remains source of truth)", "POST", "Payment"],
+
+  // Priority Config
+  "POST /api/priority-configs": ["Create a priority config", "POST", "Priority Config"],
+  "PATCH /api/priority-configs/:id": ["Update a priority config", "PATCH", "Priority Config"],
+  "DELETE /api/priority-configs/:id": ["Soft-delete a priority config", "DELETE", "Priority Config"],
+  "POST /api/priority-configs/:id/move-order": ["Move a priority config up or down in display order", "POST", "Priority Config"],
+  "POST /api/priority-configs/reorder": ["Bulk reorder priority configs by ID list", "POST", "Priority Config"],
+
+  // Priority Rule Change Request
+  "POST /api/priority-rule-change-requests": ["Submit a priority-rule change for approval", "POST", "Priority Rule Change Request"],
+  "POST /api/priority-rule-change-requests/:id/approve": ["Approve and apply a pending change", "POST", "Priority Rule Change Request"],
+  "POST /api/priority-rule-change-requests/:id/reject": ["Reject a pending change", "POST", "Priority Rule Change Request"],
+
+  // Procurement
+  "POST /api/procurement/acquisitions": ["Create an asset acquisition", "POST", "Procurement"],
+  "PATCH /api/procurement/acquisitions/:id": ["Update an asset acquisition", "PATCH", "Procurement"],
+  "DELETE /api/procurement/acquisitions/:id": ["Delete an asset acquisition", "DELETE", "Procurement"],
+  "POST /api/procurement/disposals": ["Create an asset disposal", "POST", "Procurement"],
+  "DELETE /api/procurement/disposals/:id": ["Delete an asset disposal", "DELETE", "Procurement"],
+  "POST /api/procurement/vendors": ["Create a vendor", "POST", "Procurement"],
+  "PATCH /api/procurement/vendors/:id": ["Update a vendor", "PATCH", "Procurement"],
+  "DELETE /api/procurement/vendors/:id": ["Delete a vendor", "DELETE", "Procurement"],
+
+  // Rate
+  "POST /api/rates": ["Create a rate (DRAFT)", "POST", "Rate"],
+  "PATCH /api/rates/:id": ["Update a DRAFT rate", "PATCH", "Rate"],
+  "DELETE /api/rates/:id": ["Soft-delete a rate", "DELETE", "Rate"],
+  "POST /api/rates/:id/approve": ["CEO approves a rate", "POST", "Rate"],
+  "POST /api/rates/:id/submit": ["Submit rate for CEO approval", "POST", "Rate"],
+
+  // Rate Change Request
+  "POST /api/rate-change-requests": ["Propose a change to a LIVE rate", "POST", "Rate Change Request"],
+  "POST /api/rate-change-requests/:id/approve": ["Approve a rate change and put it into effect", "POST", "Rate Change Request"],
+  "POST /api/rate-change-requests/:id/reject": ["Reject a rate change — the rate keeps its current value", "POST", "Rate Change Request"],
+
+  // Route
+  "POST /api/routes": ["Create route", "POST", "Route"],
+  "PATCH /api/routes/:id": ["Update route", "PATCH", "Route"],
+  "DELETE /api/routes/:id": ["Deactivate route", "DELETE", "Route"],
+  "DELETE /api/routes/:id/permanent": ["Permanently delete a route (irreversible; refused while any train schedule references it)", "DELETE", "Route"],
+
+  // Schedule
+  // NOTE: duplicate route — also declared in modules/scheduling-reschedule/scheduling-reschedule.controller.ts:52.
+  // Two controllers register this same path; Nest serves whichever module loads first.
+  "POST /api/train-scheduling/schedules/:id/maintenance": ["Reschedule train for maintenance (new departure + rebalance)", "POST", "Schedule"],
+  "POST /api/train-scheduling/schedules/:id/reschedule/execute": ["Execute a confirmed reschedule plan", "POST", "Schedule"],
+  "POST /api/train-scheduling/schedules/:id/reschedule/preview": ["Preview reschedule / government preempt plan", "POST", "Schedule"],
+
+  // Service Type
+  "POST /api/service-types": ["Create a service type", "POST", "Service Type"],
+  "PATCH /api/service-types/:id": ["Update a service type", "PATCH", "Service Type"],
+  "DELETE /api/service-types/:id": ["Soft-delete a service type", "DELETE", "Service Type"],
+  "POST /api/service-types/:id/move-order": ["Move a service type up or down in display order", "POST", "Service Type"],
+  "POST /api/service-types/reorder": ["Bulk reorder service types by ID list", "POST", "Service Type"],
+
+  // Shipping Line
+  "POST /api/shipping-lines": ["Create a shipping line", "POST", "Shipping Line"],
+  "PATCH /api/shipping-lines/:id": ["Update a shipping line", "PATCH", "Shipping Line"],
+  "DELETE /api/shipping-lines/:id": ["Soft-delete a shipping line", "DELETE", "Shipping Line"],
+
+  // Signature
+  "PUT /api/me/signature": ["Create or update the reusable saved signature", "PUT", "Signature"],
+
+  // Support Chat
+  "POST /api/support/agent/conversations": ["Start chatting with a company (returns the thread if one exists)", "POST", "Support Chat"],
+  "POST /api/support/agent/conversations/:id/messages": ["Reply as an agent, optionally with attachments", "POST", "Support Chat"],
+  "POST /api/support/agent/conversations/:id/read": ["Mark a thread read (agent side)", "POST", "Support Chat"],
+  "POST /api/support/conversation/messages": ["Send a message as the customer (optionally with attachments), opening the thread if needed", "POST", "Support Chat"],
+  "POST /api/support/conversation/read": ["Mark my company's thread read (customer side)", "POST", "Support Chat"],
+
+  // Support Content
+  "PATCH /api/support-content/documents/:slug": ["Replace a document's payload, recording a new version", "PATCH", "Support Content"],
+  "POST /api/support-content/documents/:slug/versions/:version/restore": ["Restore a version — re-saves it as a new version, never destructive", "POST", "Support Content"],
+  "POST /api/support-content/media": ["Upload an image or video for a help section", "POST", "Support Content"],
+
+  // Train
+  "POST /api/trains": ["Register a new train", "POST", "Train"],
+  "PATCH /api/trains/:id": ["Update a train", "PATCH", "Train"],
+  "DELETE /api/trains/:id": ["Delete a train", "DELETE", "Train"],
+
+  // Train Build
+  "POST /api/train-builder": ["Build a train: code + yard + 2+ locomotives (+ optional wagons)", "POST", "Train Build"],
+  "DELETE /api/train-builder/:id": ["Disband the train (release wagons and locomotives)", "DELETE", "Train Build"],
+  "POST /api/train-builder/:id/activate": ["Reactivate a deactivated train back to AVAILABLE", "POST", "Train Build"],
+  "POST /api/train-builder/:id/deactivate": ["Deactivate the train (park it) — only allowed with no active schedule", "POST", "Train Build"],
+  "PATCH /api/train-builder/:id/details": ["Edit the train's name and fixed import/export run numbers", "PATCH", "Train Build"],
+  "PUT /api/train-builder/:id/locomotives": ["Replace the locomotive set (minimum 1, same yard)", "PUT", "Train Build"],
+  "POST /api/train-builder/:id/reorder-wagons": ["Persist a drag-reorder of the full consist", "POST", "Train Build"],
+  "POST /api/train-builder/:id/wagons": ["Append AVAILABLE wagons from the train's yard to the consist", "POST", "Train Build"],
+  "DELETE /api/train-builder/:id/wagons/:wagonId": ["Detach one wagon from the consist", "DELETE", "Train Build"],
+  "POST /api/train-builder/:id/wagons/:wagonId/maintenance": ["Detach one wagon and move it to MAINTENANCE status", "POST", "Train Build"],
+  "PATCH /api/train-builder/:id/yard": ["Relocate the train — its locomotives and wagons move to the new yard with it", "PATCH", "Train Build"],
+
+  // Train Schedule
+  "POST /api/train-scheduling/bookings/:bookingId/allocate": ["Staff: place a paid booking onto a fitting train (notifies customer on date change)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bookings/:bookingId/expire": ["Staff: expire a reservation and free its capacity", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bookings/:bookingId/mark-paid": ["Staff: mark a reserved booking paid and allocate it now", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bookings/:bookingId/move-schedule": ["Re-point a booking to another OPEN same-route schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bulk/preview": ["Preview a bulk train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bulk/schedules": ["Create a bulk train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bulk/schedules/:id/assign-bookings": ["Assign bulk bookings to a train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/bulk/schedules/:id/cancel": ["Cancel bulk train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/container/preview": ["Preview a container train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/container/schedules": ["Create a container train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/container/schedules/:id/assign-bookings": ["Assign container bookings to a train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/container/schedules/:id/cancel": ["Cancel container train schedule", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/global-rules": ["Update global train scheduling rules (singleton)", "PATCH", "Train Schedule"],
+  "POST /api/train-scheduling/preview": ["Preview a mixed-capable train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/adjust-consist": ["Permanently trim free wagons off / couple yard wagons onto the schedule's built train (weight & length limits incl. tolerance enforced, every change logged)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/arrive": ["Mark a dispatched train arrived (move assets to destination yard, free assets)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/assign-bookings": ["Assign bookings to a train schedule (mixed-capable)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/assign-unassigned-booking": ["Assign one linked unallocated booking to wagons (preserves existing assignments)", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/schedules/:id/booking-window": ["Open or close a schedule booking window", "PATCH", "Train Schedule"],
+  "DELETE /api/train-scheduling/schedules/:id/bookings/:bookingId": ["Unassign a booking from a train schedule", "DELETE", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/bookings/:bookingId/load": ["Confirm a booking's cargo loaded at its origin yard (any direction; train must be at that yard)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/bookings/:bookingId/unload": ["Confirm a booking's cargo unloaded at its destination yard — per-booking arrival, may precede the train's final arrival", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/checkpoints": ["Log the train passing a station (final station triggers arrival)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/confirm-loading": ["Confirm cargo loaded on the train (any direction; unblocks import-Djibouti dispatch)", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/schedules/:id/container-items/:itemId": ["Update a container number on a wagon slot", "PATCH", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/dispatch": ["Dispatch a scheduled train", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/doc-review-complete": ["Staff finished document review early — run the batch/payment phase now (applies to the whole route-day group)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/finalize": ["Finalize a draft train schedule", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/import-djibouti/depart": ["Depart loaded import train from Djibouti", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/import-djibouti/documents": ["Upload/check an import Djibouti-side document", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/import-djibouti/gatepass-granted": ["Mark import Djibouti gatepass permission granted", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/import-djibouti/load-list": ["Generate import load list / marshalling document summary", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/import-djibouti/loaded-on-train": ["Confirm import cargo loaded on train at Djibouti", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/import-djibouti/ready-for-loading": ["Mark import train ready for loading at Djibouti", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/schedules/:id/import-loading-status": ["Mark import bookings loaded/unloaded on this schedule (tracking only, does not affect dispatch)", "PATCH", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/intercity/:bookingId/load": ["Confirm intercity cargo loaded (train must be at the booking's origin yard)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/intercity/:bookingId/unload": ["Confirm intercity cargo unloaded at the booking's destination yard (completes the booking)", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/intercity/accept": ["Accept intercity bookings onto this train (opens their pay window; capacity re-checked per booking)", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/schedules/:id/loading-status": ["Mark bookings loaded/unloaded on this schedule (any direction, pre-dispatch only)", "PATCH", "Train Schedule"],
+  // NOTE: duplicate route — also declared in modules/train-scheduling/controllers/train-scheduling.controller.ts:798.
+  // Two controllers register this same path; Nest serves whichever module loads first.
+  "POST /api/train-scheduling/schedules/:id/maintenance [modules/train-scheduling/controllers/train-scheduling.controller.ts]": ["Maintenance reschedule: move the train to a new departure with every allocated booking aboard — links, wagons and window settings unchanged", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/pin-wagons": ["Pin physical wagons to train set slots", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/run-allocation": ["Run wagon-level allocation for all eligible linked bookings", "POST", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/run-batch": ["Manually run the batch fill for a schedule", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/schedules/:id/schedule-date": ["Reschedule a train's departure date — only before the booking window opens, and only if the new date still leaves room for the booking lead window", "PATCH", "Train Schedule"],
+  "PATCH /api/train-scheduling/schedules/:id/train-number": ["Edit a departure's train number and voyage number — allowed only until the train is dispatched", "PATCH", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/switch-government-booking": ["Switch out commercial bookings to allocate a government booking in their place", "POST", "Train Schedule"],
+  "DELETE /api/train-scheduling/schedules/:id/wagons/:trainSetWagonId": ["Remove an empty wagon slot from a train", "DELETE", "Train Schedule"],
+  "POST /api/train-scheduling/schedules/:id/wagons/:wagonId/move-load": ["Move a wagon's whole load to another wagon (empty → move/repin, loaded → swap loads)", "POST", "Train Schedule"],
+  "PATCH /api/train-scheduling/schedules/:id/window-rule": ["Override the booking-window rule for one schedule (open/close hour, duration, doc-review, payment, lead days) — only before the window opens", "PATCH", "Train Schedule"],
+
+  // Transit Agent
+  "POST /api/transit-agents": ["Create a transit agent", "POST", "Transit Agent"],
+  "PATCH /api/transit-agents/:id": ["Update a transit agent", "PATCH", "Transit Agent"],
+  "DELETE /api/transit-agents/:id": ["Soft-delete a transit agent", "DELETE", "Transit Agent"],
+
+  // Truck Type
+  "POST /api/truck-types": ["Create a truck type", "POST", "Truck Type"],
+  "PATCH /api/truck-types/:id": ["Update a truck type", "PATCH", "Truck Type"],
+  "DELETE /api/truck-types/:id": ["Soft-delete a truck type", "DELETE", "Truck Type"],
+
+  // User Trade Access
+  "PUT /api/user-trade-access/:userId": ["Set the trade directions a backoffice user may see", "PUT", "User Trade Access"],
+
+  // Vehicle
+  "POST /api/vehicles": ["Create a new vehicle", "POST", "Vehicle"],
+  "PATCH /api/vehicles/:id": ["Update a vehicle", "PATCH", "Vehicle"],
+  "DELETE /api/vehicles/:id": ["Delete a vehicle", "DELETE", "Vehicle"],
+
+  // Wagon
+  "POST /api/wagons": ["Create a new wagon", "POST", "Wagon"],
+  "PATCH /api/wagons/:id": ["Update a wagon", "PATCH", "Wagon"],
+  "DELETE /api/wagons/:id": ["Delete a wagon", "DELETE", "Wagon"],
+  "POST /api/wagons/:id/assign-train": ["Assign wagon to a train", "POST", "Wagon"],
+  "DELETE /api/wagons/:id/permanent": ["Permanently delete a wagon (irreversible; refused if it has movements, containers or train-set slots)", "DELETE", "Wagon"],
+  "POST /api/wagons/:id/unassign-train": ["Unassign wagon from train", "POST", "Wagon"],
+  "POST /api/wagons/bulk-status": ["Set the status of multiple wagons (audited in wagon_status_logs)", "POST", "Wagon"],
+  "POST /api/wagons/bulk-transfer": ["Transfer multiple wagons to a destination yard", "POST", "Wagon"],
+
+  // Wagon Transfer Request
+  "POST /api/wagon-transfer-requests": ["File a count-only wagon-transfer request", "POST", "Wagon Transfer Request"],
+  "POST /api/wagon-transfer-requests/:id/cancel": ["Withdraw a request that has not moved any wagon yet (use close-short once wagons have moved)", "POST", "Wagon Transfer Request"],
+  "POST /api/wagon-transfer-requests/:id/close-short": ["OCC: end the request with fewer wagons than asked for — what moved stays, the requester is told the shortfall", "POST", "Wagon Transfer Request"],
+  "POST /api/wagon-transfer-requests/:id/fulfill": ["OCC: pick wagons and execute the transfer", "POST", "Wagon Transfer Request"],
+  "POST /api/wagon-transfer-requests/bulk-fulfill": ["OCC: accept-and-execute a subset of pending requests (auto-picks available wagons; the rest stay PENDING)", "POST", "Wagon Transfer Request"],
+
+  // Wagon Type
+  "POST /api/wagon-types": ["Create a wagon type", "POST", "Wagon Type"],
+  "PATCH /api/wagon-types/:id": ["Update a wagon type", "PATCH", "Wagon Type"],
+  "DELETE /api/wagon-types/:id": ["Soft-delete a wagon type", "DELETE", "Wagon Type"],
+
+  // Warehouse
+  "POST /api/warehouse-allocation-rules": ["Create a warehouse allocation rule", "POST", "Warehouse"],
+  "PATCH /api/warehouse-allocation-rules/:id": ["Update a warehouse allocation rule", "PATCH", "Warehouse"],
+  "DELETE /api/warehouse-allocation-rules/:id": ["Delete a warehouse allocation rule", "DELETE", "Warehouse"],
+  "POST /api/warehouse-allocation/preview": ["Preview the yard/warehouse/zone a booking would be allocated to", "POST", "Warehouse"],
+  "POST /api/warehouse-fee-rules": ["Create a storage / demurrage fee rule", "POST", "Warehouse"],
+  "PATCH /api/warehouse-fee-rules/:id": ["Update a fee rule", "PATCH", "Warehouse"],
+  "DELETE /api/warehouse-fee-rules/:id": ["Delete a fee rule", "DELETE", "Warehouse"],
+  "POST /api/warehouse-fees/accrual/:inventoryId/acknowledge": ["Acknowledge / snooze an item fee-accrual alert", "POST", "Warehouse"],
+  "DELETE /api/warehouse-fees/accrual/:inventoryId/acknowledge": ["Remove an accrual acknowledgement (re-surface for alerts)", "DELETE", "Warehouse"],
+  "POST /api/warehouses": ["Create warehouse", "POST", "Warehouse"],
+  "PATCH /api/warehouses/:id": ["Update warehouse", "PATCH", "Warehouse"],
+  "POST /api/warehouses/:warehouseId/yards": ["Create a yard within a warehouse", "POST", "Warehouse"],
+
+  // Warehouse Fee Invoice
+  "POST /api/last-mile/:id/generate-truck-detention-invoice": ["Generate a truck-detention invoice for a last-mile leg (per truck per day)", "POST", "Warehouse Fee Invoice"],
+  "PATCH /api/warehouse-fee-invoices/:id/cancel": ["Cancel a warehouse fee invoice", "PATCH", "Warehouse Fee Invoice"],
+  "POST /api/warehouse-fee-invoices/:id/pay": ["Record a payment against a warehouse fee invoice", "POST", "Warehouse Fee Invoice"],
+  "POST /api/warehouse-fee-invoices/:id/pay-online": ["Initiate Telebirr/Waafi payment for a warehouse fee invoice", "POST", "Warehouse Fee Invoice"],
+  "POST /api/warehouse-inventory/:id/generate-fee-invoice": ["Generate a warehouse fee invoice from Batch 5 fee calculation", "POST", "Warehouse Fee Invoice"],
+
+  // Warehouse Inspection Report
+  "PATCH /api/warehouse-inspection-reports/:id": ["Update an inspection report", "PATCH", "Warehouse Inspection Report"],
+  "POST /api/warehouse-inspection-reports/:id/attachments": ["Upload inspection images / documents", "POST", "Warehouse Inspection Report"],
+  "POST /api/warehouse-inventory/:inventoryId/inspection-reports": ["Create an inspection / damage report for an inventory item", "POST", "Warehouse Inspection Report"],
+
+  // Warehouse Inventory
+  "POST /api/warehouse-inventory/:id/deliver": ["Deliver import goods to the customer + capture proof of delivery", "POST", "Warehouse Inventory"],
+  "PATCH /api/warehouse-inventory/:id/dispatch": ["Mark loaded inventory DISPATCHED (left the terminal)", "PATCH", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/gate-clearance": ["Final terminal release / gate clearance (blocked while fees unpaid)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/load": ["Load READY_FOR_LOADING inventory onto a wagon", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/move": ["Move inventory to another warehouse/yard/zone", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/ready-for-loading": ["Mark reserved inventory READY_FOR_LOADING", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/ready-for-pickup": ["Mark inspected IMPORT inventory READY_FOR_PICKUP", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/release": ["Issue a DO / release order for ready-for-pickup inventory", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/:id/store": ["Mark received inventory as STORED (optional explicit warehouse/yard/zone)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/auto-load-ready": ["Auto-load READY_FOR_LOADING inventory with PAID bookings", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/auto-unload-arrived": ["Bulk auto-unload all arrived bookings into the warehouse", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/bookings/:bookingId/approve-delivery": ["Approve delivery — customer records their full name (signature optional)", "POST", "Warehouse Inventory"],
+  "PATCH /api/warehouse-inventory/bookings/:bookingId/double-handling": ["Record Yes/No double handling after unloading (Yes applies the double-handling fee rule)", "PATCH", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/bookings/:bookingId/request-handover-signature": ["Ask the customer to sign the handover (creates one if none, then notifies)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/bookings/:bookingId/unload": ["Unload a single arrived booking into a location", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/bulk-dispatch-export": ["Bulk-dispatch loaded EXPORT inventory (LOADED → DISPATCHED)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/bulk-mark-inspected": ["Bulk mark received inventory inspection PASSED (EXPORT → READY_FOR_LOADING)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/export/auto-unload-at-djibouti": ["Unload all eligible export items assigned to an arrived Djibouti-side train", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/handovers/:handoverId/sign": ["Customer signs one handover (EDR last-mile: one signature per truck)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/import/auto-unload-arrived-bookings": ["Unload all eligible assigned bookings of an ARRIVED import train (→ UNLOADED)", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/receive": ["Receive inventory at a warehouse location", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/receive-bulk": ["Bulk-receive selected eligible PAID bookings into a location", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/reserve": ["Reserve stored inventory for a PAID booking", "POST", "Warehouse Inventory"],
+  "POST /api/warehouse-inventory/train/:scheduleId/load": ["Load selected inventory items onto their allocated wagons for a train", "POST", "Warehouse Inventory"],
+
+  // Warehouse Yard
+  "PATCH /api/warehouse-yards/:id": ["Update warehouse yard", "PATCH", "Warehouse Yard"],
+  "POST /api/warehouse-yards/:yardId/zones": ["Create a zone within a yard", "POST", "Warehouse Yard"],
+
+  // Warehouse Zone
+  "PATCH /api/warehouse-zones/:id": ["Update warehouse zone", "PATCH", "Warehouse Zone"],
+
+  // Weight Limit Rule
+  "POST /api/weight-limit-rules": ["Create a weight limit rule", "POST", "Weight Limit Rule"],
+  "PATCH /api/weight-limit-rules/:id": ["Update a weight limit rule", "PATCH", "Weight Limit Rule"],
+  "DELETE /api/weight-limit-rules/:id": ["Soft-delete a weight limit rule", "DELETE", "Weight Limit Rule"],
+
+  // Yard
+  "POST /api/yards": ["Create a yard", "POST", "Yard"],
+  "PATCH /api/yards/:id": ["Update a yard", "PATCH", "Yard"],
+  "DELETE /api/yards/:id": ["Soft-delete a yard", "DELETE", "Yard"],
+  "POST /api/yards/:id/move-order": ["Move a yard up or down in display order", "POST", "Yard"],
+  "POST /api/yards/reorder": ["Bulk reorder yards by ID list", "POST", "Yard"],
+
+  // Yard Distance
+  "POST /api/yard-distances": ["Create a yard distance", "POST", "Yard Distance"],
+  "PATCH /api/yard-distances/:id": ["Update a yard distance", "PATCH", "Yard Distance"],
+  "DELETE /api/yard-distances/:id": ["Soft-delete a yard distance", "DELETE", "Yard Distance"],
+};
diff --git a/apps/edr-freight-api/src/modules/audit/audit-log.repository.ts b/apps/edr-freight-api/src/modules/audit/audit-log.repository.ts
new file mode 100644
index 000000000..91d6c9901
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/audit/audit-log.repository.ts
@@ -0,0 +1,79 @@
+import { Injectable } from '@nestjs/common';
+import { BaseRepository } from '@edr/api-common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Between, FindOptionsWhere, LessThanOrEqual, MoreThanOrEqual, Repository } from 'typeorm';
+import type { QueryDeepPartialEntity } from 'typeorm/query-builder/QueryPartialEntity';
+
+import { AuditLog } from './entities/audit-log.entity';
+
+export interface AuditLogQuery {
+  type?: string;
+  userId?: string;
+  method?: string;
+  isSuccess?: boolean;
+  resourceId?: string;
+  from?: Date;
+  to?: Date;
+  skip: number;
+  take: number;
+}
+
+@Injectable()
+export class AuditLogRepository extends BaseRepository<AuditLog> {
+  constructor(
+    @InjectRepository(AuditLog)
+    private readonly auditLogRepository: Repository<AuditLog>,
+  ) {
+    super(auditLogRepository);
+  }
+
+  /**
+   * Insert one audit row.
+   *
+   * `insert` rather than `save`: save would issue a SELECT first to decide
+   * between insert and update, which is wasted work for a table that is only
+   * ever appended to.
+   */
+  async record(entry: Partial<AuditLog>): Promise<void> {
+    await this.auditLogRepository.insert(
+      entry as QueryDeepPartialEntity<AuditLog>,
+    );
+  }
+
+  /**
+   * Paginated, filtered read. Newest first — every index on this table is
+   * ordered `created_at DESC` to match.
+   */
+  async search(query: AuditLogQuery): Promise<[AuditLog[], number]> {
+    const where: FindOptionsWhere<AuditLog> = {};
+
+    if (query.type) where.type = query.type;
+    if (query.userId) where.userId = query.userId;
+    if (query.method) where.method = query.method;
+    if (query.resourceId) where.resourceId = query.resourceId;
+    if (query.isSuccess !== undefined) where.isSuccess = query.isSuccess;
+
+    // Date range: either bound may be supplied alone.
+    if (query.from && query.to) where.createdAt = Between(query.from, query.to);
+    else if (query.from) where.createdAt = MoreThanOrEqual(query.from);
+    else if (query.to) where.createdAt = LessThanOrEqual(query.to);
+
+    return this.auditLogRepository.findAndCount({
+      where,
+      order: { createdAt: 'DESC' },
+      skip: query.skip,
+      take: query.take,
+    });
+  }
+
+  /** Distinct entity types present, for populating a filter dropdown. */
+  async distinctTypes(): Promise<string[]> {
+    const rows = await this.auditLogRepository
+      .createQueryBuilder('audit_log')
+      .select('DISTINCT audit_log.type', 'type')
+      .orderBy('audit_log.type', 'ASC')
+      .getRawMany<{ type: string }>();
+
+    return rows.map((row) => row.type);
+  }
+}
diff --git a/apps/edr-freight-api/src/modules/audit/audit.controller.ts b/apps/edr-freight-api/src/modules/audit/audit.controller.ts
index a7c8782b2..1a07a5fe5 100644
--- a/apps/edr-freight-api/src/modules/audit/audit.controller.ts
+++ b/apps/edr-freight-api/src/modules/audit/audit.controller.ts
@@ -1,32 +1,46 @@
-import { Controller, Get, Query } from "@nestjs/common";
-import { ApiOperation, ApiQuery, ApiTags } from "@nestjs/swagger";
+import { Controller, Get, Query } from '@nestjs/common';
+import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
+import { PaginatedResponse } from '@edr/types';
 
-import { BookingStaff } from "../../common/booking-guards";
-import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
-import { AuditService } from "./audit.service";
+import { BookingStaff } from '../../common/booking-guards';
+import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
+import { AuditService } from './audit.service';
+import { AuditLog } from './entities/audit-log.entity';
+import { AuditLogQueryDto } from './dto/audit-log-query.dto';
 
-@ApiTags("audit")
-@Controller("audit")
-@BookingStaff(FREIGHT_PERMS.audit.view)
+/**
+ * Read-only view over the audit trail.
+ *
+ * Gated on `edr_freight_app:audit_log:view` — a dedicated view key rather than
+ * the broad `admin` key, so reading the trail can be granted without also
+ * granting write access to everything else.
+ *
+ * There is deliberately no write, update or delete endpoint here — rows are
+ * created only by `AuditInterceptor`, and an audit trail that can be edited
+ * through the API is not an audit trail.
+ */
+@ApiTags('audit')
+@ApiBearerAuth()
+@Controller('audit')
 export class AuditController {
   constructor(private readonly auditService: AuditService) {}
 
-  @Get("logs")
-  @ApiOperation({ summary: "List freight-api audit log commands" })
-  @ApiQuery({ name: "skip", type: Number, required: false })
-  @ApiQuery({ name: "take", type: Number, required: false })
-  list(@Query("skip") skip?: string, @Query("take") take?: string) {
-    // Same fallback chain @tria-plc/auditlog's client interceptor uses to
-    // stamp AuditLog.application (mezgeb/client/client-audit.interceptor.js)
-    // — reading it here instead of a hardcoded literal means this can't
-    // silently drift out of sync with whatever APPLICATION_NAME/APP_NAME
-    // actually is at runtime.
-    const application =
-      process.env.APPLICATION_NAME ?? process.env.APP_NAME ?? "DEFAULT";
-    return this.auditService.list(
-      application,
-      skip !== undefined ? parseInt(skip, 10) : undefined,
-      take !== undefined ? parseInt(take, 10) : undefined,
-    );
+  @Get('logs')
+  @BookingStaff(FREIGHT_PERMS.auditLog.view)
+  @ApiOperation({
+    summary:
+      'List backoffice audit logs — filter by entity type, user, method, outcome and date range',
+  })
+  list(@Query() query: AuditLogQueryDto): Promise<PaginatedResponse<AuditLog>> {
+    return this.auditService.search(query);
+  }
+
+  @Get('types')
+  @BookingStaff(FREIGHT_PERMS.auditLog.view)
+  @ApiOperation({
+    summary: 'Distinct entity types present in the audit log (filter dropdown)',
+  })
+  types(): Promise<string[]> {
+    return this.auditService.listTypes();
   }
 }
diff --git a/apps/edr-freight-api/src/modules/audit/audit.interceptor.ts b/apps/edr-freight-api/src/modules/audit/audit.interceptor.ts
new file mode 100644
index 000000000..cf12fd4d3
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/audit/audit.interceptor.ts
@@ -0,0 +1,189 @@
+import {
+  CallHandler,
+  ExecutionContext,
+  HttpException,
+  Injectable,
+  NestInterceptor,
+} from '@nestjs/common';
+import { Observable, tap } from 'rxjs';
+import type { Request, Response } from 'express';
+
+import { AuditService } from './audit.service';
+import {
+  auditEndpointMatcher,
+  type MatchedAuditEndpoint,
+} from './audit-endpoint-matcher';
+import {
+  isAuditableActor,
+  resolveAuditActor,
+  type AuditActorSource,
+} from './audit-actor';
+import { redactUrlQuery, sanitizeRequestPayload } from './audit.sanitizer';
+
+/** Methods that can change state. Everything else is never audited. */
+const AUDITED_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+
+/** `error_message` ceiling — stack traces do not belong in this column. */
+const MAX_ERROR_LENGTH = 2_000;
+
+type RequestWithUser = Request & {
+  user?: AuditActorSource;
+  files?: unknown;
+  file?: unknown;
+  id?: string;
+};
+
+/**
+ * Writes one `audit_logs` row per state-changing backoffice request.
+ *
+ * An interceptor rather than the two middlewares originally sketched, for one
+ * decisive reason: Express middleware runs BEFORE guards, so `req.user` is not
+ * populated yet. Both the backoffice-only rule and `user_id` would be
+ * unavailable there. Interceptors run after guards and wrap the handler's
+ * result, so a single class covers both halves — request context on the way in,
+ * outcome on the way out — sharing one timer for `duration_ms`.
+ *
+ * Registered globally (see `audit.module.ts`), so new routes are covered
+ * automatically as long as they appear in `AUDIT_ENDPOINTS`.
+ */
+@Injectable()
+export class AuditInterceptor implements NestInterceptor {
+  constructor(private readonly auditService: AuditService) {}
+
+  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {
+    // Non-HTTP contexts (the RabbitMQ microservice transport) have no request.
+    if (context.getType() !== 'http') return next.handle();
+
+    const httpContext = context.switchToHttp();
+    const request = httpContext.getRequest<RequestWithUser>();
+
+    if (!AUDITED_METHODS.has(request.method)) return next.handle();
+
+    // Backoffice only. Customers and unauthenticated callers are skipped
+    // outright — decided in `audit-actor.ts`, which reuses the same
+    // `userType` discriminator as the permission guards.
+    if (!isAuditableActor(request.user)) return next.handle();
+
+    const matched = auditEndpointMatcher.match(request.method, request.originalUrl);
+    // Not in AUDIT_ENDPOINTS means the route is not a known auditable action;
+    // recording it would produce rows with no title or entity.
+    if (!matched) return next.handle();
+
+    const startedAt = Date.now();
+    // The body is captured up front: handlers are free to mutate the DTO they
+    // are given, so reading it after the fact can record post-mutation values.
+    const requestPayload = sanitizeRequestPayload(
+      request.body,
+      request.files ?? request.file,
+    );
+
+    return next.handle().pipe(
+      tap({
+        next: () => {
+          const response = httpContext.getResponse<Response>();
+          void this.write(request, matched, requestPayload, startedAt, {
+            isSuccess: true,
+            // Nest has not applied the handler's @HttpCode yet at this point
+            // for some routes; statusCode on the response object is the value
+            // actually being sent.
+            statusCode: response.statusCode,
+            errorMessage: null,
+          });
+        },
+        error: (error: unknown) => {
+          void this.write(request, matched, requestPayload, startedAt, {
+            isSuccess: false,
+            statusCode: resolveErrorStatus(error),
+            errorMessage: resolveErrorMessage(error),
+          });
+        },
+      }),
+    );
+  }
+
+  /**
+   * Build and persist the row.
+   *
+   * Deliberately not awaited by `intercept`: the audit write must not add
+   * latency to the request, and `AuditService.record` already swallows its own
+   * failures so a rejected promise cannot surface as an unhandled rejection.
+   */
+  private async write(
+    request: RequestWithUser,
+    matched: MatchedAuditEndpoint,
+    requestPayload: Record<string, unknown> | null,
+    startedAt: number,
+    outcome: {
+      isSuccess: boolean;
+      statusCode: number | null;
+      errorMessage: string | null;
+    },
+  ): Promise<void> {
+    const actor = resolveAuditActor(request.user as AuditActorSource);
+
+    await this.auditService.record({
+      title: matched.title,
+      method: request.method,
+      // Full URL including query string, with sensitive query values redacted.
+      url: redactUrlQuery(request.originalUrl),
+      routePath: matched.routePath,
+      type: matched.type,
+      isSuccess: outcome.isSuccess,
+      statusCode: outcome.statusCode,
+      errorMessage: outcome.errorMessage,
+      userId: actor.userId,
+      userName: actor.userName,
+      userRole: actor.userRole,
+      resourceId: matched.resourceId,
+      request: requestPayload,
+      ipAddress: resolveIp(request),
+      userAgent: request.headers['user-agent'] ?? null,
+      requestId: resolveRequestId(request),
+      durationMs: Date.now() - startedAt,
+    });
+  }
+}
+
+/** HTTP status for the failure, falling back to 500 for non-HTTP errors. */
+function resolveErrorStatus(error: unknown): number {
+  return error instanceof HttpException ? error.getStatus() : 500;
+}
+
+/** Message only — stack traces belong in application logs, not this column. */
+function resolveErrorMessage(error: unknown): string | null {
+  if (error instanceof HttpException) {
+    const response = error.getResponse();
+    const message =
+      typeof response === 'string'
+        ? response
+        : ((response as { message?: unknown })?.message ?? error.message);
+    const text = Array.isArray(message) ? message.join('; ') : String(message);
+    return text.slice(0, MAX_ERROR_LENGTH);
+  }
+
+  if (error instanceof Error) return error.message.slice(0, MAX_ERROR_LENGTH);
+  return error ? String(error).slice(0, MAX_ERROR_LENGTH) : null;
+}
+
+/**
+ * Client IP. The API sits behind a reverse proxy, so `req.ip` is the proxy
+ * unless `trust proxy` is set; the forwarded header is preferred and its first
+ * entry (the original client) taken.
+ */
+function resolveIp(request: Request): string | null {
+  const forwarded = request.headers['x-forwarded-for'];
+  const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+  const candidate = raw?.split(',')[0]?.trim() || request.ip;
+  if (!candidate) return null;
+
+  // Normalize IPv4-mapped IPv6 (`::ffff:10.0.0.1`), which the `inet` column
+  // accepts but which reads badly and breaks grouping by address.
+  return candidate.startsWith('::ffff:') ? candidate.slice(7) : candidate;
+}
+
+/** Correlation id from the proxy/tracing layer, when present. */
+function resolveRequestId(request: RequestWithUser): string | null {
+  const header = request.headers['x-request-id'] ?? request.headers['x-correlation-id'];
+  const value = Array.isArray(header) ? header[0] : header;
+  return (value ?? request.id ?? null)?.toString().slice(0, 64) ?? null;
+}
diff --git a/apps/edr-freight-api/src/modules/audit/audit.module.ts b/apps/edr-freight-api/src/modules/audit/audit.module.ts
index 635973fc6..608af3672 100644
--- a/apps/edr-freight-api/src/modules/audit/audit.module.ts
+++ b/apps/edr-freight-api/src/modules/audit/audit.module.ts
@@ -1,13 +1,34 @@
-import { Module } from "@nestjs/common";
-import { TypeOrmModule } from "@nestjs/typeorm";
-import { AuditLogCommand } from "@tria-plc/auditlog";
+import { Global, Module } from '@nestjs/common';
+import { APP_INTERCEPTOR } from '@nestjs/core';
+import { TypeOrmModule } from '@nestjs/typeorm';
 
-import { AuditController } from "./audit.controller";
-import { AuditService } from "./audit.service";
+import { AuditController } from './audit.controller';
+import { AuditInterceptor } from './audit.interceptor';
+import { AuditLog } from './entities/audit-log.entity';
+import { AuditLogRepository } from './audit-log.repository';
+import { AuditService } from './audit.service';
 
+/**
+ * Backoffice audit trail.
+ *
+ * `AuditInterceptor` is bound through `APP_INTERCEPTOR`, so it applies to every
+ * route in the application without touching the 488 mutating handlers
+ * individually. Coverage therefore follows `AUDIT_ENDPOINTS`: a new route is
+ * audited as soon as it appears in that map, and unknown routes are skipped
+ * rather than recorded with an empty title.
+ *
+ * Global so other modules can inject `AuditService` to record domain events
+ * that do not map cleanly onto an HTTP request.
+ */
+@Global()
 @Module({
-  imports: [TypeOrmModule.forFeature([AuditLogCommand])],
+  imports: [TypeOrmModule.forFeature([AuditLog])],
   controllers: [AuditController],
-  providers: [AuditService],
+  providers: [
+    AuditLogRepository,
+    AuditService,
+    { provide: APP_INTERCEPTOR, useClass: AuditInterceptor },
+  ],
+  exports: [AuditService, AuditLogRepository],
 })
 export class AuditModule {}
diff --git a/apps/edr-freight-api/src/modules/audit/audit.sanitizer.ts b/apps/edr-freight-api/src/modules/audit/audit.sanitizer.ts
new file mode 100644
index 000000000..3a934beea
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/audit/audit.sanitizer.ts
@@ -0,0 +1,195 @@
+/**
+ * Redaction and shrinking for anything copied into `audit_logs.request`.
+ *
+ * This matters more here than in a typical audit log. `main.ts` raises the JSON
+ * body ceiling to 100MB so contract signing can post a signature AND a company
+ * stamp as base64 in one request. Copying a body like that verbatim would put
+ * both a credential-grade artefact and a 100MB blob into the audit table, on
+ * the write path of every audited endpoint.
+ */
+
+const REDACTED = '[REDACTED]';
+
+/**
+ * Substring-matched against lower-cased key names, so `newPassword`,
+ * `otpCode` and `x-authorization` are all caught without enumerating variants.
+ *
+ * `signature` and `stamp` are here because contract signing posts both as
+ * base64 — they are simultaneously the largest and the most sensitive fields
+ * this API accepts.
+ */
+const SENSITIVE_KEY_PATTERNS = [
+  'password',
+  'otp',
+  'token',
+  'secret',
+  'pin',
+  'authorization',
+  'signature',
+  'stamp',
+  'apikey',
+  'api_key',
+  'credential',
+  'ssn',
+];
+
+/** Serialized `request` ceiling. Beyond this the payload is dropped for a marker. */
+const MAX_REQUEST_BYTES = 64 * 1024;
+
+/** Depth guard: deep nesting is never worth the recursion cost here. */
+const MAX_DEPTH = 6;
+
+/** Long strings (base64 blobs) are truncated rather than stored whole. */
+const MAX_STRING_LENGTH = 2_000;
+
+function isSensitiveKey(key: string): boolean {
+  const lower = key.toLowerCase();
+  return SENSITIVE_KEY_PATTERNS.some((pattern) => lower.includes(pattern));
+}
+
+/**
+ * Multer file shape, reduced to a descriptor. The buffer is never stored —
+ * Postgres is the wrong home for file bytes, and `audit_logs` doubly so.
+ */
+function isMulterFile(value: unknown): boolean {
+  if (typeof value !== 'object' || value === null) return false;
+  const candidate = value as Record<string, unknown>;
+  return (
+    typeof candidate.originalname === 'string' &&
+    (typeof candidate.mimetype === 'string' || typeof candidate.size === 'number')
+  );
+}
+
+function describeFile(value: Record<string, unknown>): Record<string, unknown> {
+  return {
+    __file: true,
+    originalName: value.originalname ?? null,
+    mimeType: value.mimetype ?? null,
+    size: typeof value.size === 'number' ? value.size : null,
+    fieldName: value.fieldname ?? null,
+  };
+}
+
+function sanitizeValue(value: unknown, depth: number): unknown {
+  if (value === null || value === undefined) return value ?? null;
+
+  if (typeof value === 'string') {
+    return value.length > MAX_STRING_LENGTH
+      ? `${value.slice(0, MAX_STRING_LENGTH)}…[truncated ${value.length} chars]`
+      : value;
+  }
+
+  if (typeof value === 'number' || typeof value === 'boolean') return value;
+  if (value instanceof Date) return value.toISOString();
+  // Buffers are file bytes by definition — never persisted, only described.
+  if (Buffer.isBuffer(value)) return { __buffer: true, size: value.length };
+
+  if (depth >= MAX_DEPTH) return '[MAX_DEPTH]';
+
+  if (Array.isArray(value)) {
+    // Cap array length: bulk endpoints post large collections.
+    const capped = value.slice(0, 50).map((item) => sanitizeValue(item, depth + 1));
+    if (value.length > 50) capped.push(`…[${value.length - 50} more items]`);
+    return capped;
+  }
+
+  if (typeof value === 'object') {
+    if (isMulterFile(value)) return describeFile(value as Record<string, unknown>);
+
+    const out: Record<string, unknown> = {};
+    for (const [key, nested] of Object.entries(value as Record<string, unknown>)) {
+      out[key] = isSensitiveKey(key) ? REDACTED : sanitizeValue(nested, depth + 1);
+    }
+    return out;
+  }
+
+  // Functions, symbols and anything else are not audit data.
+  return null;
+}
+
+/**
+ * Sanitize a request body (or query object) for storage.
+ *
+ * Returns null when there is nothing worth keeping, so empty bodies do not
+ * occupy jsonb rows.
+ */
+export function sanitizeRequestPayload(
+  body: unknown,
+  files?: unknown,
+): Record<string, unknown> | null {
+  const payload: Record<string, unknown> = {};
+
+  if (body && typeof body === 'object' && Object.keys(body).length > 0) {
+    const sanitizedBody = sanitizeValue(body, 0);
+    if (sanitizedBody && typeof sanitizedBody === 'object') {
+      Object.assign(payload, sanitizedBody as Record<string, unknown>);
+    }
+  }
+
+  // Multer puts uploads on `req.files`, outside `req.body`, so they are folded
+  // in explicitly — otherwise a pure-upload request records an empty payload.
+  if (files) {
+    const sanitizedFiles = sanitizeValue(files, 0);
+    if (
+      sanitizedFiles &&
+      (Array.isArray(sanitizedFiles) || typeof sanitizedFiles === 'object')
+    ) {
+      const hasEntries = Array.isArray(sanitizedFiles)
+        ? sanitizedFiles.length > 0
+        : Object.keys(sanitizedFiles as object).length > 0;
+      if (hasEntries) payload.__uploads = sanitizedFiles;
+    }
+  }
+
+  if (Object.keys(payload).length === 0) return null;
+
+  // Final size guard. A body can stay under every per-field cap and still be
+  // enormous in aggregate, so the serialized form is measured before storing.
+  const serialized = JSON.stringify(payload);
+  if (serialized && Buffer.byteLength(serialized, 'utf8') > MAX_REQUEST_BYTES) {
+    return {
+      __truncated: true,
+      reason: 'Payload exceeded the audit size limit',
+      bytes: Buffer.byteLength(serialized, 'utf8'),
+      keys: Object.keys(payload).slice(0, 50),
+    };
+  }
+
+  return payload;
+}
+
+/**
+ * Rebuild a URL with sensitive query values redacted.
+ *
+ * `url` is stored with its full query string, and query strings are a common
+ * place for one-time tokens and signed links, so the same deny-list that
+ * protects the body is applied to the query.
+ */
+export function redactUrlQuery(url: string): string {
+  const queryIndex = url.indexOf('?');
+  if (queryIndex === -1) return url;
+
+  const path = url.slice(0, queryIndex);
+  const query = url.slice(queryIndex + 1);
+  if (!query) return path;
+
+  const redacted = query
+    .split('&')
+    .map((pair) => {
+      const eq = pair.indexOf('=');
+      if (eq === -1) return pair;
+      const key = pair.slice(0, eq);
+      // Keys arrive percent-encoded; decode before matching so `api%2Dkey`
+      // is not treated as harmless.
+      let decodedKey = key;
+      try {
+        decodedKey = decodeURIComponent(key);
+      } catch {
+        /* malformed encoding — fall back to the raw key */
+      }
+      return isSensitiveKey(decodedKey) ? `${key}=${REDACTED}` : pair;
+    })
+    .join('&');
+
+  return `${path}?${redacted}`;
+}
diff --git a/apps/edr-freight-api/src/modules/audit/audit.service.ts b/apps/edr-freight-api/src/modules/audit/audit.service.ts
index 04ea4beed..de7dfd956 100644
--- a/apps/edr-freight-api/src/modules/audit/audit.service.ts
+++ b/apps/edr-freight-api/src/modules/audit/audit.service.ts
@@ -1,70 +1,71 @@
-import { Injectable } from "@nestjs/common";
-import { InjectRepository } from "@nestjs/typeorm";
-import { Repository } from "typeorm";
-import { AuditLogCommand } from "@tria-plc/auditlog";
+import { BadRequestException, Injectable, Logger } from '@nestjs/common';
+import { PaginatedResponse } from '@edr/types';
 
-import { CLIENT_APP_HEADER } from "../auth/login-audience.middleware";
+import { AuditLog } from './entities/audit-log.entity';
+import { AuditLogRepository } from './audit-log.repository';
+import { AuditLogQueryDto } from './dto/audit-log-query.dto';
+import {
+  buildPaginationMeta,
+  normalizePagination,
+} from '../../common/utils/pagination.util';
 
-export interface AuditLogListResult {
-  count: number;
-  items: AuditLogCommand[];
-}
-
-/**
- * Own read path onto @tria-plc/auditlog's tables, gated by AuditController's
- * @BookingStaff — the package's own AuditLogCommandController (mounted at
- * /api/audit-log-commands) ships with no guards at all, so it can't be used
- * directly for a permission-gated UI. Query mirrors the package's
- * AuditLogCommandService.buildAuditLogQuery/getAllAuditLogs exactly.
- */
 @Injectable()
 export class AuditService {
-  constructor(
-    @InjectRepository(AuditLogCommand)
-    private readonly auditLogCommandRepository: Repository<AuditLogCommand>,
-  ) {}
+  private readonly logger = new Logger(AuditService.name);
 
-  async list(
-    application: string,
-    skip = 0,
-    take = 10,
-  ): Promise<AuditLogListResult> {
-    const [items, count] = await this.auditLogCommandRepository
-      .createQueryBuilder("audit_log_commands")
-      .leftJoinAndSelect("audit_log_commands.auditLog", "auditLog")
-      .andWhere(
-        "(audit_log_commands.auditLogId IS NULL OR auditLog.application = :application)",
-        { application },
-      )
-      .andWhere(
-        "(audit_log_commands.auditLogId IS NULL OR auditLog.status = :status)",
-        { status: "Commit" },
-      )
-      // Backoffice-only view: portal (customer-facing) writes carry the same
-      // request-header set by every axios call from that app — see
-      // login-audience.middleware.ts. Rows with no linked auditLog (child/
-      // event commands with no request context) stay visible; they aren't
-      // attributable to any frontend, so they're not portal noise either.
-      .andWhere(
-        "(audit_log_commands.auditLogId IS NULL OR auditLog.requestHeader ->> :clientAppHeader = :clientApp)",
-        { clientAppHeader: CLIENT_APP_HEADER, clientApp: "backoffice" },
-      )
-      .select([
-        "audit_log_commands.id",
-        "audit_log_commands.createdAt",
-        "audit_log_commands.deletedAt",
-        "audit_log_commands.entityName",
-        "audit_log_commands.queryMethod",
-        "audit_log_commands.changes",
-        "audit_log_commands.payload",
-        "auditLog.id",
-        "auditLog.user",
-      ])
-      .addOrderBy("audit_log_commands.createdAt", "DESC")
-      .skip(skip)
-      .take(take)
-      .getManyAndCount();
+  constructor(private readonly auditLogRepository: AuditLogRepository) {}
 
-    return { count, items };
+  /**
+   * Persist one audit row, swallowing any failure.
+   *
+   * An audit write must never turn a successful business action into an error
+   * for the user: if this table is full, misconfigured or mid-migration,
+   * contract approvals still need to work. Failures are logged so the gap is
+   * visible in application logs rather than silent.
+   */
+  async record(entry: Partial<AuditLog>): Promise<void> {
+    try {
+      await this.auditLogRepository.record(entry);
+    } catch (error) {
+      this.logger.error(
+        `Failed to write audit log for ${entry.method} ${entry.routePath}: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+    }
+  }
+
+  /** Paginated, filtered audit history, newest first. */
+  async search(query: AuditLogQueryDto): Promise<PaginatedResponse<AuditLog>> {
+    const { page, pageSize, skip, take } = normalizePagination(query);
+
+    const from = query.from ? new Date(query.from) : undefined;
+    const to = query.to ? new Date(query.to) : undefined;
+
+    // A reversed range silently returns zero rows, which reads as "nothing
+    // happened" rather than "your filter is wrong" — reject it explicitly.
+    if (from && to && from > to) {
+      throw new BadRequestException('`from` must be earlier than `to`');
+    }
+
+    const [items, total] = await this.auditLogRepository.search({
+      type: query.type,
+      userId: query.userId,
+      method: query.method,
+      resourceId: query.resourceId,
+      isSuccess:
+        query.isSuccess === undefined ? undefined : query.isSuccess === 'true',
+      from,
+      to,
+      skip,
+      take,
+    });
+
+    return { items, meta: buildPaginationMeta(total, page, pageSize) };
+  }
+
+  /** Distinct entity types, for the filter dropdown on the audit screen. */
+  async listTypes(): Promise<string[]> {
+    return this.auditLogRepository.distinctTypes();
   }
 }
diff --git a/apps/edr-freight-api/src/modules/audit/dto/audit-log-query.dto.ts b/apps/edr-freight-api/src/modules/audit/dto/audit-log-query.dto.ts
new file mode 100644
index 000000000..5a5199538
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/audit/dto/audit-log-query.dto.ts
@@ -0,0 +1,64 @@
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { Transform } from 'class-transformer';
+import { IsBooleanString, IsIn, IsISO8601, IsOptional, IsString, IsUUID, MaxLength } from 'class-validator';
+
+import { PaginationQueryDto } from '../../../common/dto/pagination-query.dto';
+
+const AUDITED_METHODS = ['POST', 'PUT', 'PATCH', 'DELETE'] as const;
+
+/**
+ * Filters for the audit log read endpoint.
+ *
+ * Extends the shared pagination DTO so page/pageSize behave (and are capped)
+ * exactly as they do on every other list endpoint.
+ */
+export class AuditLogQueryDto extends PaginationQueryDto {
+  @ApiPropertyOptional({
+    description: 'Entity type, e.g. "Contract", "Booking", "Locomotive".',
+    example: 'Contract',
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(50)
+  type?: string;
+
+  @ApiPropertyOptional({ description: 'IAM id of the acting backoffice user.' })
+  @IsOptional()
+  @IsUUID()
+  userId?: string;
+
+  @ApiPropertyOptional({ enum: AUDITED_METHODS })
+  @IsOptional()
+  @Transform(({ value }) => String(value).toUpperCase())
+  @IsIn([...AUDITED_METHODS])
+  method?: string;
+
+  @ApiPropertyOptional({ description: 'Id of the affected record.' })
+  @IsOptional()
+  @IsString()
+  @MaxLength(64)
+  resourceId?: string;
+
+  @ApiPropertyOptional({
+    description: 'Filter by outcome: true = succeeded, false = failed.',
+  })
+  @IsOptional()
+  @IsBooleanString()
+  isSuccess?: string;
+
+  @ApiPropertyOptional({
+    description: 'Inclusive start of the range (ISO 8601).',
+    example: '2026-01-01T00:00:00.000Z',
+  })
+  @IsOptional()
+  @IsISO8601()
+  from?: string;
+
+  @ApiPropertyOptional({
+    description: 'Inclusive end of the range (ISO 8601).',
+    example: '2026-01-31T23:59:59.999Z',
+  })
+  @IsOptional()
+  @IsISO8601()
+  to?: string;
+}
diff --git a/apps/edr-freight-api/src/modules/audit/entities/audit-log.entity.ts b/apps/edr-freight-api/src/modules/audit/entities/audit-log.entity.ts
new file mode 100644
index 000000000..0ff7727ff
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/audit/entities/audit-log.entity.ts
@@ -0,0 +1,132 @@
+import { Column, CreateDateColumn, Entity, Index, PrimaryGeneratedColumn } from 'typeorm';
+
+/**
+ * One backoffice action against a state-changing endpoint.
+ *
+ * Deliberately does NOT extend `BaseEntity`, which is the repo standard
+ * everywhere else. `BaseEntity` carries `updatedAt` and `deletedAt`, and both
+ * are wrong here:
+ *
+ *  - `updatedAt` implies an audit row can be edited. A record that can be
+ *    rewritten after the fact is not evidence.
+ *  - `deletedAt` (soft delete) would let anyone who can delete erase their own
+ *    trail, and TypeORM would then hide those rows from every default query —
+ *    the failure would be silent, which is the worst property an audit log can
+ *    have.
+ *
+ * Rows are insert-only: nothing in this module updates or deletes them.
+ *
+ * `userId` is a bare uuid with NO foreign key into the `iam` schema. Two
+ * reasons: cross-schema FKs are forbidden platform-wide, and a FK would let
+ * deleting a user cascade away the record of what that user did — exactly
+ * backwards. `userName` / `userRole` are point-in-time snapshots for the same
+ * reason: resolving them at read time would rewrite history whenever somebody
+ * is renamed or changes role.
+ */
+@Entity({ schema: 'freight', name: 'audit_logs' })
+// Every audit query is time-bounded, so created_at leads most indexes.
+@Index('IDX_audit_logs_created_at', ['createdAt'])
+@Index('IDX_audit_logs_user_id_created_at', ['userId', 'createdAt'])
+@Index('IDX_audit_logs_type_created_at', ['type', 'createdAt'])
+@Index('IDX_audit_logs_type_resource_id', ['type', 'resourceId'])
+@Index('IDX_audit_logs_route_path_created_at', ['routePath', 'createdAt'])
+export class AuditLog {
+  @PrimaryGeneratedColumn('uuid')
+  id!: string;
+
+  /**
+   * Human-readable action, e.g. "Approve contract" — taken from the matched
+   * entry in `AUDIT_ENDPOINTS`, which sources it from each route's
+   * `@ApiOperation` summary.
+   */
+  @Column({ name: 'title', type: 'varchar', length: 255 })
+  title!: string;
+
+  @Column({ name: 'method', type: 'varchar', length: 10 })
+  method!: string;
+
+  /**
+   * The URL as actually called, real ids and query string included
+   * (`/api/contracts/abc-123/cancel?force=true`). Query values run through the
+   * same redaction pass as the body, so a `?token=` never lands here.
+   */
+  @Column({ name: 'url', type: 'text' })
+  url!: string;
+
+  /**
+   * The route template (`/api/contracts/:id/cancel`).
+   *
+   * `url` alone cannot be grouped — every contract cancel is a distinct string.
+   * This column is the join key back to `AUDIT_ENDPOINTS` and makes
+   * "every contract cancellation" one indexed query instead of a regex scan.
+   */
+  @Column({ name: 'route_path', type: 'varchar', length: 255, nullable: true })
+  routePath?: string | null;
+
+  /** Primary entity the action touched: `Contract`, `Booking`, `Locomotive`. */
+  @Column({ name: 'type', type: 'varchar', length: 50 })
+  type!: string;
+
+  @Column({ name: 'is_success', type: 'boolean' })
+  isSuccess!: boolean;
+
+  /** IAM user id. Nullable by design — see the class comment. */
+  @Column({ name: 'user_id', type: 'uuid', nullable: true })
+  userId?: string | null;
+
+  /**
+   * Id of the affected record, recovered from the first path parameter of the
+   * matched template.
+   *
+   * `varchar`, not `uuid`: not every identifier is a uuid
+   * (`/api/contract-templates/:code`), and a create has no id at all until it
+   * succeeds. A `uuid NOT NULL` column would throw during the write and lose
+   * the audit row rather than the id.
+   */
+  @Column({ name: 'resource_id', type: 'varchar', length: 64, nullable: true })
+  resourceId?: string | null;
+
+  /**
+   * Sanitized request body. Secrets are replaced with `[REDACTED]` and uploads
+   * are reduced to `{ __file, originalName, mimeType, size }` descriptors —
+   * never raw bytes. See `audit.sanitizer.ts`.
+   */
+  @Column({ name: 'request', type: 'jsonb', nullable: true })
+  request?: Record<string, unknown> | null;
+
+  /**
+   * `isSuccess` alone cannot separate 403 (denied — the security signal worth
+   * alerting on) from 500 (broke). Both are simply `false`.
+   */
+  @Column({ name: 'status_code', type: 'smallint', nullable: true })
+  statusCode?: number | null;
+
+  @Column({ name: 'error_message', type: 'text', nullable: true })
+  errorMessage?: string | null;
+
+  /** Snapshot of the actor's display name at the time of the action. */
+  @Column({ name: 'user_name', type: 'varchar', length: 150, nullable: true })
+  userName?: string | null;
+
+  /** Snapshot of the actor's role at the time of the action. */
+  @Column({ name: 'user_role', type: 'varchar', length: 100, nullable: true })
+  userRole?: string | null;
+
+  /** Non-repudiation: the first thing asked in any incident review. */
+  @Column({ name: 'ip_address', type: 'inet', nullable: true })
+  ipAddress?: string | null;
+
+  /** Helps separate a real browser session from a script using a stolen token. */
+  @Column({ name: 'user_agent', type: 'text', nullable: true })
+  userAgent?: string | null;
+
+  /** Correlates this row with application logs/traces for the same request. */
+  @Column({ name: 'request_id', type: 'varchar', length: 64, nullable: true })
+  requestId?: string | null;
+
+  @Column({ name: 'duration_ms', type: 'integer', nullable: true })
+  durationMs?: number | null;
+
+  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
+  createdAt!: Date;
+}
diff --git a/apps/edr-freight-api/src/modules/billing/billing.service.ts b/apps/edr-freight-api/src/modules/billing/billing.service.ts
index 9a31466f0..6c7e8455d 100644
--- a/apps/edr-freight-api/src/modules/billing/billing.service.ts
+++ b/apps/edr-freight-api/src/modules/billing/billing.service.ts
@@ -8,6 +8,7 @@ import {
   NotFoundException,
 } from "@nestjs/common";
 import { EventEmitter2 } from "@nestjs/event-emitter";
+import { logCtx } from "@edr/api-common";
 import { DataSource, EntityManager, In } from "typeorm";
 
 import { Booking } from "../bookings/entities/booking.entity";
@@ -951,6 +952,24 @@ export class BillingService {
 
       await mg.update(Invoice, { id: invoice.id }, { status, ...extra });
 
+      // Every invoice status move in the app funnels through here — money
+      // changing state is the single most-asked question in support.
+      logCtx(
+        {
+          invoiceId: invoice.id,
+          invoiceNumber: invoice.invoiceNumber,
+          source: invoice.source,
+          sourceId: invoice.sourceId,
+          from: invoice.status,
+          to: status,
+          event,
+          amount: Number(invoice.totalAmount),
+          currency: invoice.currency,
+          paymentId: extra.paymentId ?? invoice.paymentId ?? undefined,
+        },
+        { path: "invoiceTransitions", mode: "push" },
+      );
+
       const updated = { ...invoice, ...extra, status } as Invoice;
       return {
         result: updated,
@@ -1320,6 +1339,21 @@ export class BillingService {
       throw new BadRequestException("Invoice has no outstanding balance.");
     }
 
+    logCtx(
+      {
+        invoiceId: invoice.id,
+        invoiceNumber: invoice.invoiceNumber,
+        source: invoice.source,
+        sourceId: invoice.sourceId,
+        companyId: invoice.companyId,
+        amountDue,
+        currency: invoice.currency,
+        method: opts.method ?? "TELEBIRR",
+        platform: opts.platform,
+      },
+      { path: "payment.payInvoice" },
+    );
+
     // CAC Bank is an OTP debit — the bank SMSes the code to this number, so it is
     // required up front (the payment service rejects it otherwise, as a 502 here).
     if (
@@ -1443,7 +1477,24 @@ export class BillingService {
       // first on DESC, which would hand back an unissued invoice.
       order: { issuedAt: { direction: "DESC", nulls: "LAST" } },
     });
-    if (!invoice) return null;
+    if (!invoice) {
+      logCtx(
+        { paymentId, outcome: "no-invoice-for-payment" },
+        { path: "payment.settleInvoice" },
+      );
+      return null;
+    }
+
+    logCtx(
+      {
+        paymentId,
+        providerTxnId,
+        invoiceId: invoice.id,
+        invoiceNumber: invoice.invoiceNumber,
+        invoiceStatus: invoice.status,
+      },
+      { path: "payment.settleInvoice" },
+    );
 
     const settleable: Freight.InvoiceStatus[] = [
       ...OPEN_STATUSES,
@@ -1453,6 +1504,12 @@ export class BillingService {
       // Already PAID is the ordinary idempotent no-op (redelivery, or settled
       // inline by payInvoice). Anything else means money was captured with
       // nowhere to land — that needs a person, so say so loudly.
+      logCtx(
+        invoice.status === Freight.InvoiceStatus.Paid
+          ? "already-paid"
+          : "captured-with-nowhere-to-land",
+        { path: "payment.settleInvoice.outcome", mode: "set" },
+      );
       if (invoice.status !== Freight.InvoiceStatus.Paid) {
         this.logger.error(
           `Payment ${paymentId} succeeded but invoice ${invoice.invoiceNumber} ` +
diff --git a/apps/edr-freight-api/src/modules/billing/documents/documents.module.ts b/apps/edr-freight-api/src/modules/billing/documents/documents.module.ts
index c320a5d44..363cda3f0 100644
--- a/apps/edr-freight-api/src/modules/billing/documents/documents.module.ts
+++ b/apps/edr-freight-api/src/modules/billing/documents/documents.module.ts
@@ -7,7 +7,9 @@ import { PdfRenderService } from "./pdf-render.service";
  * Standalone document infrastructure — generic HTML→PDF plus the shared
  * invoice/receipt renderer. Has no domain dependencies, so any module (billing,
  * warehouses, …) can import it to print invoices without coupling to the
- * billing payment graph.
+ * billing payment graph. StampSettingsService is @Global (see
+ * StampSettingsModule) so InvoiceDocumentService can inject it without this
+ * module declaring an explicit import.
  */
 @Module({
   providers: [PdfRenderService, InvoiceDocumentService],
diff --git a/apps/edr-freight-api/src/modules/billing/documents/invoice-document.service.ts b/apps/edr-freight-api/src/modules/billing/documents/invoice-document.service.ts
index 06d164bbd..268e94ad9 100644
--- a/apps/edr-freight-api/src/modules/billing/documents/invoice-document.service.ts
+++ b/apps/edr-freight-api/src/modules/billing/documents/invoice-document.service.ts
@@ -1,6 +1,8 @@
 import { Injectable } from "@nestjs/common";
 
+import { StampSettingsService } from "../../stamp-settings/stamp-settings.service";
 import { PdfRenderService } from "./pdf-render.service";
+import { sealClass, sealImageCss, sealMarkup } from "./seal-markup.util";
 import {
   PdfColor,
   assembleSinglePagePdf,
@@ -53,6 +55,13 @@ export interface InvoiceDocumentModel {
   totals: InvoiceDocumentTotal[];
   /** Override the round seal text; defaults from kind/status. */
   sealText?: string;
+  /**
+   * Company stamp image (data URL) to render instead of the plain text seal.
+   * Callers normally leave this unset — `InvoiceDocumentService.render()`
+   * fills it in from the single global stamp in StampSettingsService; set it
+   * explicitly only to override that default for one document.
+   */
+  stampImageUrl?: string | null;
 }
 
 /**
@@ -63,12 +72,21 @@ export interface InvoiceDocumentModel {
  */
 @Injectable()
 export class InvoiceDocumentService {
-  constructor(private readonly pdf: PdfRenderService) {}
+  constructor(
+    private readonly pdf: PdfRenderService,
+    private readonly stampSettings: StampSettingsService,
+  ) {}
 
   async render(
     model: InvoiceDocumentModel,
   ): Promise<{ filename: string; buffer: Buffer }> {
-    const html = this.buildHtml(model);
+    const stampImageUrl =
+      model.stampImageUrl !== undefined
+        ? model.stampImageUrl
+        : await this.stampSettings.getStampImageUrl();
+    const resolvedModel: InvoiceDocumentModel = { ...model, stampImageUrl };
+
+    const html = this.buildHtml(resolvedModel);
     const kindLabel = model.kind === "RECEIPT" ? "receipt" : "invoice";
     return {
       filename: `${this.safeFilename(model.documentNumber)}-${kindLabel}.pdf`,
@@ -77,7 +95,11 @@ export class InvoiceDocumentService {
         // Chromium-less fallback: draw a genuine styled invoice (header, seal,
         // summary grid, line-item table, totals) from the model — not a flat
         // plain-text dump — so it still reads as a proper invoice document.
-        fallback: () => this.buildFallbackPdf(model),
+        // ponytail: still draws the plain vector seal, not the uploaded stamp
+        // image — embedding a raster image needs a new PDF XObject primitive
+        // in styled-pdf.util.ts. Upgrade when the Chromium-less path needs to
+        // carry the real stamp too; today it's a rare degraded fallback.
+        fallback: () => this.buildFallbackPdf(resolvedModel),
       }),
     };
   }
@@ -218,6 +240,8 @@ export class InvoiceDocumentService {
     const showCategory = Boolean(model.categoryHeader);
     const sealText =
       model.sealText ?? (model.kind === "RECEIPT" || model.status === "PAID" ? "EDR PAID" : "EDR");
+    const sealInner = sealMarkup(model.stampImageUrl, sealText);
+    const sealCssClass = sealClass(model.stampImageUrl);
 
     const summaryRows = model.summary
       .map((row) => `<div><span>${esc(row.label)}</span>${esc(row.value)}</div>`)
@@ -256,6 +280,7 @@ export class InvoiceDocumentService {
     .meta { text-align: right; font-size: 12px; color: #475569; }
     .meta strong { display: block; color: #0f172a; font-size: 17px; margin-top: 5px; }
     .seal { position: absolute; right: 28px; top: 118px; width: 116px; height: 116px; border: 4px double #0f766e; border-radius: 999px; color: #0f766e; display: flex; align-items: center; justify-content: center; text-align: center; font-weight: 800; font-size: 18px; transform: rotate(-14deg); opacity: .82; }
+    ${sealImageCss()}
     .summary { display: grid; grid-template-columns: 1fr 1fr; gap: 12px 28px; margin: 24px 150px 16px 0; font-size: 13px; }
     .summary div { border-bottom: 1px solid #e2e8f0; padding: 7px 0; }
     .summary span { color: #64748b; display: block; font-size: 11px; margin-bottom: 3px; }
@@ -283,7 +308,7 @@ export class InvoiceDocumentService {
         Issued: ${esc(date(model.issuedAt))}
       </div>
     </div>
-    <div class="seal">${esc(sealText)}</div>
+    <div class="${sealCssClass}">${sealInner}</div>
     <div class="summary">${summaryRows}</div>
     <table>
       <thead>
diff --git a/apps/edr-freight-api/src/modules/billing/documents/seal-markup.util.spec.ts b/apps/edr-freight-api/src/modules/billing/documents/seal-markup.util.spec.ts
new file mode 100644
index 000000000..d07f8ebf6
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/billing/documents/seal-markup.util.spec.ts
@@ -0,0 +1,78 @@
+import { sealClass, sealImageCss, sealMarkup } from "./seal-markup.util";
+
+/**
+ * These three helpers are the single image-vs-text branch shared by every
+ * EDR document's round seal, so a regression here silently unstamps invoices,
+ * warehouse release papers and handover papers at once.
+ */
+describe("seal markup helpers", () => {
+  const STAMP = "data:image/png;base64,QUJD";
+
+  describe("sealMarkup", () => {
+    it("renders the stamp image when one is configured", () => {
+      expect(sealMarkup(STAMP, ["EDR", "Warehouse"])).toBe(
+        `<img src="${STAMP}" alt="Company stamp" />`,
+      );
+    });
+
+    it("falls back to text rings when no stamp is configured", () => {
+      expect(sealMarkup(null, ["EDR", "Warehouse", "Cleared"])).toBe(
+        "<span>EDR<br />Warehouse<br />Cleared</span>",
+      );
+    });
+
+    it("treats undefined as unset", () => {
+      expect(sealMarkup(undefined, "EDR")).toBe("<span>EDR</span>");
+    });
+
+    it("accepts a bare string as a single line", () => {
+      expect(sealMarkup(null, "EDR")).toBe("<span>EDR</span>");
+    });
+
+    it("escapes text lines so document data cannot inject markup", () => {
+      expect(sealMarkup(null, ['<script>alert("x")</script>'])).toBe(
+        "<span>&lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt;</span>",
+      );
+    });
+
+    it("escapes the image src so it cannot break out of the attribute", () => {
+      expect(sealMarkup('data:image/png;base64,A" onerror="x', "EDR")).toBe(
+        '<img src="data:image/png;base64,A&quot; onerror=&quot;x" alt="Company stamp" />',
+      );
+    });
+  });
+
+  describe("sealClass", () => {
+    it("adds the image modifier only when stamped", () => {
+      expect(sealClass(STAMP)).toBe("seal seal-image");
+      expect(sealClass(null)).toBe("seal");
+    });
+
+    it("honours a document's own seal selector", () => {
+      expect(sealClass(STAMP, "sig-stamp-box")).toBe(
+        "sig-stamp-box sig-stamp-box-image",
+      );
+      expect(sealClass(null, "sig-stamp-box")).toBe("sig-stamp-box");
+    });
+  });
+
+  describe("sealImageCss", () => {
+    it("neutralizes the drawn ring and rotation for a real stamp image", () => {
+      const css = sealImageCss();
+
+      expect(css).toContain(".seal.seal-image { border: none;");
+      expect(css).toContain("transform: none;");
+      // The ::before pseudo-element draws the inner ring of the text seal.
+      expect(css).toContain(".seal.seal-image::before { content: none; }");
+      expect(css).toContain(".seal img { max-width: 100%;");
+    });
+
+    it("scopes every rule to the given selector", () => {
+      const css = sealImageCss("sig-stamp-box");
+
+      expect(css).not.toContain(".seal");
+      expect(css).toContain(".sig-stamp-box.sig-stamp-box-image");
+      expect(css).toContain(".sig-stamp-box img");
+    });
+  });
+});
diff --git a/apps/edr-freight-api/src/modules/billing/documents/seal-markup.util.ts b/apps/edr-freight-api/src/modules/billing/documents/seal-markup.util.ts
new file mode 100644
index 000000000..2dd9c4715
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/billing/documents/seal-markup.util.ts
@@ -0,0 +1,64 @@
+/**
+ * The single decision every EDR document makes about its round seal: draw the
+ * one uploaded company stamp when one is configured (StampSettingsService), or
+ * fall back to the plain text rings the document styles itself.
+ *
+ * Only the image-vs-text branch and the image overrides live here — each
+ * document keeps its own `.seal` geometry (the invoice's seal is absolutely
+ * positioned top-right, the warehouse papers' sit inline above the signature
+ * lines), so centralizing the source of the stamp does not relayout anything.
+ *
+ * These helpers are for the HTML/Chromium render path. The hand-built vector
+ * fallbacks in styled-pdf.util.ts cannot embed a raster image and continue to
+ * draw their vector seal — see InvoiceDocumentService for that caveat.
+ */
+
+/** Escape a value for interpolation into HTML text or a quoted attribute. */
+function escapeHtml(value: unknown): string {
+  return String(value ?? "")
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+/**
+ * CSS overrides that neutralize a document's own ring/rotation styling when the
+ * seal is a real stamp image. Append inside a document's <style> block, after
+ * its own `.seal` rules. `selector` is the document's seal class ("seal").
+ */
+export function sealImageCss(selector = "seal"): string {
+  return [
+    `.${selector}.${selector}-image { border: none; border-radius: 0; opacity: 1; transform: none; }`,
+    `.${selector}.${selector}-image::before { content: none; }`,
+    `.${selector} img { max-width: 100%; max-height: 100%; object-fit: contain; }`,
+  ].join("\n    ");
+}
+
+/**
+ * Inner markup for the seal element: the stamp image, or the given text lines
+ * wrapped in a <span> (matching the `.seal span { position: relative }` rule
+ * the ring-drawing documents rely on).
+ *
+ * `stampImageUrl` is expected to be a data URL from
+ * StampSettingsService.getStampImageUrl(); null renders the text fallback.
+ */
+export function sealMarkup(
+  stampImageUrl: string | null | undefined,
+  textLines: string | string[],
+): string {
+  if (stampImageUrl) {
+    return `<img src="${escapeHtml(stampImageUrl)}" alt="Company stamp" />`;
+  }
+  const lines = Array.isArray(textLines) ? textLines : [textLines];
+  return `<span>${lines.map(escapeHtml).join("<br />")}</span>`;
+}
+
+/** Class attribute for the seal element — adds the image modifier when stamped. */
+export function sealClass(
+  stampImageUrl: string | null | undefined,
+  selector = "seal",
+): string {
+  return stampImageUrl ? `${selector} ${selector}-image` : selector;
+}
diff --git a/apps/edr-freight-api/src/modules/bookings/booking-contract.service.ts b/apps/edr-freight-api/src/modules/bookings/booking-contract.service.ts
index 095928bb3..70657f9f6 100644
--- a/apps/edr-freight-api/src/modules/bookings/booking-contract.service.ts
+++ b/apps/edr-freight-api/src/modules/bookings/booking-contract.service.ts
@@ -304,6 +304,7 @@ export class BookingContractService {
   async getSignatures(bookingId: string) {
     const rows = await this.bookingsRepository.findContractSignatures(bookingId);
     const views = rows.map((r) => this.viewModelBuilder.toSignatureView(r));
+    await this.viewModelBuilder.attachProviderStamp(views);
     await this.inlineSignatureImages(views);
     return { signatures: views };
   }
diff --git a/apps/edr-freight-api/src/modules/bookings/bookings.controller.ts b/apps/edr-freight-api/src/modules/bookings/bookings.controller.ts
index f10b5f021..9c4b69ad6 100644
--- a/apps/edr-freight-api/src/modules/bookings/bookings.controller.ts
+++ b/apps/edr-freight-api/src/modules/bookings/bookings.controller.ts
@@ -1267,18 +1267,18 @@ export class BookingsController {
 
   @Post(':id/clearance/delivery-order')
   @BookingStaff(FREIGHT_PERMS.contracts.clearanceDjActions)
-  @UseInterceptors(FileInterceptor('file'))
+  @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes('multipart/form-data')
   async uploadBookingDeliveryOrder(
     @Param('id', ParseUUIDPipe) id: string,
-    @UploadedFile() file: Express.Multer.File,
+    @UploadedFiles() files: Express.Multer.File[],
     @Body('vesselArrivalDate') vesselArrivalDate: string | undefined,
     @Body('doCollectedDate') doCollectedDate: string | undefined,
     @CurrentUser() user: TCurrentUser,
   ) {
     const booking = await this.bookingClearanceService.uploadDeliveryOrder(
       id,
-      file,
+      files ?? [],
       resolveAuthUserId(user),
       { vesselArrivalDate, doCollectedDate },
     );
@@ -1287,17 +1287,17 @@ export class BookingsController {
 
   @Post(':id/clearance/release-order')
   @BookingStaff(FREIGHT_PERMS.contracts.clearanceDjActions)
-  @UseInterceptors(FileInterceptor('file'))
+  @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes('multipart/form-data')
   async uploadBookingReleaseOrder(
     @Param('id', ParseUUIDPipe) id: string,
-    @UploadedFile() file: Express.Multer.File,
+    @UploadedFiles() files: Express.Multer.File[],
     @Body('vesselDepartureDate') vesselDepartureDate: string,
     @CurrentUser() user: TCurrentUser,
   ) {
     const result = await this.bookingClearanceService.uploadReleaseOrder(
       id,
-      file,
+      files ?? [],
       vesselDepartureDate,
       resolveAuthUserId(user),
     );
diff --git a/apps/edr-freight-api/src/modules/bookings/bookings.repository.ts b/apps/edr-freight-api/src/modules/bookings/bookings.repository.ts
index 1c5cc7481..2b1463a95 100644
--- a/apps/edr-freight-api/src/modules/bookings/bookings.repository.ts
+++ b/apps/edr-freight-api/src/modules/bookings/bookings.repository.ts
@@ -1,4 +1,4 @@
-import { BaseRepository } from '@edr/api-common';
+import { BaseRepository, logCtx } from '@edr/api-common';
 import { SchedulingStatus } from '@edr/types';
 import { ConflictException, Injectable } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
@@ -631,6 +631,13 @@ export class BookingsRepository extends BaseRepository<Booking> {
     authorId?: string,
   ): Promise<BookingReviewNote> {
     const repo = this.dataSource.getRepository(BookingReviewNote);
+    // Every rejection/cancellation/change-request reason in the booking flow is
+    // written through here — the "why" behind the status change on the same log
+    // line as the status change itself.
+    logCtx(
+      { bookingId, type, note, authorId },
+      { path: 'reviewNotes', mode: 'push' },
+    );
     return repo.save(
       repo.create({ bookingId, note, type, authorId: authorId ?? null }),
     );
diff --git a/apps/edr-freight-api/src/modules/bookings/bookings.service.ts b/apps/edr-freight-api/src/modules/bookings/bookings.service.ts
index e2a3d9b0c..6c3f14ecb 100644
--- a/apps/edr-freight-api/src/modules/bookings/bookings.service.ts
+++ b/apps/edr-freight-api/src/modules/bookings/bookings.service.ts
@@ -9,7 +9,7 @@ import {
   NotFoundException,
 } from '@nestjs/common';
 import { Freight, SchedulingStatus } from '@edr/types';
-import { insertWithGeneratedReference } from '@edr/api-common';
+import { insertWithGeneratedReference, logCtx } from '@edr/api-common';
 // import { CustomersService } from '../customers/customers.service';
 import { CompaniesService } from '../companies/companies.service';
 import { CompanyKind, CompanyStatus } from '../companies/entities/company.entity';
@@ -59,9 +59,11 @@ import { PdfRenderService } from '../billing/documents/pdf-render.service';
 import { buildTabularFallbackPdf } from '../billing/documents/styled-pdf.util';
 
 /**
- * The allocated train as the backoffice booking detail page needs it: which
- * train, its window phase, and both the planned and actual clock. Attached by
- * `findById` only when the booking is on a schedule.
+ * The train as the backoffice booking detail page needs it: which train, its
+ * window phase, and both the planned and actual clock. Attached by `findById`
+ * for the allocated train (`train_schedule_id`) or, before the batch engine has
+ * allocated one, the train the customer picked at day-commit
+ * (`requested_train_schedule_id`) — see `isRequested`.
  */
 export interface TrainScheduleSummary {
   id: string;
@@ -74,6 +76,12 @@ export interface TrainScheduleSummary {
   actualArrivalAt: string | null;
   windowPhase: string | null;
   paymentPhaseEndsAt: string | null;
+  /**
+   * True when this is the customer's requested train rather than a confirmed
+   * allocation — the state staff review at OPERATION_REQUEST_PENDING, before
+   * accepting the operation puts the booking into the batch pool.
+   */
+  isRequested: boolean;
 }
 
 /** Paginated booking list: flat `total` (backoffice) + `meta` block (portal). */
@@ -2107,6 +2115,21 @@ export class BookingsService {
       throw new NotFoundException(`Booking ${id} not found`);
     }
 
+    // Nearly every booking flow loads the booking through here, so this one
+    // call puts the human-searchable reference + entry state on the request log
+    // line for all of them. Entry state only — the write trail (statusChanges)
+    // shows where it ended up.
+    logCtx(
+      {
+        id: booking.id,
+        reference: booking.reference,
+        statusAtEntry: booking.status,
+        companyId: booking.companyId,
+        contractId: booking.contractId ?? undefined,
+      },
+      { path: "booking" },
+    );
+
     if (booking.files && booking.files.length > 0) {
       booking.files = await Promise.all(
         booking.files.map(async (file: FileRecord) => {
@@ -2132,15 +2155,23 @@ export class BookingsService {
     // Surface the assigned train's operational status so the portal stepper
     // can show the Arrival stage: the booking status stays IN_TRANSIT from
     // dispatch until delivery, so arrival is only knowable from the schedule.
-    if (booking.trainScheduleId) {
+    // The allocated train, or — before the batch engine has allocated one — the
+    // train the customer picked at day-commit. Staff reviewing an operation
+    // request (OPERATION_REQUEST_PENDING) must see which train they are
+    // accepting onto before they approve, and at that point only the requested
+    // id is set.
+    const summarySourceId = booking.trainScheduleId ?? booking.requestedTrainScheduleId;
+    if (summarySourceId) {
       const schedule = await this.dataSource
         .getRepository(TrainSchedule)
-        .findOne({ where: { id: booking.trainScheduleId } });
+        .findOne({ where: { id: summarySourceId } });
+      // trainScheduleStatus drives the portal's Arrival stage, so it stays tied
+      // to a real allocation — a merely requested train has not departed.
       (booking as Booking & { trainScheduleStatus?: string | null }).trainScheduleStatus =
-        schedule?.status ?? null;
-      // Backoffice staff view: the allocated train's identity and clock, so the
-      // detail page can state which train the booking rides and when it runs
-      // without a second round-trip to the schedules API.
+        booking.trainScheduleId ? (schedule?.status ?? null) : null;
+      // Backoffice staff view: the train's identity and clock, so the detail
+      // page can state which train the booking rides and when it runs without a
+      // second round-trip to the schedules API.
       (
         booking as Booking & { trainScheduleSummary?: TrainScheduleSummary | null }
       ).trainScheduleSummary = schedule
@@ -2155,6 +2186,7 @@ export class BookingsService {
             actualArrivalAt: schedule.actualArrivalAt?.toISOString() ?? null,
             windowPhase: schedule.windowPhase ?? null,
             paymentPhaseEndsAt: schedule.paymentPhaseEndsAt?.toISOString() ?? null,
+            isRequested: !booking.trainScheduleId,
           }
         : null;
     }
diff --git a/apps/edr-freight-api/src/modules/bookings/dto/contract-view.dto.ts b/apps/edr-freight-api/src/modules/bookings/dto/contract-view.dto.ts
index 0dceadf43..0491969ed 100644
--- a/apps/edr-freight-api/src/modules/bookings/dto/contract-view.dto.ts
+++ b/apps/edr-freight-api/src/modules/bookings/dto/contract-view.dto.ts
@@ -12,6 +12,12 @@ export class ContractSignatureDto {
 
   @ApiPropertyOptional()
   signatureImageUrl?: string | null;
+
+  @ApiPropertyOptional({
+    description:
+      'Company seal beside the signature. Set for the EDR (STAFF) side from the single global company stamp; null for the client side.',
+  })
+  stampImageUrl?: string | null;
 }
 
 export class SavedSignatureViewDto {
diff --git a/apps/edr-freight-api/src/modules/companies/companies.controller.ts b/apps/edr-freight-api/src/modules/companies/companies.controller.ts
index 1b14845b2..d35400f1a 100644
--- a/apps/edr-freight-api/src/modules/companies/companies.controller.ts
+++ b/apps/edr-freight-api/src/modules/companies/companies.controller.ts
@@ -39,6 +39,7 @@ import {
   CompleteIdentityVerificationDto,
 } from "./dto/complete-identity-verification.dto";
 import { SetOnboardingStepDto } from "./dto/set-onboarding-step.dto";
+import { SetPoaDeclaredDto } from "./dto/set-poa-declared.dto";
 import { StartOnboardingDto } from "./dto/start-onboarding.dto";
 import { DashboardQueryDto } from "./dto/dashboard-query.dto";
 import {
@@ -265,6 +266,7 @@ export class CompaniesController {
       dto.companyType,
       dto.roles,
       dto.nationality,
+      dto.cooperative,
     );
     return new CompanyInfoResponseDto(profile, company);
   }
@@ -415,90 +417,31 @@ export class CompaniesController {
   @PortalCustomer()
   @ApiOperation({
     summary:
-      "Bind a completed Fayda verification to the company's owner or Power of Attorney. " +
+      "Bind a completed Fayda verification to the company's single identity. " +
       "Start the flow with POST /fayda/verification/start (platform=PORTAL), then post the returned code+state here. " +
+      "`subject` must match the company's PoA declaration — the representative when one is named, otherwise the owner. " +
       "The verified name, phone, email and address are written from the Fayda payload; on an approved company the change is staged for backoffice review.",
   })
   async completeIdentityVerification(
     @CurrentUser() user: CurrentIamUser,
     @Body() dto: CompleteIdentityVerificationDto,
   ): Promise<CompanyIdentityStateDto> {
-    return this.companiesService.completeIdentityVerification(user.id, dto, {
-      email: user.email,
-      phoneNumber: user.phoneNumber,
-    });
+    return this.companiesService.completeIdentityVerification(user.id, dto);
   }
 
-  @Post("identity/gm/same-as-owner")
+  @Patch("identity/poa-declared")
   @PortalCustomer()
   @ApiOperation({
     summary:
-      "Declare the General Manager is the company's owner, copying the owner's verified identity across. " +
-      "Refused until the owner is Fayda-verified — there would be nothing proven to copy.",
+      "Answer whether anyone holds power of attorney for this company — the question that decides whose identity is verified. " +
+      'Answering "no" removes the representative entirely: their details, their verification, their passport number and the DARS delegation paper. ' +
+      'Refused for a freight forwarder, which cannot operate without a representative (its answer is always "yes").',
   })
-  async setGmSameAsOwner(
+  async setPoaDeclared(
     @CurrentUser() user: CurrentIamUser,
+    @Body() dto: SetPoaDeclaredDto,
   ): Promise<CompanyIdentityStateDto> {
-    return this.companiesService.setGmSameAsOwner(user.id, {
-      email: user.email,
-      phoneNumber: user.phoneNumber,
-    });
-  }
-
-  @Delete("identity/gm")
-  @PortalCustomer()
-  @ApiOperation({
-    summary:
-      "Clear the General Manager's identity — the \"same as owner\" declaration or a verification, and the details either wrote. " +
-      "Leaves the GM open to be verified in their own right, or typed where Fayda is optional.",
-  })
-  async clearGmIdentity(
-    @CurrentUser() user: CurrentIamUser,
-  ): Promise<CompanyIdentityStateDto> {
-    return this.companiesService.clearGmIdentity(user.id);
-  }
-
-  @Post("identity/poa/same-as-owner")
-  @PortalCustomer()
-  @ApiOperation({
-    summary:
-      "Declare the Power of Attorney is the company's owner, copying the owner's identity across. " +
-      "Waives the DARS delegation paper — nobody delegates to themselves. " +
-      "Refused for an Ethiopian company whose owner is not Fayda-verified yet: its representative must be verified, and there would be nothing proven to copy.",
-  })
-  async setPoaSameAsOwner(
-    @CurrentUser() user: CurrentIamUser,
-  ): Promise<CompanyIdentityStateDto> {
-    return this.companiesService.setPoaSameAsOwner(user.id, {
-      email: user.email,
-      phoneNumber: user.phoneNumber,
-    });
-  }
-
-  @Delete("identity/poa/same-as-owner")
-  @PortalCustomer()
-  @ApiOperation({
-    summary:
-      "Undo the Power of Attorney \"same as owner\" declaration and the identity it copied, leaving the representative open to be verified in their own right. " +
-      "Unlike DELETE identity/fayda/poa this is allowed for a freight forwarder — it is how they change who represents them — and leaves the delegation paper on file.",
-  })
-  async clearPoaSameAsOwner(
-    @CurrentUser() user: CurrentIamUser,
-  ): Promise<CompanyIdentityStateDto> {
-    return this.companiesService.clearPoaSameAsOwner(user.id);
-  }
-
-  @Delete("identity/fayda/poa")
-  @PortalCustomer()
-  @ApiOperation({
-    summary:
-      "Remove the company's Power of Attorney — the verified identity, its details and the delegation paper together. " +
-      "Refused while the company holds a freight forwarder role, which cannot operate without a representative.",
-  })
-  async removePoaIdentity(
-    @CurrentUser() user: CurrentIamUser,
-  ): Promise<CompanyIdentityStateDto> {
-    return this.companiesService.removePoaIdentity(user.id);
+    return this.companiesService.setPoaDeclared(user.id, dto.declared);
   }
 
   @Patch("onboarding-step")
diff --git a/apps/edr-freight-api/src/modules/companies/companies.fayda-identity.spec.ts b/apps/edr-freight-api/src/modules/companies/companies.fayda-identity.spec.ts
index fe40cf08f..30c323ac3 100644
--- a/apps/edr-freight-api/src/modules/companies/companies.fayda-identity.spec.ts
+++ b/apps/edr-freight-api/src/modules/companies/companies.fayda-identity.spec.ts
@@ -177,782 +177,451 @@ function makeService(overrides: Partial<Ctx> = {}) {
 
   return { service, ctx, deps, company };
 }
+describe("one company, one verified identity", () => {
+  it("refuses a verification before the company says who represents it", async () => {
+    const { service } = makeService();
+    await expect(
+      service.completeIdentityVerification("user-1", {
+        subject: "owner",
+        code: "c",
+        state: "s",
+      }),
+    ).rejects.toBeInstanceOf(BadRequestException);
+  });
 
-describe("Fayda identity verification binds a person to the company", () => {
-  it("writes the verified identity", async () => {
-    const { service, ctx } = makeService();
-
+  it("writes the verified identity onto the declared subject", async () => {
+    const { service, ctx } = makeService({ attributes: { poaDeclared: "no" } });
     const state = await service.completeIdentityVerification("user-1", {
       subject: "owner",
       code: "c",
       state: "s",
     });
 
+    expect(state.owner.verified).toBe(true);
+    expect(state.owner.name).toBe("Haile Gebrselassie");
+    expect(state.owner.email).toBe("haile@example.com");
+    expect(state.owner.address).toBe("Addis Ababa");
     expect(ctx.attributes.ownerFaydaSub).toBe("new-sub");
-    expect(ctx.attributes.ownerName).toBe("Haile Gebrselassie");
-    expect(state.owner.verified).toBe(true);
+    expect(state.identityProven).toBe(true);
+    expect(state.complete).toBe(true);
   });
 
-  it("fills every PoA detail from the payload, address included", async () => {
-    const { service, ctx } = makeService();
-
-    await service.completeIdentityVerification("user-1", {
-      subject: "poa",
-      code: "c",
-      state: "s",
-    });
-
-    expect(ctx.attributes.poaName).toBe("Haile Gebrselassie");
-    expect(ctx.attributes.poaEmail).toBe("haile@example.com");
-    expect(ctx.attributes.poaPhone).toBe("+251922000000");
-    expect(ctx.attributes.poaAddress).toBe("Addis Ababa");
+  it("refuses a verification for the person the declaration does not point at", async () => {
+    // A PoA-declared company gates on the PoA. An owner verification here would
+    // sit on the record looking proven while the gate stayed unsatisfied.
+    const { service } = makeService({ attributes: { poaDeclared: "yes" } });
+    await expect(
+      service.completeIdentityVerification("user-1", {
+        subject: "owner",
+        code: "c",
+        state: "s",
+      }),
+    ).rejects.toBeInstanceOf(BadRequestException);
   });
 
-  it("verifies successfully even though Fayda returns no national ID number", async () => {
-    // Fayda's userinfo carries no FAN/FIN claim at all — this must be the
-    // normal, successful path, not an error.
-    const { service } = makeService({
-      verification: {
-        purpose: "VERIFY",
-        verified: true,
-        sub: "x",
-        fullName: "No Fan Here",
-      },
-    });
-
-    const state = await service.completeIdentityVerification("user-1", {
-      subject: "owner",
-      code: "c",
-      state: "s",
-    });
-
-    expect(state.owner.verified).toBe(true);
-  });
-
-  it("lets one identity be both owner and PoA", async () => {
-    // An owner who represents their own company is the ordinary small-business
-    // case, not a conflict — the same answer the GM has always been allowed.
-    const { service, ctx } = makeService({
-      attributes: { ownerFaydaSub: "same-person" },
-      verification: {
-        purpose: "VERIFY",
-        verified: true,
-        sub: "same-person",
-        fullName: "Abebe Bikila",
-      },
-    });
-
+  it("verifies the representative when one is declared", async () => {
+    const { service, ctx } = makeService({ attributes: { poaDeclared: "yes" } });
     const state = await service.completeIdentityVerification("user-1", {
       subject: "poa",
       code: "c",
       state: "s",
     });
-
+    expect(state.subject).toBe("poa");
     expect(state.poa.verified).toBe(true);
-    expect(ctx.attributes.poaFaydaSub).toBe("same-person");
-  });
-
-  it("stages an owner re-verification for review on an approved company", async () => {
-    // The owner is the live company's identity proof, so re-verifying one is
-    // exactly what the backoffice review exists for: it must not rewrite the
-    // row directly.
-    const { service, ctx, deps } = makeService({
-      status: CompanyStatus.Active,
-    });
-
-    await service.completeIdentityVerification("user-1", {
-      subject: "owner",
-      code: "c",
-      state: "s",
-    });
-
-    expect(deps.changeRequestRepo.create).toHaveBeenCalled();
-    expect(ctx.attributes.ownerFaydaSub).toBeUndefined();
-  });
-
-  it("applies a PoA verification live on an approved company", async () => {
-    // The PoA is personnel the company names for itself — the delegation paper
-    // is what a reviewer actually judges — so it does not go to review.
-    const { service, ctx, deps } = makeService({
-      status: CompanyStatus.Active,
-    });
-
-    await service.completeIdentityVerification("user-1", {
-      subject: "poa",
-      code: "c",
-      state: "s",
-    });
-
-    expect(deps.changeRequestRepo.create).not.toHaveBeenCalled();
+    expect(state.poa.address).toBe("Addis Ababa");
+    expect(state.identityProven).toBe(true);
     expect(ctx.attributes.poaFaydaSub).toBe("new-sub");
   });
 
-  it("stages nothing for a verified field an approved company resubmits", async () => {
-    // Approving it could not move the live row — the verified value is written
-    // back over it — so it must never reach a reviewer as a pending change.
-    const { service, deps } = makeService({
-      status: CompanyStatus.Active,
-      attributes: { ...OWNER_VERIFIED, ownerEmail: "abebe@example.com" },
-    });
-
-    await expect(
-      service.updateProfile("user-1", {
-        companyEmail: "someone-else@example.com",
-      } as never),
-    ).resolves.toBeDefined();
-    expect(deps.changeRequestRepo.create).not.toHaveBeenCalled();
-    expect(deps.changeRequestRepo.update).not.toHaveBeenCalled();
-    expect(deps.companiesRepo.update).not.toHaveBeenCalled();
-  });
-
-  // The verified value wins, and it wins by overwriting rather than by
-  // rejecting: nobody types these fields, so a submission that disagrees is a
-  // stale form echoing itself back, not an edit. Failing it would block a save
-  // the customer never made — and leave them no way through, since re-verifying
-  // returns the same value they are being 400'd for.
-  it("overwrites a hand-renamed verified person with the verified name", async () => {
+  it("verifies successfully even though Fayda returns no national ID number", async () => {
     const { service, ctx } = makeService({
-      attributes: { ...OWNER_VERIFIED, ...POA_VERIFIED },
-      files: [paper()],
-    });
-
-    await expect(
-      service.updateProfile("user-1", { poaName: "Someone Else" } as never),
-    ).resolves.toBeDefined();
-    expect(ctx.attributes.poaName).toBe(POA_VERIFIED.poaName);
-  });
-
-  // Fayda's email and phone claims are optional — a verification can prove the
-  // person and return neither. Holding the company mirrors to "the owner is
-  // verified" rather than to "the verification supplied this value" would
-  // clobber the fallbacks the portal is built to send (account email, eTrade's
-  // registered phone) with nothing at all. OWNER_VERIFIED is exactly that
-  // shape: a sub, no contact details.
-  it("keeps company contact details a Fayda verification never supplied", async () => {
-    const { deps } = makeService({
-      attributes: { ...OWNER_VERIFIED },
-    });
-
-    const [, patch] = deps.companiesRepo.update.mock.calls.at(-1)!;
-    expect(patch.email).toBe("account@example.com");
-    expect(patch.phone).toBe("+251911777777");
-  });
-
-  // "Same as owner" copies `ownerEmail ?? null` onto the GM while setting
-  // `gmFaydaSub`. Locking that null made generalManagerEmail required by
-  // onboarding, hidden by the portal's link card and unwritable at once.
-  it("lets the GM's details be typed when the copied owner identity carried none", async () => {
-    const { service } = makeService({
-      attributes: {
-        ...OWNER_VERIFIED,
-        gmSameAsOwner: true,
-        gmFaydaSub: "owner-sub",
-        generalManagerName: "Abebe Bikila",
-        generalManagerEmail: null,
-        generalManagerPhone: null,
+      attributes: { poaDeclared: "no" },
+      verification: {
+        purpose: "VERIFY",
+        verified: true,
+        sub: "new-sub",
+        fullName: "Haile Gebrselassie",
       },
     });
-
-    await expect(
-      service.updateProfile("user-1", {
-        generalManagerEmail: "gm@example.com",
-        generalManagerPhone: "+251911888888",
-      } as never),
-    ).resolves.toBeDefined();
-  });
-
-  // Fayda's email and phone claims are optional and routinely absent. The owner
-  // is who the company is reached through and the step renders no input for
-  // their contact details, so the onboarding account — already OTP-proven —
-  // stands in rather than leaving the company unreachable.
-  describe("account contact details stand in for absent Fayda claims", () => {
-    const noContactClaims = {
-      purpose: "VERIFY",
-      verified: true,
-      sub: "new-sub",
-      fullName: "Haile Gebrselassie",
-      address: "Addis Ababa",
-    };
-    const account = {
-      email: "account@example.com",
-      phoneNumber: "+251911777777",
-    };
-
-    it("falls back to the account for an owner Fayda gave no email or phone", async () => {
-      const { service, ctx } = makeService({ verification: noContactClaims });
-
-      await service.completeIdentityVerification(
-        "user-1",
-        { subject: "owner", code: "c", state: "s" },
-        account,
-      );
-
-      expect(ctx.attributes.ownerEmail).toBe("account@example.com");
-      expect(ctx.attributes.ownerPhone).toBe("+251911777777");
-    });
-
-    it("prefers the Fayda claim over the account when there is one", async () => {
-      const { service, ctx } = makeService();
-
-      await service.completeIdentityVerification(
-        "user-1",
-        { subject: "owner", code: "c", state: "s" },
-        account,
-      );
-
-      expect(ctx.attributes.ownerEmail).toBe("haile@example.com");
-      expect(ctx.attributes.ownerPhone).toBe("+251922000000");
-    });
-
-    it("leaves the PoA alone — the account is not that person", async () => {
-      const { service, ctx } = makeService({ verification: noContactClaims });
-
-      await service.completeIdentityVerification(
-        "user-1",
-        { subject: "poa", code: "c", state: "s" },
-        account,
-      );
-
-      expect(ctx.attributes.poaEmail).toBeUndefined();
-      expect(ctx.attributes.poaPhone).toBeUndefined();
-    });
-
-    // Owners verified before the fallback existed hold blank contacts. Copying
-    // those blanks onto the GM makes generalManagerEmail required by onboarding
-    // with no field anywhere to satisfy it.
-    it("fills the GM copy from the account when the stored owner has no contacts", async () => {
-      const { service, ctx } = makeService({
-        attributes: { ...OWNER_VERIFIED },
-      });
-
-      await service.setGmSameAsOwner("user-1", account);
-
-      expect(ctx.attributes.gmEmail).toBe("account@example.com");
-      expect(ctx.attributes.generalManagerEmail).toBe("account@example.com");
-      expect(ctx.attributes.generalManagerPhone).toBe("+251911777777");
-    });
-
-    it("keeps the stored owner contacts when the GM copy has them", async () => {
-      const { service, ctx } = makeService({
-        attributes: {
-          ...OWNER_VERIFIED,
-          ownerEmail: "abebe@example.com",
-          ownerPhone: "+251911000111",
-        },
-      });
-
-      await service.setGmSameAsOwner("user-1", account);
-
-      expect(ctx.attributes.generalManagerEmail).toBe("abebe@example.com");
-      expect(ctx.attributes.generalManagerPhone).toBe("+251911000111");
-    });
-  });
-
-  it("never locks or gates the general manager — it is not the verified subject", async () => {
-    // GM is a plain typed role; the portal offers a "same as owner" copy, but
-    // the backend must not treat it as identity-owned or require it verified.
-    const { service } = makeService({
-      attributes: { ...OWNER_VERIFIED },
-    });
-
-    await expect(
-      service.updateProfile("user-1", {
-        generalManagerName: "Someone Else",
-        generalManagerEmail: "someone@example.com",
-        generalManagerPhone: "+251911223344",
-      } as never),
-    ).resolves.toBeDefined();
-  });
-});
-
-describe("Ethiopian companies verify with Fayda; foreign companies verify identity by passport", () => {
-  // The company is applying for the forwarder role, so it must not already
-  // hold it — createCompanyProfileForUser short-circuits on an existing profile
-  // and would never reach the gate.
-  const applyingForFf = {
-    profileTypes: [ProfileType.importer],
-    attributes: { ...POA_VERIFIED },
-    files: [paper()],
-  };
-
-  it("blocks the forwarder role while the owner is unverified", async () => {
-    const { service } = makeService(applyingForFf);
-
-    await expect(
-      service.createCompanyProfileForUser(
-        "user-1",
-        ProfileType.freightForwarder,
-      ),
-    ).rejects.toBeInstanceOf(BadRequestException);
-  });
-
-  it("blocks the forwarder role while the PoA is unverified", async () => {
-    const { service } = makeService({
-      profileTypes: [ProfileType.importer],
-      attributes: {
-        ...OWNER_VERIFIED,
-        poaName: "Tirunesh Dibaba",
-        poaEmail: "t@example.com",
-        poaPhone: "+251911000000",
-      },
-      files: [paper()],
-    });
-
-    await expect(
-      service.createCompanyProfileForUser(
-        "user-1",
-        ProfileType.freightForwarder,
-      ),
-    ).rejects.toBeInstanceOf(BadRequestException);
-  });
-
-  it("grants the forwarder role once owner and PoA are both verified", async () => {
-    const { service } = makeService({
-      profileTypes: [ProfileType.importer],
-      attributes: { ...OWNER_VERIFIED, ...POA_VERIFIED },
-      files: [paper()],
-    });
-
-    await expect(
-      service.createCompanyProfileForUser(
-        "user-1",
-        ProfileType.freightForwarder,
-      ),
-    ).resolves.toBeDefined();
-  });
-
-  it("never asks a foreign company for Fayda, verified or not", async () => {
-    const { service } = makeService({
-      nationality: CompanyNationality.Foreign,
-    });
-
     const state = await service.completeIdentityVerification("user-1", {
       subject: "owner",
       code: "c",
       state: "s",
     });
-
-    // Still lets the owner verify — a foreign owner verifying is allowed, just
-    // never required — but the passport is the thing that actually gates it.
     expect(state.owner.verified).toBe(true);
-    expect(state.faydaRequired).toBe(false);
-    expect(state.passportRequired).toBe(true);
+    expect(ctx.attributes.fanNumber).toBeUndefined();
   });
 
-  it("blocks the forwarder role for a foreign company with no owner passport", async () => {
-    const { service } = makeService({
-      profileTypes: [ProfileType.importer],
-      nationality: CompanyNationality.Foreign,
-      attributes: {
-        poaName: "Jean Dupont",
-        poaEmail: "jean@example.com",
-        poaPhone: "+33100000000",
-      },
-    });
-
-    await expect(
-      service.createCompanyProfileForUser(
-        "user-1",
-        ProfileType.freightForwarder,
-      ),
-    ).rejects.toBeInstanceOf(BadRequestException);
-  });
-
-  it("grants the forwarder role to a foreign company whose owner has a passport and whose PoA is Fayda-verified", async () => {
-    const { service } = makeService({
-      profileTypes: [ProfileType.importer],
-      nationality: CompanyNationality.Foreign,
-      attributes: {
-        ownerPassportNumber: "P1234567",
-        ...POA_VERIFIED,
-      },
-      files: [paper()],
-    });
-
-    await expect(
-      service.createCompanyProfileForUser(
-        "user-1",
-        ProfileType.freightForwarder,
-      ),
-    ).resolves.toBeDefined();
-  });
-
-  it("accepts a typed PoA from a foreign company, whose representative may hold no Fayda ID", async () => {
-    // Fayda is an Ethiopian national ID, so only an Ethiopian company's
-    // representative can be held to it. A foreign company is offered the
-    // verification and uses it where its representative holds one, but a typed
-    // name stays sufficient — holding it to Fayda would leave a foreign
-    // company whose representative has no Fayda ID unable to trade at all.
-    const { service } = makeService({
-      profileTypes: [ProfileType.importer],
-      nationality: CompanyNationality.Foreign,
-      attributes: {
-        ownerPassportNumber: "P1234567",
-        poaName: "Jean Dupont",
-        poaEmail: "jean@example.com",
-        poaPhone: "+33100000000",
-      },
-      files: [paper()],
-    });
-
-    await expect(
-      service.createCompanyProfileForUser(
-        "user-1",
-        ProfileType.freightForwarder,
-      ),
-    ).resolves.toBeDefined();
-  });
-
-  it("still refuses a foreign company that named no PoA at all", async () => {
-    // The typed fallback is a different credential, not a waiver: a freight
-    // forwarder acts on other companies' behalf and needs a representative
-    // whatever its nationality.
-    const { service } = makeService({
-      profileTypes: [ProfileType.importer],
-      nationality: CompanyNationality.Foreign,
-      attributes: { ownerPassportNumber: "P1234567" },
-      files: [paper()],
-    });
-
-    await expect(
-      service.createCompanyProfileForUser(
-        "user-1",
-        ProfileType.freightForwarder,
-      ),
-    ).rejects.toBeInstanceOf(BadRequestException);
-  });
-
-  it("holds an Ethiopian company to a Fayda-verified PoA, typed details notwithstanding", async () => {
-    // The relaxation above is scoped to foreign companies only — an Ethiopian
-    // representative holds a Fayda ID, so typing a name must not substitute.
-    const { service } = makeService({
-      profileTypes: [ProfileType.importer],
-      nationality: CompanyNationality.Ethiopian,
-      attributes: {
-        ...OWNER_VERIFIED,
-        poaName: "Abebe Bekele",
-        poaEmail: "abebe@example.com",
-        poaPhone: "+251911000000",
-      },
-      files: [paper()],
-    });
-
-    await expect(
-      service.createCompanyProfileForUser(
-        "user-1",
-        ProfileType.freightForwarder,
-      ),
-    ).rejects.toBeInstanceOf(BadRequestException);
-  });
-
-  it("still requires the passport for a foreign owner who chose to verify with Fayda too", async () => {
-    // Verifying is optional for a foreign owner, but it does not waive the
-    // passport requirement — the two are independent credentials.
-    const { service } = makeService({
-      profileTypes: [ProfileType.importer],
-      nationality: CompanyNationality.Foreign,
-      attributes: {
-        ...OWNER_VERIFIED,
-        poaName: "Jean Dupont",
-        poaEmail: "jean@example.com",
-        poaPhone: "+33100000000",
-      },
-    });
-
-    await expect(
-      service.createCompanyProfileForUser(
-        "user-1",
-        ProfileType.freightForwarder,
-      ),
-    ).rejects.toBeInstanceOf(BadRequestException);
-  });
-
-  // -------------------------------------------------------------------------
-  // General manager
-  // -------------------------------------------------------------------------
-
-  it("reuses the owner's verified identity when the GM is declared the same person", async () => {
-    // The GM is very often the owner. Copying the proven identity is the whole
-    // point — asking one human to complete two verifications proves nothing
-    // extra, and typing the details instead would forge a verified badge.
+  it("never stands the signed-in account in for an absent Fayda claim", async () => {
+    // The person onboarding is not necessarily the person on the licence.
+    // Stamping their address onto the owner made a required field a guess.
     const { service, ctx } = makeService({
-      attributes: {
-        ...OWNER_VERIFIED,
-        ownerEmail: "abebe@example.com",
-        ownerPhone: "+251911222333",
-      },
-    });
-
-    const state = await service.setGmSameAsOwner("user-1");
-
-    expect(state.gm.verified).toBe(true);
-    expect(state.gmSameAsOwner).toBe(true);
-    expect(state.gm.name).toBe("Abebe Bikila");
-    expect(ctx.attributes.gmFaydaSub).toBe("owner-sub");
-    // The notifiers mail the flat column, so a linked GM has to land there too.
-    expect(ctx.attributes.generalManagerEmail).toBe("abebe@example.com");
-  });
-
-  it("refuses to declare the GM is the owner while the owner is unverified", async () => {
-    // Without a verification there is no proven identity to copy — only typed
-    // text, which would arrive wearing a badge it had not earned.
-    const { service } = makeService({ attributes: {} });
-
-    await expect(service.setGmSameAsOwner("user-1")).rejects.toBeInstanceOf(
-      BadRequestException,
-    );
-  });
-
-  it("lets the GM verify as the same human as the owner", async () => {
-    // One human in every role is the ordinary small-business shape, so
-    // verifying with the owner's own Fayda sub has to succeed.
-    const { service, ctx } = makeService({
-      attributes: { ...OWNER_VERIFIED },
+      attributes: { poaDeclared: "no" },
       verification: {
         purpose: "VERIFY",
         verified: true,
-        sub: "owner-sub",
-        fullName: "Abebe Bikila",
-        email: "abebe@example.com",
-        phoneNumber: "+251911222333",
+        sub: "new-sub",
+        fullName: "Haile Gebrselassie",
       },
     });
-
     const state = await service.completeIdentityVerification("user-1", {
-      subject: "gm",
+      subject: "owner",
       code: "c",
       state: "s",
     });
-
-    expect(state.gm.verified).toBe(true);
-    expect(ctx.attributes.gmFaydaSub).toBe("owner-sub");
-    expect(ctx.attributes.generalManagerName).toBe("Abebe Bikila");
+    expect(state.owner.email).toBeNull();
+    expect(state.owner.phone).toBeNull();
+    expect(ctx.attributes.ownerEmail).toBeUndefined();
   });
 
-  it("declares the PoA is the owner, copying the verified identity across", async () => {
-    const { service, ctx } = makeService({ attributes: { ...OWNER_VERIFIED } });
-
-    const state = await service.setPoaSameAsOwner("user-1");
-
-    expect(state.poaSameAsOwner).toBe(true);
-    expect(state.poa.verified).toBe(true);
-    expect(ctx.attributes.poaFaydaSub).toBe(OWNER_VERIFIED.ownerFaydaSub);
-    expect(ctx.attributes.poaName).toBe(OWNER_VERIFIED.ownerName);
+  it("stages a verification for review on an approved company", async () => {
+    const { service, deps, ctx } = makeService({
+      status: CompanyStatus.Active,
+      attributes: { poaDeclared: "no", ...OWNER_VERIFIED },
+    });
+    await service.completeIdentityVerification("user-1", {
+      subject: "owner",
+      code: "c",
+      state: "s",
+    });
+    expect(deps.changeRequestRepo.create).toHaveBeenCalled();
+    // The live row is untouched until a reviewer approves.
+    expect(ctx.attributes.ownerFaydaSub).toBe("owner-sub");
   });
 
-  it("refuses to declare the PoA is the owner while an Ethiopian owner is unverified", async () => {
-    // Its representative must be Fayda-verified, so a declaration here would
-    // record one that could never satisfy the gate.
-    const { service } = makeService({ attributes: {} });
+  it("overwrites a hand-renamed verified person with the verified name", async () => {
+    const { service } = makeService({
+      attributes: { poaDeclared: "no", ...OWNER_VERIFIED },
+    });
+    const profile = await service.updateProfile("user-1", {
+      ownerName: "Someone Else",
+    } as never);
+    expect(profile.ownerName).toBe("Abebe Bikila");
+  });
 
-    await expect(service.setPoaSameAsOwner("user-1")).rejects.toBeInstanceOf(
+  it("keeps a field the verification never supplied typeable", async () => {
+    // Fayda's email claim is optional and `REQUIRED_COMPANY_INFO` demands one,
+    // so locking against an absent value would make it unfillable forever.
+    const { service, ctx } = makeService({
+      attributes: { poaDeclared: "no", ...OWNER_VERIFIED },
+    });
+    await service.updateProfile("user-1", {
+      ownerEmail: "typed@example.com",
+    } as never);
+    expect(ctx.attributes.ownerEmail).toBe("typed@example.com");
+  });
+
+  it("writes the owner's email onto the company, verified or not", async () => {
+    // `companies.email` is what the notification resolver reads first. Gating
+    // this on a Fayda verification left every foreign company without one.
+    const { service, deps } = makeService({ attributes: { poaDeclared: "no" } });
+    await service.updateProfile("user-1", {
+      ownerEmail: "owner@example.com",
+      ownerPhone: "+251911223344",
+    } as never);
+    const patch = deps.companiesRepo.update.mock.calls.at(-1)?.[1] as Record<
+      string,
+      unknown
+    >;
+    expect(patch.email).toBe("owner@example.com");
+    expect(patch.phone).toBe("+251911223344");
+  });
+});
+
+describe("the declaration decides who verifies", () => {
+  it("points at the owner when the company says it has no representative", async () => {
+    const { service, company } = makeService({
+      attributes: { poaDeclared: "no" },
+    });
+    expect(service.getCompanyIdentityState(company() as never).subject).toBe(
+      "owner",
+    );
+  });
+
+  it("points at the representative when it says it has one", async () => {
+    const { service, company } = makeService({
+      attributes: { poaDeclared: "yes" },
+    });
+    expect(service.getCompanyIdentityState(company() as never).subject).toBe(
+      "poa",
+    );
+  });
+
+  it("is null until the company answers, and nothing is proven yet", async () => {
+    const { service, company } = makeService({ attributes: OWNER_VERIFIED });
+    const state = service.getCompanyIdentityState(company() as never);
+    expect(state.poaDeclared).toBeNull();
+    expect(state.subject).toBeNull();
+    expect(state.identityProven).toBe(false);
+    expect(state.complete).toBe(false);
+  });
+
+  it('forces "yes" for a freight forwarder whatever is stored', async () => {
+    // A forwarder signs on other companies' behalf, so a representative is
+    // non-negotiable — including one that answered "no" before taking the role.
+    const { service, company } = makeService({
+      attributes: { poaDeclared: "no" },
+      profileTypes: [ProfileType.freightForwarder],
+    });
+    const state = service.getCompanyIdentityState(company() as never);
+    expect(state.poaDeclared).toBe("yes");
+    expect(state.subject).toBe("poa");
+  });
+
+  it('refuses to set "no" for a freight forwarder', async () => {
+    const { service } = makeService({
+      profileTypes: [ProfileType.freightForwarder],
+    });
+    await expect(service.setPoaDeclared("user-1", "no")).rejects.toBeInstanceOf(
       BadRequestException,
     );
   });
 
-  it("undoes the PoA \"same as owner\" declaration without touching a real verification", async () => {
-    const { service, ctx } = makeService({
-      attributes: { ...OWNER_VERIFIED, ...POA_VERIFIED },
+  it('tears the representative down when answered "no"', async () => {
+    const { service, ctx, deps } = makeService({
+      attributes: { poaDeclared: "yes", ...POA_VERIFIED },
+      files: [paper()],
     });
-
-    // No declaration in place: the verified representative must survive.
-    await service.clearPoaSameAsOwner("user-1");
-    expect(ctx.attributes.poaFaydaSub).toBe(POA_VERIFIED.poaFaydaSub);
-
-    await service.setPoaSameAsOwner("user-1");
-    const state = await service.clearPoaSameAsOwner("user-1");
-
-    expect(state.poaSameAsOwner).toBe(false);
+    const state = await service.setPoaDeclared("user-1", "no");
+    expect(state.poaDeclared).toBe("no");
     expect(state.poa.verified).toBe(false);
+    expect(ctx.attributes.poaName).toBeNull();
     expect(ctx.attributes.poaFaydaSub).toBeNull();
-  });
-
-  it("reports a pre-existing typed GM as unverified rather than blank", async () => {
-    // Companies onboarded before the GM was verifiable have typed details and
-    // no gm* attributes. Those details are still what the notifiers mail, so
-    // they must survive — flagged unverified so the portal offers the upgrade.
-    const { service, company } = makeService({
-      attributes: {
-        ...OWNER_VERIFIED,
-        generalManagerName: "Legacy Manager",
-        generalManagerEmail: "legacy@example.com",
-      },
-    });
-
-    const state = service.getCompanyIdentityState(company() as never);
-
-    expect(state.gm.verified).toBe(false);
-    expect(state.gm.name).toBe("Legacy Manager");
-    expect(state.gm.email).toBe("legacy@example.com");
-  });
-
-  // The mirror image, and the reason the fallback above is gated on the GM
-  // being unverified: a manager Fayda proved but supplied no email for types
-  // one instead, and the portal decides whether to render that input by asking
-  // whether the identity holds one. Reading the typed column back as part of
-  // the verified identity would answer "yes" the moment it was saved — the
-  // input would vanish and a typo could never be corrected.
-  it("keeps a verified GM's typed email out of the verified identity", async () => {
-    const { service, company } = makeService({
-      attributes: {
-        ...OWNER_VERIFIED,
-        gmFaydaSub: "gm-sub",
-        gmFaydaVerifiedAt: "2026-07-03T00:00:00.000Z",
-        gmName: "Derartu Tulu",
-        generalManagerName: "Derartu Tulu",
-        generalManagerEmail: "typed@example.com",
-      },
-    });
-
-    const state = service.getCompanyIdentityState(company() as never);
-
-    expect(state.gm.verified).toBe(true);
-    expect(state.gm.name).toBe("Derartu Tulu");
-    expect(state.gm.email).toBeNull();
-  });
-
-  it("never stands the account in for a GM Fayda gave no email", async () => {
-    // Deliberate: the account is the person onboarding, not necessarily the
-    // manager. The portal asks for the email instead.
-    const { service, ctx } = makeService({
-      attributes: { ...OWNER_VERIFIED },
-      verification: {
-        purpose: "VERIFY",
-        verified: true,
-        sub: "gm-sub",
-        fullName: "Derartu Tulu",
-        phoneNumber: "+251911222333",
-      },
-    });
-
-    const state = await service.completeIdentityVerification(
-      "user-1",
-      { subject: "gm", code: "c", state: "s" },
-      { email: "account@example.com", phoneNumber: "+251911777777" },
-    );
-
-    expect(ctx.attributes.gmEmail).toBeUndefined();
-    expect(state.gm.verified).toBe(true);
-    expect(state.gm.email).toBeNull();
-  });
-
-  it("accepts the email typed for a GM whose verification carried none", async () => {
-    const { service, ctx } = makeService({
-      attributes: {
-        ...OWNER_VERIFIED,
-        gmFaydaSub: "gm-sub",
-        gmName: "Derartu Tulu",
-        generalManagerName: "Derartu Tulu",
-      },
-    });
-
-    await service.updateProfile("user-1", {
-      generalManagerEmail: "gm@example.com",
-    } as never);
-
-    expect(ctx.attributes.generalManagerEmail).toBe("gm@example.com");
-  });
-
-  it("does not let an unproven GM block the company from trading", async () => {
-    // The GM names who to talk to, not what the company may do. Capturing it
-    // through Fayda changed how it is collected, not whether it gates.
-    const { service } = makeService({
-      attributes: { ...OWNER_VERIFIED },
-    });
-
-    await expect(
-      service.createCompanyProfileForUser("user-1", ProfileType.importer),
-    ).resolves.toBeDefined();
+    // The paper evidenced a delegation that no longer exists.
+    expect(deps.filesService.remove).toHaveBeenCalledWith("file-1");
   });
 });
 
-/**
- * Fayda's email and phone claims are optional, so a *verified* representative
- * can still be missing the details `REQUIRED_POA_FIELDS` demands. The PoA step
- * renders an input for whatever the verification did not supply — so onboarding
- * has to report them outstanding, rather than letting a freight forwarder
- * submit an incomplete representative and be refused its next PoA edit for it.
- */
-describe("onboarding requirements name the PoA details Fayda did not supply", () => {
-  const POA_VERIFIED_NO_CONTACTS = {
-    poaFaydaSub: "poa-sub",
-    poaFaydaVerifiedAt: "2026-07-02T00:00:00.000Z",
-    poaName: "Tirunesh Dibaba",
-  };
+describe("foreign companies prove the same person by Fayda OR passport", () => {
+  const foreign = (attributes: Record<string, unknown>) =>
+    makeService({ nationality: CompanyNationality.Foreign, attributes });
 
-  it("reports the missing email and phone for a freight forwarder", async () => {
+  it("accepts a passport number in place of Fayda", async () => {
+    const { service, company } = foreign({
+      poaDeclared: "no",
+      ownerPassportNumber: "P1234567",
+    });
+    const state = service.getCompanyIdentityState(company() as never);
+    expect(state.passportAccepted).toBe(true);
+    expect(state.identityProven).toBe(true);
+  });
+
+  it("accepts a Fayda verification instead — the passport is not additional", async () => {
+    const { service, company } = foreign({ poaDeclared: "no", ...OWNER_VERIFIED });
+    expect(
+      service.getCompanyIdentityState(company() as never).identityProven,
+    ).toBe(true);
+  });
+
+  it("collects the passport of whichever person carries the identity", async () => {
+    const { service, company } = foreign({
+      poaDeclared: "yes",
+      poaPassportNumber: "P7654321",
+    });
+    const state = service.getCompanyIdentityState(company() as never);
+    expect(state.subject).toBe("poa");
+    expect(state.identityProven).toBe(true);
+  });
+
+  it("is not satisfied by the OTHER person's passport", async () => {
+    // A PoA-represented company gates on the PoA; the owner's passport proves
+    // nobody relevant.
+    const { service, company } = foreign({
+      poaDeclared: "yes",
+      ownerPassportNumber: "P1234567",
+    });
+    expect(
+      service.getCompanyIdentityState(company() as never).identityProven,
+    ).toBe(false);
+  });
+
+  it("offers an Ethiopian company no passport alternative", async () => {
+    const { service, company } = makeService({
+      attributes: { poaDeclared: "no", ownerPassportNumber: "P1234567" },
+    });
+    const state = service.getCompanyIdentityState(company() as never);
+    expect(state.passportAccepted).toBe(false);
+    expect(state.identityProven).toBe(false);
+  });
+});
+
+describe("the owner is checked against the eTrade licence", () => {
+  it("matches ignoring case, punctuation and word order", async () => {
+    const { service, company } = makeService({
+      attributes: {
+        poaDeclared: "no",
+        ownerName: "abebe  bikila",
+        etradeManagerName: "BIKILA, Abebe",
+      },
+    });
+    expect(
+      service.getCompanyIdentityState(company() as never).ownerMatchesEtrade,
+    ).toBe(true);
+  });
+
+  it("flags a different person", async () => {
+    const { service, company } = makeService({
+      attributes: {
+        poaDeclared: "no",
+        ownerName: "Haile Gebrselassie",
+        etradeManagerName: "Abebe Bikila",
+      },
+    });
+    expect(
+      service.getCompanyIdentityState(company() as never).ownerMatchesEtrade,
+    ).toBe(false);
+  });
+
+  it("reports null when there is nothing to compare", async () => {
+    // eTrade's ManagerNameEng is frequently blank; a null must not read as a
+    // mismatch, which would flag half the customer base.
+    const { service, company } = makeService({
+      attributes: { poaDeclared: "no", ownerName: "Abebe Bikila" },
+    });
+    expect(
+      service.getCompanyIdentityState(company() as never).ownerMatchesEtrade,
+    ).toBeNull();
+  });
+
+  it("never blocks on a mismatch — it is the reviewer's call", async () => {
     const { service } = makeService({
-      attributes: { ...OWNER_VERIFIED, ...POA_VERIFIED_NO_CONTACTS },
-      profileTypes: [ProfileType.freightForwarder],
+      attributes: {
+        poaDeclared: "no",
+        ...OWNER_VERIFIED,
+        // The verified owner is a different human from the one on the licence.
+        ownerName: "Haile Gebrselassie",
+        etradeManagerName: "Abebe Bikila",
+      },
+    });
+    const reqs = await service.getOnboardingRequirements("user-1");
+    expect(reqs.outstanding).not.toContain(
+      expect.stringContaining("eTrade"),
+    );
+  });
+});
+
+describe("the freight-forwarder gate", () => {
+  const addForwarder = (service: CompaniesService) =>
+    service.addCompanyProfilesForUser("user-1", [ProfileType.freightForwarder]);
+
+  it("blocks the role while the representative is unverified", async () => {
+    const { service } = makeService({ attributes: { poaDeclared: "yes" } });
+    await expect(addForwarder(service)).rejects.toBeInstanceOf(
+      BadRequestException,
+    );
+  });
+
+  it("blocks the role on a company that answered no — it becomes yes", async () => {
+    // Taking the role forces the declaration, so a company that had answered
+    // "no" cannot inherit that answer past the gate.
+    const { service } = makeService({
+      attributes: { poaDeclared: "no", ...OWNER_VERIFIED },
+    });
+    await expect(addForwarder(service)).rejects.toBeInstanceOf(
+      BadRequestException,
+    );
+  });
+
+  it("blocks the role without the DARS delegation paper", async () => {
+    const { service } = makeService({
+      attributes: { poaDeclared: "yes", ...POA_VERIFIED },
+      files: [],
+    });
+    await expect(addForwarder(service)).rejects.toBeInstanceOf(
+      BadRequestException,
+    );
+  });
+
+  it("grants the role once the representative is proven and the paper is on file", async () => {
+    const { service } = makeService({
+      attributes: { poaDeclared: "yes", ...POA_VERIFIED },
       files: [paper()],
     });
+    await expect(addForwarder(service)).resolves.toBeDefined();
+  });
 
-    const req = await service.getOnboardingRequirements("user-1");
+  it("grants it to a foreign forwarder whose representative has a passport", async () => {
+    const { service } = makeService({
+      nationality: CompanyNationality.Foreign,
+      attributes: {
+        poaDeclared: "yes",
+        ...POA_VERIFIED,
+        poaFaydaSub: undefined,
+        poaPassportNumber: "P7654321",
+      },
+      files: [paper()],
+    });
+    await expect(addForwarder(service)).resolves.toBeDefined();
+  });
+});
 
-    expect(req.poa.missingFields.map((f) => f.key)).toEqual([
+describe("onboarding requirements report exactly what is outstanding", () => {
+  it("asks the power-of-attorney question before anything else about identity", async () => {
+    const { service } = makeService();
+    const reqs = await service.getOnboardingRequirements("user-1");
+    expect(reqs.poa.declared).toBeNull();
+    expect(reqs.outstanding).toContain(
+      "Tell us whether anyone holds power of attorney for your company",
+    );
+  });
+
+  it("names the representative's missing details once one is declared", async () => {
+    const { service } = makeService({
+      attributes: { poaDeclared: "yes", poaName: "Tirunesh Dibaba" },
+    });
+    const reqs = await service.getOnboardingRequirements("user-1");
+    expect(reqs.poa.missingFields.map((f) => f.key)).toEqual([
       "poaEmail",
       "poaPhone",
     ]);
-    expect(req.poa.complete).toBe(false);
-    expect(req.outstanding).toEqual(
-      expect.arrayContaining(["Add your poa email", "Add your poa phone"]),
-    );
   });
 
-  it("clears once they are typed", async () => {
+  it("asks nothing about a representative from a company that has none", async () => {
     const { service } = makeService({
-      attributes: { ...OWNER_VERIFIED, ...POA_VERIFIED },
-      profileTypes: [ProfileType.freightForwarder],
-      files: [paper()],
+      attributes: { poaDeclared: "no", ...OWNER_VERIFIED },
     });
-
-    const req = await service.getOnboardingRequirements("user-1");
-
-    expect(req.poa.missingFields).toEqual([]);
-    expect(req.poa.complete).toBe(true);
-    expect(req.outstanding).not.toContain("Add your poa email");
+    const reqs = await service.getOnboardingRequirements("user-1");
+    expect(reqs.poa.missingFields).toEqual([]);
+    expect(reqs.poa.delegationLetterRequired).toBe(false);
   });
 
-  // Fayda's email claim is optional and the GM's verification has no account to
-  // fall back on, so demanding one blocked a manager the government had already
-  // proved. `companyNotifyEmailExpr` resolves the address from the contact
-  // person or the registering account instead, so nothing needs this filled.
-  it("does not hold a company back for a general manager with no email", async () => {
+  it("demands the delegation paper from every declared representative", async () => {
+    // No waiver: the owner representing the company IS the "no" answer, so a
+    // "yes" always means a delegation that has to be evidenced.
     const { service } = makeService({
-      attributes: {
-        ...OWNER_VERIFIED,
-        gmFaydaSub: "gm-sub",
-        generalManagerName: "Derartu Tulu",
-        generalManagerPhone: "+251911222333",
-      },
+      attributes: { poaDeclared: "yes", ...POA_VERIFIED },
+      files: [],
     });
-
-    const req = await service.getOnboardingRequirements("user-1");
-
-    expect(req.companyInfo.missingFields.map((f) => f.key)).not.toContain(
-      "generalManagerEmail",
-    );
-    expect(req.outstanding).not.toContain("Add your general manager email");
+    const reqs = await service.getOnboardingRequirements("user-1");
+    expect(reqs.poa.delegationLetterRequired).toBe(true);
+    expect(reqs.isComplete).toBe(false);
   });
 
-  it("still holds it back for the manager's name and phone", async () => {
-    const { service } = makeService({ attributes: { ...OWNER_VERIFIED } });
-
-    const req = await service.getOnboardingRequirements("user-1");
-
-    expect(req.companyInfo.missingFields.map((f) => f.key)).toEqual(
-      expect.arrayContaining(["generalManagerName", "generalManagerPhone"]),
+  it("names the owner's missing details", async () => {
+    const { service } = makeService({ attributes: { poaDeclared: "no" } });
+    const reqs = await service.getOnboardingRequirements("user-1");
+    const missing = reqs.companyInfo.missingFields.map((f) => f.key);
+    expect(missing).toEqual(
+      expect.arrayContaining(["ownerName", "ownerEmail", "ownerPhone"]),
     );
   });
 
-  // An importer that never named a representative owes nothing here — the step
-  // is one it may walk straight past.
-  it("asks nothing of a company with no PoA at all", async () => {
-    const { service } = makeService({ attributes: { ...OWNER_VERIFIED } });
+  it("reports the verification against the person it actually gates on", async () => {
+    const { service } = makeService({ attributes: { poaDeclared: "yes" } });
+    const reqs = await service.getOnboardingRequirements("user-1");
+    expect(reqs.outstanding).toContain(
+      "Verify your Power of Attorney with Fayda",
+    );
+  });
 
-    const req = await service.getOnboardingRequirements("user-1");
-
-    expect(req.poa.missingFields).toEqual([]);
-    expect(req.poa.complete).toBe(true);
+  it("offers the passport alternative to a foreign company", async () => {
+    const { service } = makeService({
+      nationality: CompanyNationality.Foreign,
+      attributes: { poaDeclared: "no" },
+    });
+    const reqs = await service.getOnboardingRequirements("user-1");
+    expect(reqs.outstanding).toContain(
+      "Verify the person named on your eTrade licence with Fayda, or add their passport number",
+    );
   });
 });
diff --git a/apps/edr-freight-api/src/modules/companies/companies.poa-delegation.spec.ts b/apps/edr-freight-api/src/modules/companies/companies.poa-delegation.spec.ts
index b85344e8e..96dc3ff53 100644
--- a/apps/edr-freight-api/src/modules/companies/companies.poa-delegation.spec.ts
+++ b/apps/edr-freight-api/src/modules/companies/companies.poa-delegation.spec.ts
@@ -174,21 +174,26 @@ describe("PoA delegation paper is enforced wherever PoA state changes", () => {
     ).resolves.toBeDefined();
   });
 
-  it("waives the paper when the owner represents the company themselves", async () => {
-    // Nobody delegates to themselves, so a self-declared PoA owes no DARS
-    // paper — the representative's own details are still required.
+  it('owes nothing when the company answered "no representative"', async () => {
+    // "The owner represents the company themselves" is now expressed as the
+    // declaration being "no" — there is no delegation, so no paper is due. The
+    // representative's details are cleared with the answer, so there is nothing
+    // left to evidence either.
     const { service } = makeService({
-      attributes: { ...VERIFIED_IDENTITIES, poaSameAsOwner: true },
+      attributes: { ...VERIFIED_IDENTITIES, poaDeclared: "no" },
     });
 
     await expect(
-      service.updateProfile("user-1", POA as never),
+      service.updateProfile("user-1", {} as never),
     ).resolves.toBeDefined();
   });
 
-  it("grants the forwarder role to a self-represented company with no paper", async () => {
+  it("refuses the forwarder role without a paper, however it represents itself", async () => {
+    // The self-representation waiver is gone: a freight forwarder signs on
+    // other companies' behalf, so the delegation and the paper evidencing it
+    // are non-negotiable.
     const { service } = makeService({
-      attributes: { ...VERIFIED_IDENTITIES, ...POA, poaSameAsOwner: true },
+      attributes: { ...VERIFIED_IDENTITIES, ...POA, poaDeclared: "yes" },
     });
 
     await expect(
@@ -196,7 +201,7 @@ describe("PoA delegation paper is enforced wherever PoA state changes", () => {
         "user-1",
         ProfileType.freightForwarder,
       ),
-    ).resolves.toBeDefined();
+    ).rejects.toBeInstanceOf(BadRequestException);
   });
 
   it("rejects a paper the reviewer sent back for correction", async () => {
diff --git a/apps/edr-freight-api/src/modules/companies/companies.role-deselect.spec.ts b/apps/edr-freight-api/src/modules/companies/companies.role-deselect.spec.ts
index 5961be90f..ea81e4dbe 100644
--- a/apps/edr-freight-api/src/modules/companies/companies.role-deselect.spec.ts
+++ b/apps/edr-freight-api/src/modules/companies/companies.role-deselect.spec.ts
@@ -26,7 +26,13 @@ function makeService(existing: ExistingProfile[]) {
     })),
     softDelete: jest.fn(async () => undefined),
   };
-  const companiesRepo = { update: jest.fn(async () => null) };
+  // `findById` is only consulted when the co-operative flag is in play (adding
+  // a forwarder role, or setting the flag itself) — a plain company row is the
+  // right answer for every case here.
+  const companiesRepo = {
+    update: jest.fn(async () => null),
+    findById: jest.fn(async () => ({ id: "company-1", attributes: {} })),
+  };
   const profilesRepo = {
     findByUserId: jest.fn(async () => ({
       id: "external-1",
diff --git a/apps/edr-freight-api/src/modules/companies/companies.service.ts b/apps/edr-freight-api/src/modules/companies/companies.service.ts
index 5dd55e704..98b30f006 100644
--- a/apps/edr-freight-api/src/modules/companies/companies.service.ts
+++ b/apps/edr-freight-api/src/modules/companies/companies.service.ts
@@ -24,6 +24,7 @@ import { FilesService } from "../files/files.service";
 import { FileRecord } from "../files/entities/file.entity";
 import { FileUploadSettingsService } from "../file-upload-settings/file-upload-settings.service";
 import {
+  COOPERATIVE_ONBOARDING_CODE,
   POA_DELEGATION_FILE_KEY,
   POA_DELEGATION_LABEL,
   POA_DELEGATION_PENDING_CODE,
@@ -33,8 +34,13 @@ import {
   buildCompanyIdentityState,
   CompanyIdentityStateDto,
   CompleteIdentityVerificationDto,
+  ETRADE_MANAGER_NAME_KEY,
+  ETRADE_MANAGER_PHONE_KEY,
   IDENTITY_SUBJECTS,
   IdentitySubject,
+  POA_DECLARED_KEY,
+  PoaDeclaration,
+  readPoaDeclaration,
 } from "./dto/complete-identity-verification.dto";
 import { ETradeService } from "./services/etrade.service";
 import { CompanyNotifierService } from "./company-notifier.service";
@@ -55,6 +61,8 @@ import {
   CompanyNationality,
   CompanyStatus,
   CompanyType,
+  COOPERATIVE_KEY,
+  isCooperative,
 } from "./entities/company.entity";
 import { ExternalProfile } from "./entities/external-profile.entity";
 import {
@@ -93,15 +101,16 @@ const POA_ATTRIBUTES = [
   "poaAddress",
 ] as const;
 /**
- * Personnel an approved company maintains itself: its contact person, its
- * general manager and its Power of Attorney. These name who to talk to, not
- * what the company is allowed to do, so freezing the settings page until a
- * reviewer gets to a new phone number costs more than it protects. They write
- * straight to the live row even for an active company.
+ * The one person an approved company maintains itself: its contact person.
+ * That names who to talk to, not what the company is allowed to do, so freezing
+ * the settings page until a reviewer gets to a new phone number costs more than
+ * it protects. It writes straight to the live row even for an active company.
  *
- * The PoA's *delegation letter* is deliberately not here — the paper is the
- * thing that actually evidences the delegation, so it still goes through
- * review (see `uploadPoaDelegationLetter`), as does the owner's own identity.
+ * The owner and the Power of Attorney are deliberately NOT here. Between them
+ * they carry the company's only identity verification — the owner is who the
+ * eTrade licence names, the PoA is who may act for the company — so an edit to
+ * either is exactly the kind of change a reviewer exists to see. Their
+ * delegation letter has always gone through review (`uploadPoaDelegationLetter`).
  */
 const SELF_SERVICE_ATTRIBUTES: readonly string[] = [
   "contactPersonName",
@@ -109,12 +118,8 @@ const SELF_SERVICE_ATTRIBUTES: readonly string[] = [
   "contactPersonEmail",
   "contactPersonPhone",
   "contactVerifiedPhone",
-  "generalManagerName",
-  "generalManagerEmail",
-  "generalManagerPhone",
-  ...POA_ATTRIBUTES,
 ];
-/** Mandatory once the company operates as a freight forwarder. */
+/** Mandatory once the company names a Power of Attorney. */
 const REQUIRED_POA_FIELDS: { key: string; label: string }[] = [
   { key: "poaName", label: "PoA name" },
   { key: "poaEmail", label: "PoA email" },
@@ -122,42 +127,25 @@ const REQUIRED_POA_FIELDS: { key: string; label: string }[] = [
 ];
 
 /**
- * `attributes` key prefix per verifiable person. The owner is NOT the general
- * manager: the owner is who the verification proves the company through, the
- * GM is personnel it names. They're very often the same human, which is what
- * the portal's "same as owner" copy is for.
+ * `attributes` key prefix per person. The owner is whoever the eTrade licence
+ * names as the business's manager; the PoA is whoever the company delegates to.
+ * Exactly one of them carries the company's identity verification — which one
+ * is the company's own declaration (`poaDeclared`).
  */
 const IDENTITY_PREFIX: Record<IdentitySubject, string> = {
   owner: "owner",
   poa: "poa",
-  gm: "gm",
 };
 
-/**
- * Typed GM columns a GM verification also writes. Three notifier services mail
- * `company.generalManagerEmail` directly, so leaving these behind would mean a
- * verified GM whose address the system never actually uses.
- */
-const GM_TYPED_FIELDS = [
-  "generalManagerName",
-  "generalManagerEmail",
-  "generalManagerPhone",
-] as const;
-
 /**
  * Identity fields a Fayda verification owns outright, per person. Once verified
  * these can no longer be typed — the government IdP is the source, so an edit
  * that disagrees with it is either a mistake or an attempt to launder the
  * guarantee away.
- *
- * The GM's entries are its typed columns: a verified GM is locked the same way
- * the others are, while an unverified one (a foreign company's, or a record
- * that predates this) stays freely editable.
  */
 const IDENTITY_OWNED_FIELDS: Record<IdentitySubject, string[]> = {
   owner: ["ownerName", "ownerEmail", "ownerPhone", "ownerAddress"],
   poa: ["poaName", "poaEmail", "poaPhone", "poaAddress"],
-  gm: [...GM_TYPED_FIELDS],
 };
 
 /**
@@ -242,35 +230,46 @@ export class CompaniesService {
         label: "Contact person phone",
         get: (c) => c.attributes?.contactPersonPhone,
       },
+      // The owner — whoever the eTrade licence names as the business's manager.
+      // All three are required whatever their source: the eTrade lookup fills
+      // the name and phone, a Fayda verification can fill all three, and the
+      // portal renders an input for whatever neither supplied. eTrade never
+      // returns an email and Fayda's email claim is optional, so in practice
+      // that field is usually typed — which is fine, because there IS an input
+      // for it. What there is no longer is a fallback to the signed-in account:
+      // the person onboarding is not necessarily the person on the licence, and
+      // silently stamping their address onto the owner made the record a guess.
       {
-        key: "generalManagerName",
-        label: "General manager name",
-        get: (c) => c.attributes?.generalManagerName,
+        key: "ownerName",
+        label: "Owner name",
+        get: (c) => c.attributes?.ownerName,
       },
-      // The manager's EMAIL is deliberately absent. It was demanded because the
-      // notifiers were believed to mail it, and Fayda's email claim is optional
-      // — so a manager the government proved without one blocked the whole
-      // submission over an address nothing could produce. `companyNotifyEmailExpr`
-      // now resolves the address itself and falls through to the contact
-      // person's, then to the registering account's (which signup guarantees),
-      // so nothing depends on this being filled. It is still collected and still
-      // preferred when present; it just no longer holds the company hostage.
       {
-        key: "generalManagerPhone",
-        label: "General manager phone",
-        get: (c) => c.attributes?.generalManagerPhone,
+        key: "ownerEmail",
+        label: "Owner email",
+        get: (c) => c.attributes?.ownerEmail,
+      },
+      {
+        key: "ownerPhone",
+        label: "Owner phone",
+        get: (c) => c.attributes?.ownerPhone,
       },
     ];
 
-  /** The nationality-based document setting code for a company. */
-  private documentSettingCodeFor(
-    nationality: CompanyNationality | null | undefined,
-  ): string {
-    return nationality === CompanyNationality.Foreign
+  /**
+   * The document setting code for a company: one of three mutually exclusive
+   * sets. A co-operative union or farm resolves to its own set regardless of
+   * nationality — it holds no business licence, so it owes a different list of
+   * papers rather than the nationality list plus extras.
+   */
+  private documentSettingCodeFor(company: Company): string {
+    if (isCooperative(company)) return COOPERATIVE_ONBOARDING_CODE;
+    return company.nationality === CompanyNationality.Foreign
       ? "company_onboarding_documents_foreign"
       : "company_onboarding_documents_ethiopian";
   }
 
+
   async createCompany(dto: CreateCompanyDto): Promise<Company> {
     const exists = await this.companiesRepo.existsByTin(dto.tin);
     if (exists) {
@@ -377,19 +376,45 @@ export class CompaniesService {
     companyType: CompanyType,
     roles: ProfileType[],
     nationality?: CompanyNationality,
+    cooperative?: boolean,
   ): Promise<{ profile: ExternalProfile; company: Company }> {
     // Already started — reuse the existing draft, just ensure roles exist and
     // keep the nationality up to date if it was (re)selected.
     const existing = await this.profilesRepo.findByUserId(identity.userId);
     if (existing) {
       const companyId = existing.company?.id ?? existing.companyId;
+      // Only load the row when the answer actually depends on it: to merge the
+      // flag into `attributes`, or to read a stored one the caller didn't send.
+      const needsCompany =
+        cooperative !== undefined ||
+        roles.includes(ProfileType.freightForwarder);
+      const current = needsCompany
+        ? await this.companiesRepo.findById(companyId)
+        : null;
+      const isCoop = cooperative ?? isCooperative(current);
+      this.assertRolesAllowedForCooperative(isCoop, roles);
+      this.assertNationalityAllowedForCooperative(isCoop, nationality);
       await this.syncCompanyProfiles(companyId, companyType, roles);
-      if (nationality) {
-        await this.companiesRepo.update(companyId, { nationality });
+      const updates: Partial<Company> = {};
+      if (nationality) updates.nationality = nationality;
+      // Ticking the box on a draft that was saved as foreign has to correct the
+      // stored nationality too, or the company keeps resolving to the foreign
+      // document set.
+      if (isCoop) updates.nationality = CompanyNationality.Ethiopian;
+      if (cooperative !== undefined) {
+        updates.attributes = {
+          ...(current?.attributes ?? {}),
+          [COOPERATIVE_KEY]: cooperative,
+        };
+      }
+      if (Object.keys(updates).length > 0) {
+        await this.companiesRepo.update(companyId, updates);
       }
       return this.getCompanyInfoByUserId(identity.userId);
     }
 
+    this.assertRolesAllowedForCooperative(cooperative === true, roles);
+    this.assertNationalityAllowedForCooperative(cooperative === true, nationality);
     const allowedTypes = this.getProfileTypeForCompanyType(companyType);
     const chosenTypes = roles.filter((t) => allowedTypes.includes(t));
 
@@ -402,6 +427,7 @@ export class CompaniesService {
       country: "Ethiopia",
       nationality: nationality ?? CompanyNationality.Ethiopian,
       status: CompanyStatus.Pending,
+      ...(cooperative ? { attributes: { [COOPERATIVE_KEY]: true } } : {}),
     });
 
     await this.profilesRepo.create({
@@ -419,6 +445,45 @@ export class CompaniesService {
     return this.getCompanyInfoByUserId(identity.userId);
   }
 
+  /**
+   * A co-operative union or farm cannot hold the freight-forwarder role.
+   *
+   * Forwarding is licensed work — the forwarder signs on other companies'
+   * behalf, which is why the role carries a mandatory Power of Attorney and a
+   * DARS delegation paper. A co-op is here precisely because it has no business
+   * licence, so the role is refused at the door rather than left to fail later
+   * at approval with a document it can never produce.
+   */
+  private assertRolesAllowedForCooperative(
+    cooperative: boolean,
+    roles: ProfileType[],
+  ): void {
+    if (!cooperative) return;
+    if (roles.includes(ProfileType.freightForwarder)) {
+      throw new BadRequestException(
+        "A co-operative union or farm cannot register as a freight forwarder — that role requires a business licence.",
+      );
+    }
+  }
+
+  /**
+   * A co-operative union or farm is registered in Ethiopia by the co-operative
+   * promotion agency, so it is always an Ethiopian company — "foreign" is not a
+   * combination that exists, and allowing it would resolve the company to a
+   * document set built around an investment licence it cannot hold.
+   */
+  private assertNationalityAllowedForCooperative(
+    cooperative: boolean,
+    nationality: CompanyNationality | undefined,
+  ): void {
+    if (!cooperative) return;
+    if (nationality === CompanyNationality.Foreign) {
+      throw new BadRequestException(
+        "A co-operative union or farm is registered in Ethiopia — it cannot onboard as a foreign company.",
+      );
+    }
+  }
+
   /**
    * Reconcile the company's operational profiles with the roles the user has
    * selected: create the missing ones, drop the ones they deselected.
@@ -768,6 +833,7 @@ export class CompaniesService {
     company: Company,
     dto: Partial<UpdateProfileDto> & {
       faydaIdentity?: VerifiedIdentityAttributes;
+      etradeManager?: { name: string; phone: string };
     },
   ): Record<string, any> {
     const companyUpdates: Record<string, any> = {};
@@ -796,12 +862,10 @@ export class CompaniesService {
       attrUpdates.contactVerifiedPhone = normalizeE164(
         dto.contactVerifiedPhone,
       );
-    if (dto.generalManagerName !== undefined)
-      attrUpdates.generalManagerName = dto.generalManagerName;
-    if (dto.generalManagerEmail !== undefined)
-      attrUpdates.generalManagerEmail = dto.generalManagerEmail;
-    if (dto.generalManagerPhone !== undefined)
-      attrUpdates.generalManagerPhone = normalizeE164(dto.generalManagerPhone);
+    if (dto.ownerName !== undefined) attrUpdates.ownerName = dto.ownerName;
+    if (dto.ownerEmail !== undefined) attrUpdates.ownerEmail = dto.ownerEmail;
+    if (dto.ownerPhone !== undefined)
+      attrUpdates.ownerPhone = normalizeE164(dto.ownerPhone);
     if (dto.poaName !== undefined) attrUpdates.poaName = dto.poaName;
     if (dto.poaPhone !== undefined)
       attrUpdates.poaPhone = normalizeE164(dto.poaPhone);
@@ -829,11 +893,29 @@ export class CompaniesService {
     if (dto.etradePhone !== undefined)
       companyUpdates.etradePhone = normalizeE164(dto.etradePhone);
 
-    // A plain typed field — never Fayda-verified, so no lock ever applies to
-    // it. Independent of the owner's verification: still required for a
-    // foreign company even if the owner also verifies with Fayda.
+    // Plain typed fields — never Fayda-verified, so no lock ever applies. For a
+    // foreign company a passport number proves the person just as a Fayda
+    // verification does, so it is collected for whichever of the two carries
+    // the company's identity.
     if (dto.ownerPassportNumber !== undefined)
       attrUpdates.ownerPassportNumber = dto.ownerPassportNumber;
+    if (dto.poaPassportNumber !== undefined)
+      attrUpdates.poaPassportNumber = dto.poaPassportNumber;
+
+    // eTrade's own manager, captured at lookup by `applyEtradeSourcedFields`.
+    // Never off the wire — the global pipe runs `forbidNonWhitelisted`, so this
+    // reaches us only from that method, the same guarantee `faydaIdentity` has.
+    // Stored apart from `ownerName`/`ownerPhone` so the two can be COMPARED:
+    // the company asserts an owner, eTrade states a manager, and the backoffice
+    // check is whether they are the same person (`ownerMatchesEtrade`).
+    if (dto.etradeManager) {
+      if (dto.etradeManager.name)
+        attrUpdates[ETRADE_MANAGER_NAME_KEY] = dto.etradeManager.name;
+      if (dto.etradeManager.phone)
+        attrUpdates[ETRADE_MANAGER_PHONE_KEY] = normalizeE164(
+          dto.etradeManager.phone,
+        );
+    }
 
     // A verified identity overwrites the person's details. `faydaIdentity`
     // never comes off the wire — the global validation pipe runs with
@@ -844,19 +926,17 @@ export class CompaniesService {
       Object.assign(attrUpdates, dto.faydaIdentity);
     }
 
-    // Keyed on the verified VALUE, not on `ownerFaydaSub`: Fayda's email and
-    // phone claims are optional, so a verification can prove the person while
-    // supplying neither (see completeIdentityVerification's conditional
-    // spreads). The portal falls back to the account email / eTrade's
-    // registered phone in exactly that case and submits it on every save of
-    // the company step — locking against an absent value would 400 that
-    // forever, and re-verifying could never clear it because Fayda still has
-    // nothing to return.
-    if (attrUpdates.ownerFaydaSub) {
-      if (attrUpdates.ownerEmail) companyUpdates.email = attrUpdates.ownerEmail;
-      if (attrUpdates.ownerPhone)
-        companyUpdates.phone = normalizeE164(String(attrUpdates.ownerPhone));
-    }
+    // The company's own contact columns follow the owner, verified or not.
+    //
+    // This used to be gated on `ownerFaydaSub`, which meant `companies.email`
+    // was only ever written for a Fayda-verified owner — so every foreign
+    // company (passport instead of Fayda) had none, and the notification
+    // resolver papered over it by falling through to the general manager's
+    // address. The GM is gone and the owner's email is now required outright,
+    // so this is simply where it lands.
+    if (attrUpdates.ownerEmail) companyUpdates.email = attrUpdates.ownerEmail;
+    if (attrUpdates.ownerPhone)
+      companyUpdates.phone = normalizeE164(String(attrUpdates.ownerPhone));
 
     // Renaming a Fayda-verified person by hand would launder the guarantee
     // away, so the verification keeps these fields: a submission that disagrees
@@ -874,12 +954,10 @@ export class CompaniesService {
         if (dto.faydaIdentity && field in dto.faydaIdentity) continue;
         const stored = company.attributes?.[field];
         // A verification that supplied nothing for this field left no guarantee
-        // to protect, so it stays typeable. Matters most for the GM —
-        // `setGmSameAsOwner` copies `ownerEmail ?? null` onto
-        // `generalManagerEmail` while setting `gmFaydaSub`, and
-        // REQUIRED_COMPANY_INFO still demands that email, so holding a null
-        // here makes it required, hidden by the portal's "same as owner" card,
-        // and unwritable all at once.
+        // to protect, so it stays typeable. This is what makes the required
+        // owner email reachable: Fayda's email claim is optional, so a verified
+        // owner routinely has none stored — locking against that absence would
+        // make `REQUIRED_COMPANY_INFO` demand a field nobody could ever fill.
         if (stored === null || stored === undefined || stored === "") continue;
         attrUpdates[field] = stored;
       }
@@ -965,9 +1043,7 @@ export class CompaniesService {
     if (POA_ATTRIBUTES.some((k) => dto[k] !== undefined)) {
       const attributes = this.mapProfileDtoToCompanyUpdates(company, dto)
         .attributes as Record<string, unknown>;
-      await this.assertPoaDelegationSatisfied(company.id, attributes, {
-        requirePoa: await this.isFreightForwarder(company.id),
-      });
+      await this.assertPoaDelegationSatisfied(company, attributes);
     }
 
     if (company.status !== CompanyStatus.Active) {
@@ -1202,7 +1278,7 @@ export class CompaniesService {
     uploaded: FileRecord[],
   ): Promise<CompanyRevisionChange[]> {
     const setting = await this.fileUploadSettingsService
-      .getByCode(this.documentSettingCodeFor(company.nationality))
+      .getByCode(this.documentSettingCodeFor(company))
       .catch(() => null);
     const fields = setting?.fields ?? [];
     const singleFileCodes = new Set(
@@ -1615,12 +1691,13 @@ export class CompaniesService {
       // the last place it has to be checked — the role may have been applied
       // for before the paper was withdrawn.
       if (company && existing.type === ProfileType.freightForwarder) {
-        this.assertIdentityVerified(company, { requirePoa: true });
-        await this.assertPoaDelegationSatisfied(
-          company.id,
-          company.attributes,
-          { requirePoa: true },
-        );
+        // The row was loaded FOR UPDATE, so its relations are not populated —
+        // and `readPoaDeclaration` reads `companyProfiles` to force "yes" for a
+        // forwarder. This IS the forwarder profile being approved, so naming it
+        // is enough (and truthful) for both assertions below.
+        company.companyProfiles = company.companyProfiles ?? [existing];
+        this.assertIdentityVerified(company);
+        await this.assertPoaDelegationSatisfied(company, company.attributes);
       }
 
       const [companyDocs, profileDocs] = await Promise.all([
@@ -1884,11 +1961,12 @@ export class CompaniesService {
       // without a Power of Attorney and its DARS paper — checked here so the
       // customer is told at the point of asking, not at review.
       if (type === ProfileType.freightForwarder) {
-        this.assertIdentityVerified(company, { requirePoa: true });
+        this.assertRolesAllowedForCooperative(isCooperative(company), [type]);
+        const asForwarder = this.withProfileType(company, type);
+        this.assertIdentityVerified(asForwarder);
         await this.assertPoaDelegationSatisfied(
-          companyId,
+          asForwarder,
           await this.effectivePoaAttributes(company),
-          { requirePoa: true },
         );
       }
 
@@ -1930,11 +2008,12 @@ export class CompaniesService {
 
     let created = await this.companyProfilesRepo.findByType(companyId, type);
     if (!created && type === ProfileType.freightForwarder) {
-      this.assertIdentityVerified(company, { requirePoa: true });
+      this.assertRolesAllowedForCooperative(isCooperative(company), [type]);
+      const asForwarder = this.withProfileType(company, type);
+      this.assertIdentityVerified(asForwarder);
       await this.assertPoaDelegationSatisfied(
-        companyId,
+        asForwarder,
         await this.effectivePoaAttributes(company),
-        { requirePoa: true },
       );
     }
     if (!created) {
@@ -1983,10 +2062,12 @@ export class CompaniesService {
       .filter((f) => !f.get(company))
       .map((f) => ({ key: f.key, label: f.label }));
 
-    // 2. Nationality-based company documents + which are already uploaded.
-    const documentSettingCode = this.documentSettingCodeFor(
-      company.nationality,
-    );
+    // 2. Company documents + which are already uploaded. One set applies: the
+    // company's nationality set, or the co-operative set in its place — a union
+    // or farm holds no business licence, so it owes its own list rather than the
+    // nationality list plus extras.
+    const cooperative = isCooperative(company);
+    const documentSettingCode = this.documentSettingCodeFor(company);
     const [setting, uploadedFiles] = await Promise.all([
       this.fileUploadSettingsService
         .getByCode(documentSettingCode)
@@ -2026,35 +2107,34 @@ export class CompaniesService {
         };
       }),
     );
-    const missingLicenses = licenseProfiles.filter((p) => !p.uploaded);
+    // A co-operative holds no business licence — that is the whole reason it
+    // skips the eTrade lookup — so the per-role licence is not owed. Its own
+    // document set (merged above) is what stands in for it. The profiles are
+    // still reported so the portal can show them; only the requirement lifts.
+    const missingLicenses = cooperative
+      ? []
+      : licenseProfiles.filter((p) => !p.uploaded);
 
-    // 4. Power of Attorney. Optional in general, but a freight forwarder acts on
-    // other companies' behalf so its PoA is mandatory. Either way, a PoA that
-    // has been entered must be evidenced by the DARS delegation paper — a legal
-    // requirement, so unlike the documents above it does not depend on the
-    // upload set carrying a field for it (see poa-delegation.constants.ts).
-    const poaRequired = (company.companyProfiles ?? []).some(
-      (p) => p.type === ProfileType.freightForwarder,
-    );
-    const poaProvided = POA_ATTRIBUTES.some((k) =>
-      (company.attributes?.[k] as string | undefined)?.trim(),
-    );
+    // 4. Power of Attorney. Whether there is one at all is the company's own
+    // declaration — the question the wizard asks outright — and that answer is
+    // what decides whose identity gets verified, so an unanswered one is itself
+    // outstanding. A freight forwarder never gets to answer: it signs on other
+    // companies' behalf, so `readPoaDeclaration` forces "yes".
+    //
+    // Once there IS a representative, their details and the DARS delegation
+    // paper are both due. The paper is a legal requirement, so unlike the
+    // documents above it does not depend on the upload set carrying a field for
+    // it (see poa-delegation.constants.ts).
+    const poaDue = identity.poaDeclared === "yes";
     const delegation = await this.getPoaDelegationState(company.id);
-    // "There is a representative" and "a paper is owed for them" used to be the
-    // same condition. They part company once the owner represents the company
-    // themselves: the representative's details are still required, but nobody
-    // delegates to themselves, so no DARS paper is due (`assertPoaDelegationSatisfied`
-    // returns on the same flag — the two must agree).
-    const poaDue = poaRequired || poaProvided;
-    const delegationDue = poaDue && !identity.poaSameAsOwner;
+    const delegationDue = poaDue;
     // The representative's details normally arrive from their Fayda
     // verification — but Fayda's email and phone claims are optional and
     // routinely come back empty, and the PoA step renders an input for whatever
     // the verification did not supply. So these are askable after all, and are
-    // reported outstanding once a PoA is required or provided; reporting
-    // nothing here let a freight forwarder finish onboarding with a
-    // representative the API's own `REQUIRED_POA_FIELDS` calls incomplete, then
-    // 400'd their next PoA edit for it.
+    // reported outstanding once a PoA is declared; reporting nothing here let a
+    // freight forwarder finish onboarding with a representative the API's own
+    // `REQUIRED_POA_FIELDS` calls incomplete, then 400'd their next PoA edit.
     const missingPoaFields = poaDue
       ? REQUIRED_POA_FIELDS.filter(
         (f) => !(company.attributes?.[f.key] as string | undefined)?.trim(),
@@ -2065,10 +2145,15 @@ export class CompaniesService {
     // replace it before the application counts as complete.
     const flaggedDelegation = delegationDue && delegation.flagged;
 
-    // Mirrors `poaProven` in buildCompanyIdentityState — see the note there.
-    const poaProven = identity.faydaRequired
-      ? identity.poa.verified
-      : identity.poa.verified || Boolean(identity.poa.name?.trim());
+    // 5. The single identity. Who proves it is `identity.subject`; how they may
+    // prove it is nationality-dependent (Fayda always, a passport number as an
+    // alternative for a foreign company). Both are derived once in
+    // buildCompanyIdentityState so this list can never disagree with the gate
+    // `assertIdentityVerified` actually enforces.
+    const identitySubjectLabel =
+      identity.subject === "poa"
+        ? "your Power of Attorney"
+        : "the person named on your eTrade licence";
 
     const outstanding = [
       ...missingInfo.map((f) => `Add your ${f.label.toLowerCase()}`),
@@ -2086,58 +2171,38 @@ export class CompaniesService {
           `Re-upload your ${POA_DELEGATION_LABEL} — EDR asked for a correction`,
         ]
         : []),
-      ...(identity.faydaRequired && !identity.owner.verified
-        ? ["Verify the company owner's identity with Fayda"]
+      ...(identity.poaDeclared === null
+        ? ["Tell us whether anyone holds power of attorney for your company"]
         : []),
-      // Nationality-aware, exactly like `poaProven` in
-      // buildCompanyIdentityState and the check in `assertIdentityVerified`:
-      // Fayda is an Ethiopian national ID, so a foreign company's typed
-      // representative has to count. Demanding a verification here regardless
-      // made this list disagree with the rule actually enforced, and left a
-      // foreign freight forwarder unable to submit — asked for a Fayda
-      // verification its representative may have no way to obtain.
-      ...((poaRequired || poaProvided) && !poaProven
+      ...(identity.poaDeclared !== null && !identity.identityProven
         ? [
-          identity.faydaRequired
-            ? "Verify your Power of Attorney's identity with Fayda"
-            : "Name your Power of Attorney, or verify them with Fayda",
+          identity.passportAccepted
+            ? `Verify ${identitySubjectLabel} with Fayda, or add their passport number`
+            : `Verify ${identitySubjectLabel} with Fayda`,
         ]
         : []),
-      ...(identity.passportRequired && !identity.owner.passportNumber
-        ? ["Add the company owner's passport number"]
-        : []),
     ];
 
     // Progress spans every required item the user has to satisfy: company-info
-    // fields, required documents, one license per operational profile, and the
-    // PoA details/paper whenever those are mandatory.
+    // fields, required documents, one license per operational profile, the PoA
+    // details/paper once declared, and the two identity items — answering the
+    // declaration, and proving the person it points at.
     const requiredDocCount = documents.filter((d) => d.isRequired).length;
     // The delegation paper plus the representative's own required details —
     // `completed` below subtracts every one of those it is still missing, so
     // leaving them out of the total would make the bar understate progress.
     const poaItemCount =
       (poaDue ? REQUIRED_POA_FIELDS.length : 0) + (delegationDue ? 1 : 0);
-    // One item per identity credential the company has to prove: the owner
-    // always (Fayda for Ethiopian, passport for foreign), plus the PoA once
-    // there is one — Fayda for an Ethiopian company, a named representative
-    // for a foreign one, same rule as `poaProven` above. Counting a foreign
-    // company's typed PoA as unproven here left the progress bar permanently
-    // short of 100% on an item it had already satisfied.
-    const ownerCredentialDue =
-      identity.faydaRequired || identity.passportRequired;
-    const ownerCredentialProven = identity.faydaRequired
-      ? identity.owner.verified
-      : Boolean(identity.owner.passportNumber);
-    const identityItemCount = (ownerCredentialDue ? 1 : 0) + (poaDue ? 1 : 0);
     const missingIdentityCount =
-      (ownerCredentialDue && !ownerCredentialProven ? 1 : 0) +
-      (poaDue && !poaProven ? 1 : 0);
+      (identity.poaDeclared === null ? 1 : 0) +
+      (identity.identityProven ? 0 : 1);
     const total =
       requiredInfo.length +
       requiredDocCount +
-      licenseProfiles.length +
+      (cooperative ? 0 : licenseProfiles.length) +
       poaItemCount +
-      identityItemCount;
+      // The declaration and the verification it selects.
+      2;
     const completed =
       total -
       (missingInfo.length +
@@ -2150,6 +2215,7 @@ export class CompaniesService {
     return new OnboardingRequirementsResponseDto({
       documentSettingCode,
       nationality: company.nationality ?? CompanyNationality.Ethiopian,
+      cooperative,
       companyInfo: {
         complete: missingInfo.length === 0,
         missingFields: missingInfo,
@@ -2157,8 +2223,12 @@ export class CompaniesService {
       documents,
       licenseProfiles,
       poa: {
-        required: poaRequired,
-        provided: poaProvided,
+        // "Locked" rather than "required": a freight forwarder is not asked the
+        // question at all, everyone else answers it themselves.
+        locked: identity.poaDeclared === "yes" && (company.companyProfiles ?? []).some(
+          (p) => p.type === ProfileType.freightForwarder,
+        ),
+        declared: identity.poaDeclared,
         delegationLetterRequired: delegationDue,
         delegationLetterUploaded: delegation.onFile,
         delegationLetterFlagged: delegation.flagged,
@@ -2689,39 +2759,44 @@ export class CompaniesService {
    * judged against the files that would survive it (`ignoreFileIds`).
    */
   private async assertPoaDelegationSatisfied(
-    companyId: string,
+    company: Company,
     attributes: Record<string, unknown> | null | undefined,
-    opts: { requirePoa: boolean; ignoreFileIds?: string[] },
+    opts: { ignoreFileIds?: string[] } = {},
   ): Promise<void> {
+    // The declaration is the whole gate. A company that says it has no
+    // representative owes nothing here; one that says it has owes the details
+    // AND the paper, with no exceptions — including a freight forwarder, for
+    // whom `readPoaDeclaration` forces "yes" regardless of what is stored.
+    const declared = readPoaDeclaration({
+      attributes: attributes as Company["attributes"],
+      companyProfiles: company.companyProfiles,
+    });
+    if (declared !== "yes") return;
+
+    const isForwarder = (company.companyProfiles ?? []).some(
+      (p) => p.type === ProfileType.freightForwarder,
+    );
     const read = (key: string) =>
       (attributes?.[key] as string | undefined)?.trim();
-    const poaProvided = POA_ATTRIBUTES.some((k) => read(k));
-    if (!opts.requirePoa && !poaProvided) return;
 
-    if (opts.requirePoa) {
-      const missing = REQUIRED_POA_FIELDS.filter((f) => !read(f.key));
-      if (missing.length > 0) {
-        throw new BadRequestException(
-          `A freight forwarder acts on other companies' behalf, so a Power of Attorney is required. ` +
-          `Add the ${missing.map((f) => f.label.toLowerCase()).join(", ")} first.`,
-        );
-      }
+    const missing = REQUIRED_POA_FIELDS.filter((f) => !read(f.key));
+    if (missing.length > 0) {
+      throw new BadRequestException(
+        (isForwarder
+          ? "A freight forwarder acts on other companies' behalf, so a Power of Attorney is required. "
+          : "You told us someone holds power of attorney for this company. ") +
+        `Add the ${missing.map((f) => f.label.toLowerCase()).join(", ")} first.`,
+      );
     }
 
-    // Nobody delegates to themselves: an owner representing their own company
-    // has no delegation to evidence, so the DARS paper is not owed. The
-    // representative's own details are still required above — a forwarder's
-    // counterparties need someone to contact either way.
-    if (attributes?.poaSameAsOwner) return;
-
     const { onFile, flagged } = await this.getPoaDelegationState(
-      companyId,
+      company.id,
       opts.ignoreFileIds,
     );
     if (!onFile) {
       throw new BadRequestException(
         `Upload the ${POA_DELEGATION_LABEL} for the Power of Attorney` +
-        (opts.requirePoa ? " — it is required for freight forwarders." : "."),
+        (isForwarder ? " — it is required for freight forwarders." : "."),
       );
     }
     if (flagged) {
@@ -2732,54 +2807,145 @@ export class CompaniesService {
     }
   }
 
-  /** Does this company operate as a freight forwarder? */
-  private async isFreightForwarder(companyId: string): Promise<boolean> {
-    const profiles = await this.companyProfilesRepo.findByCompanyId(companyId);
-    return profiles.some((p) => p.type === ProfileType.freightForwarder);
-  }
-
   // ---------------------------------------------------------------------------
-  // Fayda identity verification (owner / PoA)
+  // Identity verification (one per company)
   //
-  // A completed VeriFayda verification proves a person's name, phone, email
-  // and address — Fayda's userinfo carries no national ID number, so none of
-  // that is collected here. For an Ethiopian company both the owner and its
-  // PoA (once named) must be verified before the company can trade. Fayda is
-  // an Ethiopian national ID system, so a foreign company's owner proves
-  // identity with a typed passport number instead — required on its own
-  // terms, not waived by an owner who happens to verify with Fayda too.
+  // A company proves itself through exactly ONE person. Which one is its own
+  // declaration: the Power of Attorney when it names a representative,
+  // otherwise the owner — whoever the eTrade licence names as the business's
+  // manager. There is no general manager and no "same as owner" copy: an owner
+  // who represents their own company simply answers "no, nobody holds power of
+  // attorney", and verifies as the owner.
+  //
+  // A completed VeriFayda verification proves that person's name, phone, email
+  // and address (Fayda's userinfo carries no national ID number, so none is
+  // collected). Fayda is an Ethiopian national ID, so a foreign company may
+  // instead type a passport number for the same person — an alternative, not an
+  // addition.
   // ---------------------------------------------------------------------------
 
   /**
-   * Verification state for both people, plus whether it is mandatory here.
-   * `complete` answers the gate question directly so the portal, the onboarding
-   * requirements and the assertions below all read the same verdict — the
-   * derivation itself is shared with ProfileResponseDto.
+   * The company's identity state: both people, who currently carries the
+   * verification, whether it is proven, and whether the owner the company put
+   * forward matches the eTrade licence. `complete` answers the gate question
+   * directly so the portal, the onboarding requirements and the assertions
+   * above all read the same verdict — the derivation itself is shared with
+   * ProfileResponseDto and the backoffice company DTO.
    */
   getCompanyIdentityState(company: Company): CompanyIdentityStateDto {
     return buildCompanyIdentityState(company);
   }
 
   /**
-   * Complete a Fayda verification and bind the identity to one of the company's
-   * people. The portal starts the flow through the shared
+   * Record whether anyone holds power of attorney for this company.
+   *
+   * This is the question that decides whose identity gets verified, so it is
+   * stored rather than inferred from "are any `poa*` keys set" — absence means
+   * "not asked yet", which is an outstanding onboarding item in its own right.
+   *
+   * Answering "no" tears the representative down: their details, their
+   * verification, their passport number and the DARS paper evidencing them all
+   * go. Leaving any of it behind would keep the company on the hook for a
+   * delegation it has just said does not exist.
+   *
+   * Refused for a freight forwarder — it signs on other companies' behalf, so a
+   * representative is non-negotiable. (`readPoaDeclaration` forces "yes" for
+   * them anyway; this is the honest error rather than a silently ignored write.)
+   */
+  async setPoaDeclared(
+    userId: string,
+    declared: PoaDeclaration,
+  ): Promise<CompanyIdentityStateDto> {
+    const { company } = await this.getCompanyInfoByUserId(userId);
+
+    if (
+      declared === "no" &&
+      (company.companyProfiles ?? []).some(
+        (p) => p.type === ProfileType.freightForwarder,
+      )
+    ) {
+      throw new BadRequestException(
+        "A freight forwarder acts on other companies' behalf, so it must have a Power of Attorney. Remove the freight forwarder role first.",
+      );
+    }
+
+    const attributes: Record<string, unknown> = {
+      ...(company.attributes ?? {}),
+      [POA_DECLARED_KEY]: declared,
+    };
+
+    if (declared === "no") {
+      for (const key of [
+        ...POA_ATTRIBUTES,
+        "poaFaydaSub",
+        "poaFaydaVerifiedAt",
+        "poaBirthdate",
+        "poaGender",
+        "poaPassportNumber",
+      ]) {
+        attributes[key] = null;
+      }
+      await this.deletePoaDelegationFiles(company.id);
+    }
+
+    const updated = await this.companiesRepo.update(company.id, { attributes });
+    if (!updated)
+      throw new NotFoundException(`Company ${company.id} not found`);
+    updated.companyProfiles = company.companyProfiles;
+    return this.getCompanyIdentityState(updated);
+  }
+
+  /** Drop every DARS paper on file — the delegation it evidenced is gone. */
+  private async deletePoaDelegationFiles(companyId: string): Promise<void> {
+    const records = await this.filesService.findByResource(
+      companyId,
+      COMPANY_RESOURCE,
+    );
+    for (const r of records) {
+      if (
+        r.code === POA_DELEGATION_FILE_KEY ||
+        r.code === POA_DELEGATION_PENDING_CODE
+      ) {
+        await this.filesService.remove(r.id);
+        await this.withdrawDocumentIntent(companyId, r.id);
+      }
+    }
+  }
+
+  /**
+   * Complete a Fayda verification and bind the identity to the company.
+   *
+   * The portal starts the flow through the shared
    * `POST /fayda/verification/start` and only tells us which person it was for
    * here, at completion — so the verifayda module stays generic and its session
    * table needs no company-specific column.
+   *
+   * The subject has to be the one the company's declaration calls for. A
+   * verification bound to the other person would sit on the record looking
+   * proven while the gate — which reads only the declared subject — stayed
+   * unsatisfied, and nothing in the portal would explain why.
    */
   async completeIdentityVerification(
     userId: string,
     dto: CompleteIdentityVerificationDto,
-    /**
-     * The signed-in account, used as the owner's fallback contact details.
-     * Optional so the callers that only have a user id keep compiling — they
-     * simply get no fallback.
-     */
-    account?: { email?: string; phoneNumber?: string },
   ): Promise<CompanyIdentityStateDto> {
     const { company } = await this.getCompanyInfoByUserId(userId);
+    const state = buildCompanyIdentityState(company);
     const prefix = IDENTITY_PREFIX[dto.subject];
 
+    if (state.subject === null) {
+      throw new BadRequestException(
+        "Tell us whether anyone holds power of attorney for this company first — the answer decides whose identity we verify.",
+      );
+    }
+    if (state.subject !== dto.subject) {
+      throw new BadRequestException(
+        state.subject === "poa"
+          ? "This company is represented by a Power of Attorney, so it is their identity we need — not the owner's."
+          : "This company has no Power of Attorney, so it is the owner's identity we need.",
+      );
+    }
+
     const result = await this.verifaydaService.completeVerification({
       code: dto.code,
       state: dto.state,
@@ -2790,71 +2956,38 @@ export class CompaniesService {
       );
     }
 
-    // An owner who is also the company's representative is a supported answer,
-    // not a conflict — the same way the GM is very often the owner. Small
-    // companies routinely have one human in all three roles, and the portal's
-    // "same as owner" cards exist precisely so they can say so. No identity
-    // here is refused for colliding with another.
-
-    const now = new Date().toISOString();
-
-    // Fayda's email and phone claims are optional and routinely come back empty.
-    // For the owner that leaves the company with no contact details at all: the
-    // step renders no input for them (they are the verification's output), and
-    // "same as owner" then copies those blanks onto `generalManagerEmail` /
-    // `generalManagerPhone`, which `REQUIRED_COMPANY_INFO` demands at submit —
-    // an unfixable dead end. The account doing the onboarding is the one contact
-    // we always have, and it is already OTP-proven, so it stands in.
+    // Only what Fayda actually returned is written. Its email and phone claims
+    // are optional and routinely come back empty — the portal renders an input
+    // for whatever is missing and the customer fills it in.
     //
-    // Owner only: the PoA and the GM are other people, and the registering
-    // account's address is not theirs to wear.
-    const isOwner = dto.subject === "owner";
-    const email = result.email || (isOwner ? account?.email : undefined);
-    const phone =
-      result.phoneNumber || (isOwner ? account?.phoneNumber : undefined);
-
+    // There is deliberately NO fallback to the signed-in account. The person
+    // onboarding is not necessarily the person on the licence, so stamping
+    // their address onto the owner turned a required field into a guess that
+    // looked verified.
     const identity: VerifiedIdentityAttributes = {
       [`${prefix}FaydaSub`]: result.sub,
-      [`${prefix}FaydaVerifiedAt`]: now,
+      [`${prefix}FaydaVerifiedAt`]: new Date().toISOString(),
       [`${prefix}Birthdate`]: result.birthdate ?? null,
       [`${prefix}Gender`]: result.gender ?? null,
       // The verified payload owns the person's details from here on.
       ...(result.fullName ? { [`${prefix}Name`]: result.fullName } : {}),
-      ...(email ? { [`${prefix}Email`]: email } : {}),
+      ...(result.email ? { [`${prefix}Email`]: result.email } : {}),
       // Fayda returns whatever the national registry holds, which is routinely a
       // local number ("0911223344"). Every typed phone in this service is stored
       // E.164, and `@IsValidPhone()` rejects anything else — so a raw claim here
       // becomes a value the portal reads back and cannot resubmit.
-      ...(phone ? { [`${prefix}Phone`]: normalizeE164(phone) } : {}),
+      ...(result.phoneNumber
+        ? { [`${prefix}Phone`]: normalizeE164(result.phoneNumber) }
+        : {}),
       ...(result.address ? { [`${prefix}Address`]: result.address } : {}),
     };
 
-    // A GM verification also lands on the typed columns the rest of the system
-    // already reads (the booking, train-scheduling and contract notifiers all
-    // mail `generalManagerEmail`), and clears any earlier "same as owner"
-    // declaration — verifying in their own right is the GM answering for
-    // themselves.
-    // Verifying the representative in their own right answers the question the
-    // "same as owner" declaration answered, so the declaration goes.
-    if (dto.subject === "poa") {
-      identity.poaSameAsOwner = false;
-    }
-
-    if (dto.subject === "gm") {
-      identity.gmSameAsOwner = false;
-      if (result.fullName) identity.generalManagerName = result.fullName;
-      if (result.email) identity.generalManagerEmail = result.email;
-      if (result.phoneNumber)
-        identity.generalManagerPhone = normalizeE164(result.phoneNumber);
-    }
-
-    // An approved company's *owner* is its identity proof, so re-verifying one
-    // is staged for backoffice review rather than quietly rewriting a live
-    // record. The PoA and GM are personnel — the company names its own
-    // representative and manager, and the delegation letter backing the PoA is
-    // what the reviewer sees — so those land live, matching their typed
-    // counterparts in `SELF_SERVICE_ATTRIBUTES`.
-    if (company.status === CompanyStatus.Active && dto.subject === "owner") {
+    // An approved company's identity is what its approval rested on, so
+    // re-verifying is staged for backoffice review rather than quietly
+    // rewriting a live record. Both subjects go through review now: whichever
+    // one the declaration points at IS the company's proof, and the owner is
+    // additionally the person the reviewer checks against the eTrade licence.
+    if (company.status === CompanyStatus.Active) {
       await this.stageIdentityChange(company, userId, identity);
       return this.getCompanyIdentityState(company);
     }
@@ -2868,261 +3001,6 @@ export class CompaniesService {
     return this.getCompanyIdentityState(updated);
   }
 
-  /**
-   * Declare that the General Manager is the company's owner.
-   *
-   * The GM is very often the owner, and making that human verify twice buys
-   * nothing — the owner's verification already proves them. So this copies the
-   * owner's verified identity across rather than starting a second flow, and
-   * records `gmSameAsOwner` so the portal can show it as a declaration rather
-   * than as a verification the GM passed in their own right.
-   *
-   * Refused until the owner is actually verified: without that there is no
-   * proven identity to copy, only typed text that would arrive wearing a
-   * verified badge.
-   */
-  async setGmSameAsOwner(
-    userId: string,
-    /** Same fallback as {@link completeIdentityVerification}, for owners
-     * verified before that fallback existed — their stored contact details are
-     * blank, and copying blanks here would block the submit. */
-    account?: { email?: string; phoneNumber?: string },
-  ): Promise<CompanyIdentityStateDto> {
-    const { company } = await this.getCompanyInfoByUserId(userId);
-    const attrs = company.attributes ?? {};
-    const ownerSub = attrs.ownerFaydaSub as string | undefined;
-    if (!ownerSub) {
-      throw new BadRequestException(
-        "Verify the company owner with Fayda first — there is no proven identity to reuse yet.",
-      );
-    }
-
-    const ownerEmail = (attrs.ownerEmail as string | undefined) || account?.email || null;
-    const ownerPhone = (attrs.ownerPhone as string | undefined) || account?.phoneNumber || null;
-
-    const copied: Record<string, unknown> = {
-      gmSameAsOwner: true,
-      gmFaydaSub: ownerSub,
-      gmFaydaVerifiedAt: attrs.ownerFaydaVerifiedAt ?? new Date().toISOString(),
-      gmName: attrs.ownerName ?? null,
-      gmEmail: ownerEmail,
-      gmPhone: ownerPhone ? normalizeE164(ownerPhone) : null,
-      gmAddress: attrs.ownerAddress ?? null,
-      gmBirthdate: attrs.ownerBirthdate ?? null,
-      gmGender: attrs.ownerGender ?? null,
-      // Kept in step for the notifiers, same as a GM verification does.
-      generalManagerName: attrs.ownerName ?? null,
-      generalManagerEmail: ownerEmail,
-      generalManagerPhone: ownerPhone ? normalizeE164(ownerPhone) : null,
-    };
-
-    const updated = await this.companiesRepo.update(company.id, {
-      attributes: { ...attrs, ...copied },
-    });
-    if (!updated)
-      throw new NotFoundException(`Company ${company.id} not found`);
-    updated.companyProfiles = company.companyProfiles;
-    return this.getCompanyIdentityState(updated);
-  }
-
-  /**
-   * Undo the "same as owner" declaration, clearing the copied identity so the
-   * GM can be verified in their own right (or typed, where Fayda is optional).
-   */
-  async clearGmIdentity(userId: string): Promise<CompanyIdentityStateDto> {
-    const { company } = await this.getCompanyInfoByUserId(userId);
-    const attrs = { ...(company.attributes ?? {}) };
-    for (const key of [
-      "gmSameAsOwner",
-      "gmFaydaSub",
-      "gmFaydaVerifiedAt",
-      "gmName",
-      "gmEmail",
-      "gmPhone",
-      "gmAddress",
-      "gmBirthdate",
-      "gmGender",
-      ...GM_TYPED_FIELDS,
-    ]) {
-      attrs[key] = null;
-    }
-
-    const updated = await this.companiesRepo.update(company.id, {
-      attributes: attrs,
-    });
-    if (!updated)
-      throw new NotFoundException(`Company ${company.id} not found`);
-    updated.companyProfiles = company.companyProfiles;
-    return this.getCompanyIdentityState(updated);
-  }
-
-  /**
-   * Declare that the company's Power of Attorney is its owner.
-   *
-   * An owner representing their own company is the ordinary case for a small
-   * business, so this is a supported answer rather than the conflict it used to
-   * be refused as. Two shapes, matching {@link setGmSameAsOwner}:
-   *
-   * - A Fayda-verified owner is a proven identity, so it is copied outright —
-   *   the representative inherits the verification instead of the same human
-   *   being sent through Fayda a second time.
-   * - A foreign company's owner is backed by a typed passport, so there is
-   *   nothing proven to copy. The declaration is still recorded (it is what
-   *   waives the DARS paper) and whatever owner details exist come across; the
-   *   portal types the rest, which `poaProven` accepts for a foreign company.
-   *
-   * Refused for an Ethiopian company whose owner is not verified yet: Fayda is
-   * mandatory for its representative, so a declaration there would record a
-   * representative that could never satisfy the gate.
-   */
-  async setPoaSameAsOwner(
-    userId: string,
-    /** Same fallback as {@link completeIdentityVerification} — an owner whose
-     * Fayda claims carried no email/phone has none stored, and copying blanks
-     * onto a freight forwarder's PoA would block the submit on
-     * `REQUIRED_POA_FIELDS`. */
-    account?: { email?: string; phoneNumber?: string },
-  ): Promise<CompanyIdentityStateDto> {
-    const { company } = await this.getCompanyInfoByUserId(userId);
-    const attrs = company.attributes ?? {};
-    const state = buildCompanyIdentityState(company);
-    const ownerSub = attrs.ownerFaydaSub as string | undefined;
-
-    if (state.faydaRequired && !ownerSub) {
-      throw new BadRequestException(
-        "Verify the company owner with Fayda first — there is no proven identity to reuse yet.",
-      );
-    }
-
-    const ownerEmail = (attrs.ownerEmail as string | undefined) || account?.email;
-    const ownerPhone =
-      (attrs.ownerPhone as string | undefined) || account?.phoneNumber;
-
-    // Only non-blank values are copied: a blank here would overwrite something
-    // the portal typed for a foreign company, whose owner has no verified
-    // claims to draw on.
-    const copied: Record<string, unknown> = { poaSameAsOwner: true };
-    const copy = (key: string, value: unknown) => {
-      if (value !== null && value !== undefined && value !== "")
-        copied[key] = value;
-    };
-    copy("poaName", attrs.ownerName);
-    copy("poaEmail", ownerEmail);
-    copy("poaPhone", ownerPhone ? normalizeE164(ownerPhone) : undefined);
-    copy("poaAddress", attrs.ownerAddress);
-
-    if (ownerSub) {
-      copied.poaFaydaSub = ownerSub;
-      copied.poaFaydaVerifiedAt =
-        attrs.ownerFaydaVerifiedAt ?? new Date().toISOString();
-      copy("poaBirthdate", attrs.ownerBirthdate);
-      copy("poaGender", attrs.ownerGender);
-    }
-
-    const updated = await this.companiesRepo.update(company.id, {
-      attributes: { ...attrs, ...copied },
-    });
-    if (!updated)
-      throw new NotFoundException(`Company ${company.id} not found`);
-    updated.companyProfiles = company.companyProfiles;
-    return this.getCompanyIdentityState(updated);
-  }
-
-  /**
-   * Undo the PoA "same as owner" declaration, clearing the identity it copied
-   * so a different representative can be verified (or typed, for a foreign
-   * company).
-   *
-   * Separate from {@link removePoaIdentity}, which drops the representative and
-   * their paper and is refused to a freight forwarder. Undoing a declaration is
-   * how a forwarder changes its mind about who represents it, so it must stay
-   * open to them — the submit gate still refuses a forwarder that never names a
-   * replacement. The delegation paper is left alone for the same reason: the
-   * company still owes one, now for whoever comes next.
-   *
-   * A no-op when no declaration is in place: a stray call must not wipe a
-   * representative who verified in their own right.
-   */
-  async clearPoaSameAsOwner(userId: string): Promise<CompanyIdentityStateDto> {
-    const { company } = await this.getCompanyInfoByUserId(userId);
-    const attrs = { ...(company.attributes ?? {}) };
-    if (!attrs.poaSameAsOwner) return this.getCompanyIdentityState(company);
-
-    attrs.poaSameAsOwner = false;
-    for (const key of [
-      ...POA_ATTRIBUTES,
-      "poaFaydaSub",
-      "poaFaydaVerifiedAt",
-      "poaBirthdate",
-      "poaGender",
-    ]) {
-      attrs[key] = null;
-    }
-
-    const updated = await this.companiesRepo.update(company.id, {
-      attributes: attrs,
-    });
-    if (!updated)
-      throw new NotFoundException(`Company ${company.id} not found`);
-    updated.companyProfiles = company.companyProfiles;
-    return this.getCompanyIdentityState(updated);
-  }
-
-  /**
-   * Drop the Power of Attorney entirely — the verified identity, the details it
-   * wrote and the delegation paper together.
-   *
-   * Only the PoA can go: a company always has an owner, and a freight forwarder
-   * always has a representative. Once a PoA is Fayda-verified its
-   * fields are locked, so blanking the form is no longer a way out — without
-   * this the customer would be stuck with a representative they cannot remove.
-   */
-  async removePoaIdentity(userId: string): Promise<CompanyIdentityStateDto> {
-    const { company } = await this.getCompanyInfoByUserId(userId);
-    if (
-      (company.companyProfiles ?? []).some(
-        (p) => p.type === ProfileType.freightForwarder,
-      )
-    ) {
-      throw new BadRequestException(
-        "A freight forwarder must have a Power of Attorney. Remove the freight forwarder role first.",
-      );
-    }
-
-    const cleared: Record<string, unknown> = { poaSameAsOwner: false };
-    for (const key of [
-      ...POA_ATTRIBUTES,
-      "poaFaydaSub",
-      "poaFaydaVerifiedAt",
-      "poaBirthdate",
-      "poaGender",
-    ]) {
-      cleared[key] = null;
-    }
-    const attributes = { ...(company.attributes ?? {}), ...cleared };
-
-    // The paper evidences a representative who no longer exists.
-    const records = await this.filesService.findByResource(
-      company.id,
-      COMPANY_RESOURCE,
-    );
-    for (const r of records) {
-      if (
-        r.code === POA_DELEGATION_FILE_KEY ||
-        r.code === POA_DELEGATION_PENDING_CODE
-      ) {
-        await this.filesService.remove(r.id);
-        await this.withdrawDocumentIntent(company.id, r.id);
-      }
-    }
-
-    const updated = await this.companiesRepo.update(company.id, { attributes });
-    if (!updated)
-      throw new NotFoundException(`Company ${company.id} not found`);
-    updated.companyProfiles = company.companyProfiles;
-    return this.getCompanyIdentityState(updated);
-  }
-
   /** Stage a verified identity onto the company's pending change request. */
   private async stageIdentityChange(
     company: Company,
@@ -3171,62 +3049,56 @@ export class CompaniesService {
   }
 
   /**
-   * The gate: an Ethiopian company's owner must be Fayda-verified, and so must
-   * its Power of Attorney once it has one; a foreign company's owner must carry
-   * a passport number instead. Called from the same places as
-   * `assertPoaDelegationSatisfied` — the two rules describe the same moment
-   * (who may act for this company, and on what evidence) and drifting them
-   * apart is how one of them ends up unenforced.
+   * The company as it will be once `type` is one of its roles.
+   *
+   * Taking on the freight-forwarder role is checked BEFORE the profile row
+   * exists, and both assertions below read `companyProfiles` — a forwarder is
+   * what forces the PoA declaration to "yes". Judging the company as it stands
+   * would let one that answered "no" pick up the role and skip the very
+   * requirement the role exists to impose. Read-only; never persisted.
    */
-  private assertIdentityVerified(
-    company: Company,
-    opts: { requirePoa: boolean },
-  ): void {
+  private withProfileType(company: Company, type: ProfileType): Company {
+    const profiles = company.companyProfiles ?? [];
+    if (profiles.some((p) => p.type === type)) return company;
+    return {
+      ...company,
+      companyProfiles: [...profiles, { type } as CompanyProfile],
+    } as Company;
+  }
+
+  /**
+   * The gate: the company's ONE identity must be proven.
+   *
+   * Which person that is comes from the company's own declaration — the
+   * representative when it names one, otherwise the owner (whoever the eTrade
+   * licence names as manager). How they prove it depends on nationality: Fayda
+   * for an Ethiopian company, Fayda *or* a typed passport number for a foreign
+   * one, whose people may hold no Fayda ID at all.
+   *
+   * Called from the same places as `assertPoaDelegationSatisfied` — the two
+   * rules describe the same moment (who may act for this company, and on what
+   * evidence) and drifting them apart is how one of them ends up unenforced.
+   */
+  private assertIdentityVerified(company: Company): void {
     const state = buildCompanyIdentityState(company);
 
-    // Only the owner's credential is nationality-specific: Fayda for an
-    // Ethiopian company, a typed passport number for a foreign one.
-    if (state.passportRequired) {
-      if (!state.owner.passportNumber) {
-        throw new BadRequestException(
-          "Add the company owner's passport number before continuing.",
-        );
-      }
-    } else if (!state.owner.verified) {
+    if (state.poaDeclared === null) {
       throw new BadRequestException(
-        "Verify the company owner's identity with Fayda before continuing.",
+        "Tell us whether anyone holds power of attorney for this company — the answer decides whose identity we verify.",
       );
     }
 
-    const poaNamed = POA_ATTRIBUTES.some((k) =>
-      (company.attributes?.[k] as string | undefined)?.trim(),
+    if (state.identityProven) return;
+
+    const who =
+      state.subject === "poa"
+        ? "your Power of Attorney"
+        : "the person named on your eTrade licence";
+    throw new BadRequestException(
+      state.passportAccepted
+        ? `Verify ${who} with Fayda, or add their passport number.`
+        : `Verify ${who} with Fayda before continuing.`,
     );
-    if (!opts.requirePoa && !poaNamed) return;
-
-    // Fayda is an Ethiopian national ID, so only an Ethiopian company's
-    // representative can be held to it. A foreign company is offered the
-    // verification and nominates a Fayda-holding representative where it can,
-    // but a typed name has to remain sufficient — otherwise a foreign company
-    // whose representative holds no Fayda ID could never trade at all. Mirrors
-    // `poaProven` in buildCompanyIdentityState; the two must agree.
-    if (state.passportRequired) {
-      if (!state.poa.verified && !state.poa.name?.trim()) {
-        throw new BadRequestException(
-          opts.requirePoa
-            ? "Name your Power of Attorney — a freight forwarder cannot operate without one."
-            : "Complete the Power of Attorney you named, or remove the representative.",
-        );
-      }
-      return;
-    }
-
-    if (!state.poa.verified) {
-      throw new BadRequestException(
-        opts.requirePoa
-          ? "Verify your Power of Attorney with Fayda — a freight forwarder cannot operate without one."
-          : "Verify the Power of Attorney you named with Fayda, or remove the representative.",
-      );
-    }
   }
 
   /**
@@ -3350,12 +3222,9 @@ export class CompaniesService {
     // the representative it evidences is gone too (which, for an Active
     // company, means the clearing edit is already staged).
     await this.assertPoaDelegationSatisfied(
-      company.id,
+      company,
       await this.effectivePoaAttributes(company),
-      {
-        requirePoa: await this.isFreightForwarder(company.id),
-        ignoreFileIds: [fileId],
-      },
+      { ignoreFileIds: [fileId] },
     );
 
     if (record.code === POA_DELEGATION_PENDING_CODE) {
@@ -3583,8 +3452,15 @@ export class CompaniesService {
    */
   private async applyEtradeSourcedFields(
     company: Company,
-    dto: UpdateProfileDto,
+    dto: UpdateProfileDto & { etradeManager?: { name: string; phone: string } },
   ): Promise<void> {
+    // A co-operative union or farm has a TIN but no business licence, so eTrade holds no
+    // record to check these against — the customer types the company name and
+    // the registered address themselves, and what they send IS the data. The
+    // check is skipped rather than failed: running the lookup would 400 every
+    // save with "no registration found for this TIN".
+    if (isCooperative(company)) return;
+
     const touched = ETRADE_SOURCED_FIELDS.some(
       (key) => key !== "tin" && dto[key] !== undefined,
     );
@@ -3626,5 +3502,18 @@ export class CompaniesService {
       // (the onboarding/settings card lets the customer type it directly then).
       if (value) (dto as Record<string, unknown>)[key] = value;
     }
+
+    // Capture the licence's own manager alongside the registration it belongs
+    // to. NOT written onto `ownerName`/`ownerPhone`: those are what the company
+    // asserts (and what a Fayda verification owns), and overwriting them here
+    // would destroy the very difference the backoffice is asked to check. The
+    // portal prefills the owner from these, so they agree unless someone made
+    // them disagree — which is exactly the case worth surfacing.
+    if (registration.managerName || registration.managerPhone) {
+      dto.etradeManager = {
+        name: registration.managerName,
+        phone: registration.managerPhone,
+      };
+    }
   }
 }
diff --git a/apps/edr-freight-api/src/modules/companies/company-revision-diff.util.ts b/apps/edr-freight-api/src/modules/companies/company-revision-diff.util.ts
index 83fa539e3..71b60a268 100644
--- a/apps/edr-freight-api/src/modules/companies/company-revision-diff.util.ts
+++ b/apps/edr-freight-api/src/modules/companies/company-revision-diff.util.ts
@@ -23,9 +23,18 @@ export const COMPANY_FIELD_LABELS: Record<string, string> = {
   contactPersonPhone: "Contact person phone",
   contactPersonEmail: "Contact person email",
   contactPersonPosition: "Contact person position",
-  generalManagerName: "General manager name",
-  generalManagerPhone: "General manager phone",
-  generalManagerEmail: "General manager email",
+  ownerName: "Owner name",
+  ownerPhone: "Owner phone",
+  ownerEmail: "Owner email",
+  ownerPassportNumber: "Owner passport number",
+  poaPassportNumber: "PoA passport number",
+  poaDeclared: "Has a Power of Attorney",
+  // Nothing writes these any more (the general manager was removed), but
+  // revisions and change requests filed before that still carry them — without
+  // the labels those rows render raw attribute keys to a reviewer.
+  generalManagerName: "General manager name (retired)",
+  generalManagerPhone: "General manager phone (retired)",
+  generalManagerEmail: "General manager email (retired)",
   poaName: "PoA name",
   poaPhone: "PoA phone",
   poaEmail: "PoA email",
diff --git a/apps/edr-freight-api/src/modules/companies/dto/complete-identity-verification.dto.ts b/apps/edr-freight-api/src/modules/companies/dto/complete-identity-verification.dto.ts
index df39949d4..feccc855d 100644
--- a/apps/edr-freight-api/src/modules/companies/dto/complete-identity-verification.dto.ts
+++ b/apps/edr-freight-api/src/modules/companies/dto/complete-identity-verification.dto.ts
@@ -5,21 +5,61 @@ import { Company, CompanyNationality } from "../entities/company.entity";
 import { ProfileType } from "../entities/company-profile.entity";
 
 /**
- * The three people a company is verified through — its owner, its Power of
- * Attorney and its General Manager. The owner is the person the company's
- * existence is proven by; the other two are personnel it names.
+ * The two people a company can be described through.
  *
- * The GM is very often the owner, which is what the portal's "same as owner"
- * copy is for: that path reuses the owner's verified identity outright rather
- * than asking the same human to verify twice.
+ * The **owner** is whoever the eTrade TIN record names as the business's
+ * manager. Not necessarily the legal owner — eTrade's `ManagerNameEng` is
+ * simply the person on the licence — but that is the point: whoever the company
+ * puts forward here has to match the eTrade record, and the backoffice check is
+ * exactly that comparison (see `ownerMatchesEtrade`).
+ *
+ * The **Power of Attorney** is who the company delegates to act for it, when it
+ * delegates at all.
+ *
+ * Exactly ONE of them is identity-verified, and which one is decided by the
+ * company's own answer (see {@link PoaDeclaration}): the representative if
+ * there is one, otherwise the owner. There is no general manager — the concept
+ * was removed; it named who to talk to and gated nothing.
  */
-export const IDENTITY_SUBJECTS = ["owner", "poa", "gm"] as const;
+export const IDENTITY_SUBJECTS = ["owner", "poa"] as const;
 export type IdentitySubject = (typeof IDENTITY_SUBJECTS)[number];
 
+/**
+ * The company's answer to "does anyone hold power of attorney for you?".
+ *
+ * Explicit rather than derived from "are any `poa*` keys set", because "no" is
+ * an answer that moves the verification onto the owner, while *absent* is a
+ * question the customer has not reached yet. Stored on `company.attributes`
+ * under {@link POA_DECLARED_KEY}.
+ *
+ * A freight forwarder never gets to answer: it signs on other companies'
+ * behalf, so a Power of Attorney (and the DARS paper evidencing it) is
+ * non-negotiable. {@link readPoaDeclaration} forces "yes" for them, which is
+ * why the declaration is read through that helper rather than off the blob.
+ */
+export const POA_DECLARATIONS = ["yes", "no"] as const;
+export type PoaDeclaration = (typeof POA_DECLARATIONS)[number];
+
+/** `company.attributes` key holding the {@link PoaDeclaration}. */
+export const POA_DECLARED_KEY = "poaDeclared";
+
+/**
+ * `company.attributes` keys holding the eTrade record's own manager, captured
+ * at lookup time.
+ *
+ * Kept apart from `ownerName`/`ownerPhone` — which are what the *company*
+ * asserts, and what a Fayda verification overwrites — precisely so the two can
+ * be compared. Storing only one value would leave the reviewer comparing the
+ * owner field against itself.
+ */
+export const ETRADE_MANAGER_NAME_KEY = "etradeManagerName";
+export const ETRADE_MANAGER_PHONE_KEY = "etradeManagerPhone";
+
 export class CompleteIdentityVerificationDto {
   @ApiProperty({
     enum: IDENTITY_SUBJECTS,
-    description: "Which of the company's people this verification is for.",
+    description:
+      "Which of the company's people this verification is for. Must match the company's PoA declaration — the representative when one is named, the owner when not.",
   })
   @IsIn(IDENTITY_SUBJECTS)
   subject!: IdentitySubject;
@@ -35,9 +75,11 @@ export class CompleteIdentityVerificationDto {
   state!: string;
 }
 
-/** One person's verification state, as reported back to the portal. */
+/** One person's identity state, as reported back to the portal. */
 export class IdentityVerificationStateDto {
-  @ApiProperty() verified!: boolean;
+  @ApiProperty({ description: "True once a Fayda verification is bound." })
+  verified!: boolean;
+
   @ApiProperty({ nullable: true }) name!: string | null;
   @ApiProperty({ nullable: true }) phone!: string | null;
   @ApiProperty({ nullable: true }) email!: string | null;
@@ -45,13 +87,11 @@ export class IdentityVerificationStateDto {
   @ApiProperty({ nullable: true }) verifiedAt!: string | null;
   @ApiProperty({ nullable: true }) birthdate!: string | null;
   @ApiProperty({ nullable: true }) gender!: string | null;
-}
 
-export class OwnerIdentityStateDto extends IdentityVerificationStateDto {
   @ApiProperty({
     nullable: true,
     description:
-      "Typed passport number — the foreign-company identity credential. Independent of Fayda: never written by a verification, and still required even if the owner also verifies.",
+      "Typed passport number. Fayda is an Ethiopian national ID, so a foreign company proves the identity with either — this is the alternative, not an addition.",
   })
   passportNumber!: string | null;
 }
@@ -59,44 +99,62 @@ export class OwnerIdentityStateDto extends IdentityVerificationStateDto {
 export class CompanyIdentityStateDto {
   @ApiProperty({
     description:
-      "True when Fayda verification of the owner (and PoA, once named) is mandatory — Ethiopian companies only.",
+      "True for a foreign company: a typed passport number proves the identity just as a Fayda verification does. An Ethiopian company must use Fayda.",
   })
-  faydaRequired!: boolean;
+  passportAccepted!: boolean;
 
   @ApiProperty({
+    enum: POA_DECLARATIONS,
+    nullable: true,
     description:
-      "True when the owner's passport number is mandatory — foreign companies only. Independent of faydaRequired: a foreign owner may verify with Fayda too, but the passport is still required.",
+      'Whether the company named a Power of Attorney. Null until the customer answers — which is itself an outstanding onboarding item, since the answer decides who verifies.',
   })
-  passportRequired!: boolean;
+  poaDeclared!: PoaDeclaration | null;
 
-  @ApiProperty({ type: OwnerIdentityStateDto })
-  owner!: OwnerIdentityStateDto;
+  @ApiProperty({
+    enum: IDENTITY_SUBJECTS,
+    nullable: true,
+    description:
+      "Who the company's single identity verification belongs to: the PoA when one is named, the owner when not. Null while the declaration is unanswered.",
+  })
+  subject!: IdentitySubject | null;
+
+  @ApiProperty({ type: IdentityVerificationStateDto })
+  owner!: IdentityVerificationStateDto;
 
   @ApiProperty({ type: IdentityVerificationStateDto })
   poa!: IdentityVerificationStateDto;
 
   @ApiProperty({
     description:
-      "True when the Power of Attorney is the company's owner, declared through the portal's \"same as owner\" copy. Waives the DARS delegation paper — nobody delegates to themselves.",
+      "True once the subject is proven — Fayda-verified, or carrying a passport number where that is accepted.",
   })
-  poaSameAsOwner!: boolean;
+  identityProven!: boolean;
 
   @ApiProperty({
-    type: IdentityVerificationStateDto,
+    nullable: true,
     description:
-      "General manager. `verified` is true both when the GM verified with Fayda in their own right and when the company declared the GM is the owner — in the latter case the owner's Fayda sub backs it.",
+      "The manager named on the eTrade licence, captured at lookup. Null when eTrade returned none (ManagerNameEng is frequently blank).",
   })
-  gm!: IdentityVerificationStateDto;
+  etradeManagerName!: string | null;
+
+  @ApiProperty({
+    nullable: true,
+    description:
+      "That manager's phone, normalized to E.164 and captured at the same lookup. Paired with the name so the portal can still tell that the owner's details came from eTrade after a refresh, when the live lookup result is long gone — without it a resumed wizard offers them back as typeable inputs.",
+  })
+  etradeManagerPhone!: string | null;
+
+  @ApiProperty({
+    nullable: true,
+    description:
+      "Does the owner the company put forward match the person on the eTrade licence? This is the backoffice's check. Null when there is nothing to compare — no eTrade manager on file, or no owner name yet. Advisory, not a gate: eTrade's Latin transliteration and Fayda's rarely agree character-for-character, so a reviewer decides.",
+  })
+  ownerMatchesEtrade!: boolean | null;
 
   @ApiProperty({
     description:
-      "True when the GM's identity is the owner's, declared through the portal's \"same as owner\" copy rather than a separate verification.",
-  })
-  gmSameAsOwner!: boolean;
-
-  @ApiProperty({
-    description:
-      "False while a mandatory requirement (Fayda for Ethiopian, passport for foreign) is still outstanding.",
+      "False while the declaration is unanswered or the subject is unproven. Field-level completeness (owner/PoA details, documents) is reported separately by the onboarding requirements.",
   })
   complete!: boolean;
 }
@@ -105,26 +163,9 @@ export class CompanyIdentityStateDto {
 const PREFIX: Record<IdentitySubject, string> = {
   owner: "owner",
   poa: "poa",
-  gm: "gm",
 };
 
-/**
- * Typed GM fields, kept in step with the Fayda-written ones.
- *
- * The GM predates this verification: its details are plain company columns
- * that three notifier services mail (booking-lifecycle, train-scheduling and
- * contract notifiers all read `company.generalManagerEmail`). A verification
- * therefore writes BOTH — the `gm*` attributes carry the proof, these carry
- * the value everything else already reads — and an unverified company keeps
- * showing whatever was typed before this existed.
- */
-const GM_TYPED_KEYS = {
-  name: "generalManagerName",
-  email: "generalManagerEmail",
-  phone: "generalManagerPhone",
-} as const;
-
-/** company.attributes keys that together mean "a PoA was entered". */
+/** `company.attributes` keys that together mean "a representative was entered". */
 const POA_KEYS = [
   "poaName",
   "poaPhone",
@@ -139,7 +180,7 @@ function stateFor(
 ): IdentityVerificationStateDto {
   const p = PREFIX[subject];
   const read = (key: string) => (attrs[key] as string | undefined) ?? null;
-  const state: IdentityVerificationStateDto = {
+  return {
     verified: Boolean(read(`${p}FaydaSub`)),
     name: read(`${p}Name`),
     phone: read(`${p}Phone`),
@@ -148,88 +189,114 @@ function stateFor(
     verifiedAt: read(`${p}FaydaVerifiedAt`),
     birthdate: read(`${p}Birthdate`),
     gender: read(`${p}Gender`),
-  };
-  if (subject !== "gm" || state.verified) return state;
-
-  // Companies onboarded before the GM was verifiable have typed details and no
-  // `gm*` attributes at all. Report those rather than a blank card — they are
-  // still what the notifiers mail — leaving `verified` false so the portal
-  // offers the upgrade instead of pretending the identity is proven.
-  //
-  // Only for such an unverified GM, which is the whole population this exists
-  // for. Merging the typed columns into a *verified* manager's state would read
-  // back the email the portal asked them to type when Fayda supplied none, and
-  // the input offering it — keyed on that value being absent — would vanish the
-  // moment it was saved, leaving a typo uncorrectable.
-  return {
-    ...state,
-    name: state.name ?? read(GM_TYPED_KEYS.name),
-    email: state.email ?? read(GM_TYPED_KEYS.email),
-    phone: state.phone ?? read(GM_TYPED_KEYS.phone),
+    passportNumber: read(`${p}PassportNumber`),
   };
 }
 
 /**
- * Derive both people's verification state from the company row.
+ * The company's PoA declaration, or null when it hasn't answered yet.
  *
- * Pure and shared: `CompaniesService` gates on it and `ProfileResponseDto`
- * renders from it, so the settings page and the onboarding wizard can never
- * disagree with the rule the API actually enforces.
+ * A freight forwarder is never asked: it acts on other companies' behalf, so a
+ * representative and the DARS paper behind them are mandatory. Forcing it here
+ * — rather than only disabling the radio in the portal — is what stops a
+ * forwarder role added *after* onboarding from inheriting an old "no".
+ */
+export function readPoaDeclaration(
+  company: Pick<Company, "attributes" | "companyProfiles">,
+): PoaDeclaration | null {
+  if (
+    (company.companyProfiles ?? []).some(
+      (p) => p.type === ProfileType.freightForwarder,
+    )
+  ) {
+    return "yes";
+  }
+  const value = company.attributes?.[POA_DECLARED_KEY];
+  if (value === "yes" || value === "no") return value;
+
+  // No explicit answer, but the company holds a representative's details —
+  // so it has one, and owes everything a representative brings with them.
+  //
+  // Covers rows that predate the question (the migration derives the same way)
+  // and any write that reaches the attributes without going through
+  // `setPoaDeclared`. Without this, PoA details could be saved with the
+  // delegation paper silently unowed. Safe against a genuine "no": answering
+  // it clears these keys, so they cannot outlive the answer.
+  return POA_KEYS.some((k) => (company.attributes?.[k] as string | undefined)?.trim())
+    ? "yes"
+    : null;
+}
+
+/**
+ * Do two people's names refer to the same person, as far as a string can tell?
+ *
+ * Deliberately loose: eTrade returns uppercase Latin transliterations of
+ * Amharic names and Fayda returns its own, so exact equality would flag almost
+ * every company. Case, punctuation, extra whitespace and word ORDER are all
+ * ignored — "ABEBE KEBEDE TESFA" and "Tesfa, Abebe Kebede" match. Anything
+ * beyond that is the reviewer's call, which is why the verdict is advisory.
+ */
+export function ownerNameMatchesEtrade(
+  ownerName: string | null | undefined,
+  etradeName: string | null | undefined,
+): boolean | null {
+  const words = (v: string | null | undefined) =>
+    (v ?? "")
+      .toLowerCase()
+      .replace(/[^a-z0-9ሀ-፿\s]/g, " ")
+      .split(/\s+/)
+      .filter(Boolean)
+      .sort();
+  const a = words(ownerName);
+  const b = words(etradeName);
+  if (a.length === 0 || b.length === 0) return null;
+  return a.length === b.length && a.every((w, i) => w === b[i]);
+}
+
+/**
+ * Derive the company's identity state from its row.
+ *
+ * Pure and shared: `CompaniesService` gates on it, `ProfileResponseDto` and the
+ * backoffice's company DTO render from it, so the settings page, the onboarding
+ * wizard and the reviewer can never disagree with the rule the API enforces.
  */
 export function buildCompanyIdentityState(
   company: Company,
 ): CompanyIdentityStateDto {
   const attrs = company.attributes ?? {};
-  const read = (key: string) => (attrs[key] as string | undefined) ?? null;
 
-  // Fayda is an Ethiopian national ID — a foreign company's owner may not hold
-  // one, so a typed passport number is the mandatory credential there instead.
-  // The two are mutually exclusive by nationality but independently tracked,
-  // since a foreign owner verifying with Fayda doesn't waive the passport.
-  const foreign = company.nationality === CompanyNationality.Foreign;
-  const faydaRequired = !foreign;
-  const passportRequired = foreign;
+  // Fayda is an Ethiopian national ID. A foreign company's people may hold
+  // none, so a typed passport number stands in — either one proves the person,
+  // and holding both is fine.
+  const passportAccepted = company.nationality === CompanyNationality.Foreign;
 
-  const owner: OwnerIdentityStateDto = {
-    ...stateFor(attrs, "owner"),
-    passportNumber: read("ownerPassportNumber"),
-  };
+  const owner = stateFor(attrs, "owner");
   const poa = stateFor(attrs, "poa");
-  const poaDue =
-    (company.companyProfiles ?? []).some(
-      (p) => p.type === ProfileType.freightForwarder,
-    ) || POA_KEYS.some((k) => (attrs[k] as string | undefined)?.trim());
+  const poaDeclared = readPoaDeclaration(company);
+  const subject: IdentitySubject | null =
+    poaDeclared === "yes" ? "poa" : poaDeclared === "no" ? "owner" : null;
 
-  const gm = stateFor(attrs, "gm");
-  const gmSameAsOwner = Boolean(attrs.gmSameAsOwner);
-  const poaSameAsOwner = Boolean(attrs.poaSameAsOwner);
+  const proven = (s: IdentityVerificationStateDto) =>
+    s.verified || (passportAccepted && Boolean(s.passportNumber?.trim()));
 
-  const ownerProven = faydaRequired
-    ? owner.verified
-    : !passportRequired || Boolean(owner.passportNumber);
+  const identityProven =
+    subject === null ? false : proven(subject === "poa" ? poa : owner);
 
-  // Fayda is an Ethiopian national ID, so only an Ethiopian company's
-  // personnel can be held to it. A foreign company may nominate a
-  // representative who holds one — and is offered the verification — but a
-  // typed name has to remain sufficient, or a foreign company whose PoA has no
-  // Fayda ID could never finish onboarding.
-  const poaProven = faydaRequired
-    ? poa.verified
-    : poa.verified || Boolean(poa.name?.trim());
-
-  // The GM is deliberately absent from this verdict: it names who to talk to,
-  // not what the company may do, and it has never gated trading. Capturing it
-  // through Fayda changes how it is collected, not whether it is required.
-  const complete = ownerProven && (!poaDue || poaProven);
+  const etradeManagerName =
+    (attrs[ETRADE_MANAGER_NAME_KEY] as string | undefined) ?? null;
+  const etradeManagerPhone =
+    (attrs[ETRADE_MANAGER_PHONE_KEY] as string | undefined) ?? null;
 
   return {
-    faydaRequired,
-    passportRequired,
+    passportAccepted,
+    poaDeclared,
+    subject,
     owner,
     poa,
-    poaSameAsOwner,
-    gm,
-    gmSameAsOwner,
-    complete,
+    identityProven,
+    etradeManagerName,
+    etradeManagerPhone,
+    ownerMatchesEtrade: ownerNameMatchesEtrade(owner.name, etradeManagerName),
+    complete: subject !== null && identityProven,
   };
 }
diff --git a/apps/edr-freight-api/src/modules/companies/dto/onboarding-requirements-response.dto.ts b/apps/edr-freight-api/src/modules/companies/dto/onboarding-requirements-response.dto.ts
index 9b69bb15d..20bd0ab06 100644
--- a/apps/edr-freight-api/src/modules/companies/dto/onboarding-requirements-response.dto.ts
+++ b/apps/edr-freight-api/src/modules/companies/dto/onboarding-requirements-response.dto.ts
@@ -8,7 +8,10 @@
  * truth the wizard uses to auto-finish.
  */
 
-import { CompanyIdentityStateDto } from "./complete-identity-verification.dto";
+import {
+  CompanyIdentityStateDto,
+  PoaDeclaration,
+} from "./complete-identity-verification.dto";
 
 export interface OnboardingInfoField {
   key: string;
@@ -38,15 +41,19 @@ export interface OnboardingLicenseProfile {
 }
 
 export interface OnboardingPoaState {
-  /** True when the company operates as a freight forwarder — PoA is mandatory. */
-  required: boolean;
-  /** True once any PoA detail has been entered. */
-  provided: boolean;
   /**
-   * True when the DARS delegation paper is owed — a PoA exists (or is
-   * mandatory) and is not the owner themselves. An owner representing their own
-   * company delegates to nobody, so there is no delegation to evidence.
+   * True when the company operates as a freight forwarder: it signs on other
+   * companies' behalf, so a Power of Attorney is non-negotiable and the portal
+   * renders the question answered and locked rather than asking it.
    */
+  locked: boolean;
+  /**
+   * The company's answer to "does anyone hold power of attorney for you?".
+   * Null until it answers — which is itself outstanding, since the answer
+   * decides whose identity is verified.
+   */
+  declared: PoaDeclaration | null;
+  /** True when the DARS delegation paper is owed — i.e. `declared === "yes"`. */
   delegationLetterRequired: boolean;
   /** True when the DARS delegation paper is stored for the company. */
   delegationLetterUploaded: boolean;
@@ -59,9 +66,17 @@ export interface OnboardingPoaState {
 }
 
 export class OnboardingRequirementsResponseDto {
-  /** Resolved document setting code (by nationality) the docs were drawn from. */
+  /**
+   * Resolved document setting code the docs were drawn from: the company's
+   * nationality set, or the co-operative set in its place.
+   */
   documentSettingCode: string;
   nationality: string;
+  /**
+   * The company trades as a co-operative: no business licence, so no eTrade
+   * lookup, no per-role licence upload, and no freight-forwarder role.
+   */
+  cooperative: boolean;
 
   /** Required company-information fields and whether each is filled. */
   companyInfo: {
@@ -100,6 +115,7 @@ export class OnboardingRequirementsResponseDto {
   constructor(init: Omit<OnboardingRequirementsResponseDto, never>) {
     this.documentSettingCode = init.documentSettingCode;
     this.nationality = init.nationality;
+    this.cooperative = init.cooperative;
     this.companyInfo = init.companyInfo;
     this.documents = init.documents;
     this.licenseProfiles = init.licenseProfiles;
diff --git a/apps/edr-freight-api/src/modules/companies/dto/profile-response.dto.ts b/apps/edr-freight-api/src/modules/companies/dto/profile-response.dto.ts
index a70c52b5d..0d7293ab0 100644
--- a/apps/edr-freight-api/src/modules/companies/dto/profile-response.dto.ts
+++ b/apps/edr-freight-api/src/modules/companies/dto/profile-response.dto.ts
@@ -2,7 +2,7 @@ import {
   buildCompanyIdentityState,
   CompanyIdentityStateDto,
 } from "./complete-identity-verification.dto";
-import { Company } from "../entities/company.entity";
+import { Company, isCooperative } from "../entities/company.entity";
 import { ExternalProfile } from "../entities/external-profile.entity";
 import {
   ChangeRequestStatus,
@@ -15,6 +15,12 @@ export class ProfileResponseDto {
   companyName: string;
   companyType: string;
   nationality: string | null;
+  /**
+   * The company trades as a co-operative: it has a TIN but no business licence,
+   * so the company step collects the registration by hand instead of fetching
+   * it from eTrade.
+   */
+  cooperative: boolean;
   companyLocation: string;
   companyAddress: string | null;
   tinNumber: string;
@@ -42,9 +48,10 @@ export class ProfileResponseDto {
   contactPersonPhone: string | null;
   /** Phone that passed SMS OTP verification (drives the verify-step resume). */
   contactVerifiedPhone: string | null;
-  generalManagerName: string | null;
-  generalManagerEmail: string | null;
-  generalManagerPhone: string | null;
+  /** The owner — whoever the eTrade licence names as the business's manager. */
+  ownerName: string | null;
+  ownerEmail: string | null;
+  ownerPhone: string | null;
 
   poaName: string | null;
   poaPhone: string | null;
@@ -55,12 +62,13 @@ export class ProfileResponseDto {
   profileId: string;
 
   /**
-   * Fayda verification state for the company's owner and PoA — not the general
-   * manager, which is a separate typed role. The settings tabs and the
-   * onboarding wizard render from `identity.faydaRequired` /
-   * `identity.passportRequired`: an Ethiopian company verifies the owner (and
-   * PoA) instead of typing their details; a foreign one requires a typed
-   * passport number instead.
+   * The company's single identity verification, plus who it belongs to.
+   *
+   * `identity.subject` follows the company's PoA declaration — the
+   * representative when one is named, otherwise the owner. The settings tabs
+   * and the onboarding wizard render from it: `passportAccepted` says whether a
+   * typed passport number is an alternative to Fayda (foreign companies only),
+   * and `ownerMatchesEtrade` is the check the backoffice makes.
    */
   identity: CompanyIdentityStateDto;
 
@@ -84,6 +92,7 @@ export class ProfileResponseDto {
     this.companyName = company.name;
     this.companyType = company.type;
     this.nationality = company.nationality ?? null;
+    this.cooperative = isCooperative(company);
     this.companyProfiles =
       company.companyProfiles?.map((p) => new ResponseCompanyProfileDto(p)) ??
       [];
@@ -113,9 +122,9 @@ export class ProfileResponseDto {
     this.contactPersonEmail = attrs.contactPersonEmail ?? null;
     this.contactPersonPhone = attrs.contactPersonPhone ?? null;
     this.contactVerifiedPhone = attrs.contactVerifiedPhone ?? null;
-    this.generalManagerName = attrs.generalManagerName ?? null;
-    this.generalManagerEmail = attrs.generalManagerEmail ?? null;
-    this.generalManagerPhone = attrs.generalManagerPhone ?? null;
+    this.ownerName = attrs.ownerName ?? null;
+    this.ownerEmail = attrs.ownerEmail ?? null;
+    this.ownerPhone = attrs.ownerPhone ?? null;
     this.poaName = attrs.poaName ?? null;
     this.poaPhone = attrs.poaPhone ?? null;
     this.poaEmail = attrs.poaEmail ?? null;
diff --git a/apps/edr-freight-api/src/modules/companies/dto/response-company.dto.ts b/apps/edr-freight-api/src/modules/companies/dto/response-company.dto.ts
index d705e7323..e75182889 100644
--- a/apps/edr-freight-api/src/modules/companies/dto/response-company.dto.ts
+++ b/apps/edr-freight-api/src/modules/companies/dto/response-company.dto.ts
@@ -3,6 +3,7 @@ import {
   CompanyType,
   CompanyStatus,
   CompanyNationality,
+  isCooperative,
 } from '../entities/company.entity';
 import {
   CompanyProfile,
@@ -55,6 +56,12 @@ export class ResponseCompanyDto {
   type: CompanyType;
   status: CompanyStatus;
   nationality?: CompanyNationality | null;
+  /**
+   * The company trades as a co-operative: no business licence, so its
+   * registration was typed rather than fetched from eTrade and there is no
+   * eTrade manager to check the owner against.
+   */
+  cooperative: boolean;
   tin: string;
   vatNumber?: string | null;
   fanNumber?: string | null;
@@ -89,9 +96,14 @@ export class ResponseCompanyDto {
   houseNo?: string | null;
 
   /**
-   * Owner/PoA Fayda verification state, shared with the portal
-   * (`buildCompanyIdentityState`) so backoffice never re-derives — or
-   * disagrees with — the rule the API actually enforces.
+   * The company's single identity verification, shared with the portal
+   * (`buildCompanyIdentityState`) so backoffice never re-derives — or disagrees
+   * with — the rule the API actually enforces.
+   *
+   * `subject` names whose verification it is (the PoA when one is declared,
+   * otherwise the owner), and `ownerMatchesEtrade` is the reviewer's check:
+   * does the owner the company put forward match the manager on the eTrade
+   * licence? Advisory — see the note on that field.
    */
   identity: CompanyIdentityStateDto;
 
@@ -105,6 +117,7 @@ export class ResponseCompanyDto {
     this.type = company.type;
     this.status = company.status;
     this.nationality = company.nationality ?? null;
+    this.cooperative = isCooperative(company);
     this.tin = company.tin;
     this.vatNumber = company.vatNumber;
     this.fanNumber = company.fanNumber;
diff --git a/apps/edr-freight-api/src/modules/companies/dto/set-poa-declared.dto.ts b/apps/edr-freight-api/src/modules/companies/dto/set-poa-declared.dto.ts
new file mode 100644
index 000000000..37c54b254
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/companies/dto/set-poa-declared.dto.ts
@@ -0,0 +1,17 @@
+import { ApiProperty } from "@nestjs/swagger";
+import { IsIn } from "class-validator";
+
+import {
+  POA_DECLARATIONS,
+  PoaDeclaration,
+} from "./complete-identity-verification.dto";
+
+export class SetPoaDeclaredDto {
+  @ApiProperty({
+    enum: POA_DECLARATIONS,
+    description:
+      'Whether anyone holds power of attorney for this company. "no" tears down any representative already recorded.',
+  })
+  @IsIn(POA_DECLARATIONS)
+  declared!: PoaDeclaration;
+}
diff --git a/apps/edr-freight-api/src/modules/companies/dto/start-onboarding.dto.ts b/apps/edr-freight-api/src/modules/companies/dto/start-onboarding.dto.ts
index 7687faab1..91fcb44a1 100644
--- a/apps/edr-freight-api/src/modules/companies/dto/start-onboarding.dto.ts
+++ b/apps/edr-freight-api/src/modules/companies/dto/start-onboarding.dto.ts
@@ -1,4 +1,10 @@
-import { ArrayMinSize, IsArray, IsEnum, IsOptional } from "class-validator";
+import {
+  ArrayMinSize,
+  IsArray,
+  IsBoolean,
+  IsEnum,
+  IsOptional,
+} from "class-validator";
 import { CompanyNationality, CompanyType } from "../entities/company.entity";
 import { ProfileType } from "../entities/company-profile.entity";
 
@@ -14,4 +20,15 @@ export class StartOnboardingDto {
   @IsOptional()
   @IsEnum(CompanyNationality)
   nationality?: CompanyNationality;
+
+  /**
+   * The company trades as a co-operative: it holds a TIN but no business
+   * licence, so there is no eTrade record to fetch its registration from.
+   * Chosen on the same step as the nationality and the roles, because it
+   * decides all three of what the next step asks for, which documents apply,
+   * and which roles are even available (a co-op cannot freight-forward).
+   */
+  @IsOptional()
+  @IsBoolean()
+  cooperative?: boolean;
 }
diff --git a/apps/edr-freight-api/src/modules/companies/dto/update-profile.dto.ts b/apps/edr-freight-api/src/modules/companies/dto/update-profile.dto.ts
index c89326fa1..2273bf79a 100644
--- a/apps/edr-freight-api/src/modules/companies/dto/update-profile.dto.ts
+++ b/apps/edr-freight-api/src/modules/companies/dto/update-profile.dto.ts
@@ -5,7 +5,6 @@ import {
   MaxLength,
   IsEnum,
   IsIn,
-  Matches,
 } from "class-validator";
 import { ETHIOPIAN_REGIONS, type EthiopianRegion } from "@edr/types";
 import { CompanyNationality } from "../entities/company.entity";
@@ -36,20 +35,21 @@ export class UpdateProfileDto {
   @IsTin({ message: "TIN must be exactly 10 digits" })
   tin?: string;
 
-  // Ethiopian VAT registration numbers are 10 digits (the same shape as the
-  // TIN), but some are issued with an 11th. Both portal forms enforce the same
-  // range; without it here the API happily stored whatever a stale client sent,
-  // and the two layers disagreed about what the column may hold.
+  // No shape check. Ethiopian VAT numbers are usually 10 or 11 digits, but a
+  // foreign company's is whatever its own tax authority issues — letters,
+  // dashes and any length — and a co-operative's registration numbering does
+  // not follow the trade-licence pattern either. The field is required (the
+  // portal enforces non-blank) but its content is not ours to police.
   @IsOptional()
   @IsString()
-  @Matches(/^\d{10,11}$/, { message: "VAT number must be 10 or 11 digits" })
+  @MaxLength(64)
   vatNumber?: string;
 
-  // `fanNumber` is deliberately absent: the FAN is the Fayda number of the
-  // company's PoA (or its general manager), so it is derived from a completed
-  // Fayda verification rather than typed. The global validation pipe runs with
-  // forbidNonWhitelisted, so a client that still sends it gets a 400 telling it
-  // so — see CompaniesService.completeIdentityVerification.
+  // `fanNumber` is deliberately absent: the FAN is a Fayda number, so it would
+  // have to come from a completed verification rather than be typed — and
+  // Fayda's userinfo carries no national ID number, so nothing produces one.
+  // The global validation pipe runs with forbidNonWhitelisted, so a client that
+  // still sends it gets a 400 telling it so.
 
   @IsOptional()
   @IsString()
@@ -78,18 +78,31 @@ export class UpdateProfileDto {
   @IsValidPhone()
   contactVerifiedPhone?: string;
 
+  /**
+   * The owner — whoever the eTrade licence names as the business's manager.
+   *
+   * All three are required before onboarding can be submitted, whatever their
+   * source: the eTrade lookup prefills the name and phone, a Fayda
+   * verification can supply all three, and the portal renders an input for
+   * whatever neither did (eTrade returns no email at all, and Fayda's email
+   * claim is optional, so that one is usually typed).
+   *
+   * Locked once a Fayda verification supplied them — see
+   * `IDENTITY_OWNED_FIELDS` — but only field by field: a claim that came back
+   * empty owns nothing and stays typeable.
+   */
   @IsOptional()
   @IsString()
-  generalManagerName?: string;
+  ownerName?: string;
 
   @IsOptional()
   @IsEmail()
-  generalManagerEmail?: string;
+  ownerEmail?: string;
 
   @IsOptional()
   @IsString()
   @IsValidPhone()
-  generalManagerPhone?: string;
+  ownerPhone?: string;
 
   @IsOptional()
   @IsString()
@@ -113,15 +126,22 @@ export class UpdateProfileDto {
   poaAddress?: string;
 
   /**
-   * The owner's passport number — the identity credential for a foreign
-   * company, since Fayda is an Ethiopian national ID. Plain typed field, never
-   * written or locked by a Fayda verification: still required even if the
-   * owner also verifies.
+   * Passport numbers — the alternative identity credential for a foreign
+   * company, since Fayda is an Ethiopian national ID. Plain typed fields, never
+   * written or locked by a Fayda verification.
+   *
+   * Only the one belonging to the company's declared identity subject matters:
+   * the PoA's when a representative is named, the owner's otherwise. An
+   * Ethiopian company is not offered either — it must use Fayda.
    */
   @IsOptional()
   @IsString()
   ownerPassportNumber?: string;
 
+  @IsOptional()
+  @IsString()
+  poaPassportNumber?: string;
+
   @IsOptional()
   @IsString()
   @MaxLength(100)
diff --git a/apps/edr-freight-api/src/modules/companies/entities/company.entity.ts b/apps/edr-freight-api/src/modules/companies/entities/company.entity.ts
index f254e0121..54c36bf41 100644
--- a/apps/edr-freight-api/src/modules/companies/entities/company.entity.ts
+++ b/apps/edr-freight-api/src/modules/companies/entities/company.entity.ts
@@ -32,6 +32,25 @@ export enum CompanyNationality {
   Foreign = "foreign",
 }
 
+/**
+ * `attributes` key marking a co-operative union or farm.
+ *
+ * Such a company has a TIN but no business licence, so there is no eTrade record to
+ * look its registration up in — the company name, registered address and the
+ * owner are all typed instead of fetched, and the eTrade authenticity check is
+ * skipped rather than failed. It is a flag rather than a column because
+ * everything it changes is behavioural (which lookup runs, which documents
+ * apply, which roles are offered); nothing queries or joins on it.
+ */
+export const COOPERATIVE_KEY = "cooperative";
+
+/** Is this a co-operative union or farm (a TIN, but no business licence)? */
+export function isCooperative(
+  company: Pick<Company, "attributes"> | null | undefined,
+): boolean {
+  return company?.attributes?.[COOPERATIVE_KEY] === true;
+}
+
 @Entity({ schema: "freight", name: "companies" })
 @Index(["tin"])
 @Index(["type"])
@@ -112,29 +131,11 @@ export class Company extends BaseEntity {
   })
   contactPersonPhone?: string | null;
 
-  @Column({
-    name: "general_manager_name",
-    type: "varchar",
-    length: 100,
-    nullable: true,
-  })
-  generalManagerName?: string | null;
-
-  @Column({
-    name: "general_manager_email",
-    type: "varchar",
-    length: 150,
-    nullable: true,
-  })
-  generalManagerEmail?: string | null;
-
-  @Column({
-    name: "general_manager_phone",
-    type: "varchar",
-    length: 20,
-    nullable: true,
-  })
-  generalManagerPhone?: string | null;
+  // The general manager used to live here as three columns. It named who to
+  // talk to, gated nothing, and nothing ever populated the columns — the write
+  // path put the values in `attributes`. Removed in RemoveGeneralManager; the
+  // company's people are now its owner (whoever the eTrade licence names) and
+  // its Power of Attorney, both in `attributes`.
 
   @Column({ name: "website", type: "varchar", length: 200, nullable: true })
   website?: string | null;
diff --git a/apps/edr-freight-api/src/modules/companies/services/etrade-business-selection.spec.ts b/apps/edr-freight-api/src/modules/companies/services/etrade-business-selection.spec.ts
index 0719d7fe8..86117d306 100644
--- a/apps/edr-freight-api/src/modules/companies/services/etrade-business-selection.spec.ts
+++ b/apps/edr-freight-api/src/modules/companies/services/etrade-business-selection.spec.ts
@@ -63,6 +63,21 @@ describe('ETradeService business selection', () => {
     expect(fetched).toEqual(['MT/AA/14/670/11551235/2017']);
   });
 
+  it('survives the null entries eTrade puts in SubGroups', () => {
+    const { service } = build();
+    const info = companyInfo();
+    (info.Businesses[0] as any).SubGroups = [
+      null,
+      { Code: 66331, Description: 'Export trade in minerals' },
+      { Code: 1, Description: null },
+    ];
+    const data = service.extractRegistrationData(
+      { LicenceNumber: 'x' } as ETradeBusinessInfo,
+      info,
+    );
+    expect(data.businesses?.[0].activity).toBe('Export trade in minerals');
+  });
+
   it('lists every licence for the picker, code prefixes stripped', () => {
     const { service } = build();
     const data = service.extractRegistrationData(
diff --git a/apps/edr-freight-api/src/modules/companies/services/etrade.service.ts b/apps/edr-freight-api/src/modules/companies/services/etrade.service.ts
index 45cc8e840..fac57238a 100644
--- a/apps/edr-freight-api/src/modules/companies/services/etrade.service.ts
+++ b/apps/edr-freight-api/src/modules/companies/services/etrade.service.ts
@@ -142,7 +142,8 @@ export class ETradeService {
         tradeName: b.TradesName?.trim() || "",
         activity: (b.SubGroups ?? [])
           // Some descriptions repeat the code inline ("(65611)Import trade …").
-          .map((g) => g.Description?.replace(/^\(\d+\)\s*/, "").trim())
+          // eTrade also puts null entries in this array, so every hop is optional.
+          .map((g) => g?.Description?.replace(/^\(\d+\)\s*/, "").trim())
           .filter(Boolean)
           .join(", "),
         renewedTo: b.RenewedTo || "",
diff --git a/apps/edr-freight-api/src/modules/contracts/booking-clearance.service.spec.ts b/apps/edr-freight-api/src/modules/contracts/booking-clearance.service.spec.ts
index df55493de..8c127e840 100644
--- a/apps/edr-freight-api/src/modules/contracts/booking-clearance.service.spec.ts
+++ b/apps/edr-freight-api/src/modules/contracts/booking-clearance.service.spec.ts
@@ -291,7 +291,7 @@ describe('BookingClearanceService', () => {
       const { service, bookingsRepository } = makeService({ booking: generalExportBooking });
       const result = await service.uploadReleaseOrder(
         'b-export',
-        { fieldname: 'ro' } as Express.Multer.File,
+        [{ fieldname: 'ro' } as Express.Multer.File],
         dateStr,
       );
 
diff --git a/apps/edr-freight-api/src/modules/contracts/booking-clearance.service.ts b/apps/edr-freight-api/src/modules/contracts/booking-clearance.service.ts
index c9c15f8b0..e0d30a2be 100644
--- a/apps/edr-freight-api/src/modules/contracts/booking-clearance.service.ts
+++ b/apps/edr-freight-api/src/modules/contracts/booking-clearance.service.ts
@@ -1,6 +1,7 @@
 import { BadRequestException, Injectable } from '@nestjs/common';
 import {
   ContractDocPhase,
+  isDeliveryOrderFileCode,
   isDraftDeclarationFileCode,
   type ClearanceFinalInvoiceSummary,
   type ClearanceOffloadState,
@@ -29,7 +30,7 @@ import { GlOperationsService } from './gl-operations.service';
 import { GlExchangeService } from './gl-exchange.service';
 import { TransitAgentsService } from '../transit-agents/transit-agents.service';
 import { AdviseContractDutyDto } from './dto/phased-clearance.dto';
-import { buildWorkflowFiles, belongsOnDjClearanceQueue, belongsOnEtClearanceQueue, DJ_BOOKING_QUEUE_STATUSES, persistDeclarationUploads, persistDraftDeclarationUploads, persistTransitPermitUploads, PHASED_CUSTOMS_BOOKING_QUEUE_STATUSES } from './phased-clearance.util';
+import { buildWorkflowFiles, belongsOnDjClearanceQueue, belongsOnEtClearanceQueue, DJ_BOOKING_QUEUE_STATUSES, persistDeclarationUploads, persistDeliveryOrderUploads, persistDraftDeclarationUploads, persistReleaseOrderUploads, persistTransitPermitUploads, PHASED_CUSTOMS_BOOKING_QUEUE_STATUSES } from './phased-clearance.util';
 
 const RO_VESSEL_MIN_DAYS_CODE = 'ro_vessel_min_days';
 
@@ -813,7 +814,7 @@ export class BookingClearanceService {
 
     // GL Djibouti may have uploaded the DO early (un-gated) — count it now.
     const files = await this.filesService.findByResource(bookingId, 'bookings');
-    if (files.some((f) => f.code === 'delivery_order')) {
+    if (files.some((f) => isDeliveryOrderFileCode(f.code))) {
       await this.workflowService.completeMilestoneForBooking(bookingId, 'DO_COLLECTED');
       await this.workflowService.markReadyForOperation(bookingId);
     }
@@ -823,7 +824,7 @@ export class BookingClearanceService {
 
   async uploadDeliveryOrder(
     bookingId: string,
-    file: Express.Multer.File,
+    files: Express.Multer.File[],
     userId?: string,
     dates?: { vesselArrivalDate?: string; doCollectedDate?: string },
   ): Promise<Booking> {
@@ -832,19 +833,12 @@ export class BookingClearanceService {
       throw new BadRequestException('Delivery Order applies only to import bookings.');
     }
 
-    if (!file) throw new BadRequestException('No Delivery Order uploaded');
-
     const { vesselArrivalDate, doCollectedDate } = assertDoCollectionDates(dates);
 
     // DO upload is deliberately un-gated: GL Djibouti may attach it at any point,
     // any file type. The DO_COLLECTED milestone (and operation readiness) still
     // waits for GL Ethiopia to finalize pre-clearance so the workflow order holds.
-    await this.filesService.upsertByCode({
-      resourceId: bookingId,
-      resource: 'bookings',
-      code: 'delivery_order',
-      file,
-    });
+    await persistDeliveryOrderUploads(this.filesService, bookingId, 'bookings', files ?? []);
 
     await this.bookingsRepository.update(bookingId, {
       vesselArrivalDate,
@@ -880,7 +874,7 @@ export class BookingClearanceService {
 
   async uploadReleaseOrder(
     bookingId: string,
-    file: Express.Multer.File,
+    files: Express.Multer.File[],
     vesselDepartureDate: string,
     userId?: string,
   ): Promise<{ booking: Booking; hold: boolean; holdReason?: string }> {
@@ -894,7 +888,6 @@ export class BookingClearanceService {
       'RELEASE_ORDER_SECURED',
     );
 
-    if (!file) throw new BadRequestException('No Release Order uploaded');
     if (!vesselDepartureDate?.trim()) {
       throw new BadRequestException('Vessel departure date is required');
     }
@@ -902,12 +895,7 @@ export class BookingClearanceService {
     const minDays = await this.resolveRoMinDays();
     const leadDays = this.daysUntil(vesselDepartureDate);
 
-    await this.filesService.upsertByCode({
-      resourceId: bookingId,
-      resource: 'bookings',
-      code: 'release_order',
-      file,
-    });
+    await persistReleaseOrderUploads(this.filesService, bookingId, 'bookings', files ?? []);
 
     await this.bookingsRepository.update(bookingId, {
       vesselDepartureDate,
diff --git a/apps/edr-freight-api/src/modules/contracts/contract-clearance.service.ts b/apps/edr-freight-api/src/modules/contracts/contract-clearance.service.ts
index 2ebd8fc70..76106a9ff 100644
--- a/apps/edr-freight-api/src/modules/contracts/contract-clearance.service.ts
+++ b/apps/edr-freight-api/src/modules/contracts/contract-clearance.service.ts
@@ -6,6 +6,7 @@ import {
 } from '@nestjs/common';
 import {
   ContractDocPhase,
+  isDeliveryOrderFileCode,
   type ClearanceFinalInvoiceSummary,
   type ClearanceOffloadState,
   type ClearanceSecondDuty,
@@ -36,7 +37,7 @@ import { Contract } from './entities/contract.entity';
 import { ContractDocReviewStatus } from './entities/contract-document-review.entity';
 import { FilterContractDto } from './dto/filter-contract.dto';
 import { AdviseContractDutyDto } from './dto/phased-clearance.dto';
-import { buildWorkflowFiles, persistDeclarationUploads, persistTransitPermitUploads, PHASED_CUSTOMS_CONTRACT_QUEUE_STATUSES } from './phased-clearance.util';
+import { buildWorkflowFiles, persistDeclarationUploads, persistDeliveryOrderUploads, persistReleaseOrderUploads, persistTransitPermitUploads, PHASED_CUSTOMS_CONTRACT_QUEUE_STATUSES } from './phased-clearance.util';
 
 const RO_VESSEL_MIN_DAYS_CODE = 'ro_vessel_min_days';
 
@@ -1449,7 +1450,7 @@ export class ContractClearanceService {
 
     // GL Djibouti may have uploaded the DO early (un-gated) — count it now.
     const files = await this.filesService.findByResource(contractId, 'contracts');
-    if (files.some((f) => f.code === 'delivery_order')) {
+    if (files.some((f) => isDeliveryOrderFileCode(f.code))) {
       await this.workflowService.completeMilestone(contractId, 'DO_COLLECTED');
       await this.workflowService.markReadyForBooking(contractId);
     }
@@ -1460,7 +1461,7 @@ export class ContractClearanceService {
 
   async uploadDeliveryOrder(
     contractId: string,
-    file: Express.Multer.File,
+    files: Express.Multer.File[],
     userId?: string,
     dates?: { vesselArrivalDate?: string; doCollectedDate?: string },
   ): Promise<Contract> {
@@ -1470,19 +1471,12 @@ export class ContractClearanceService {
       throw new BadRequestException('Delivery Order applies only to import contracts.');
     }
 
-    if (!file) throw new BadRequestException('No Delivery Order uploaded');
-
     const { vesselArrivalDate, doCollectedDate } = assertDoCollectionDates(dates);
 
     // DO upload is deliberately un-gated: GL Djibouti may attach it at any point,
     // any file type. The DO_COLLECTED milestone (and booking readiness) still waits
     // for GL Ethiopia to finalize pre-clearance so the workflow order holds.
-    await this.filesService.upsertByCode({
-      resourceId: contractId,
-      resource: 'contracts',
-      code: 'delivery_order',
-      file,
-    });
+    await persistDeliveryOrderUploads(this.filesService, contractId, 'contracts', files ?? []);
 
     const cycle = await this.contractsRepository.currentCycle(contractId);
     if (cycle) {
@@ -1520,7 +1514,7 @@ export class ContractClearanceService {
 
   async uploadReleaseOrder(
     contractId: string,
-    file: Express.Multer.File,
+    files: Express.Multer.File[],
     vesselDepartureDate: string,
     userId?: string,
   ): Promise<{ contract: Contract; hold: boolean; holdReason?: string }> {
@@ -1535,7 +1529,6 @@ export class ContractClearanceService {
       'RELEASE_ORDER_SECURED',
     );
 
-    if (!file) throw new BadRequestException('No Release Order uploaded');
     if (!vesselDepartureDate?.trim()) {
       throw new BadRequestException('Vessel departure date is required');
     }
@@ -1545,12 +1538,7 @@ export class ContractClearanceService {
     const cycle = await this.contractsRepository.currentCycle(contractId);
     if (!cycle) throw new BadRequestException('No clearance cycle found');
 
-    await this.filesService.upsertByCode({
-      resourceId: contractId,
-      resource: 'contracts',
-      code: 'release_order',
-      file,
-    });
+    await persistReleaseOrderUploads(this.filesService, contractId, 'contracts', files ?? []);
 
     await this.contractsRepository.updateCycle(cycle.id, {
       vesselDepartureDate,
diff --git a/apps/edr-freight-api/src/modules/contracts/contract-staff-stamp.spec.ts b/apps/edr-freight-api/src/modules/contracts/contract-staff-stamp.spec.ts
new file mode 100644
index 000000000..6d370c276
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/contracts/contract-staff-stamp.spec.ts
@@ -0,0 +1,152 @@
+import { BadRequestException } from '@nestjs/common';
+
+import { ContractTransitionService } from './contract-transition.service';
+
+/**
+ * Where the booking-contract view reads the global stamp live, the contracts
+ * path SNAPSHOTS it onto the signature row at signing time, so replacing the
+ * company stamp can never restamp an already-executed contract. These specs
+ * pin the sourcing split: EDR always seals with the global stamp and staff
+ * never supply one, while the customer must upload their own.
+ */
+describe('applySignature stamp sourcing', () => {
+  const contract = { id: 'c-1', reference: 'CTR-1', status: 'SIGNED_CUSTOMER' };
+  const GLOBAL_STAMP = 'data:image/png;base64,RURS';
+
+  const build = (globalStamp: string | null = GLOBAL_STAMP) => {
+    const uploads: Array<{ code: string; image: string }> = [];
+    const saved: unknown[] = [];
+    const service = Object.create(
+      ContractTransitionService.prototype,
+    ) as ContractTransitionService;
+    Object.assign(service, {
+      logger: { warn: jest.fn(), log: jest.fn() },
+      stampSettings: {
+        getStampImageUrl: jest.fn().mockResolvedValue(globalStamp),
+      },
+      contractsRepository: {
+        saveSignature: jest.fn((row: unknown) => {
+          saved.push(row);
+          return Promise.resolve(undefined);
+        }),
+      },
+      signaturesService: {
+        getForUser: jest.fn().mockResolvedValue(null),
+        upsertForUser: jest.fn().mockResolvedValue(undefined),
+      },
+      uploadSignatureAsset: jest.fn((_c: unknown, code: string, image: string) => {
+        uploads.push({ code, image });
+        return Promise.resolve({ id: `file-${code}` });
+      }),
+    });
+    return { service, uploads, saved };
+  };
+
+  const apply = (
+    service: ContractTransitionService,
+    dto: Record<string, unknown>,
+  ) =>
+    (
+      service as unknown as {
+        applySignature(
+          c: unknown,
+          d: unknown,
+          o: { signerUserId?: string },
+        ): Promise<void>;
+      }
+    ).applySignature(contract, dto, { signerUserId: 'u-1' });
+
+  const staffDto = {
+    role: 'STAFF' as const,
+    signerDisplayName: 'E. Staff',
+    signatureImageBase64: 'data:image/png;base64,U0lH',
+  };
+
+  it('seals the EDR side with the global stamp', async () => {
+    const { service, uploads, saved } = build();
+
+    await apply(service, staffDto);
+
+    expect(uploads).toContainEqual({ code: 'stamp_staff', image: GLOBAL_STAMP });
+    expect(saved[0]).toEqual(
+      expect.objectContaining({ stampFileId: 'file-stamp_staff' }),
+    );
+  });
+
+  it('ignores a stamp a staff client tries to supply', async () => {
+    const { service, uploads } = build();
+
+    await apply(service, {
+      ...staffDto,
+      stampImageBase64: 'data:image/png;base64,SEFDSw==',
+    });
+
+    expect(uploads).toContainEqual({ code: 'stamp_staff', image: GLOBAL_STAMP });
+    expect(uploads.map((u) => u.image)).not.toContain(
+      'data:image/png;base64,SEFDSw==',
+    );
+  });
+
+  /**
+   * Failing loudly matters here: getStampImageUrl degrades to null when the
+   * stamp cannot be inlined, and silently executing an unsealed contract would
+   * be worse than refusing to counter-sign.
+   */
+  it('refuses to counter-sign when no global stamp is configured', async () => {
+    const { service, saved } = build(null);
+
+    await expect(apply(service, staffDto)).rejects.toBeInstanceOf(
+      BadRequestException,
+    );
+    await expect(apply(service, staffDto)).rejects.toThrow(/company stamp is configured/i);
+    expect(saved).toHaveLength(0);
+  });
+
+  it('requires the customer to upload their own stamp', async () => {
+    const { service, saved } = build();
+
+    await expect(
+      apply(service, {
+        role: 'CUSTOMER',
+        signerDisplayName: 'C. Customer',
+        signatureImageBase64: 'data:image/png;base64,U0lH',
+      }),
+    ).rejects.toThrow(/company stamp is required/i);
+    expect(saved).toHaveLength(0);
+  });
+
+  it('snapshots the customer stamp and never substitutes the global one', async () => {
+    const { service, uploads } = build();
+    const customerStamp = 'data:image/png;base64,Q1VTVA==';
+
+    await apply(service, {
+      role: 'CUSTOMER',
+      signerDisplayName: 'C. Customer',
+      signatureImageBase64: 'data:image/png;base64,U0lH',
+      stampImageBase64: customerStamp,
+    });
+
+    expect(uploads).toContainEqual({
+      code: 'stamp_customer',
+      image: customerStamp,
+    });
+    expect(uploads.map((u) => u.image)).not.toContain(GLOBAL_STAMP);
+  });
+
+  /**
+   * DIRECTOR/CEO rows are internal approval signatures, not party seals, so
+   * they are deliberately exempt from the stamp requirement.
+   */
+  it('lets internal approval signatures through without any stamp', async () => {
+    const { service, uploads, saved } = build();
+
+    await apply(service, {
+      role: 'DIRECTOR',
+      signerDisplayName: 'D. Director',
+      signatureImageBase64: 'data:image/png;base64,U0lH',
+    });
+
+    expect(uploads.map((u) => u.code)).toEqual(['signature_director']);
+    expect(saved[0]).toEqual(expect.objectContaining({ stampFileId: null }));
+  });
+});
diff --git a/apps/edr-freight-api/src/modules/contracts/contract-transition.service.ts b/apps/edr-freight-api/src/modules/contracts/contract-transition.service.ts
index ba3e3fd8b..e6f208ae2 100644
--- a/apps/edr-freight-api/src/modules/contracts/contract-transition.service.ts
+++ b/apps/edr-freight-api/src/modules/contracts/contract-transition.service.ts
@@ -9,7 +9,7 @@ import { InjectDataSource } from '@nestjs/typeorm';
 import { DataSource } from 'typeorm';
 import { randomUUID } from 'node:crypto';
 import { Readable } from 'stream';
-import { insertWithGeneratedReference } from '@edr/api-common';
+import { insertWithGeneratedReference, logCtx } from '@edr/api-common';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 
 import { ContractDocumentViewModelBuilder } from '../../contracts/contract-document-view-model.builder';
@@ -35,6 +35,7 @@ import { CargoTypesService } from '../rule-engine/services/cargo-types.service';
 import { DropdownSettingsService } from '../dropdown-settings/dropdown-settings.service';
 import { FilesService } from '../files/files.service';
 import { SignaturesService } from '../signatures/signatures.service';
+import { StampSettingsService } from '../stamp-settings/stamp-settings.service';
 import { OtpService } from '../otp/otp.service';
 import { ContractTemplatesService } from '../contract-templates/contract-templates.service';
 import { ContractPricingService } from './contract-pricing.service';
@@ -175,6 +176,7 @@ export class ContractTransitionService {
     private readonly otpService: OtpService,
     private readonly notifier: ContractNotifierService,
     private readonly contractTemplates: ContractTemplatesService,
+    private readonly stampSettings: StampSettingsService,
     @InjectDataSource()
     private readonly dataSource: DataSource,
   ) {}
@@ -1082,6 +1084,19 @@ export class ContractTransitionService {
   ): Promise<void> {
     const role = dto.role as ContractSignerRole;
 
+    // Both sign() and counterSign() land here — who signed what, and whether the
+    // ink came from the request or the signer's saved profile signature.
+    logCtx(
+      {
+        contractId: contract.id,
+        reference: contract.reference,
+        role,
+        signerUserId: options.signerUserId,
+        usedDrawnImage: Boolean(dto.signatureImageBase64),
+      },
+      { path: "contractSignatures", mode: "push" },
+    );
+
     // Resolve the signature image. The client may send a freshly-drawn image, or
     // omit it to reuse the signer's saved profile signature. Fall back to the
     // saved one whenever no image is supplied.
@@ -1103,23 +1118,39 @@ export class ContractTransitionService {
     // The company stamp is a separate image from the drawn signature. Both
     // parties to the contract (client + EDR) must seal it; DIRECTOR/CEO rows
     // are internal approval signatures, not party seals, so they stay exempt.
-    const stampRequired = role === 'CUSTOMER' || role === 'STAFF';
-    if (stampRequired && !dto.stampImageBase64) {
+    //
+    // The two parties source their seal differently: the customer uploads their
+    // own company stamp, while EDR always seals with the ONE global stamp
+    // (StampSettingsService) — staff never upload or pick a stamp.
+    if (role === 'CUSTOMER' && !dto.stampImageBase64) {
       throw new BadRequestException(
         'A company stamp is required to sign this contract.',
       );
     }
 
+    // Snapshot whichever stamp applies onto the signature row rather than
+    // referencing the global one, so replacing the company stamp later can
+    // never restamp an already-executed contract.
+    let stampImageBase64 = dto.stampImageBase64 ?? null;
+    if (role === 'STAFF') {
+      stampImageBase64 = await this.stampSettings.getStampImageUrl();
+      if (!stampImageBase64) {
+        throw new BadRequestException(
+          'No company stamp is configured. Upload the company stamp under Settings before counter-signing contracts.',
+        );
+      }
+    }
+
     const fileRecord = await this.uploadSignatureAsset(
       contract,
       `signature_${role.toLowerCase()}`,
       imageBase64,
     );
-    const stampRecord = dto.stampImageBase64
+    const stampRecord = stampImageBase64
       ? await this.uploadSignatureAsset(
           contract,
           `stamp_${role.toLowerCase()}`,
-          dto.stampImageBase64,
+          stampImageBase64,
         )
       : null;
 
diff --git a/apps/edr-freight-api/src/modules/contracts/contracts.controller.ts b/apps/edr-freight-api/src/modules/contracts/contracts.controller.ts
index 0ff9b7c24..c9db49b24 100644
--- a/apps/edr-freight-api/src/modules/contracts/contracts.controller.ts
+++ b/apps/edr-freight-api/src/modules/contracts/contracts.controller.ts
@@ -956,20 +956,20 @@ export class ContractsController {
 
   @Post(':id/clearance/delivery-order')
   @BookingStaff(FREIGHT_PERMS.contracts.clearanceDjActions)
-  @UseInterceptors(FileInterceptor('file'))
+  @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes('multipart/form-data')
   @ApiOperation({
     summary:
-      'GL DJ uploads Delivery Order (import) with vessel arrival + DO collected dates',
+      'GL DJ uploads Delivery Order files (import) with vessel arrival + DO collected dates',
   })
   uploadDeliveryOrder(
     @Param('id', ParseUUIDPipe) id: string,
-    @UploadedFile() file: Express.Multer.File,
+    @UploadedFiles() files: Express.Multer.File[],
     @Body('vesselArrivalDate') vesselArrivalDate: string | undefined,
     @Body('doCollectedDate') doCollectedDate: string | undefined,
     @CurrentUser() user: AuthUserPayload,
   ) {
-    return this.clearanceService.uploadDeliveryOrder(id, file, resolveAuthUserId(user), {
+    return this.clearanceService.uploadDeliveryOrder(id, files ?? [], resolveAuthUserId(user), {
       vesselArrivalDate,
       doCollectedDate,
     });
@@ -977,18 +977,18 @@ export class ContractsController {
 
   @Post(':id/clearance/release-order')
   @BookingStaff(FREIGHT_PERMS.contracts.clearanceDjActions)
-  @UseInterceptors(FileInterceptor('file'))
+  @UseInterceptors(AnyFilesInterceptor())
   @ApiConsumes('multipart/form-data')
-  @ApiOperation({ summary: 'GL DJ uploads Release Order + vessel departure date (export)' })
+  @ApiOperation({ summary: 'GL DJ uploads Release Order files + vessel departure date (export)' })
   uploadReleaseOrder(
     @Param('id', ParseUUIDPipe) id: string,
-    @UploadedFile() file: Express.Multer.File,
+    @UploadedFiles() files: Express.Multer.File[],
     @Body('vesselDepartureDate') vesselDepartureDate: string,
     @CurrentUser() user: AuthUserPayload,
   ) {
     return this.clearanceService.uploadReleaseOrder(
       id,
-      file,
+      files ?? [],
       vesselDepartureDate,
       resolveAuthUserId(user),
     );
diff --git a/apps/edr-freight-api/src/modules/contracts/contracts.service.ts b/apps/edr-freight-api/src/modules/contracts/contracts.service.ts
index 6e170f126..607a6f525 100644
--- a/apps/edr-freight-api/src/modules/contracts/contracts.service.ts
+++ b/apps/edr-freight-api/src/modules/contracts/contracts.service.ts
@@ -7,7 +7,7 @@ import {
 } from '@nestjs/common';
 import { InjectDataSource } from '@nestjs/typeorm';
 import { DataSource } from 'typeorm';
-import { insertWithGeneratedReference } from '@edr/api-common';
+import { insertWithGeneratedReference, logCtx } from '@edr/api-common';
 
 import { YardCountry } from '@edr/types';
 //
@@ -811,6 +811,18 @@ export class ContractsService {
       throw new NotFoundException(`Contract ${id} not found`);
     }
 
+    // Entry state for every contract flow (submit, approve, sign, suspend…) —
+    // see the equivalent in BookingsService.findById.
+    logCtx(
+      {
+        id: contract.id,
+        reference: contract.reference,
+        statusAtEntry: contract.status,
+        companyId: contract.companyId,
+      },
+      { path: "contract" },
+    );
+
     if (contract.files && contract.files.length > 0) {
       contract.files = await Promise.all(
         contract.files.map(async (file: FileRecord) => {
diff --git a/apps/edr-freight-api/src/modules/contracts/phased-clearance.util.ts b/apps/edr-freight-api/src/modules/contracts/phased-clearance.util.ts
index 78d0d6b47..ab2a2b2d4 100644
--- a/apps/edr-freight-api/src/modules/contracts/phased-clearance.util.ts
+++ b/apps/edr-freight-api/src/modules/contracts/phased-clearance.util.ts
@@ -5,6 +5,10 @@ import {
   draftDeclarationFileLabel,
   isDeclarationFileCode,
   isDraftDeclarationFileCode,
+  isDeliveryOrderFileCode,
+  isReleaseOrderFileCode,
+  deliveryOrderFileLabel,
+  releaseOrderFileLabel,
   isImportTransitPermitFileCode,
   isExportTransportFileCode,
   isT1TransportFileCode,
@@ -166,6 +170,98 @@ export async function persistTransitPermitUploads(
   );
 }
 
+/** Require at least one Delivery Order file in the upload batch. */
+export function assertDeliveryOrderFiles(files: Express.Multer.File[]): void {
+  if (files.length === 0) {
+    throw new BadRequestException('No Delivery Order uploaded');
+  }
+}
+
+/** Assign stable `delivery_order_*` codes for multi-file DO uploads. */
+export function normalizeDeliveryOrderFieldNames(
+  files: Express.Multer.File[],
+): Express.Multer.File[] {
+  return files.map((file, index) => ({
+    ...file,
+    fieldname: `delivery_order_${index}`,
+  }));
+}
+
+/** Replace all Delivery Order files on a resource with a new multi-file batch. */
+export async function persistDeliveryOrderUploads(
+  store: DeclarationFileStore,
+  resourceId: string,
+  resource: string,
+  files: Express.Multer.File[],
+): Promise<void> {
+  const normalized = normalizeDeliveryOrderFieldNames(files);
+  assertDeliveryOrderFiles(normalized);
+
+  const existing = await store.findByResource(resourceId, resource);
+  await Promise.all(
+    existing
+      .filter((f) => f.code && isDeliveryOrderFileCode(f.code))
+      .map((f) => store.deleteByCode(resourceId, resource, f.code!)),
+  );
+
+  await Promise.all(
+    normalized.map((file, index) =>
+      store.upload({
+        resourceId,
+        resource,
+        code: `delivery_order_${index}`,
+        file,
+      }),
+    ),
+  );
+}
+
+/** Require at least one Release Order file in the upload batch. */
+export function assertReleaseOrderFiles(files: Express.Multer.File[]): void {
+  if (files.length === 0) {
+    throw new BadRequestException('No Release Order uploaded');
+  }
+}
+
+/** Assign stable `release_order_*` codes for multi-file RO uploads. */
+export function normalizeReleaseOrderFieldNames(
+  files: Express.Multer.File[],
+): Express.Multer.File[] {
+  return files.map((file, index) => ({
+    ...file,
+    fieldname: `release_order_${index}`,
+  }));
+}
+
+/** Replace all Release Order files on a resource with a new multi-file batch. */
+export async function persistReleaseOrderUploads(
+  store: DeclarationFileStore,
+  resourceId: string,
+  resource: string,
+  files: Express.Multer.File[],
+): Promise<void> {
+  const normalized = normalizeReleaseOrderFieldNames(files);
+  assertReleaseOrderFiles(normalized);
+
+  const existing = await store.findByResource(resourceId, resource);
+  await Promise.all(
+    existing
+      .filter((f) => f.code && isReleaseOrderFileCode(f.code))
+      .map((f) => store.deleteByCode(resourceId, resource, f.code!)),
+  );
+
+  await Promise.all(
+    normalized.map((file, index) =>
+      store.upload({
+        resourceId,
+        resource,
+        code: `release_order_${index}`,
+        file,
+      }),
+    ),
+  );
+}
+
 /** Require at least one export transport document in the upload batch. */
 export function assertExportTransportFiles(files: Express.Multer.File[]): void {
   if (files.length === 0) {
@@ -422,6 +518,22 @@ export function buildWorkflowFiles(
       });
     });
 
+    const extraDeliveryOrders = files
+      .filter((f) => f.code && isDeliveryOrderFileCode(f.code) && !included.has(f.code))
+      .sort((a, b) => (a.code ?? '').localeCompare(b.code ?? ''));
+
+    extraDeliveryOrders.forEach((file, index) => {
+      if (!file.code) return;
+      included.add(file.code);
+      out.push({
+        code: file.code,
+        label: deliveryOrderFileLabel(file.code, index),
+        uploadedBy: 'gl_dj',
+        category: 'djibouti',
+        file: { id: file.id, name: file.name, url: file.url },
+      });
+    });
+
     const extraT1 = files
       .filter((f) => f.code && isT1TransportFileCode(f.code) && !included.has(f.code))
       .sort((a, b) => (a.code ?? '').localeCompare(b.code ?? ''));
@@ -440,6 +552,22 @@ export function buildWorkflowFiles(
   }
 
   if (tradeDirection === 'EXPORT') {
+    const extraReleaseOrders = files
+      .filter((f) => f.code && isReleaseOrderFileCode(f.code) && !included.has(f.code))
+      .sort((a, b) => (a.code ?? '').localeCompare(b.code ?? ''));
+
+    extraReleaseOrders.forEach((file, index) => {
+      if (!file.code) return;
+      included.add(file.code);
+      out.push({
+        code: file.code,
+        label: releaseOrderFileLabel(file.code, index),
+        uploadedBy: 'gl_dj',
+        category: 'djibouti',
+        file: { id: file.id, name: file.name, url: file.url },
+      });
+    });
+
     const extraExportTransport = files
       .filter((f) => f.code && isExportTransportFileCode(f.code) && !included.has(f.code))
       .sort((a, b) => (a.code ?? '').localeCompare(b.code ?? ''));
diff --git a/apps/edr-freight-api/src/modules/file-upload-settings/poa-delegation.constants.ts b/apps/edr-freight-api/src/modules/file-upload-settings/poa-delegation.constants.ts
index 7f8a34175..e23a87818 100644
--- a/apps/edr-freight-api/src/modules/file-upload-settings/poa-delegation.constants.ts
+++ b/apps/edr-freight-api/src/modules/file-upload-settings/poa-delegation.constants.ts
@@ -26,6 +26,15 @@ export const POA_DELEGATION_LABEL = "DARS Delegation Paper";
 /** Prefix of the setting codes the field is injected into. */
 export const COMPANY_ONBOARDING_CODE_PREFIX = "company_onboarding_documents_";
 
+/**
+ * The co-operative onboarding set — the third alternative to `_ethiopian` and
+ * `_foreign`, not an addition to them: a union or farm resolves to this set
+ * INSTEAD of its nationality's, because it holds no business licence and so
+ * owes a different list of papers. The delegation paper is injected into it
+ * like any other company onboarding set.
+ */
+export const COOPERATIVE_ONBOARDING_CODE = `${COMPANY_ONBOARDING_CODE_PREFIX}cooperative`;
+
 const POA_DELEGATION_HELP =
   "Delegation paper issued by the Documents Authentication and Registration " +
   "Service (DARS) delegating the representative named above. Upload the " +
diff --git a/apps/edr-freight-api/src/modules/notifications/resolve-company-phone.util.ts b/apps/edr-freight-api/src/modules/notifications/resolve-company-phone.util.ts
index 886aa8b85..104456384 100644
--- a/apps/edr-freight-api/src/modules/notifications/resolve-company-phone.util.ts
+++ b/apps/edr-freight-api/src/modules/notifications/resolve-company-phone.util.ts
@@ -12,8 +12,8 @@ import { DataSource, EntityManager } from "typeorm";
  * `companies.contact_person_phone` is deliberately NOT consulted: the live write
  * path stores that value in the `attributes` jsonb and has never populated the
  * column, so every reader of it was silently falling through to `phone` anyway.
- * `companies.general_manager_email` is the same trap on the email side — see
- * {@link companyNotifyEmailExpr}.
+ * The retired `general_manager_email` column was the same trap on the email
+ * side — see {@link companyNotifyEmailExpr}.
  */
 
 /**
@@ -50,24 +50,30 @@ export function companyNotifyPhoneExpr(alias: string): string {
  * SQL expression for the company's notification address, given the joined `pc`
  * alias.
  *
- * `companies.email` alone is not enough: it is written from ONE place — a
- * Fayda-verified owner's email claim — so a foreign company, whose owner proves
- * identity by passport instead, never gets one. Readers papered over that with
- * `COALESCE(email, general_manager_email)`, but that column has the same problem
- * `contact_person_phone` has above: onboarding writes the value into the
- * `attributes` jsonb and nothing has ever populated the column, so the fallback
- * could not fire and the mail was dropped in silence.
+ * `companies.email` is now the owner's email, written on every profile save
+ * whether or not the owner verified with Fayda — and the owner's email is a
+ * required onboarding field, so a company that finished onboarding has one.
+ * (It used to be written ONLY for a Fayda-verified owner, which meant every
+ * foreign company had none; the gap was papered over with a
+ * `general_manager_email` leg that could never fire, because onboarding wrote
+ * that value into `attributes` and nothing ever populated the column.)
  *
- * So: the company address, then the two the customer actually filled in during
- * onboarding, then the account that registered them — which always has one,
- * signup requires it. `NULLIF` because a blank jsonb key is not an address and
- * `COALESCE` would happily stop on it.
+ * The `generalManagerEmail` attribute is still consulted, after the contact
+ * person: the general manager was removed, but companies onboarded before that
+ * may carry an address there and nowhere else. RemoveGeneralManager backfills
+ * `companies.email` from it, so this is belt-and-braces for rows that migration
+ * could not resolve.
+ *
+ * `NULLIF` because a blank jsonb key is not an address and `COALESCE` would
+ * happily stop on it. The account that registered the company is the last
+ * resort — signup guarantees it has one.
  */
 export function companyNotifyEmailExpr(alias: string): string {
   return `COALESCE(
     NULLIF(${alias}.email, ''),
-    NULLIF(${alias}.attributes->>'generalManagerEmail', ''),
+    NULLIF(${alias}.attributes->>'ownerEmail', ''),
     NULLIF(${alias}.attributes->>'contactPersonEmail', ''),
+    NULLIF(${alias}.attributes->>'generalManagerEmail', ''),
     NULLIF(pc.email, '')
   )`;
 }
diff --git a/apps/edr-freight-api/src/modules/otp/otp.service.ts b/apps/edr-freight-api/src/modules/otp/otp.service.ts
index a7361fbdd..42d46226a 100644
--- a/apps/edr-freight-api/src/modules/otp/otp.service.ts
+++ b/apps/edr-freight-api/src/modules/otp/otp.service.ts
@@ -1,6 +1,7 @@
 // otp.service.ts
 
 import { BadRequestException, Injectable, Logger } from "@nestjs/common";
+import { logCtx } from "@edr/api-common";
 import { randomInt } from "node:crypto";
 
 import { OtpRepository } from "./otp.repository";
@@ -317,6 +318,13 @@ export class OtpService {
       }`;
     if (result === "ok") this.logger.log(line);
     else this.logger.warn(line);
+
+    // Outcome only — the target is a phone number / email address and stays out
+    // of the canonical line. Channels are safe and say which one was used.
+    logCtx(
+      { mode, result, channels: channelsOf(target) },
+      { path: "otp.verify", mode: "push" },
+    );
   }
 
   /**
diff --git a/apps/edr-freight-api/src/modules/payment/payment-client.service.ts b/apps/edr-freight-api/src/modules/payment/payment-client.service.ts
index 26a0cf5ed..de220fd59 100644
--- a/apps/edr-freight-api/src/modules/payment/payment-client.service.ts
+++ b/apps/edr-freight-api/src/modules/payment/payment-client.service.ts
@@ -7,6 +7,7 @@ import {
 import { HttpService } from "@nestjs/axios";
 import { AxiosError } from "axios";
 import { firstValueFrom } from "rxjs";
+import { logCtx } from "@edr/api-common";
 import {
   InitiatePaymentRequest,
   PaymentIntentSnapshot,
@@ -111,6 +112,16 @@ export class PaymentClientService {
     body?: unknown,
   ): Promise<T> {
     const url = `${this.baseUrl}${path}`;
+    // Every hop to the payment service lands on the request log line: which
+    // call, how slow, and what it answered. A settle that never happened is
+    // almost always one of these coming back 4xx/5xx or timing out.
+    const startedAt = Date.now();
+    const trace = (extra: Record<string, unknown>) =>
+      logCtx(
+        { method, path, ms: Date.now() - startedAt, ...extra },
+        { path: "outbound.payment", mode: "push" },
+      );
+
     try {
       const response = await firstValueFrom(
         this.http.request<T>({
@@ -122,9 +133,11 @@ export class PaymentClientService {
             : {},
         }),
       );
+      trace({ status: response.status });
       return response.data;
     } catch (err) {
       if (err instanceof AxiosError && err.response) {
+        trace({ status: err.response.status });
         if (err.response.status === 404) throw err;
         const detail =
           (err.response.data as { message?: string | string[] })?.message ??
@@ -136,6 +149,7 @@ export class PaymentClientService {
       }
       const message =
         err instanceof Error && err.message ? err.message : String(err);
+      trace({ unreachable: true, error: message });
       this.logger.error(
         `payment service unreachable (${method} ${path}): ${message}`,
       );
diff --git a/apps/edr-freight-api/src/modules/payment/payment-events.consumer.ts b/apps/edr-freight-api/src/modules/payment/payment-events.consumer.ts
index e285c181c..91237223c 100644
--- a/apps/edr-freight-api/src/modules/payment/payment-events.consumer.ts
+++ b/apps/edr-freight-api/src/modules/payment/payment-events.consumer.ts
@@ -1,4 +1,4 @@
-import { Injectable, Logger, SetMetadata } from "@nestjs/common";
+import { Injectable, Logger } from "@nestjs/common";
 import { Nack, RabbitSubscribe } from "@golevelup/nestjs-rabbitmq";
 import { Public } from "@edr/api-common";
 import {
@@ -14,11 +14,6 @@ import { PaymentService as PaymentSvc } from "./payment.service";
 
 const FREIGHT_QUEUE = PAYMENT_QUEUES[PaymentService.FREIGHT];
 
-// @tria-plc/auditlog's global ClientLoggerInterceptor (present in deployed builds)
-// crashes on non-HTTP contexts (`originalUrl.split` on a RabbitMQ message) and the
-// resulting requeue storm blocks payment.succeeded forever. Its IgnoreLoggerAudit
-// decorator is just this metadata key — set it directly so we don't need the package.
-@SetMetadata("ignoreAuditLogger", true)
 @Injectable()
 export class PaymentEventsConsumer {
     private readonly logger = new Logger(PaymentEventsConsumer.name);
diff --git a/apps/edr-freight-api/src/modules/payment/payment.service.ts b/apps/edr-freight-api/src/modules/payment/payment.service.ts
index 316f3e8fe..4d27c8c77 100644
--- a/apps/edr-freight-api/src/modules/payment/payment.service.ts
+++ b/apps/edr-freight-api/src/modules/payment/payment.service.ts
@@ -7,6 +7,7 @@ import {
   Logger,
   NotFoundException,
 } from "@nestjs/common";
+import { logCtx } from "@edr/api-common";
 import { applyBookingRefDirectionScope } from "../user-trade-access/trade-scope.util";
 import { PaymentEntity } from "./entities/payment.entity";
 import { PaymentRepository } from "./payment.repository";
@@ -214,8 +215,16 @@ export class PaymentService {
         PaymentReferenceType.SHIPMENT,
         referenceId,
       );
+      logCtx(
+        { referenceId, paid: result.paid, unverifiable: result.unverifiable },
+        { path: "payment.reconcile" },
+      );
       return { paid: result.paid, unverifiable: result.unverifiable };
     } catch (err) {
+      logCtx(
+        { referenceId, unverifiable: true, error: (err as Error).message },
+        { path: "payment.reconcile" },
+      );
       this.logger.warn(
         `Reconcile for shipment ${referenceId} failed: ${(err as Error).message}`,
       );
@@ -224,6 +233,18 @@ export class PaymentService {
   }
 
   async initiate(input: InitiateIntentInput): Promise<InitiateIntentResult> {
+    logCtx(
+      {
+        referenceId: input.referenceId,
+        source: input.source,
+        orderRef: input.orderRef,
+        method: input.method,
+        amountMinor: input.amountMinor,
+        currency: input.currency,
+        platform: input.platform,
+      },
+      { path: "payment.initiate" },
+    );
     try {
       const isCbeBill = input.method === ProviderMethod.CBE_BILL;
       // CBE settles ETB only (docs/cbe/CBE_IMPLEMENTATION_PLAN.md D8).
@@ -268,6 +289,17 @@ export class PaymentService {
 
       const intent = await this.upsertIntent(input, snapshot);
 
+      logCtx(
+        {
+          intentId: intent.id,
+          providerStatus: snapshot.status,
+          providerTxnId: snapshot.providerTxnId,
+          merchantOrderId: snapshot.merchantOrderId,
+          immediateSuccess,
+        },
+        { path: "payment.initiate" },
+      );
+
       if (immediateSuccess) {
         // Settle the projection but DO NOT notify billing — billing settles
         // inline once it has stored intentId on the invoice (see payInvoice),
@@ -428,6 +460,17 @@ export class PaymentService {
       otp,
     );
 
+    logCtx(
+      {
+        intentId: local.id,
+        refId: local.refId,
+        gatewayIntentId: snapshot.intentId,
+        providerStatus: confirmed.status,
+        failureCode: confirmed.failureCode,
+      },
+      { path: "payment.confirmOtp" },
+    );
+
     if (confirmed.status === ProviderPaymentStatus.SUCCEEDED) {
       await this.markIntentSucceeded(local.id, {
         providerTxnId: confirmed.providerTxnId,
@@ -460,6 +503,16 @@ export class PaymentService {
   ): Promise<{ alreadyFinalized: boolean }> {
     const intent = await this.paymentRepo.findOneBy({ id: intentId });
     if (!intent) throw new NotFoundException("PaymentIntent not found");
+    logCtx(
+      {
+        intentId,
+        refId: intent.refId,
+        priorStatus: intent.status,
+        providerTxnId: opts.providerTxnId,
+        notifyBilling: opts.notify !== false,
+      },
+      { path: "payment.settle" },
+    );
     if (intent.status === "success") {
       // Still notify billing: a prior delivery may have flipped the intent to
       // success and then died before the invoice settled (the two steps are not
@@ -471,6 +524,7 @@ export class PaymentService {
           opts.paidAt ?? intent.paidAt ?? undefined,
         );
       }
+      logCtx(true, { path: "payment.settle.alreadyFinalized", mode: "set" });
       return { alreadyFinalized: true };
     }
 
@@ -507,6 +561,15 @@ export class PaymentService {
     referenceId: string,
   ): Promise<{ acknowledged: boolean }> {
     const intent = await this.paymentRepo.findOneBy({ refId: referenceId });
+    logCtx(
+      {
+        referenceId,
+        intentId: intent?.id,
+        intentStatus: intent?.status ?? "none",
+        method: intent?.method,
+      },
+      { path: "payment.successRedirect" },
+    );
     if (!intent || intent.method === "cbe-bill") {
       return { acknowledged: false };
     }
@@ -533,6 +596,16 @@ export class PaymentService {
   }): Promise<void> {
     const intent = await this.paymentRepo.findOneBy({ id: input.intentId });
     if (!intent) throw new NotFoundException("PaymentIntent not found");
+    logCtx(
+      {
+        intentId: intent.id,
+        refId: intent.refId,
+        priorStatus: intent.status,
+        failureCode: input.failureCode,
+        failureMessage: input.failureMessage,
+      },
+      { path: "payment.failed" },
+    );
     if (intent.status === "success" || intent.status === "canceled") return;
 
     await this.paymentRepo.update(
diff --git a/apps/edr-freight-api/src/modules/rule-engine/repositories/cargo-types.repository.ts b/apps/edr-freight-api/src/modules/rule-engine/repositories/cargo-types.repository.ts
index 07993c267..d285deeb0 100644
--- a/apps/edr-freight-api/src/modules/rule-engine/repositories/cargo-types.repository.ts
+++ b/apps/edr-freight-api/src/modules/rule-engine/repositories/cargo-types.repository.ts
@@ -91,9 +91,8 @@ export class CargoTypesRepository implements ICargoTypesRepository {
 
   /**
    * Diffs the wagon-type links through the relation query builder rather than
-   * an entity save: junction-row inserts from save() broadcast afterInsert with
-   * no entity attached, which the @tria-plc/auditlog subscriber (deployed
-   * builds) dereferences and crashes the request on.
+   * an entity save, so junction rows are written without broadcasting
+   * afterInsert events for entity-less inserts.
    */
   private async syncWagonTypes(
     id: string,
diff --git a/apps/edr-freight-api/src/modules/stamp-settings/dto/update-stamp-setting.dto.ts b/apps/edr-freight-api/src/modules/stamp-settings/dto/update-stamp-setting.dto.ts
new file mode 100644
index 000000000..96f86bf61
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/stamp-settings/dto/update-stamp-setting.dto.ts
@@ -0,0 +1,9 @@
+import { ApiProperty } from "@nestjs/swagger";
+import { IsString, MinLength } from "class-validator";
+
+export class UpdateStampSettingDto {
+  @ApiProperty({ description: "Stamp image as a base64 data URL (PNG/JPG)." })
+  @IsString()
+  @MinLength(1)
+  stampImageBase64!: string;
+}
diff --git a/apps/edr-freight-api/src/modules/stamp-settings/entities/stamp-setting.entity.ts b/apps/edr-freight-api/src/modules/stamp-settings/entities/stamp-setting.entity.ts
new file mode 100644
index 000000000..7ab7a0e2c
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/stamp-settings/entities/stamp-setting.entity.ts
@@ -0,0 +1,24 @@
+import { BaseEntity } from "@edr/api-common";
+import { Column, Entity, JoinColumn, ManyToOne } from "typeorm";
+
+import { FileRecord } from "../../files/entities/file.entity";
+
+/**
+ * Single-row table holding the one company stamp/seal image stamped onto
+ * generated invoice/receipt PDFs (see InvoiceDocumentService). Mirrors the
+ * exchange_settings single-row pattern — `get()` lazily creates the row, and
+ * there is never more than one.
+ */
+@Entity({ schema: "freight", name: "stamp_settings" })
+export class StampSetting extends BaseEntity {
+  @Column({ name: "stamp_file_id", type: "uuid", nullable: true })
+  stampFileId?: string | null;
+
+  @ManyToOne(() => FileRecord, { nullable: true })
+  @JoinColumn({ name: "stamp_file_id" })
+  stampFile?: FileRecord | null;
+
+  /** IAM user id of the last operator to set/clear the stamp. */
+  @Column({ name: "updated_by_id", type: "uuid", nullable: true })
+  updatedById?: string | null;
+}
diff --git a/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.controller.ts b/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.controller.ts
new file mode 100644
index 000000000..1ba60139e
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.controller.ts
@@ -0,0 +1,39 @@
+import { Body, Controller, Delete, Get, Put } from "@nestjs/common";
+import { ApiBearerAuth, ApiOperation, ApiTags } from "@nestjs/swagger";
+import { CurrentUser } from "@edr/api-common";
+import type { TCurrentUser } from "@tria-plc/api-common/modules/auth/types/current-user.type";
+
+import { BookingStaff } from "../../common/booking-guards";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
+import { UpdateStampSettingDto } from "./dto/update-stamp-setting.dto";
+import { StampSettingsService } from "./stamp-settings.service";
+
+@ApiTags("stamp-settings")
+@ApiBearerAuth()
+@Controller("stamp-settings")
+export class StampSettingsController {
+  constructor(private readonly service: StampSettingsService) {}
+
+  @Get()
+  @BookingStaff([FREIGHT_PERMS.settings.stamp.view, FREIGHT_PERMS.admin])
+  @ApiOperation({ summary: "Current company stamp used on invoice/receipt PDFs" })
+  get() {
+    return this.service.getView();
+  }
+
+  @Put()
+  @BookingStaff([FREIGHT_PERMS.settings.stamp.manage, FREIGHT_PERMS.admin])
+  @ApiOperation({ summary: "Replace the company stamp" })
+  update(@Body() dto: UpdateStampSettingDto, @CurrentUser() user: TCurrentUser) {
+    return this.service.setStamp(dto.stampImageBase64, user?.id ?? null);
+  }
+
+  @Delete()
+  @BookingStaff([FREIGHT_PERMS.settings.stamp.manage, FREIGHT_PERMS.admin])
+  @ApiOperation({
+    summary: "Clear the company stamp (invoices fall back to the plain seal)",
+  })
+  clear(@CurrentUser() user: TCurrentUser) {
+    return this.service.clearStamp(user?.id ?? null);
+  }
+}
diff --git a/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.module.ts b/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.module.ts
new file mode 100644
index 000000000..6c9fc3a36
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.module.ts
@@ -0,0 +1,23 @@
+import { Global, Module } from "@nestjs/common";
+import { TypeOrmModule } from "@nestjs/typeorm";
+
+import { FilesModule } from "../files/files.module";
+import { MinioModule } from "../minio/minio.module";
+import { StampSetting } from "./entities/stamp-setting.entity";
+import { StampSettingsController } from "./stamp-settings.controller";
+import { StampSettingsRepository } from "./stamp-settings.repository";
+import { StampSettingsService } from "./stamp-settings.service";
+
+/**
+ * Global so DocumentsModule (invoice PDF rendering) can inject
+ * {@link StampSettingsService} without pulling in a circular billing/warehouse
+ * dependency — same reasoning as ExchangeSettingsModule.
+ */
+@Global()
+@Module({
+  imports: [TypeOrmModule.forFeature([StampSetting]), FilesModule, MinioModule],
+  controllers: [StampSettingsController],
+  providers: [StampSettingsRepository, StampSettingsService],
+  exports: [StampSettingsService],
+})
+export class StampSettingsModule {}
diff --git a/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.repository.ts b/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.repository.ts
new file mode 100644
index 000000000..0ca4cfb68
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.repository.ts
@@ -0,0 +1,21 @@
+import { Injectable } from "@nestjs/common";
+import { InjectRepository } from "@nestjs/typeorm";
+import { Repository } from "typeorm";
+import { BaseRepository } from "@edr/api-common";
+
+import { StampSetting } from "./entities/stamp-setting.entity";
+
+@Injectable()
+export class StampSettingsRepository extends BaseRepository<StampSetting> {
+  constructor(
+    @InjectRepository(StampSetting)
+    repo: Repository<StampSetting>,
+  ) {
+    super(repo);
+  }
+
+  /** The single settings row, with its stamp file joined, or null before first upload. */
+  findSingleton(): Promise<StampSetting | null> {
+    return this.repository.findOne({ where: {}, relations: ["stampFile"] });
+  }
+}
diff --git a/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.service.spec.ts b/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.service.spec.ts
new file mode 100644
index 000000000..ef55e9ecc
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.service.spec.ts
@@ -0,0 +1,110 @@
+import { Readable } from "stream";
+
+import { StampSettingsService } from "./stamp-settings.service";
+
+/**
+ * The one global company stamp feeds three document paths (invoices, warehouse
+ * papers, contract signature blocks). All three treat the returned value as a
+ * `data:` URL — so the data-URL-or-null contract of getStampImageUrl is what
+ * these specs pin down, especially its behaviour when MinIO cannot be reached.
+ */
+describe("StampSettingsService.getStampImageUrl", () => {
+  const PNG = Buffer.from("fake-png-bytes");
+  const OBJECT_URL = "https://minio.local:9000/edr-freight/stamp/company.png";
+
+  const build = (
+    overrides: {
+      stampUrl?: string | null;
+      getFileStream?: jest.Mock;
+      findSingleton?: jest.Mock;
+    } = {},
+  ) => {
+    const service = Object.create(
+      StampSettingsService.prototype,
+    ) as StampSettingsService;
+    const warn = jest.fn();
+    Object.assign(service, {
+      logger: { warn, log: jest.fn() },
+      repository: {
+        findSingleton:
+          overrides.findSingleton ??
+          jest.fn().mockResolvedValue({
+            id: "s-1",
+            stampFileId: overrides.stampUrl ? "f-1" : null,
+            stampFile: overrides.stampUrl ? { url: overrides.stampUrl } : null,
+            updatedById: null,
+            updatedAt: null,
+          }),
+        create: jest.fn(),
+        update: jest.fn(),
+      },
+      minioService: {
+        getObjectNameFromUrl: jest.fn().mockReturnValue("stamp/company.png"),
+        getFileStream:
+          overrides.getFileStream ??
+          jest.fn().mockResolvedValue(Readable.from(PNG)),
+      },
+      filesService: { upload: jest.fn() },
+    });
+    return { service, warn };
+  };
+
+  it("inlines the stored stamp as a data URL", async () => {
+    const { service } = build({ stampUrl: OBJECT_URL });
+
+    await expect(service.getStampImageUrl()).resolves.toBe(
+      `data:image/png;base64,${PNG.toString("base64")}`,
+    );
+  });
+
+  it("returns null when no stamp is configured", async () => {
+    const { service } = build({ stampUrl: null });
+
+    await expect(service.getStampImageUrl()).resolves.toBeNull();
+  });
+
+  it("passes an already-inlined data URL straight through", async () => {
+    const dataUrl = "data:image/png;base64,QUJD";
+    const { service } = build({ stampUrl: dataUrl });
+
+    await expect(service.getStampImageUrl()).resolves.toBe(dataUrl);
+  });
+
+  /**
+   * Regression: inlineImageUrl falls back to the raw object URL when MinIO is
+   * unreachable, which is right for getView (a browser can fetch it) but wrong
+   * here. ContractTransitionService base64-decodes this value to snapshot the
+   * seal — and a URL decodes to garbage bytes WITHOUT throwing, so a transient
+   * MinIO failure used to seal an executed contract with a corrupt image file.
+   * Degrade to null instead so callers draw their text/vector seal.
+   */
+  it("returns null rather than a raw object URL when MinIO inlining fails", async () => {
+    const { service, warn } = build({
+      stampUrl: OBJECT_URL,
+      getFileStream: jest.fn().mockRejectedValue(new Error("connect ECONNREFUSED")),
+    });
+
+    await expect(service.getStampImageUrl()).resolves.toBeNull();
+    expect(warn).toHaveBeenCalledWith(expect.stringMatching(/plain seal/i));
+  });
+
+  it("never throws when the settings lookup itself fails", async () => {
+    const { service, warn } = build({
+      findSingleton: jest.fn().mockRejectedValue(new Error("db is down")),
+    });
+
+    await expect(service.getStampImageUrl()).resolves.toBeNull();
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining("db is down"));
+  });
+
+  it("still exposes the raw URL through getView, which a browser can load", async () => {
+    const { service } = build({
+      stampUrl: OBJECT_URL,
+      getFileStream: jest.fn().mockRejectedValue(new Error("connect ECONNREFUSED")),
+    });
+
+    await expect(service.getView()).resolves.toEqual(
+      expect.objectContaining({ stampImageUrl: OBJECT_URL }),
+    );
+  });
+});
diff --git a/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.service.ts b/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.service.ts
new file mode 100644
index 000000000..9bb4f3a37
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.service.ts
@@ -0,0 +1,170 @@
+import { Injectable, Logger } from "@nestjs/common";
+import { Readable } from "stream";
+import { DataSource } from "typeorm";
+
+import { FilesService } from "../files/files.service";
+import { FileRecord } from "../files/entities/file.entity";
+import { MinioService } from "../minio/minio.service";
+import { StampSettingsRepository } from "./stamp-settings.repository";
+import { StampSetting } from "./entities/stamp-setting.entity";
+
+export interface StampSettingView {
+  stampImageUrl: string | null;
+  updatedById: string | null;
+  updatedAt: Date | null;
+}
+
+/**
+ * Owns the single `stamp_settings` row: the one company stamp/seal image used
+ * on generated invoice/receipt PDFs (see InvoiceDocumentService). Same
+ * single-row shape as ExchangeSettingsService, but the value is an uploaded
+ * image (via FilesService) rather than a scalar.
+ */
+@Injectable()
+export class StampSettingsService {
+  private readonly logger = new Logger(StampSettingsService.name);
+
+  constructor(
+    private readonly repository: StampSettingsRepository,
+    private readonly filesService: FilesService,
+    private readonly minioService: MinioService,
+    private readonly dataSource: DataSource,
+  ) {}
+
+  /** The settings row, created empty on first access. */
+  async get(): Promise<StampSetting> {
+    const existing = await this.repository.findSingleton();
+    if (existing) return existing;
+    return this.repository.create({ stampFileId: null, updatedById: null });
+  }
+
+  /** Current stamp, with the image inlined as a data URL (or null if unset). */
+  async getView(): Promise<StampSettingView> {
+    const setting = await this.get();
+    return {
+      stampImageUrl: await this.inlineImageUrl(setting.stampFile?.url),
+      updatedById: setting.updatedById ?? null,
+      updatedAt: setting.updatedAt ?? null,
+    };
+  }
+
+  /**
+   * The stamp image for embedding into generated documents, ALWAYS as a
+   * `data:` URL or null. Never throws — document generation must succeed even
+   * if the stamp lookup fails; callers fall back to their own seal on null.
+   *
+   * The data-URL-or-null guarantee is load-bearing, not cosmetic. Callers do
+   * two things with this value that a bare MinIO URL silently corrupts:
+   * ContractTransitionService base64-decodes it to snapshot the seal onto a
+   * signature row (a URL decodes to garbage bytes, not an error, permanently
+   * sealing an executed contract with a broken image), and the HTML render
+   * path inlines it into an <img> that headless Chromium cannot fetch. So
+   * where getView() may hand a raw URL to a browser that can load it, this
+   * degrades to null and lets the caller draw its text/vector seal instead.
+   */
+  async getStampImageUrl(): Promise<string | null> {
+    try {
+      const setting = await this.get();
+      const inlined = await this.inlineImageUrl(setting.stampFile?.url);
+      if (inlined && !inlined.startsWith("data:")) {
+        this.logger.warn(
+          `Company stamp could not be inlined for document rendering (falling back to the plain seal): ${inlined}`,
+        );
+        return null;
+      }
+      return inlined;
+    } catch (err) {
+      this.logger.warn(
+        `Could not load company stamp for PDF rendering: ${(err as Error).message}`,
+      );
+      return null;
+    }
+  }
+
+  /** Replace the stamp image, storing it in MinIO via FilesService. */
+  async setStamp(
+    stampImageBase64: string,
+    updatedById?: string | null,
+  ): Promise<StampSettingView> {
+    const current = await this.get();
+    const previousFileId = current.stampFileId ?? null;
+
+    const fileRecord = await this.filesService.upload({
+      resourceId: current.id,
+      resource: "stamp_settings",
+      code: "stamp",
+      file: this.toUploadFile(stampImageBase64),
+      uploadedByUserId: updatedById ?? null,
+    });
+
+    await this.repository.update(current.id, {
+      stampFileId: fileRecord.id,
+      updatedById: updatedById ?? null,
+    });
+
+    if (previousFileId && previousFileId !== fileRecord.id) {
+      await this.dataSource.getRepository(FileRecord).delete(previousFileId);
+    }
+
+    this.logger.log(`Company stamp updated by ${updatedById ?? "unknown user"}`);
+    return this.getView();
+  }
+
+  /** Clear the stamp (invoices fall back to the programmatic seal). */
+  async clearStamp(updatedById?: string | null): Promise<StampSettingView> {
+    const current = await this.get();
+    const previousFileId = current.stampFileId ?? null;
+
+    await this.repository.update(current.id, {
+      stampFileId: null,
+      updatedById: updatedById ?? null,
+    });
+
+    if (previousFileId) {
+      await this.dataSource.getRepository(FileRecord).delete(previousFileId);
+    }
+
+    return this.getView();
+  }
+
+  private toUploadFile(base64: string): Express.Multer.File {
+    const raw = base64.includes(",") ? base64.split(",")[1]! : base64;
+    const buffer = Buffer.from(raw, "base64");
+    return {
+      fieldname: "stamp",
+      originalname: "company-stamp.png",
+      encoding: "7bit",
+      mimetype: "image/png",
+      size: buffer.length,
+      buffer,
+      stream: Readable.from(buffer),
+      destination: "",
+      filename: "",
+      path: "",
+    };
+  }
+
+  private async inlineImageUrl(url?: string | null): Promise<string | null> {
+    if (!url) return null;
+    if (url.startsWith("data:")) return url;
+    try {
+      const objectName = this.minioService.getObjectNameFromUrl(url);
+      const stream = await this.minioService.getFileStream(objectName);
+      const buffer = await this.streamToBuffer(stream);
+      return `data:image/png;base64,${buffer.toString("base64")}`;
+    } catch {
+      return url;
+    }
+  }
+
+  private streamToBuffer(stream: Readable): Promise<Buffer> {
+    return new Promise((resolve, reject) => {
+      const chunks: Buffer[] = [];
+      stream.on("data", (chunk: Buffer | string) => {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      });
+      stream.on("error", reject);
+      stream.on("end", () => resolve(Buffer.concat(chunks)));
+    });
+  }
+}
diff --git a/apps/edr-freight-api/src/modules/train-schedules/entities/train-schedule.entity.ts b/apps/edr-freight-api/src/modules/train-schedules/entities/train-schedule.entity.ts
index 5730120e9..cd8fe1bb9 100644
--- a/apps/edr-freight-api/src/modules/train-schedules/entities/train-schedule.entity.ts
+++ b/apps/edr-freight-api/src/modules/train-schedules/entities/train-schedule.entity.ts
@@ -64,6 +64,14 @@ export class TrainSchedule extends BaseEntity {
   @Column({ name: 'train_number', type: 'varchar', length: 20, nullable: true })
   trainNumber?: string | null;
 
+  /**
+   * Voyage (sailing) number for this departure — the identifier yards and
+   * customs quote alongside the train number. Per-departure, so it lives here
+   * rather than on the built train.
+   */
+  @Column({ name: 'voyage_number', type: 'varchar', length: 20, nullable: true })
+  voyageNumber?: string | null;
+
   // Human-facing unique schedule reference (S-YYYY-NNNNN). Shown on the schedule
   // list, booking windows, and load lists. Assigned at creation from the highest
   // sequence issued this year (see TrainSchedulesRepository.maxReferenceSequence).
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/controllers/train-scheduling.controller.ts b/apps/edr-freight-api/src/modules/train-scheduling/controllers/train-scheduling.controller.ts
index c87d118c8..93a187a95 100644
--- a/apps/edr-freight-api/src/modules/train-scheduling/controllers/train-scheduling.controller.ts
+++ b/apps/edr-freight-api/src/modules/train-scheduling/controllers/train-scheduling.controller.ts
@@ -15,6 +15,7 @@ import {
   PortalCustomer,
   TrainSchedulingCancel,
   TrainSchedulingCreate,
+  TrainSchedulingEditTrainNumber,
   TrainSchedulingReschedule,
   TrainSchedulingRulesManage,
   TrainSchedulingUpdate,
@@ -52,6 +53,8 @@ import { AvailableDaysForCargoQueryDto } from "../dto/available-days-for-cargo-q
 import { UpdateTrainSchedulingGlobalRulesDto } from "../dto/update-train-scheduling-global-rules.dto";
 import { UpdateScheduleWindowRuleDto } from "../dto/update-schedule-window-rule.dto";
 import { UpdateScheduleDateDto } from "../dto/update-schedule-date.dto";
+import { MergeScheduleTrainDto } from "../dto/merge-schedule-train.dto";
+import { UpdateScheduleTrainNumberDto } from "../dto/update-schedule-train-number.dto";
 import { MaintenanceRescheduleDto } from "../dto/maintenance-reschedule.dto";
 import { TrainSchedulingService } from "../services/train-scheduling.service";
 import { BookingBatchService } from "../booking-batch.service";
@@ -795,6 +798,47 @@ export class TrainSchedulingController {
     return this.trainSchedulingService.getContainerTrainScheduleById(id);
   }
 
+  @Patch("schedules/:id/train-number")
+  @TrainSchedulingEditTrainNumber()
+  @ApiOperation({
+    summary:
+      "Edit a departure's train number and voyage number — allowed only until the train is dispatched",
+  })
+  async updateScheduleTrainNumber(
+    @Param("id", ParseUUIDPipe) id: string,
+    @Body() dto: UpdateScheduleTrainNumberDto,
+  ) {
+    await this.trainSchedulingService.updateScheduleTrainNumber(id, dto);
+    return this.trainSchedulingService.getContainerTrainScheduleById(id);
+  }
+
+  @Get("schedules/:id/merge-preview/:targetTrainId")
+  @TrainSchedulingUpdate()
+  @ApiOperation({
+    summary:
+      "What merging a train into this schedule would do — affected schedules, wagon totals and any blocking reasons. Read-only.",
+  })
+  async previewScheduleMerge(
+    @Param("id", ParseUUIDPipe) id: string,
+    @Param("targetTrainId", ParseUUIDPipe) targetTrainId: string,
+  ) {
+    return this.trainSchedulingService.previewMerge(id, targetTrainId);
+  }
+
+  @Post("schedules/:id/merge")
+  @TrainSchedulingUpdate()
+  @ApiOperation({
+    summary:
+      "Merge another train into this schedule: its wagons join this consist, a same-day schedule on it is absorbed, and the emptied train is deactivated",
+  })
+  async mergeScheduleTrain(
+    @Param("id", ParseUUIDPipe) id: string,
+    @Body() dto: MergeScheduleTrainDto,
+  ) {
+    await this.trainSchedulingService.mergeScheduleTrain(id, dto);
+    return this.trainSchedulingService.getContainerTrainScheduleById(id);
+  }
+
   @Post("schedules/:id/maintenance")
   @TrainSchedulingReschedule()
   @ApiOperation({
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/dto/merge-schedule-train.dto.ts b/apps/edr-freight-api/src/modules/train-scheduling/dto/merge-schedule-train.dto.ts
new file mode 100644
index 000000000..8f4c09d43
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/train-scheduling/dto/merge-schedule-train.dto.ts
@@ -0,0 +1,23 @@
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import { IsOptional, IsString, IsUUID, MaxLength } from 'class-validator';
+
+/**
+ * Merge another train into this schedule's train. The schedule always survives:
+ * its train set is repointed at `targetTrainId`, that train's wagons join this
+ * consist, and the source train is left empty and deactivated.
+ */
+export class MergeScheduleTrainDto {
+  @ApiProperty({
+    description: "The train being merged IN. This schedule's train absorbs it.",
+  })
+  @IsUUID()
+  targetTrainId!: string;
+
+  @ApiPropertyOptional({
+    description: 'Why the trains were merged — kept on the audit trail.',
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(500)
+  reason?: string;
+}
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/dto/update-schedule-train-number.dto.ts b/apps/edr-freight-api/src/modules/train-scheduling/dto/update-schedule-train-number.dto.ts
new file mode 100644
index 000000000..5756732c4
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/train-scheduling/dto/update-schedule-train-number.dto.ts
@@ -0,0 +1,40 @@
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { IsOptional, IsString, MaxLength } from 'class-validator';
+
+/**
+ * Edit a departure's operational run identifiers. Both fields are optional so
+ * either can be corrected alone; the service rejects a body carrying neither,
+ * so an empty request cannot write an audit row for a no-op.
+ *
+ * Sending an empty string clears the field; omitting it leaves it unchanged.
+ */
+export class UpdateScheduleTrainNumberDto {
+  @ApiPropertyOptional({
+    example: '9201',
+    description: "Run number for this departure. Empty string clears it.",
+    maxLength: 20,
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(20)
+  trainNumber?: string;
+
+  @ApiPropertyOptional({
+    example: 'V-2026-014',
+    description: 'Voyage (sailing) number for this departure. Empty string clears it.',
+    maxLength: 20,
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(20)
+  voyageNumber?: string;
+
+  @ApiPropertyOptional({
+    description: 'Why the numbers changed — kept on the audit trail.',
+    maxLength: 500,
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(500)
+  reason?: string;
+}
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/schedule-merge.spec.ts b/apps/edr-freight-api/src/modules/train-scheduling/schedule-merge.spec.ts
new file mode 100644
index 000000000..c3acfbecb
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/train-scheduling/schedule-merge.spec.ts
@@ -0,0 +1,399 @@
+import { BadRequestException, NotFoundException } from '@nestjs/common';
+
+import { TrainSchedulingService } from './services/train-scheduling.service';
+
+/**
+ * Merging one train into a schedule. The schedule ALWAYS survives: its train
+ * set is repointed at the target train, that train's wagons join the consist,
+ * a same-day schedule on the target is absorbed (bookings move here, it is
+ * soft-deleted), and the emptied source train is deactivated.
+ *
+ * Driven against stub repositories — every rule under test is service logic.
+ */
+describe('TrainSchedulingService — train merge', () => {
+  const DAY = '2026-08-12T00:00:00.000Z';
+  const OTHER_DAY = '2026-08-14T00:00:00.000Z';
+
+  /** Rows each repository returns, keyed by entity. */
+  type Fixture = {
+    schedule: Record<string, unknown> | null;
+    train?: Record<string, unknown> | null;
+    trainSets?: Record<string, unknown>[];
+    schedules?: Record<string, unknown>[];
+    wagons?: Record<string, unknown>[];
+    wagonTypes?: Record<string, unknown>[];
+    scheduleBookings?: Record<string, unknown>[];
+    allocations?: Record<string, unknown>[];
+    milestones?: Record<string, unknown>[];
+    setWagons?: Record<string, unknown>[];
+  };
+
+  const makeService = (fx: Fixture) => {
+    const updates: Array<{ entity: string; args: unknown[] }> = [];
+    const softDeletes: string[] = [];
+
+    const repoFor = (entity: unknown) => {
+      const name = (entity as { name?: string })?.name ?? String(entity);
+      const rows = (): Record<string, unknown>[] => {
+        switch (name) {
+          case 'Train':
+            return fx.train ? [fx.train] : [];
+          case 'TrainSet':
+            return fx.trainSets ?? [];
+          case 'TrainSchedule':
+            return fx.schedules ?? [];
+          case 'Wagon':
+            return fx.wagons ?? [];
+          case 'WagonType':
+            return fx.wagonTypes ?? [];
+          case 'TrainScheduleBooking':
+            return fx.scheduleBookings ?? [];
+          case 'WagonBookingAllocation':
+            return fx.allocations ?? [];
+          case 'RouteMilestone':
+            return fx.milestones ?? [];
+          case 'TrainSetWagon':
+            return fx.setWagons ?? [];
+          default:
+            return [];
+        }
+      };
+      return {
+        find: jest.fn().mockImplementation(async () => rows()),
+        findOne: jest.fn().mockImplementation(async () => rows()[0] ?? null),
+        update: jest.fn().mockImplementation(async (...args: unknown[]) => {
+          updates.push({ entity: name, args });
+        }),
+        softDelete: jest.fn().mockImplementation(async (id: string) => {
+          softDeletes.push(id);
+        }),
+      };
+    };
+
+    const dataSource = {
+      getRepository: jest.fn().mockImplementation(repoFor),
+      transaction: jest
+        .fn()
+        .mockImplementation(async (cb: (m: unknown) => Promise<void>) =>
+          cb({ getRepository: repoFor }),
+        ),
+    };
+
+    const service = Object.create(
+      TrainSchedulingService.prototype,
+    ) as TrainSchedulingService;
+    Object.assign(service, {
+      dataSource,
+      trainSchedulesRepository: {
+        findByIdWithFullGraph: jest.fn().mockResolvedValue(fx.schedule),
+        findById: jest.fn().mockResolvedValue(fx.schedule),
+      },
+      logger: { log: jest.fn(), warn: jest.fn() },
+    });
+    return { service, updates, softDeletes };
+  };
+
+  /** A draft schedule on T1 with 10 wagons and no locomotive caps. */
+  const baseSchedule = (over: Record<string, unknown> = {}) => ({
+    id: 'S1',
+    reference: 'S-2026-00001',
+    status: 'DRAFT',
+    scheduledDepartureDate: DAY,
+    routeId: null,
+    maxWagons: 0,
+    trainSetId: 'TS1',
+    trainSet: {
+      id: 'TS1',
+      trainId: 'T1',
+      wagons: Array.from({ length: 10 }, (_, i) => ({
+        id: `sw-${i}`,
+        sequenceNo: i + 1,
+        lengthMeters: 14,
+        wagonType: { tareWeightTons: 22.4 },
+      })),
+    },
+    ...over,
+  });
+
+  const targetWagons = (n: number) =>
+    Array.from({ length: n }, (_, i) => ({
+      id: `w-${i}`,
+      wagonNumber: `200${i}`,
+      wagonTypeId: 'wt-1',
+      trainId: 'T2',
+    }));
+
+  describe('guards', () => {
+    it('refuses to merge into a dispatched schedule', async () => {
+      const { service } = makeService({
+        schedule: baseSchedule({ status: 'DISPATCHED' }),
+      });
+
+      await expect(
+        service.mergeScheduleTrain('S1', { targetTrainId: 'T2' }),
+      ).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    it('refuses to merge a train into itself', async () => {
+      const { service } = makeService({ schedule: baseSchedule() });
+
+      await expect(
+        service.mergeScheduleTrain('S1', { targetTrainId: 'T1' }),
+      ).rejects.toThrow(/already this schedule's train/i);
+    });
+
+    it('404s on an unknown schedule', async () => {
+      const { service } = makeService({ schedule: null });
+
+      await expect(
+        service.mergeScheduleTrain('S1', { targetTrainId: 'T2' }),
+      ).rejects.toBeInstanceOf(NotFoundException);
+    });
+
+    it('blocks when the target train has no wagons to give', async () => {
+      const { service } = makeService({
+        schedule: baseSchedule(),
+        train: { id: 'T2', code: 'TR-2' },
+        wagons: [],
+      });
+
+      await expect(
+        service.mergeScheduleTrain('S1', { targetTrainId: 'T2' }),
+      ).rejects.toThrow(/no wagons to merge/i);
+    });
+  });
+
+  describe('preview', () => {
+    it('reports the merged wagon total and the emptied source train', async () => {
+      const { service } = makeService({
+        schedule: baseSchedule(),
+        train: { id: 'T2', code: 'TR-2', trainNumber: '8002' },
+        wagons: targetWagons(40),
+        wagonTypes: [{ id: 'wt-1', lengthMeters: 14, tareWeightTons: 22.4 }],
+      });
+
+      const preview = await service.previewMerge('S1', 'T2');
+
+      expect(preview.canMerge).toBe(true);
+      expect(preview.wagons).toEqual({ current: 10, incoming: 40, merged: 50 });
+      expect(preview.sourceTrainWillDeactivate).toBe(true);
+      expect(preview.absorbedSchedule).toBeNull();
+    });
+
+    it('names the same-day schedule whose bookings move here', async () => {
+      const { service } = makeService({
+        schedule: baseSchedule(),
+        train: { id: 'T2', code: 'TR-2' },
+        trainSets: [{ id: 'TS2', trainId: 'T2' }],
+        schedules: [
+          {
+            id: 'S2',
+            reference: 'S-2026-00002',
+            status: 'SCHEDULED',
+            scheduledDepartureDate: DAY,
+            trainSetId: 'TS2',
+          },
+        ],
+        wagons: targetWagons(40),
+        wagonTypes: [{ id: 'wt-1', lengthMeters: 14, tareWeightTons: 22.4 }],
+        scheduleBookings: [
+          { id: 'sb-1', bookingId: 'bk-1', trainScheduleId: 'S2' },
+          { id: 'sb-2', bookingId: 'bk-2', trainScheduleId: 'S2' },
+        ],
+      });
+
+      const preview = await service.previewMerge('S1', 'T2');
+
+      expect(preview.absorbedSchedule).toMatchObject({
+        id: 'S2',
+        reference: 'S-2026-00002',
+        bookingsMoving: 2,
+      });
+    });
+
+    it('lists an other-day schedule as wagons-only, never absorbed', async () => {
+      const { service } = makeService({
+        schedule: baseSchedule(),
+        train: { id: 'T2', code: 'TR-2' },
+        trainSets: [{ id: 'TS2', trainId: 'T2' }],
+        schedules: [
+          {
+            id: 'S3',
+            reference: 'S-2026-00003',
+            status: 'DRAFT',
+            scheduledDepartureDate: OTHER_DAY,
+            trainSetId: 'TS2',
+          },
+        ],
+        wagons: targetWagons(40),
+        wagonTypes: [{ id: 'wt-1', lengthMeters: 14, tareWeightTons: 22.4 }],
+      });
+
+      const preview = await service.previewMerge('S1', 'T2');
+
+      expect(preview.absorbedSchedule).toBeNull();
+      expect(preview.affectedSchedules).toHaveLength(1);
+      expect(preview.affectedSchedules[0]).toMatchObject({ id: 'S3' });
+    });
+
+    it('leaves a dispatched schedule on the target untouched', async () => {
+      const { service } = makeService({
+        schedule: baseSchedule(),
+        train: { id: 'T2', code: 'TR-2' },
+        trainSets: [{ id: 'TS2', trainId: 'T2' }],
+        schedules: [
+          {
+            id: 'S4',
+            status: 'DISPATCHED',
+            scheduledDepartureDate: DAY,
+            trainSetId: 'TS2',
+          },
+        ],
+        wagons: targetWagons(40),
+        wagonTypes: [{ id: 'wt-1', lengthMeters: 14, tareWeightTons: 22.4 }],
+      });
+
+      const preview = await service.previewMerge('S1', 'T2');
+
+      // Same day, but dispatched — its cargo stays put.
+      expect(preview.absorbedSchedule).toBeNull();
+      expect(preview.affectedSchedules).toHaveLength(0);
+      expect(preview.untouchedSchedules).toHaveLength(1);
+    });
+  });
+
+  describe('commit', () => {
+    it('repoints the set, moves the wagons and deactivates the source train', async () => {
+      const { service, updates } = makeService({
+        schedule: baseSchedule(),
+        train: { id: 'T2', code: 'TR-2' },
+        wagons: targetWagons(40),
+        wagonTypes: [{ id: 'wt-1', lengthMeters: 14, tareWeightTons: 22.4 }],
+      });
+
+      await service.mergeScheduleTrain('S1', { targetTrainId: 'T2' });
+
+      const setRepoint = updates.find(
+        (u) => u.entity === 'TrainSet' && u.args[0] === 'TS1',
+      );
+      expect(setRepoint?.args[1]).toMatchObject({ trainId: 'T2' });
+
+      const wagonMove = updates.find((u) => u.entity === 'Wagon');
+      expect(wagonMove?.args[1]).toMatchObject({ trainId: 'T2' });
+
+      const trainPark = updates.find(
+        (u) => u.entity === 'Train' && u.args[0] === 'T1',
+      );
+      expect(trainPark?.args[1]).toMatchObject({ status: 'DEACTIVATED' });
+    });
+
+    it('moves the absorbed schedule\'s bookings here and soft-deletes it', async () => {
+      const { service, updates, softDeletes } = makeService({
+        schedule: baseSchedule(),
+        train: { id: 'T2', code: 'TR-2' },
+        trainSets: [{ id: 'TS2', trainId: 'T2' }],
+        schedules: [
+          {
+            id: 'S2',
+            reference: 'S-2026-00002',
+            status: 'SCHEDULED',
+            scheduledDepartureDate: DAY,
+            trainSetId: 'TS2',
+          },
+        ],
+        wagons: targetWagons(40),
+        wagonTypes: [{ id: 'wt-1', lengthMeters: 14, tareWeightTons: 22.4 }],
+        scheduleBookings: [
+          { id: 'sb-1', bookingId: 'bk-1', trainScheduleId: 'S2' },
+        ],
+      });
+
+      await service.mergeScheduleTrain('S1', { targetTrainId: 'T2' });
+
+      const bookingMove = updates.find(
+        (u) => u.entity === 'TrainScheduleBooking',
+      );
+      expect(bookingMove?.args[0]).toMatchObject({ trainScheduleId: 'S2' });
+      expect(bookingMove?.args[1]).toMatchObject({ trainScheduleId: 'S1' });
+
+      // Soft-deleted, not cancelled — the bookings still exist and still depart.
+      expect(softDeletes).toEqual(['S2']);
+    });
+
+    it('appends merged wagons after the existing consist', async () => {
+      const { service, updates } = makeService({
+        schedule: baseSchedule(),
+        train: { id: 'T2', code: 'TR-2' },
+        wagons: targetWagons(2),
+        wagonTypes: [{ id: 'wt-1', lengthMeters: 14, tareWeightTons: 22.4 }],
+        setWagons: [
+          { id: 'in-0', trainSetId: 'TS2', physicalWagonId: 'w-0' },
+          { id: 'in-1', trainSetId: 'TS2', physicalWagonId: 'w-1' },
+        ],
+      });
+
+      await service.mergeScheduleTrain('S1', { targetTrainId: 'T2' });
+
+      // 10 existing wagons occupy 1..10, so the merged pair lands at 11 and 12
+      // — staff reorder them in the train builder afterwards.
+      const seqs = updates
+        .filter((u) => u.entity === 'TrainSetWagon')
+        .map((u) => (u.args[1] as { sequenceNo: number }).sequenceNo);
+      expect(seqs).toEqual([11, 12]);
+    });
+  });
+
+  describe('capacity', () => {
+    it('blocks a merge that overruns the locomotive length cap', async () => {
+      const { service } = makeService({
+        schedule: baseSchedule({
+          trainSet: {
+            id: 'TS1',
+            trainId: 'T1',
+            // A short loco: 100m of train, already 10 × 14m = 140m used.
+            locomotive: {
+              maxPullWeightTons: 5000,
+              maxTrainLengthMeters: 100,
+            },
+            wagons: Array.from({ length: 10 }, (_, i) => ({
+              id: `sw-${i}`,
+              sequenceNo: i + 1,
+              lengthMeters: 14,
+              wagonType: { tareWeightTons: 22.4 },
+            })),
+          },
+        }),
+        train: { id: 'T2', code: 'TR-2' },
+        wagons: targetWagons(40),
+        wagonTypes: [{ id: 'wt-1', lengthMeters: 14, tareWeightTons: 22.4 }],
+      });
+
+      await expect(
+        service.mergeScheduleTrain('S1', { targetTrainId: 'T2' }),
+      ).rejects.toThrow(/exceeds max train length/i);
+    });
+
+    it('blocks a merge that overruns the pull-weight cap', async () => {
+      const { service } = makeService({
+        schedule: baseSchedule({
+          trainSet: {
+            id: 'TS1',
+            trainId: 'T1',
+            locomotive: {
+              maxPullWeightTons: 300,
+              maxTrainLengthMeters: 10000,
+            },
+            wagons: [],
+          },
+        }),
+        train: { id: 'T2', code: 'TR-2' },
+        wagons: targetWagons(40),
+        wagonTypes: [{ id: 'wt-1', lengthMeters: 14, tareWeightTons: 22.4 }],
+      });
+
+      await expect(
+        service.mergeScheduleTrain('S1', { targetTrainId: 'T2' }),
+      ).rejects.toThrow(/exceeds max pull weight/i);
+    });
+  });
+});
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/schedule-train-number.spec.ts b/apps/edr-freight-api/src/modules/train-scheduling/schedule-train-number.spec.ts
new file mode 100644
index 000000000..d7dae50f4
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/train-scheduling/schedule-train-number.spec.ts
@@ -0,0 +1,114 @@
+import { BadRequestException, NotFoundException } from '@nestjs/common';
+
+import { TrainSchedulingService } from './services/train-scheduling.service';
+import type { UpdateScheduleTrainNumberDto } from './dto/update-schedule-train-number.dto';
+
+/**
+ * Guards around renumbering a departure. Exercised against a stub repository —
+ * the rules (dispatch lock, empty-body rejection, clear-vs-leave semantics) are
+ * pure service logic and need no database.
+ */
+describe('TrainSchedulingService.updateScheduleTrainNumber', () => {
+  const makeService = (schedule: Record<string, unknown> | null) => {
+    const update = jest.fn().mockResolvedValue(undefined);
+    const findById = jest.fn().mockResolvedValue(schedule);
+    const service = Object.create(
+      TrainSchedulingService.prototype,
+    ) as TrainSchedulingService;
+    Object.assign(service, {
+      trainSchedulesRepository: { findById, update },
+      logger: { log: jest.fn(), warn: jest.fn() },
+    });
+    return { service, update, findById };
+  };
+
+  const call = (service: TrainSchedulingService, dto: UpdateScheduleTrainNumberDto) =>
+    service.updateScheduleTrainNumber('sched-1', dto);
+
+  it('updates both numbers on a SCHEDULED train', async () => {
+    const { service, update } = makeService({
+      id: 'sched-1',
+      status: 'SCHEDULED',
+      trainNumber: '9101',
+      voyageNumber: null,
+    });
+
+    await call(service, { trainNumber: '9201', voyageNumber: 'V-2026-014' });
+
+    expect(update).toHaveBeenCalledWith('sched-1', {
+      trainNumber: '9201',
+      voyageNumber: 'V-2026-014',
+    });
+  });
+
+  it('refuses to renumber a dispatched train', async () => {
+    // The numbers are already printed on paperwork that left with the train.
+    const { service, update } = makeService({
+      id: 'sched-1',
+      status: 'DISPATCHED',
+      trainNumber: '9101',
+    });
+
+    await expect(call(service, { trainNumber: '9201' })).rejects.toBeInstanceOf(
+      BadRequestException,
+    );
+    expect(update).not.toHaveBeenCalled();
+  });
+
+  it.each(['ARRIVED', 'CANCELLED', 'COMPLETED'])(
+    'refuses to renumber a %s schedule',
+    async (status) => {
+      const { service, update } = makeService({ id: 'sched-1', status });
+
+      await expect(call(service, { trainNumber: '9201' })).rejects.toBeInstanceOf(
+        BadRequestException,
+      );
+      expect(update).not.toHaveBeenCalled();
+    },
+  );
+
+  it('rejects a body carrying neither number before touching the schedule', async () => {
+    const { service, update, findById } = makeService({
+      id: 'sched-1',
+      status: 'DRAFT',
+    });
+
+    await expect(call(service, {})).rejects.toBeInstanceOf(BadRequestException);
+    expect(findById).not.toHaveBeenCalled();
+    expect(update).not.toHaveBeenCalled();
+  });
+
+  it('leaves an omitted field untouched rather than clearing it', async () => {
+    const { service, update } = makeService({
+      id: 'sched-1',
+      status: 'DRAFT',
+      trainNumber: '9101',
+      voyageNumber: 'V-1',
+    });
+
+    await call(service, { trainNumber: '9201' });
+
+    expect(update).toHaveBeenCalledWith('sched-1', { trainNumber: '9201' });
+    expect(update.mock.calls[0][1]).not.toHaveProperty('voyageNumber');
+  });
+
+  it('clears a field when an empty string is sent', async () => {
+    const { service, update } = makeService({
+      id: 'sched-1',
+      status: 'DRAFT',
+      voyageNumber: 'V-1',
+    });
+
+    await call(service, { voyageNumber: '   ' });
+
+    expect(update).toHaveBeenCalledWith('sched-1', { voyageNumber: null });
+  });
+
+  it('404s on an unknown schedule', async () => {
+    const { service } = makeService(null);
+
+    await expect(call(service, { trainNumber: '9201' })).rejects.toBeInstanceOf(
+      NotFoundException,
+    );
+  });
+});
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/services/train-scheduling.service.spec.ts b/apps/edr-freight-api/src/modules/train-scheduling/services/train-scheduling.service.spec.ts
index 0a7384cfa..e6b3a5040 100644
--- a/apps/edr-freight-api/src/modules/train-scheduling/services/train-scheduling.service.spec.ts
+++ b/apps/edr-freight-api/src/modules/train-scheduling/services/train-scheduling.service.spec.ts
@@ -1646,4 +1646,92 @@ describe('TrainSchedulingService', () => {
       ).toBe(5);
     });
   });
+
+  describe('maintenanceReschedule — window reopens when it had already finished', () => {
+    const { TrainSchedule } = jest.requireActual(
+      '../../train-schedules/entities/train-schedule.entity',
+    );
+
+    const doneExportSchedule = (extra: Record<string, unknown> = {}) => ({
+      id: 'sch-done',
+      status: 'SCHEDULED',
+      direction: 'EXPORT',
+      windowPhase: 'DONE',
+      bookingWindowStatus: 'CLOSED',
+      scheduledDepartureDate: new Date('2027-06-20T05:00:00.000Z'),
+      scheduledArrivalDate: null,
+      originStationId: 'yard-origin',
+      destinationStationId: 'yard-destination',
+      scheduleBookings: [],
+      // Frozen rule snapshot: desk 8–17 EAT, 24h lead, close 120min before departure.
+      ruleWindowOpenHour: 8,
+      ruleWindowCloseHour: 17,
+      ruleExportBookingLeadHours: 24,
+      ruleExportCloseOffsetMinutes: 120,
+      ...extra,
+    });
+
+    let scheduleUpdate: jest.Mock;
+
+    beforeEach(() => {
+      scheduleUpdate = jest.fn().mockResolvedValue({ affected: 1 });
+      dataSource.getRepository.mockImplementation((entity: unknown) => {
+        if (entity === TrainSchedulingGlobalRules) {
+          return { find: jest.fn().mockResolvedValue([]) };
+        }
+        if (entity === TrainSchedule) {
+          return { update: scheduleUpdate, find: jest.fn().mockResolvedValue([]) };
+        }
+        return {
+          find: jest.fn().mockResolvedValue([]),
+          findOne: jest.fn().mockResolvedValue(null),
+          update: jest.fn(),
+        };
+      });
+      trainSchedulesRepository.findById.mockResolvedValue(null);
+    });
+
+    it('reopens a DONE export window against the new departure', async () => {
+      trainSchedulesRepository.findByIdWithFullGraph.mockResolvedValue(
+        doneExportSchedule(),
+      );
+
+      // New departure 12:00 EAT → window opens 24h earlier (12:00 EAT, inside
+      // the desk) and closes at departure − 120min = 10:00 EAT.
+      await service.maintenanceReschedule('sch-done', {
+        newDepartureDate: '2027-06-20T09:00:00.000Z',
+      } as never);
+
+      expect(scheduleUpdate).toHaveBeenCalledWith(
+        'sch-done',
+        expect.objectContaining({
+          scheduledDepartureDate: new Date('2027-06-20T09:00:00.000Z'),
+          windowPhase: 'PRE_WINDOW',
+          bookingWindowStatus: 'CLOSED',
+          windowOpensAt: new Date('2027-06-19T09:00:00.000Z'),
+          windowClosesAt: new Date('2027-06-20T07:00:00.000Z'),
+          docReviewCompletedAt: null,
+          docReviewEndsAt: null,
+          paymentPhaseEndsAt: null,
+        }),
+      );
+    });
+
+    it('keeps a FULL train closed — nothing left to sell', async () => {
+      trainSchedulesRepository.findByIdWithFullGraph.mockResolvedValue(
+        doneExportSchedule({ bookingWindowStatus: 'FULL' }),
+      );
+
+      await service.maintenanceReschedule('sch-done', {
+        newDepartureDate: '2027-06-20T09:00:00.000Z',
+      } as never);
+
+      const written = scheduleUpdate.mock.calls[0][1];
+      expect(written.scheduledDepartureDate).toEqual(
+        new Date('2027-06-20T09:00:00.000Z'),
+      );
+      expect(written.windowPhase).toBeUndefined();
+      expect(written.windowOpensAt).toBeUndefined();
+    });
+  });
 });
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/services/train-scheduling.service.ts b/apps/edr-freight-api/src/modules/train-scheduling/services/train-scheduling.service.ts
index 657703ada..a740dc932 100644
--- a/apps/edr-freight-api/src/modules/train-scheduling/services/train-scheduling.service.ts
+++ b/apps/edr-freight-api/src/modules/train-scheduling/services/train-scheduling.service.ts
@@ -96,6 +96,8 @@ import {
 } from '../dto/import-djibouti-operation.dto';
 import { UpdateScheduleWindowRuleDto } from '../dto/update-schedule-window-rule.dto';
 import { UpdateScheduleDateDto } from '../dto/update-schedule-date.dto';
+import { MergeScheduleTrainDto } from '../dto/merge-schedule-train.dto';
+import { UpdateScheduleTrainNumberDto } from '../dto/update-schedule-train-number.dto';
 import { MaintenanceRescheduleDto } from '../dto/maintenance-reschedule.dto';
 import { type BookingWindowConfig } from '../booking-window.config';
 import { BookingWindowGateway } from '../booking-window.gateway';
@@ -132,14 +134,17 @@ import {
 } from '../utils/wagon-plan.util';
 import { CorridorBudget } from '../corridor-capacity.util';
 import { deriveScheduleDirection } from '../utils/derive-schedule-direction.util';
+import { computeScheduleWagonUsage } from '../utils/schedule-wagon-usage.util';
 import { pickLowestFreeNumber, pickTrainNumberPool } from '../train-number.util';
 import {
   bookingCargoTons,
   bulkItemsFitFor,
   bulkItemWagonsRequired,
   bulkTonsPerWagon,
+  consistViolations,
   deriveTrainCapacityFromLocomotive,
   combinedLocomotiveLimits,
+  trainHardCaps,
   trainSetLocomotiveLimits,
   wagonTypeDimensionsFromEntity,
   LocomotiveLimits,
@@ -928,6 +933,68 @@ export class TrainSchedulingService {
     return fresh ?? schedule;
   }
 
+  /**
+   * Correct a departure's operational run identifiers — the train number and
+   * voyage number yards and customs quote.
+   *
+   * Editable only until the train leaves: once DISPATCHED (or beyond) the
+   * numbers are printed on paperwork and quoted downstream, so a late edit would
+   * desync records that already left with the train. The audit row is written by
+   * the global AuditInterceptor from the registered route.
+   */
+  async updateScheduleTrainNumber(
+    id: string,
+    dto: UpdateScheduleTrainNumberDto,
+  ): Promise<TrainSchedule> {
+    if (dto.trainNumber === undefined && dto.voyageNumber === undefined) {
+      throw new BadRequestException(
+        'Provide a train number or a voyage number to update.',
+      );
+    }
+
+    const schedule = await this.trainSchedulesRepository.findById(id);
+    if (!schedule) {
+      throw new NotFoundException(`Train schedule ${id} not found`);
+    }
+
+    // Only a train that has not left can be renumbered. CANCELLED is excluded
+    // too — renumbering a dead schedule has no meaning.
+    const editable: string[] = [
+      TrainScheduleStatusEnum.Draft,
+      TrainScheduleStatusEnum.Scheduled,
+    ];
+    if (!editable.includes(schedule.status)) {
+      throw new BadRequestException(
+        `Cannot change the train or voyage number of a ${schedule.status} schedule — ` +
+          'the numbers are fixed once the train is dispatched.',
+      );
+    }
+
+    // An empty string clears the field; an omitted field is left untouched.
+    const patch: Partial<TrainSchedule> = {};
+    if (dto.trainNumber !== undefined) {
+      patch.trainNumber = dto.trainNumber.trim() || null;
+    }
+    if (dto.voyageNumber !== undefined) {
+      patch.voyageNumber = dto.voyageNumber.trim() || null;
+    }
+
+    await this.trainSchedulesRepository.update(id, patch);
+    this.logger.log(
+      `Schedule ${schedule.reference ?? id} renumbered` +
+        (patch.trainNumber !== undefined
+          ? ` — train ${schedule.trainNumber ?? '—'} → ${patch.trainNumber ?? '—'}`
+          : '') +
+        (patch.voyageNumber !== undefined
+          ? ` — voyage ${schedule.voyageNumber ?? '—'} → ${patch.voyageNumber ?? '—'}`
+          : '') +
+        (dto.reason?.trim() ? ` (${dto.reason.trim()})` : ''),
+    );
+
+    const fresh = await this.trainSchedulesRepository.findById(id);
+    return fresh ?? schedule;
+  }
+
   /**
    * Reschedule ONE train's departure date (staff action on the ops board). Only
    * allowed while the booking window has not opened yet — an OPEN/past schedule
@@ -1115,13 +1182,23 @@ export class TrainSchedulingService {
       ? new Date(new Date(schedule.scheduledArrivalDate).getTime() + deltaMs)
       : undefined;
 
-    // PRE_WINDOW only: the stamped open/close were derived from the old
-    // departure and the window hasn't opened yet, so re-derive them from the
-    // schedule's own rule snapshot against the new date (joining the target
-    // day's route group timeline when one exists, exactly like
-    // updateScheduleDate). Mid/post-window schedules keep their timeline.
+    // PRE_WINDOW: the stamped open/close were derived from the old departure
+    // and the window hasn't opened yet, so re-derive them from the schedule's
+    // own rule snapshot against the new date (joining the target day's route
+    // group timeline when one exists, exactly like updateScheduleDate).
+    //
+    // DONE: the window already finished (e.g. the close offset hit and then the
+    // train was moved to a later departure). The window must follow the new
+    // departure, so it REOPENS: re-derive open/close the same way, reset the
+    // phase to PRE_WINDOW and clamp a past open into the present so the tick
+    // opens it immediately. A FULL train stays closed — there is nothing left
+    // to sell — and so does one whose re-derived window would already be over.
+    //
+    // Mid-window phases (OPEN/DOC_REVIEW/PAYMENT) keep their running timeline.
+    const reopenFromDone =
+      schedule.windowPhase === 'DONE' && schedule.bookingWindowStatus !== 'FULL';
     const windowFields =
-      schedule.windowPhase === 'PRE_WINDOW'
+      schedule.windowPhase === 'PRE_WINDOW' || reopenFromDone
         ? await (async () => {
             const merged = effectiveWindowConfig(
               schedule,
@@ -1140,12 +1217,33 @@ export class TrainSchedulingService {
                     schedule.destinationStationId,
                     departure,
                   );
-            return anchor
-              ? this.groupWindowFieldsFrom(anchor, departure)
-              : {
-                  windowOpensAt: times.windowOpensAt,
-                  windowClosesAt: times.windowClosesAt,
-                };
+            if (anchor) {
+              // groupWindowFieldsFrom copies the anchor's live phase and
+              // deadlines, so a DONE train joining a live group re-enters the
+              // group's cycle directly — no extra reset needed.
+              return this.groupWindowFieldsFrom(anchor, departure);
+            }
+            if (!reopenFromDone) {
+              return {
+                windowOpensAt: times.windowOpensAt,
+                windowClosesAt: times.windowClosesAt,
+              };
+            }
+            const now = new Date();
+            const windowOpensAt =
+              times.windowOpensAt < now ? now : times.windowOpensAt;
+            if (times.windowClosesAt.getTime() <= windowOpensAt.getTime()) {
+              return {}; // no window fits before the new departure — stay closed
+            }
+            return {
+              windowOpensAt,
+              windowClosesAt: times.windowClosesAt,
+              windowPhase: 'PRE_WINDOW',
+              bookingWindowStatus: 'CLOSED',
+              docReviewCompletedAt: null,
+              docReviewEndsAt: null,
+              paymentPhaseEndsAt: null,
+            };
           })()
         : {};
 
@@ -3262,6 +3360,12 @@ export class TrainSchedulingService {
    * Every export booking being confirmed loaded must already be received at the
    * warehouse with a GRN. An allocation puts a booking on a wagon on paper; this
    * is the check that the cargo is physically in the yard before we call it loaded.
+   *
+   * Direct truck-to-train (exportHandoverMode = DIRECT_TO_TRAIN) is excluded —
+   * that cargo is manually loaded from the customer's truck straight onto the
+   * wagon, never sees the warehouse, and is never GRN'd. Its custody is attested
+   * by the carriage acceptance sheet instead (same carve-out as the shared
+   * assertExportReceivedWithGrn gate — see common/export-received-gate.ts).
    */
   private async assertExportBookingsReceived(bookingIds: string[]): Promise<void> {
     if (!bookingIds.length) return;
@@ -3270,6 +3374,7 @@ export class TrainSchedulingService {
          FROM freight.bookings b
         WHERE b.id = ANY($1)
           AND b.deleted_at IS NULL
+          AND b.export_handover_mode IS DISTINCT FROM 'DIRECT_TO_TRAIN'
           AND NOT EXISTS (
             SELECT 1 FROM freight.warehouse_inventory inv
              WHERE inv.booking_id = b.id
@@ -4072,7 +4177,15 @@ export class TrainSchedulingService {
     const [schedules, total] = await this.trainSchedulesRepository.findAndCount({
       where,
       relations: {
-        trainSet: { locomotive: true, locomotives: { locomotive: true }, train: true },
+        trainSet: {
+          locomotive: true,
+          locomotives: { locomotive: true },
+          train: true,
+          // Slot allocations back the list's "used wagons" figure — without
+          // them the row can only report the coupled consist size, which is
+          // what made the list disagree with the detail page's wagon plan.
+          wagons: { allocations: true },
+        },
         // Yards carry the route's display name used by mapScheduleListItem;
         // milestones (with yards) let it show the full corridor path.
         route: { originYard: true, destinationYard: true, milestones: { yard: true } },
@@ -5752,12 +5865,22 @@ export class TrainSchedulingService {
   }
 
   private mapScheduleListItem(schedule: import('../../train-schedules/entities/train-schedule.entity').TrainSchedule) {
+    // Wagon figures must match the detail page's wagon plan (WagonPlanGrid) —
+    // see computeScheduleWagonUsage for why the stored counter cannot be used.
+    const { wagonsUsed, wagonsTotal, wagonsReserved, wagonsRemaining } =
+      computeScheduleWagonUsage({
+        wagonSlots: schedule.trainSet?.wagons,
+        storedWagonCount: schedule.trainSet?.wagonCount,
+        scheduleBookings: schedule.scheduleBookings,
+      });
+
     return {
       id: schedule.id,
       reference: schedule.reference ?? null,
       createdAt: schedule.createdAt ?? null,
       scheduleDate: schedule.scheduledDepartureDate,
       trainNumber: schedule.trainNumber ?? null,
+      voyageNumber: schedule.voyageNumber ?? null,
       direction: schedule.direction ?? null,
       routeName: schedule.route ? formatRouteLabel(schedule.route) : null,
       origin: schedule.originStation?.label ?? schedule.originStation?.code ?? null,
@@ -5786,6 +5909,14 @@ export class TrainSchedulingService {
         currentYardId: loco.currentYardId ?? null,
       })),
       wagonCount: schedule.trainSet?.wagonCount ?? 0,
+      /** Coupled slots carrying a booking allocation — matches the wagon plan. */
+      wagonsUsed,
+      /** Coupled consist size; the denominator of "used". */
+      wagonsTotal,
+      /** Claimed by bookings (incl. unpaid) — not bookable. */
+      wagonsReserved,
+      /** Consist minus what bookings have claimed; what is still bookable. */
+      wagonsRemaining,
       totalWeightTons: roundTons(Number(schedule.trainSet?.totalWeightTons ?? 0)),
       totalLengthMeters: roundTons(Number(schedule.trainSet?.totalLengthMeters ?? 0)),
       bookingsCount: schedule.scheduleBookings?.length ?? 0,
@@ -7703,6 +7834,7 @@ export class TrainSchedulingService {
       status: schedule.status,
       freightType: this.resolveScheduleFreightType(schedule),
       trainNumber: schedule.trainNumber ?? null,
+      voyageNumber: schedule.voyageNumber ?? null,
       maxWagons: schedule.maxWagons ?? null,
       direction: schedule.direction ?? null,
       reverseWagonOrder: schedule.reverseWagonOrder ?? false,
@@ -9122,4 +9254,376 @@ export class TrainSchedulingService {
     });
     return new Set(allocations.map((a) => a.bookingId));
   }
+
+  // ── Train merge ────────────────────────────────────────────────────────────
+  // Combine two trains into one departure. The schedule the action is taken
+  // from ALWAYS survives: its train set is repointed at the target train, the
+  // target's wagons join this consist, and the source train is emptied and
+  // deactivated. When the target also runs a schedule on the SAME DAY, that
+  // schedule's bookings move here and it is soft-deleted; the target's
+  // other-day schedules contribute wagons only.
+
+  /** Statuses whose schedules may take part in a merge. */
+  private static readonly MERGEABLE_STATUSES: string[] = [
+    TrainScheduleStatusEnum.Draft,
+    TrainScheduleStatusEnum.Scheduled,
+  ];
+
+  /**
+   * Everything a merge needs to decide, gathered once. Both `previewMerge` and
+   * `mergeScheduleTrain` run this so the modal shows exactly what will happen
+   * and the commit cannot diverge from it.
+   */
+  private async planMerge(scheduleId: string, targetTrainId: string) {
+    const schedule =
+      await this.trainSchedulesRepository.findByIdWithFullGraph(scheduleId);
+    if (!schedule) {
+      throw new NotFoundException(`Train schedule ${scheduleId} not found`);
+    }
+    if (!TrainSchedulingService.MERGEABLE_STATUSES.includes(schedule.status)) {
+      throw new BadRequestException(
+        `Cannot merge into a ${schedule.status} schedule — only draft or scheduled departures can be merged.`,
+      );
+    }
+
+    const sourceTrainId = schedule.trainSet?.trainId ?? null;
+    if (sourceTrainId && sourceTrainId === targetTrainId) {
+      throw new BadRequestException(
+        'That is already this schedule\'s train — pick a different one to merge in.',
+      );
+    }
+
+    const targetTrain = await this.dataSource
+      .getRepository(Train)
+      .findOne({ where: { id: targetTrainId } });
+    if (!targetTrain) {
+      throw new NotFoundException(`Train ${targetTrainId} not found`);
+    }
+
+    // Every schedule the target train is committed to, via its train sets.
+    const targetSets = await this.dataSource
+      .getRepository(TrainSet)
+      .find({ where: { trainId: targetTrainId } });
+    const targetSetIds = targetSets.map((s) => s.id);
+    const targetSchedules = targetSetIds.length
+      ? await this.dataSource.getRepository(TrainSchedule).find({
+          where: { trainSetId: In(targetSetIds) },
+        })
+      : [];
+
+    // The same-day schedule is the one whose bookings move here. Only a
+    // draft/scheduled one qualifies — a dispatched departure keeps its cargo.
+    const sameDay = (a: Date | string, b: Date | string) =>
+      new Date(a).toISOString().slice(0, 10) ===
+      new Date(b).toISOString().slice(0, 10);
+
+    const absorbed =
+      targetSchedules.find(
+        (s) =>
+          s.id !== schedule.id &&
+          sameDay(s.scheduledDepartureDate, schedule.scheduledDepartureDate) &&
+          TrainSchedulingService.MERGEABLE_STATUSES.includes(s.status),
+      ) ?? null;
+
+    // Wagons ride with the train, so every OTHER draft/scheduled schedule on it
+    // is affected too — it gains the merged consist but never the bookings.
+    const affectedOthers = targetSchedules.filter(
+      (s) =>
+        s.id !== schedule.id &&
+        s.id !== absorbed?.id &&
+        TrainSchedulingService.MERGEABLE_STATUSES.includes(s.status),
+    );
+    const untouched = targetSchedules.filter(
+      (s) =>
+        s.id !== schedule.id &&
+        s.id !== absorbed?.id &&
+        !TrainSchedulingService.MERGEABLE_STATUSES.includes(s.status),
+    );
+
+    // The wagons joining this consist: whatever physically sits on the target
+    // train today.
+    const incomingWagons = await this.dataSource
+      .getRepository(Wagon)
+      .find({ where: { trainId: targetTrainId }, order: { wagonNumber: 'ASC' } });
+
+    const movingBookings = absorbed
+      ? await this.dataSource.getRepository(TrainScheduleBooking).find({
+          where: { trainScheduleId: absorbed.id },
+          relations: { booking: true },
+        })
+      : [];
+
+    return {
+      schedule,
+      sourceTrainId,
+      targetTrain,
+      absorbed,
+      affectedOthers,
+      untouched,
+      incomingWagons,
+      movingBookings,
+    };
+  }
+
+  /**
+   * Blocking checks, run against the plan. Returns human-readable reasons; an
+   * empty array means the merge may proceed. Kept separate from `planMerge` so
+   * the preview can SHOW the reasons rather than throwing on them.
+   */
+  private async mergeBlockers(
+    plan: Awaited<ReturnType<TrainSchedulingService['planMerge']>>,
+  ): Promise<string[]> {
+    const blockers: string[] = [];
+    const { schedule, incomingWagons, movingBookings, absorbed } = plan;
+
+    if (incomingWagons.length === 0) {
+      blockers.push(
+        `${plan.targetTrain.code} has no wagons to merge — nothing would move.`,
+      );
+    }
+
+    // ── Capacity: the merged consist must fit this schedule's locomotives ────
+    const existingSlots = (schedule.trainSet?.wagons ?? []).map((w) => ({
+      lengthMeters: Number(w.lengthMeters) || 0,
+      tareWeightTons: Number(w.wagonType?.tareWeightTons) || 0,
+      cargoTons: 0,
+    }));
+    const wagonTypeIds = [
+      ...new Set(incomingWagons.map((w) => w.wagonTypeId).filter(Boolean)),
+    ];
+    const wagonTypes = wagonTypeIds.length
+      ? await this.dataSource
+          .getRepository(WagonType)
+          .find({ where: { id: In(wagonTypeIds) } })
+      : [];
+    const typeById = new Map(wagonTypes.map((t) => [t.id, t]));
+    const incomingSlots = incomingWagons.map((w) => {
+      const t = typeById.get(w.wagonTypeId);
+      return {
+        lengthMeters: Number(t?.lengthMeters) || 0,
+        tareWeightTons: Number(t?.tareWeightTons) || 0,
+        cargoTons: 0,
+      };
+    });
+
+    const limits = trainSetLocomotiveLimits(schedule.trainSet);
+    if (limits) {
+      const rules = await this.dataSource
+        .getRepository(TrainSchedulingGlobalRules)
+        .find({ take: 1 });
+      const caps = trainHardCaps(limits, {
+        maxTrainWeightTons: rules[0]?.maxTrainWeightTons ?? undefined,
+        maxTrainLengthMeters: rules[0]?.maxTrainLengthMeters ?? undefined,
+      });
+      const merged = [...existingSlots, ...incomingSlots];
+      // maxWagons is the schedule's own slot ceiling; fall back to the consist
+      // size when it is unset so the count axis never blocks spuriously.
+      const violations = consistViolations(merged, {
+        maxWeightTons: caps.maxWeightTons,
+        maxLengthMeters: caps.maxLengthMeters,
+        maxWagonSlots: schedule.maxWagons || merged.length,
+      });
+      blockers.push(...violations);
+    }
+
+    // ── Legs: an absorbed booking must be servable by THIS schedule's route ──
+    if (absorbed && movingBookings.length) {
+      const routeYardIds = await this.routeYardSequence(schedule.routeId ?? null);
+      if (routeYardIds.length) {
+        const position = new Map(routeYardIds.map((id, i) => [id, i]));
+        const slotIds = movingBookings.map((mb) => mb.bookingId);
+        const allocations = slotIds.length
+          ? await this.dataSource.getRepository(WagonBookingAllocation).find({
+              where: { bookingId: In(slotIds) },
+              relations: { trainSetWagon: true },
+            })
+          : [];
+        const offRoute = new Set<string>();
+        for (const alloc of allocations) {
+          const board = alloc.trainSetWagon?.boardYardId ?? null;
+          const alight = alloc.trainSetWagon?.alightYardId ?? null;
+          // Null on both = rides the whole route; always compatible.
+          if (!board && !alight) continue;
+          const from = board ? position.get(board) : 0;
+          const to = alight ? position.get(alight) : routeYardIds.length - 1;
+          if (from === undefined || to === undefined || from >= to) {
+            offRoute.add(alloc.bookingId);
+          }
+        }
+        if (offRoute.size) {
+          blockers.push(
+            `${offRoute.size} booking(s) on ${absorbed.reference ?? 'the merged schedule'} ` +
+              'travel legs this schedule\'s route does not serve in the same order.',
+          );
+        }
+      }
+    }
+
+    return blockers;
+  }
+
+  /** Ordered yard ids along a route, origin first. Empty when unknown. */
+  private async routeYardSequence(routeId: string | null): Promise<string[]> {
+    if (!routeId) return [];
+    const milestones = await this.dataSource
+      .getRepository(RouteMilestone)
+      .find({ where: { routeId }, order: { sequenceNo: 'ASC' } });
+    return milestones
+      .map((m) => m.yardId)
+      .filter((id): id is string => Boolean(id));
+  }
+
+  /**
+   * What a merge WOULD do, without doing it. Drives the confirmation modal:
+   * which schedules gain wagons, which one is absorbed, and why it is blocked.
+   */
+  async previewMerge(scheduleId: string, targetTrainId: string) {
+    const plan = await this.planMerge(scheduleId, targetTrainId);
+    const blockers = await this.mergeBlockers(plan);
+
+    const existingCount = plan.schedule.trainSet?.wagons?.length ?? 0;
+    return {
+      canMerge: blockers.length === 0,
+      blockers,
+      targetTrain: {
+        id: plan.targetTrain.id,
+        code: plan.targetTrain.code,
+        trainNumber: plan.targetTrain.trainNumber ?? null,
+      },
+      wagons: {
+        current: existingCount,
+        incoming: plan.incomingWagons.length,
+        merged: existingCount + plan.incomingWagons.length,
+      },
+      /** The same-day schedule whose bookings move here and is then removed. */
+      absorbedSchedule: plan.absorbed
+        ? {
+            id: plan.absorbed.id,
+            reference: plan.absorbed.reference ?? null,
+            scheduledDepartureDate: plan.absorbed.scheduledDepartureDate,
+            status: plan.absorbed.status,
+            bookingsMoving: plan.movingBookings.length,
+          }
+        : null,
+      /** Other draft/scheduled schedules on the target — wagons only. */
+      affectedSchedules: plan.affectedOthers.map((s) => ({
+        id: s.id,
+        reference: s.reference ?? null,
+        scheduledDepartureDate: s.scheduledDepartureDate,
+        status: s.status,
+      })),
+      /** On the target train but left alone (dispatched, cancelled, …). */
+      untouchedSchedules: plan.untouched.map((s) => ({
+        id: s.id,
+        reference: s.reference ?? null,
+        scheduledDepartureDate: s.scheduledDepartureDate,
+        status: s.status,
+      })),
+      sourceTrainWillDeactivate: Boolean(plan.sourceTrainId),
+    };
+  }
+
+  /**
+   * Execute the merge. One transaction: repoint the train set, move the wagons
+   * (appended last so the builder can reorder them later), carry the absorbed
+   * schedule's bookings across, soft-delete that schedule, and deactivate the
+   * emptied source train.
+   */
+  async mergeScheduleTrain(
+    scheduleId: string,
+    dto: MergeScheduleTrainDto,
+  ): Promise<TrainSchedule> {
+    const plan = await this.planMerge(scheduleId, dto.targetTrainId);
+    const blockers = await this.mergeBlockers(plan);
+    if (blockers.length) {
+      throw new BadRequestException(blockers.join(' '));
+    }
+
+    const {
+      schedule,
+      sourceTrainId,
+      targetTrain,
+      absorbed,
+      incomingWagons,
+      movingBookings,
+    } = plan;
+    const trainSetId = schedule.trainSetId;
+
+    await this.dataSource.transaction(async (manager) => {
+      // 1. This schedule's set now runs on the target train.
+      await manager.getRepository(TrainSet).update(trainSetId, {
+        trainId: targetTrain.id,
+      });
+
+      // 2. The physical wagons follow the train.
+      if (incomingWagons.length) {
+        await manager.getRepository(Wagon).update(
+          { id: In(incomingWagons.map((w) => w.id)) },
+          { trainId: targetTrain.id },
+        );
+      }
+
+      // 3. Carry the target's train-set wagon rows into THIS consist, appended
+      //    after the existing wagons. Sequence is provisional — staff reorder
+      //    in the train builder afterwards.
+      const existing = schedule.trainSet?.wagons ?? [];
+      let nextSequence =
+        existing.reduce((max, w) => Math.max(max, w.sequenceNo ?? 0), 0) + 1;
+      const incomingSetWagons = await manager.getRepository(TrainSetWagon).find({
+        where: { physicalWagonId: In(incomingWagons.map((w) => w.id)) },
+      });
+      for (const row of incomingSetWagons) {
+        if (row.trainSetId === trainSetId) continue;
+        await manager.getRepository(TrainSetWagon).update(row.id, {
+          trainSetId,
+          sequenceNo: nextSequence,
+        });
+        nextSequence += 1;
+      }
+
+      // 4. The absorbed schedule's bookings move here. `bookingId` is uniquely
+      //    indexed, so these rows are UPDATED across rather than re-inserted.
+      if (absorbed && movingBookings.length) {
+        await manager
+          .getRepository(TrainScheduleBooking)
+          .update(
+            { trainScheduleId: absorbed.id },
+            { trainScheduleId: schedule.id },
+          );
+      }
+
+      // 5. The absorbed schedule is soft-deleted — its bookings still exist and
+      //    still depart that day, so nobody is notified and nothing is lost.
+      if (absorbed) {
+        await manager.getRepository(TrainSchedule).softDelete(absorbed.id);
+      }
+
+      // 6. The source train is now empty; park it.
+      if (sourceTrainId) {
+        await manager.getRepository(Train).update(sourceTrainId, {
+          status: Freight.TrainStatus.Deactivated,
+        });
+      }
+
+      // 7. Keep the set's cached totals honest.
+      const mergedCount =
+        (schedule.trainSet?.wagons?.length ?? 0) + incomingSetWagons.length;
+      await manager
+        .getRepository(TrainSet)
+        .update(trainSetId, { wagonCount: mergedCount });
+    });
+
+    this.logger.log(
+      `Schedule ${schedule.reference ?? scheduleId} merged with train ${targetTrain.code}` +
+        ` — ${incomingWagons.length} wagon(s) moved` +
+        (absorbed
+          ? `, absorbed ${absorbed.reference ?? absorbed.id} (${movingBookings.length} booking(s))`
+          : '') +
+        (sourceTrainId ? ', source train deactivated' : '') +
+        (dto.reason?.trim() ? ` (${dto.reason.trim()})` : ''),
+    );
+
+    const fresh = await this.trainSchedulesRepository.findById(scheduleId);
+    return fresh ?? schedule;
+  }
 }
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/utils/schedule-wagon-usage.util.spec.ts b/apps/edr-freight-api/src/modules/train-scheduling/utils/schedule-wagon-usage.util.spec.ts
new file mode 100644
index 000000000..8fa9c1260
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/train-scheduling/utils/schedule-wagon-usage.util.spec.ts
@@ -0,0 +1,96 @@
+import { computeScheduleWagonUsage } from './schedule-wagon-usage.util';
+
+/** A coupled slot; `allocated` = a booking actually sits on it. */
+const slot = (allocated = false) => ({ allocations: allocated ? [{}] : [] });
+const booking = (wagonsRequired: number | null) => ({ booking: { wagonsRequired } });
+
+describe('computeScheduleWagonUsage', () => {
+  it('reports allocated slots as used, not the coupled consist size', () => {
+    // The reported bug: a 37-wagon consist carrying 3 allocated bookings read
+    // "37 wgn used" in the list while the detail page read "3 in use".
+    const slots = [...Array(34).fill(slot(false)), ...Array(3).fill(slot(true))];
+
+    const usage = computeScheduleWagonUsage({
+      wagonSlots: slots,
+      storedWagonCount: 37,
+      scheduleBookings: [],
+    });
+
+    expect(usage.wagonsUsed).toBe(3);
+    expect(usage.wagonsTotal).toBe(37);
+  });
+
+  it('counts a built train with no bookings as 0 used', () => {
+    const usage = computeScheduleWagonUsage({
+      wagonSlots: Array(40).fill(slot(false)),
+      storedWagonCount: 40,
+      scheduleBookings: [],
+    });
+
+    expect(usage.wagonsUsed).toBe(0);
+    expect(usage.wagonsRemaining).toBe(40);
+  });
+
+  it('treats wagons of an unpaid booking as reserved, so they are not bookable', () => {
+    // Booking claims 5 wagons but has no wagon plan yet: 0 used, still only 5
+    // bookable on a 10-wagon train — the reservation is not free space.
+    const usage = computeScheduleWagonUsage({
+      wagonSlots: Array(10).fill(slot(false)),
+      storedWagonCount: 10,
+      scheduleBookings: [booking(5)],
+    });
+
+    expect(usage.wagonsUsed).toBe(0);
+    expect(usage.wagonsReserved).toBe(5);
+    expect(usage.wagonsRemaining).toBe(5);
+  });
+
+  it('does not double-count a booking that is both reserved and allocated', () => {
+    // 3 allocated slots for a booking that reserved 3 wagons: 7 remain, not 4.
+    const usage = computeScheduleWagonUsage({
+      wagonSlots: [...Array(7).fill(slot(false)), ...Array(3).fill(slot(true))],
+      storedWagonCount: 10,
+      scheduleBookings: [booking(3)],
+    });
+
+    expect(usage.wagonsUsed).toBe(3);
+    expect(usage.wagonsReserved).toBe(3);
+    expect(usage.wagonsRemaining).toBe(7);
+  });
+
+  it('never reports negative remaining when claims exceed the consist', () => {
+    const usage = computeScheduleWagonUsage({
+      wagonSlots: Array(2).fill(slot(false)),
+      storedWagonCount: 2,
+      scheduleBookings: [booking(5)],
+    });
+
+    expect(usage.wagonsRemaining).toBe(0);
+  });
+
+  it('falls back to the stored counter when slot rows were not loaded', () => {
+    const usage = computeScheduleWagonUsage({
+      wagonSlots: [],
+      storedWagonCount: 12,
+      scheduleBookings: [],
+    });
+
+    expect(usage.wagonsTotal).toBe(12);
+    expect(usage.wagonsUsed).toBe(0);
+  });
+
+  it('tolerates missing relations and null wagonsRequired', () => {
+    const usage = computeScheduleWagonUsage({
+      wagonSlots: null,
+      storedWagonCount: null,
+      scheduleBookings: [booking(null)],
+    });
+
+    expect(usage).toEqual({
+      wagonsUsed: 0,
+      wagonsTotal: 0,
+      wagonsReserved: 0,
+      wagonsRemaining: 0,
+    });
+  });
+});
diff --git a/apps/edr-freight-api/src/modules/train-scheduling/utils/schedule-wagon-usage.util.ts b/apps/edr-freight-api/src/modules/train-scheduling/utils/schedule-wagon-usage.util.ts
new file mode 100644
index 000000000..f48d60f9a
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/train-scheduling/utils/schedule-wagon-usage.util.ts
@@ -0,0 +1,58 @@
+/**
+ * Wagon figures for a train-schedule list row.
+ *
+ * The list used to report `trainSet.wagonCount` — the COUPLED CONSIST SIZE —
+ * under the label "wgn used", so a 37-wagon train carrying 3 allocated bookings
+ * read "37 wgn used" in the list while its detail page (WagonPlanGrid) read
+ * "37 wagons · 3 in use". These helpers make the list agree with the detail
+ * page, which is the figure staff trust.
+ */
+
+/** The shape this math needs — a slot counts as used when it has allocations. */
+export interface WagonSlotLike {
+  allocations?: unknown[] | null;
+}
+
+export interface ScheduleBookingLike {
+  booking?: { wagonsRequired?: number | null } | null;
+}
+
+export interface ScheduleWagonUsage {
+  /** Coupled slots carrying at least one booking allocation. */
+  wagonsUsed: number;
+  /** Coupled consist size — the denominator of `wagonsUsed`. */
+  wagonsTotal: number;
+  /** Wagons claimed by bookings, including bookings that have not paid. */
+  wagonsReserved: number;
+  /** Consist minus what bookings have claimed — what is still bookable. */
+  wagonsRemaining: number;
+}
+
+export function computeScheduleWagonUsage(input: {
+  wagonSlots?: WagonSlotLike[] | null;
+  /** Stored counter; used only when the slot rows were not loaded. */
+  storedWagonCount?: number | null;
+  scheduleBookings?: ScheduleBookingLike[] | null;
+}): ScheduleWagonUsage {
+  const slots = input.wagonSlots ?? [];
+
+  // Same predicate as the detail page's WagonPlanGrid: a slot is in use only
+  // when a booking is actually allocated onto it.
+  const wagonsUsed = slots.filter((slot) => (slot.allocations?.length ?? 0) > 0).length;
+
+  // Prefer live slot rows; the stored counter drifts when a consist is edited
+  // without a recompute, which is why the list and detail disagreed on totals.
+  const wagonsTotal = slots.length || (input.storedWagonCount ?? 0);
+
+  // An unpaid booking still holds its wagons, so reserved space is NOT bookable.
+  const wagonsReserved = (input.scheduleBookings ?? []).reduce(
+    (sum, link) => sum + (link.booking?.wagonsRequired ?? 0),
+    0,
+  );
+
+  // Reserved subsumes allocated — an allocated booking still counts its wagons —
+  // so remaining subtracts whichever claim is larger, never both.
+  const wagonsRemaining = Math.max(0, wagonsTotal - Math.max(wagonsUsed, wagonsReserved));
+
+  return { wagonsUsed, wagonsTotal, wagonsReserved, wagonsRemaining };
+}
diff --git a/apps/edr-freight-api/src/modules/trains/dto/build-train.dto.ts b/apps/edr-freight-api/src/modules/trains/dto/build-train.dto.ts
index 0c9415e42..7b0bdd3bd 100644
--- a/apps/edr-freight-api/src/modules/trains/dto/build-train.dto.ts
+++ b/apps/edr-freight-api/src/modules/trains/dto/build-train.dto.ts
@@ -51,9 +51,9 @@ export class BuildTrainDto {
   @IsUUID('all', { each: true })
   wagonIds?: string[];
 
-  @ApiProperty({ maxLength: 100, description: 'Vogue number' })
+  @ApiProperty({ maxLength: 100, description: 'Voyage number' })
   @IsString()
-  @IsNotEmpty({ message: 'Vogue number is required' })
+  @IsNotEmpty({ message: 'Voyage number is required' })
   @MaxLength(100)
   trainName!: string;
 
diff --git a/apps/edr-freight-api/src/modules/trains/dto/send-wagon-to-maintenance.dto.ts b/apps/edr-freight-api/src/modules/trains/dto/send-wagon-to-maintenance.dto.ts
new file mode 100644
index 000000000..269c4f9b4
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/trains/dto/send-wagon-to-maintenance.dto.ts
@@ -0,0 +1,15 @@
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { IsOptional, IsString, MaxLength } from 'class-validator';
+
+export class SendWagonToMaintenanceDto {
+  @ApiPropertyOptional({
+    description:
+      "Why the wagon is going to maintenance. Stored on the wagon's status-history " +
+      'log alongside the train it was detached from, matching the fleet desk flow.',
+    maxLength: 500,
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(500)
+  note?: string;
+}
diff --git a/apps/edr-freight-api/src/modules/trains/train-builder.controller.ts b/apps/edr-freight-api/src/modules/trains/train-builder.controller.ts
index c1b1459a3..248092f95 100644
--- a/apps/edr-freight-api/src/modules/trains/train-builder.controller.ts
+++ b/apps/edr-freight-api/src/modules/trains/train-builder.controller.ts
@@ -23,6 +23,7 @@ import { AssignTrainWagonsDto } from './dto/assign-train-wagons.dto';
 import { BuildTrainDto } from './dto/build-train.dto';
 import { ListBuiltTrainsQueryDto } from './dto/list-built-trains-query.dto';
 import { ReorderTrainWagonsDto } from './dto/reorder-train-wagons.dto';
+import { SendWagonToMaintenanceDto } from './dto/send-wagon-to-maintenance.dto';
 import { UpdateTrainDetailsDto } from './dto/update-train-details.dto';
 import { UpdateTrainLocomotivesDto } from './dto/update-train-locomotives.dto';
 import { UpdateTrainYardDto } from './dto/update-train-yard.dto';
@@ -135,8 +136,14 @@ export class TrainBuilderController {
     @Param('id', ParseUUIDPipe) id: string,
     @Param('wagonId', ParseUUIDPipe) wagonId: string,
     @CurrentUser() user: AuthUserPayload,
+    @Body() dto?: SendWagonToMaintenanceDto,
   ) {
-    return this.trainBuilderService.sendWagonToMaintenance(id, wagonId, resolveAuthUserId(user));
+    return this.trainBuilderService.sendWagonToMaintenance(
+      id,
+      wagonId,
+      resolveAuthUserId(user),
+      dto?.note,
+    );
   }
 
   @Post(':id/reorder-wagons')
diff --git a/apps/edr-freight-api/src/modules/trains/train-builder.maintenance.spec.ts b/apps/edr-freight-api/src/modules/trains/train-builder.maintenance.spec.ts
new file mode 100644
index 000000000..a6157db7c
--- /dev/null
+++ b/apps/edr-freight-api/src/modules/trains/train-builder.maintenance.spec.ts
@@ -0,0 +1,83 @@
+import { buildMaintenanceNotes, formatTrainRunLabel } from './train-builder.service';
+
+describe('formatTrainRunLabel', () => {
+  it('names the train by its export and import run numbers', () => {
+    // What staff actually recognise — NOT the internal code (TRN-LEDGER-PW2).
+    expect(
+      formatTrainRunLabel({
+        exportTrainNumber: '9201',
+        importTrainNumber: '9202',
+        trainNumber: 'TRN-7',
+        code: 'TRN-LEDGER-PW2',
+      }),
+    ).toBe('export 9201 / import 9202');
+  });
+
+  it('shows only the run number that is set', () => {
+    expect(
+      formatTrainRunLabel({ exportTrainNumber: '9201', code: 'TRN-LEDGER-PW2' }),
+    ).toBe('export 9201');
+    expect(
+      formatTrainRunLabel({ importTrainNumber: '9202', code: 'TRN-LEDGER-PW2' }),
+    ).toBe('import 9202');
+  });
+
+  it('falls back to the train number, then the code, when no run is set', () => {
+    expect(formatTrainRunLabel({ trainNumber: 'TRN-7', code: 'TRN-LEDGER-PW2' })).toBe(
+      'TRN-7',
+    );
+    expect(formatTrainRunLabel({ code: 'TRN-LEDGER-PW2' })).toBe('TRN-LEDGER-PW2');
+  });
+
+  it('ignores blank run numbers rather than printing empty labels', () => {
+    expect(
+      formatTrainRunLabel({ exportTrainNumber: '  ', importTrainNumber: null, code: 'C-1' }),
+    ).toBe('C-1');
+  });
+
+  it('never returns an empty label', () => {
+    expect(formatTrainRunLabel({})).toBe('unknown');
+  });
+});
+
+describe('buildMaintenanceNotes', () => {
+  it('records the operator reason together with the train it came off', () => {
+    const notes = buildMaintenanceNotes('export 9201 / import 9202', 'Brake shoe worn through');
+
+    expect(notes.statusLogNote).toBe(
+      'Brake shoe worn through (detached from train export 9201 / import 9202)',
+    );
+    expect(notes.movementNote).toBe(
+      'Sent to maintenance from train export 9201 / import 9202: Brake shoe worn through',
+    );
+  });
+
+  it('still records the train number when no reason is given', () => {
+    // The reason is optional, but which train a wagon left is never optional —
+    // the history has to answer that on its own.
+    const notes = buildMaintenanceNotes('export 9201 / import 9202');
+
+    expect(notes.statusLogNote).toBe('Detached from train export 9201 / import 9202');
+    expect(notes.movementNote).toBe('Sent to maintenance from train export 9201 / import 9202');
+  });
+
+  it('treats a whitespace-only reason as no reason', () => {
+    const notes = buildMaintenanceNotes('export 9201 / import 9202', '   ');
+
+    expect(notes.statusLogNote).toBe('Detached from train export 9201 / import 9202');
+    expect(notes.movementNote).toBe('Sent to maintenance from train export 9201 / import 9202');
+  });
+
+  it('trims padding around a real reason', () => {
+    const notes = buildMaintenanceNotes('export 9201 / import 9202', '  Coupler damage  ');
+
+    expect(notes.statusLogNote).toBe('Coupler damage (detached from train export 9201 / import 9202)');
+    expect(notes.movementNote).toBe('Sent to maintenance from train export 9201 / import 9202: Coupler damage');
+  });
+
+  it('handles a null reason from an older client', () => {
+    expect(buildMaintenanceNotes('export 9201 / import 9202', null).statusLogNote).toBe(
+      'Detached from train export 9201 / import 9202',
+    );
+  });
+});
diff --git a/apps/edr-freight-api/src/modules/trains/train-builder.service.ts b/apps/edr-freight-api/src/modules/trains/train-builder.service.ts
index 9da3cecf0..0f377071c 100644
--- a/apps/edr-freight-api/src/modules/trains/train-builder.service.ts
+++ b/apps/edr-freight-api/src/modules/trains/train-builder.service.ts
@@ -19,6 +19,7 @@ import { TrainSet } from '../train-sets/entities/train-set.entity';
 import { TrainSetWagon } from '../train-sets/entities/train-set-wagon.entity';
 import { WagonType } from '../wagon-types/entities/wagon-type.entity';
 import { WagonMovement } from '../wagons/entities/wagon-movement.entity';
+import { WagonStatusLog } from '../wagons/entities/wagon-status-log.entity';
 import { Wagon } from '../wagons/entities/wagon.entity';
 import { AssignTrainWagonsDto } from './dto/assign-train-wagons.dto';
 import { BuildTrainDto } from './dto/build-train.dto';
@@ -530,7 +531,12 @@ export class TrainBuilderService {
    * moves to MAINTENANCE status (not AVAILABLE), so it is not re-coupled until
    * it clears maintenance. The freed sequence gap is closed.
    */
-  async sendWagonToMaintenance(id: string, wagonId: string, userId?: string | null) {
+  async sendWagonToMaintenance(
+    id: string,
+    wagonId: string,
+    userId?: string | null,
+    note?: string | null,
+  ) {
     await this.dataSource.transaction(async (manager) => {
       const train = await this.getEditableTrain(manager, id);
       const wagon = await manager.getRepository(Wagon).findOne({ where: { id: wagonId } });
@@ -542,6 +548,8 @@ export class TrainBuilderService {
           `Wagon ${wagon.wagonNumber} is pinned to an active schedule and cannot be removed`,
         );
       }
+      const previousStatus = wagon.status;
+      const notes = buildMaintenanceNotes(formatTrainRunLabel(train), note);
       await manager.getRepository(Wagon).update(wagon.id, {
         trainId: null,
         sequenceNumber: null,
@@ -549,6 +557,22 @@ export class TrainBuilderService {
         importTrainNumber: null,
         exportTrainNumber: null,
       });
+
+      // Status-history row, same as the fleet desk's "Send to maintenance" —
+      // without it a maintenance detach made here is invisible in the wagon's
+      // status history. The train number is folded into the note so the history
+      // answers "which train did it come off, and why" in one line.
+      if (previousStatus !== WagonStatus.Maintenance) {
+        await manager.getRepository(WagonStatusLog).save(
+          manager.getRepository(WagonStatusLog).create({
+            wagonId: wagon.id,
+            fromStatus: previousStatus,
+            toStatus: WagonStatus.Maintenance,
+            changedByUserId: userId ?? null,
+            note: notes.statusLogNote,
+          }),
+        );
+      }
       // Audit row: which train it came off and when. The wagon does not change
       // yard here, so from/to are the same — the ledger is the wagon's history
       // surface, and a maintenance detach has to be in it.
@@ -560,7 +584,7 @@ export class TrainBuilderService {
             fromYardId: yardId,
             toYardId: yardId,
             kind: WagonMovementKind.Maintenance,
-            note: `Sent to maintenance from train ${train.trainNumber ?? train.code}`,
+            note: notes.movementNote,
             occurredAt: new Date(),
           }),
         );
@@ -1111,6 +1135,48 @@ export class TrainBuilderService {
  * pinned to a reordered wagon adopt the wagon's new position; unpinned slots
  * trail behind in their previous relative order.
  */
+/**
+ * How a train is named in a wagon's history. Staff identify a train by its
+ * OPERATIONAL run numbers — the fixed export (odd) and import (even) numbers
+ * typed at build time — not by its internal code (`TRN-LEDGER-PW2`), which is a
+ * ledger key and means nothing on the ground. Both runs are shown when set,
+ * since one built train carries the pair. Falls back to the train number, then
+ * the code, only when no run number exists.
+ */
+export function formatTrainRunLabel(train: {
+  exportTrainNumber?: string | null;
+  importTrainNumber?: string | null;
+  trainNumber?: string | null;
+  code?: string | null;
+}): string {
+  const exportNo = train.exportTrainNumber?.trim();
+  const importNo = train.importTrainNumber?.trim();
+  const runs = [
+    exportNo ? `export ${exportNo}` : null,
+    importNo ? `import ${importNo}` : null,
+  ].filter(Boolean);
+  if (runs.length) return runs.join(' / ');
+  return train.trainNumber?.trim() || train.code?.trim() || 'unknown';
+}
+
+/**
+ * Notes for a maintenance detach. The train's run numbers are always recorded —
+ * staff need to know which consist a wagon came off — and the operator's reason
+ * is folded in when given, so the wagon's status history answers "which train,
+ * and why" in one line (matching the fleet desk's Send-to-maintenance note).
+ */
+export function buildMaintenanceNotes(trainLabel: string, note?: string | null) {
+  const reason = note?.trim();
+  return {
+    statusLogNote: reason
+      ? `${reason} (detached from train ${trainLabel})`
+      : `Detached from train ${trainLabel}`,
+    movementNote: reason
+      ? `Sent to maintenance from train ${trainLabel}: ${reason}`
+      : `Sent to maintenance from train ${trainLabel}`,
+  };
+}
+
 export function orderSlotsByWagonSequence<
   T extends Pick<TrainSetWagon, 'sequenceNo' | 'physicalWagonId'>,
 >(slots: T[], newSeq: Map<string, number>): T[] {
diff --git a/apps/edr-freight-api/src/modules/wagons/dto/create-transfer-request.dto.ts b/apps/edr-freight-api/src/modules/wagons/dto/create-transfer-request.dto.ts
index 85c879f70..615ef0701 100644
--- a/apps/edr-freight-api/src/modules/wagons/dto/create-transfer-request.dto.ts
+++ b/apps/edr-freight-api/src/modules/wagons/dto/create-transfer-request.dto.ts
@@ -1,5 +1,7 @@
 import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
 import {
+  ArrayMaxSize,
+  IsArray,
   IsInt,
   IsNotEmpty,
   IsOptional,
@@ -11,11 +13,14 @@ import {
 } from 'class-validator';
 
 /**
- * A count-only wagon-transfer request. The requester picks source yard, wagon
- * type, destination yard and HOW MANY — never the specific wagons; OCC hand-picks
- * those at fulfilment. The quantity may not exceed the AVAILABLE wagons of that
- * type currently in the source yard (enforced in the service, which is the only
- * layer that can count them), and a reason is mandatory.
+ * A wagon-transfer request. The requester picks source yard, wagon type,
+ * destination yard and HOW MANY. The quantity may not exceed the AVAILABLE
+ * wagons of that type currently in the source yard (enforced in the service,
+ * which is the only layer that can count them), and a reason is mandatory.
+ *
+ * The requester may additionally name the specific wagons they want via
+ * `preferredWagonIds`. That is a preference recorded for OCC, not a
+ * reservation — the count still drives fulfilment.
  */
 export class CreateTransferRequestDto {
   @IsUUID()
@@ -38,6 +43,17 @@ export class CreateTransferRequestDto {
   @MaxLength(2000)
   reason!: string;
 
+  @ApiPropertyOptional({
+    description:
+      'Specific wagons the requester wants, if they picked any. A preference for OCC — the wagons are not reserved.',
+    type: [String],
+  })
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(1000)
+  @IsUUID('4', { each: true })
+  preferredWagonIds?: string[];
+
   @ApiPropertyOptional({ description: 'Optional note for the fulfilling staff' })
   @IsOptional()
   @IsString()
diff --git a/apps/edr-freight-api/src/modules/wagons/entities/wagon-transfer-request.entity.ts b/apps/edr-freight-api/src/modules/wagons/entities/wagon-transfer-request.entity.ts
index c39b12b9d..8b1922711 100644
--- a/apps/edr-freight-api/src/modules/wagons/entities/wagon-transfer-request.entity.ts
+++ b/apps/edr-freight-api/src/modules/wagons/entities/wagon-transfer-request.entity.ts
@@ -56,6 +56,14 @@ export class WagonTransferRequest extends BaseEntity {
   })
   status!: WagonTransferRequestStatus;
 
+  /**
+   * The wagons the requester specifically asked for, when they picked any. A
+   * preference, not a reservation — the wagons stay AVAILABLE to everyone else,
+   * and OCC may still send different ones. Null/empty on a plain count request.
+   */
+  @Column({ name: 'preferred_wagon_ids', type: 'uuid', array: true, nullable: true })
+  preferredWagonIds?: string[] | null;
+
   @Column({ name: 'requested_by_user_id', type: 'uuid', nullable: true })
   requestedByUserId?: string | null;
 
diff --git a/apps/edr-freight-api/src/modules/wagons/wagon-transfer-requests.service.spec.ts b/apps/edr-freight-api/src/modules/wagons/wagon-transfer-requests.service.spec.ts
index 8f7457b37..74fb6d6d7 100644
--- a/apps/edr-freight-api/src/modules/wagons/wagon-transfer-requests.service.spec.ts
+++ b/apps/edr-freight-api/src/modules/wagons/wagon-transfer-requests.service.spec.ts
@@ -149,6 +149,19 @@ describe('WagonTransferRequestsService — partial fulfilment', () => {
       expect(result.skipped).toHaveLength(0);
     });
 
+    it('auto-picks the wagons the requester named ahead of the rest', async () => {
+      // Asked for 2 and named w-3 — the auto-pick must take it even though
+      // wagon-number order would have sent w-0 and w-1.
+      build(request({ quantity: 2, preferredWagonIds: ['w-3'] }));
+      wagonRepo.find.mockResolvedValue(availableWagons(5));
+
+      await service.bulkFulfill(['req-1']);
+
+      const [{ wagonIds }] = wagonsService.bulkTransfer.mock.calls[0];
+      expect(wagonIds).toHaveLength(2);
+      expect(wagonIds[0]).toBe('w-3');
+    });
+
     it('skips only when the yard has nothing to give', async () => {
       wagonRepo.find.mockResolvedValue([]);
 
@@ -253,6 +266,84 @@ describe('WagonTransferRequestsService — partial fulfilment', () => {
       expect(requestRepo.save).not.toHaveBeenCalled();
     });
 
+    it('records the wagons the requester hand-picked', async () => {
+      wagonRepo.count.mockResolvedValue(20);
+      wagonRepo.find.mockResolvedValue(availableWagons(3));
+
+      await service.createRequest(
+        {
+          fromYardId: 'yard-a',
+          toYardId: 'yard-b',
+          wagonTypeId: 'type-1',
+          quantity: 3,
+          reason: 'Grain campaign',
+          preferredWagonIds: ['w-0', 'w-1', 'w-2'],
+        },
+        'user-1',
+      );
+
+      expect(stored.preferredWagonIds).toEqual(['w-0', 'w-1', 'w-2']);
+    });
+
+    it('leaves the picks null on a plain count request', async () => {
+      wagonRepo.count.mockResolvedValue(20);
+
+      await service.createRequest(
+        {
+          fromYardId: 'yard-a',
+          toYardId: 'yard-b',
+          wagonTypeId: 'type-1',
+          quantity: 5,
+          reason: 'Grain campaign',
+        },
+        'user-1',
+      );
+
+      expect(stored.preferredWagonIds).toBeNull();
+    });
+
+    it('refuses picks that are not available in the source yard', async () => {
+      wagonRepo.count.mockResolvedValue(20);
+      // Sitting in another yard — the requester's list is stale.
+      wagonRepo.find.mockResolvedValue([
+        { ...availableWagons(1)[0], currentYardId: 'yard-z' },
+      ]);
+
+      await expect(
+        service.createRequest(
+          {
+            fromYardId: 'yard-a',
+            toYardId: 'yard-b',
+            wagonTypeId: 'type-1',
+            quantity: 1,
+            reason: 'Grain campaign',
+            preferredWagonIds: ['w-0'],
+          },
+          'user-1',
+        ),
+      ).rejects.toThrow(/no longer available in the source yard/i);
+      expect(requestRepo.save).not.toHaveBeenCalled();
+    });
+
+    it('refuses more picks than the requested quantity', async () => {
+      wagonRepo.count.mockResolvedValue(20);
+
+      await expect(
+        service.createRequest(
+          {
+            fromYardId: 'yard-a',
+            toYardId: 'yard-b',
+            wagonTypeId: 'type-1',
+            quantity: 2,
+            reason: 'Grain campaign',
+            preferredWagonIds: ['w-0', 'w-1', 'w-2'],
+          },
+          'user-1',
+        ),
+      ).rejects.toThrow(/picked 3 wagon\(s\) but are requesting 2/i);
+      expect(requestRepo.save).not.toHaveBeenCalled();
+    });
+
     it('still refuses a same-yard move', async () => {
       await expect(
         service.createRequest(
diff --git a/apps/edr-freight-api/src/modules/wagons/wagon-transfer-requests.service.ts b/apps/edr-freight-api/src/modules/wagons/wagon-transfer-requests.service.ts
index 6b63460ad..dc50a8742 100644
--- a/apps/edr-freight-api/src/modules/wagons/wagon-transfer-requests.service.ts
+++ b/apps/edr-freight-api/src/modules/wagons/wagon-transfer-requests.service.ts
@@ -27,6 +27,15 @@ import { WagonMovement } from './entities/wagon-movement.entity';
 import { WagonTransferRequest } from './entities/wagon-transfer-request.entity';
 import { WagonsService } from './wagons.service';
 
+/**
+ * A request as sent to clients: the entity plus the resolved wagon numbers for
+ * whatever the requester hand-picked, so the desk can name them without a
+ * second round trip.
+ */
+export interface TransferRequestView extends WagonTransferRequest {
+  preferredWagons?: Array<{ id: string; wagonNumber: string }>;
+}
+
 /** Bundled per-user activity: requests they touched + wagons they moved. */
 export interface TransferHistory {
   requests: WagonTransferRequest[];
@@ -75,11 +84,15 @@ export class WagonTransferRequestsService {
   ) {}
 
   /**
-   * Record a PENDING request. Count-only — no wagons are picked here, but the
-   * count IS capped by what the source yard can hand over right now: a request
-   * may not exceed the AVAILABLE, uncoupled wagons of that type in the source
-   * yard (the same number the yard desk shows). A reason is mandatory and is
-   * shown on the OCC queue.
+   * Record a PENDING request. The count is capped by what the source yard can
+   * hand over right now: a request may not exceed the AVAILABLE, uncoupled
+   * wagons of that type in the source yard (the same number the yard desk
+   * shows). A reason is mandatory and is shown on the OCC queue.
+   *
+   * The requester may also name the wagons they want (`preferredWagonIds`).
+   * Those are validated against the source yard here so a bad pick is rejected
+   * at request time rather than surfacing at fulfilment, but they are only a
+   * preference — the wagons are not reserved and OCC may send others.
    */
   async createRequest(
     dto: CreateTransferRequestDto,
@@ -104,11 +117,15 @@ export class WagonTransferRequestsService {
         `Only ${available} wagon(s) of this type are available in the source yard — cannot request ${dto.quantity}`,
       );
     }
+
+    const preferredWagonIds = await this.validatePreferredWagons(dto);
+
     const request = this.requestRepo.create({
       fromYardId: dto.fromYardId,
       toYardId: dto.toYardId,
       wagonTypeId: dto.wagonTypeId,
       quantity: dto.quantity,
+      preferredWagonIds,
       status: WagonTransferRequestStatus.Pending,
       requestedByUserId: userId ?? null,
       reason: dto.reason,
@@ -118,6 +135,45 @@ export class WagonTransferRequestsService {
     return this.findById(saved.id);
   }
 
+  /**
+   * Check the requester's hand-picked wagons against the source yard: each must
+   * exist, sit in that yard, match the requested type, be AVAILABLE and be
+   * uncoupled — the same conditions fulfilment will apply. Returns the
+   * de-duplicated ids, or null when the requester picked nothing.
+   */
+  private async validatePreferredWagons(
+    dto: CreateTransferRequestDto,
+  ): Promise<string[] | null> {
+    const ids = [...new Set(dto.preferredWagonIds ?? [])];
+    if (ids.length === 0) return null;
+
+    if (ids.length > dto.quantity) {
+      throw new BadRequestException(
+        `You picked ${ids.length} wagon(s) but are requesting ${dto.quantity} — pick at most ${dto.quantity}`,
+      );
+    }
+
+    const wagons = await this.wagonRepo.find({ where: { id: In(ids) } });
+    if (wagons.length !== ids.length) {
+      throw new NotFoundException('One or more selected wagons not found');
+    }
+    const unusable = wagons.filter(
+      (w) =>
+        w.currentYardId !== dto.fromYardId ||
+        w.wagonTypeId !== dto.wagonTypeId ||
+        w.status !== WagonStatus.Available ||
+        w.trainId != null,
+    );
+    if (unusable.length) {
+      throw new BadRequestException(
+        `These wagons are no longer available in the source yard: ${unusable
+          .map((w) => w.wagonNumber)
+          .join(', ')}`,
+      );
+    }
+    return ids;
+  }
+
   /**
    * AVAILABLE wagons of `wagonTypeId` currently in `yardId` — what OCC can move
    * right now. Shown on the desk beside the outstanding count so staff see at a
@@ -179,16 +235,51 @@ export class WagonTransferRequestsService {
           : 'r.createdAt';
     qb.orderBy(sortColumn, query.sortOrder ?? 'DESC');
 
-    return paginateQuery(qb, { page: query.page, pageSize: query.pageSize });
+    const page = await paginateQuery<WagonTransferRequest>(qb, {
+      page: query.page,
+      pageSize: query.pageSize,
+    });
+    return { ...page, items: await this.withPreferredWagons(page.items) };
   }
 
-  async findById(id: string): Promise<WagonTransferRequest> {
+  /**
+   * Resolve `preferredWagonIds` into wagon numbers for a page of requests in a
+   * single query, so the desk can show WHICH wagons were asked for. Ids that no
+   * longer resolve (purged wagon) simply drop out — the column carries no FK.
+   */
+  private async withPreferredWagons(
+    requests: WagonTransferRequest[],
+  ): Promise<TransferRequestView[]> {
+    const ids = [
+      ...new Set(requests.flatMap((r) => r.preferredWagonIds ?? [])),
+    ];
+    if (ids.length === 0) return requests;
+
+    const wagons = await this.wagonRepo.find({
+      where: { id: In(ids) },
+      select: { id: true, wagonNumber: true },
+    });
+    const byId = new Map(wagons.map((w) => [w.id, w.wagonNumber]));
+
+    return requests.map((r) => {
+      const picked = r.preferredWagonIds ?? [];
+      if (picked.length === 0) return r;
+      return Object.assign(r, {
+        preferredWagons: picked
+          .filter((id) => byId.has(id))
+          .map((id) => ({ id, wagonNumber: byId.get(id)! })),
+      });
+    });
+  }
+
+  async findById(id: string): Promise<TransferRequestView> {
     const request = await this.requestRepo.findOne({
       where: { id },
       relations: REQUEST_RELATIONS,
     });
     if (!request) throw new NotFoundException(`Transfer request ${id} not found`);
-    return request;
+    const [view] = await this.withPreferredWagons([request]);
+    return view;
   }
 
   /** Wagons still owed on an open request. */
@@ -411,7 +502,7 @@ export class WagonTransferRequestsService {
         continue;
       }
       const remaining = this.remainingOn(request);
-      const wagons = await this.wagonRepo.find({
+      const candidates = await this.wagonRepo.find({
         where: {
           currentYardId: request.fromYardId,
           wagonTypeId: request.wagonTypeId,
@@ -419,8 +510,19 @@ export class WagonTransferRequestsService {
           trainId: IsNull(),
         },
         order: { wagonNumber: 'ASC' },
-        take: remaining,
       });
+      // Honour the requester's picks first — any that are still available in
+      // the yard go out ahead of the plain wagon-number order, and the rest of
+      // the instalment is topped up from whatever else is on hand.
+      const preferred = new Set(request.preferredWagonIds ?? []);
+      const wagons = (
+        preferred.size
+          ? [
+              ...candidates.filter((w) => preferred.has(w.id)),
+              ...candidates.filter((w) => !preferred.has(w.id)),
+            ]
+          : candidates
+      ).slice(0, remaining);
       if (wagons.length === 0) {
         skipped.push({
           id,
@@ -479,7 +581,7 @@ export class WagonTransferRequestsService {
     });
 
     return {
-      requests,
+      requests: await this.withPreferredWagons(requests),
       movements,
       meta: {
         page: page ?? 1,
diff --git a/apps/edr-freight-api/src/modules/warehouses/warehouse-inventory.service.ts b/apps/edr-freight-api/src/modules/warehouses/warehouse-inventory.service.ts
index 2f204bd62..239485d3c 100644
--- a/apps/edr-freight-api/src/modules/warehouses/warehouse-inventory.service.ts
+++ b/apps/edr-freight-api/src/modules/warehouses/warehouse-inventory.service.ts
@@ -34,6 +34,8 @@ import {
   primaryContactUserJoin,
 } from '../notifications/resolve-company-phone.util';
 import { SignaturesService } from '../signatures/signatures.service';
+import { StampSettingsService } from '../stamp-settings/stamp-settings.service';
+import { sealClass, sealImageCss, sealMarkup } from '../billing/documents/seal-markup.util';
 import { BulkInspectDto } from './dto/bulk-inspect.dto';
 import { BulkReceiveDto, TruckEntranceDto } from './dto/bulk-receive.dto';
 import { DeliverInventoryDto } from './dto/deliver-inventory.dto';
@@ -414,6 +416,7 @@ export class WarehouseInventoryService {
     private readonly handover: HandoverService,
     private readonly inbox: NotificationInboxService,
     private readonly events: EventEmitter2,
+    private readonly stampSettings: StampSettingsService,
   ) {}
 
   /**
@@ -3744,6 +3747,7 @@ export class WarehouseInventoryService {
     const html = this.buildReleaseDocumentHtml({
       reference,
       issuedAt,
+      stampImageUrl: await this.stampSettings.getStampImageUrl(),
       bookingReference,
       bookingStatus: row?.bookingStatus ?? null,
       customerName: row?.customerName ?? null,
@@ -4798,6 +4802,7 @@ export class WarehouseInventoryService {
     const html = this.buildHandoverDocumentHtml({
       reference,
       handedOverAt,
+      stampImageUrl: await this.stampSettings.getStampImageUrl(),
       bookingReference,
       bookingStatus: row.bookingStatus ?? null,
       customerName: row.customerName ?? null,
@@ -5603,6 +5608,8 @@ export class WarehouseInventoryService {
     truckType?: string | null;
     truckGateOut?: string | null;
     truckWeightTons?: number | null;
+    /** The one global company stamp; null falls back to the drawn text seal. */
+    stampImageUrl?: string | null;
   }): string {
     const esc = (value: unknown) =>
       String(value ?? '-')
@@ -5689,6 +5696,7 @@ export class WarehouseInventoryService {
     .seal { width: 96px; height: 96px; margin: -28px auto 0; border: 3px double #17633a; border-radius: 999px; color: #17633a; display: flex; align-items: center; justify-content: center; text-align: center; font-weight: 800; font-size: 14px; line-height: 1.05; transform: rotate(-17deg); text-transform: uppercase; }
     .seal::before { content: ""; position: absolute; width: 78px; height: 78px; border: 1px solid #17633a; border-radius: 999px; }
     .seal span { position: relative; }
+    ${sealImageCss()}
   </style>
 </head>
 <body>
@@ -5722,7 +5730,7 @@ export class WarehouseInventoryService {
     </div>
     <div class="signatures">
       <div class="line">Officer in charge name / signature / date</div>
-      <div class="seal"><span>EDR<br />Warehouse<br />Cleared</span></div>
+      <div class="${sealClass(data.stampImageUrl)}">${sealMarkup(data.stampImageUrl, ['EDR', 'Warehouse', 'Cleared'])}</div>
       <div class="line">Customer or driver name / signature / date</div>
     </div>
   </div>
@@ -5762,6 +5770,8 @@ export class WarehouseInventoryService {
       signerDisplayName: string;
       signatureImageUrl: string | null;
     } | null;
+    /** The one global company stamp; null falls back to the drawn text seal. */
+    stampImageUrl?: string | null;
   }): string {
     const esc = (value: unknown) =>
       String(value ?? '-')
@@ -5839,6 +5849,7 @@ export class WarehouseInventoryService {
     .seal { position: relative; width: 96px; height: 96px; margin: -28px auto 0; border: 3px double #17633a; border-radius: 999px; color: #17633a; display: flex; align-items: center; justify-content: center; text-align: center; font-weight: 800; font-size: 14px; line-height: 1.05; transform: rotate(-17deg); text-transform: uppercase; }
     .seal::before { content: ""; position: absolute; width: 78px; height: 78px; border: 1px solid #17633a; border-radius: 999px; }
     .seal span { position: relative; }
+    ${sealImageCss()}
   </style>
 </head>
 <body>
@@ -5882,7 +5893,7 @@ export class WarehouseInventoryService {
   </div>
   <div class="signatures">
     <div class="line">Officer in charge name / signature / date</div>
-    <div class="seal"><span>EDR<br />Warehouse<br />Handover</span></div>
+    <div class="${sealClass(data.stampImageUrl)}">${sealMarkup(data.stampImageUrl, ['EDR', 'Warehouse', 'Handover'])}</div>
     <div class="line">
       ${approval?.signatureImageUrl ? `<img class="signature-img" src="${esc(approval.signatureImageUrl)}" />` : ''}
       <div class="signature-meta">${approval ? esc(approval.signerDisplayName) : 'Customer or driver name / signature / date'}</div>
diff --git a/apps/edr-freight-api/src/scripts/seed-negad-indode-arrived-train.ts b/apps/edr-freight-api/src/scripts/seed-negad-indode-arrived-train.ts
index 9cf1ef0cd..174a32341 100644
--- a/apps/edr-freight-api/src/scripts/seed-negad-indode-arrived-train.ts
+++ b/apps/edr-freight-api/src/scripts/seed-negad-indode-arrived-train.ts
@@ -157,9 +157,6 @@ async function main() {
             email: 'negad-indode-demo@edr.local',
             contactPersonName: 'Marshalling Demo',
             contactPersonPhone: '251900000202',
-            generalManagerName: 'Demo Manager',
-            generalManagerEmail: 'negad-indode-demo@edr.local',
-            generalManagerPhone: '251900000202',
           }),
         ));
 
diff --git a/apps/edr-freight-api/src/seed/approved-first-lastmile-demo-bookings.seeder.ts b/apps/edr-freight-api/src/seed/approved-first-lastmile-demo-bookings.seeder.ts
index 2e234bcf0..91848dff4 100644
--- a/apps/edr-freight-api/src/seed/approved-first-lastmile-demo-bookings.seeder.ts
+++ b/apps/edr-freight-api/src/seed/approved-first-lastmile-demo-bookings.seeder.ts
@@ -247,9 +247,6 @@ export class ApprovedFirstLastMileDemoBookingsSeeder {
           website: null,
           contactPersonName: 'First Last Mile Demo',
           contactPersonPhone: '251900000101',
-          generalManagerName: 'Demo Manager',
-          generalManagerEmail: COMPANY_EMAIL,
-          generalManagerPhone: '251900000101',
         },
         { conflictPaths: { tin: true } },
       );
diff --git a/apps/edr-freight-api/src/seed/demo-bookings.seeder.ts b/apps/edr-freight-api/src/seed/demo-bookings.seeder.ts
index 20d2a3f8b..4f259c28c 100644
--- a/apps/edr-freight-api/src/seed/demo-bookings.seeder.ts
+++ b/apps/edr-freight-api/src/seed/demo-bookings.seeder.ts
@@ -324,9 +324,6 @@ export class DemoBookingsSeeder {
           website: null,
           contactPersonName: "Train Scheduling",
           contactPersonPhone: "251900000001",
-          generalManagerName: "Demo Manager",
-          generalManagerEmail: COMPANY_EMAIL,
-          generalManagerPhone: "251900000001",
         },
         { conflictPaths: { tin: true } },
       );
diff --git a/apps/edr-freight-api/src/seed/edr-freight.seed.ts b/apps/edr-freight-api/src/seed/edr-freight.seed.ts
index d90fe7b80..1798a8d5f 100644
--- a/apps/edr-freight-api/src/seed/edr-freight.seed.ts
+++ b/apps/edr-freight-api/src/seed/edr-freight.seed.ts
@@ -191,6 +191,24 @@ const POSITION_TYPE_PERMISSIONS = [
   },
 ] as const;
 
+/**
+ * Audit trail access.
+ *
+ * Read-only by design: `audit_logs` rows are written solely by
+ * `AuditInterceptor` and the module exposes no create/update/delete route, so
+ * there is deliberately no `:create` / `:update` / `:delete` twin to grant.
+ * The matching `:read` key is derived automatically by
+ * `deriveReadPermissions` below.
+ */
+const AUDIT_LOG_PERMISSIONS = [
+  {
+    id: "52b2cdef-5313-4954-8c69-0f8c58ea2c1e",
+    key: "edr_freight_app:audit_log:view",
+    name: { am: "የኦዲት መዝገብ ይመልከቱ", en: "View audit logs" },
+    applicationKey: EDR_FREIGHT_APPLICATION.key,
+  },
+] as const;
+
 const EDR_FREIGHT_VIEWABLE_PERMISSIONS = [
   ...EMPLOYEE_REGISTRATION_PERMISSIONS,
   ...ROLE_ASSIGNMENT_PERMISSIONS,
@@ -198,6 +216,7 @@ const EDR_FREIGHT_VIEWABLE_PERMISSIONS = [
   ...HIERARCHY_POSITION_PERMISSIONS,
   ...HIERARCHY_EMPLOYEE_ASSIGNMENT_PERMISSIONS,
   ...POSITION_TYPE_PERMISSIONS,
+  ...AUDIT_LOG_PERMISSIONS,
   ...BOOKING_RULE_ENGINE_PERMISSIONS,
 ];
 
diff --git a/apps/edr-freight-api/src/seed/file-upload-settings.seeder.ts b/apps/edr-freight-api/src/seed/file-upload-settings.seeder.ts
index 512229706..dd8f9bd20 100644
--- a/apps/edr-freight-api/src/seed/file-upload-settings.seeder.ts
+++ b/apps/edr-freight-api/src/seed/file-upload-settings.seeder.ts
@@ -1,6 +1,7 @@
 import { Injectable, Logger } from "@nestjs/common";
 import { DataSource } from "typeorm";
 
+import { FileUploadField } from "../modules/file-upload-settings/entities/file-upload-field.entity";
 import { FileUploadSetting } from "../modules/file-upload-settings/entities/file-upload-setting.entity";
 import { poaDelegationField } from "../modules/file-upload-settings/poa-delegation.constants";
 
@@ -154,6 +155,56 @@ const FOREIGN_ONBOARDING_FIELDS: OnboardingField[] = [
 //   },
 // ];
 
+/**
+ * Documents required from a co-operative union or farm — the third alternative
+ * to the two nationality sets, not an addition to them. A co-op is always
+ * registered in Ethiopia and has a TIN but no business licence, so its
+ * registration certificate stands in for the commercial registration every
+ * other Ethiopian company uploads.
+ *
+ * Admin-managed like every other onboarding set: what these members must
+ * actually produce is a backoffice decision, edited in the file-settings editor.
+ */
+const COOPERATIVE_ONBOARDING_FIELDS: OnboardingField[] = [
+  // First on purpose: only the first field of a new set is seeded, and this is
+  // the paper that distinguishes a co-operative from every other company.
+  {
+    fileKey: "cooperative_registration_certificate",
+    fileLabel: "Co-operative Union / Farm Registration Certificate",
+    helpText:
+      "Certificate issued by the co-operative promotion agency that registered the union or farm.",
+    isRequired: true,
+    isMultiple: false,
+    maxFiles: 1,
+    allowedExtensions: DOC_EXTENSIONS,
+    maxSizeMb: 50,
+    displayOrder: 1,
+  },
+  {
+    fileKey: "tin_certificate",
+    fileLabel: "TIN Certificate",
+    helpText: "Verified against the TIN registry during registration.",
+    isRequired: true,
+    isMultiple: false,
+    maxFiles: 1,
+    allowedExtensions: DOC_EXTENSIONS,
+    maxSizeMb: 50,
+    displayOrder: 2,
+  },
+  {
+    fileKey: "national_id",
+    fileLabel: "National ID",
+    helpText: "Verified against the National ID API during registration.",
+    isRequired: true,
+    isMultiple: false,
+    maxFiles: 1,
+    allowedExtensions: DOC_EXTENSIONS,
+    maxSizeMb: 50,
+    displayOrder: 3,
+  },
+  poaDelegationDefault(4),
+];
+
 interface OnboardingDocumentSetting {
   code: string;
   label: string;
@@ -176,6 +227,14 @@ const COMPANY_ONBOARDING_DOCUMENTS: OnboardingDocumentSetting[] = [
     entity: "customer",
     fields: FOREIGN_ONBOARDING_FIELDS,
   },
+  // The third set: a union or farm resolves here INSTEAD of a nationality set
+  // (it is always Ethiopian, and holds no business licence).
+  {
+    code: "company_onboarding_documents_cooperative",
+    label: "Co-operative union / farm onboarding documents",
+    entity: "customer",
+    fields: COOPERATIVE_ONBOARDING_FIELDS,
+  },
   // Legacy per-company-type codes — removed, unused by any resolver or portal
   // lookup (only `company_onboarding_documents_ethiopian`/`_foreign` are live).
   // {
@@ -606,16 +665,15 @@ export class FileUploadSettingsSeeder {
   async run() {
     const settingRepository = this.dataSource.getRepository(FileUploadSetting);
 
-    // Seed only into an empty table: any existing rows (including
-    // soft-deleted ones, which would still conflict on the unique `code`)
-    // mean the data is admin-managed, so leave it untouched.
-    const existing = await settingRepository.count({ withDeleted: true });
-    if (existing > 0) {
-      this.logger.log(
-        `file_upload_settings already has ${existing} rows — skipping seed`,
-      );
-      return;
-    }
+    // Seed per CODE, not "only into an empty table". An existing row is
+    // admin-managed and never touched — including a soft-deleted one, which
+    // means the set was removed on purpose (and would still conflict on the
+    // unique `code`). What the table-wide check got wrong is the other half: a
+    // set added to this file after the first boot could never reach a database
+    // that already held the others, so it existed in code and nowhere else.
+    const existingCodes = new Set(
+      (await settingRepository.find({ withDeleted: true })).map((s) => s.code),
+    );
 
     const allSettings: Array<
       OnboardingDocumentSetting & { description: string }
@@ -645,20 +703,41 @@ export class FileUploadSettingsSeeder {
         })),
       ];
 
-    // Insert setting rows only — no FileUploadField rows. Fields start empty
-    // and are configured from the backoffice file-settings editor; the field
-    // definitions above are kept as reference defaults.
-    await settingRepository.insert(
-      allSettings.map((documentSetting) => ({
-        code: documentSetting.code,
-        label: documentSetting.label,
-        description: documentSetting.description,
-        entity: documentSetting.entity,
-      })),
+    const missing = allSettings.filter((s) => !existingCodes.has(s.code));
+    if (missing.length === 0) {
+      this.logger.log("file upload settings up to date — nothing to seed");
+      return;
+    }
+
+    const inserted = await settingRepository.save(
+      missing.map((documentSetting) =>
+        settingRepository.create({
+          code: documentSetting.code,
+          label: documentSetting.label,
+          description: documentSetting.description,
+          entity: documentSetting.entity,
+        }),
+      ),
     );
 
+    // A brand-new set gets exactly ONE field: its first reference default. The
+    // rest of the list above stays documentation — what a set actually asks for
+    // is a backoffice decision, edited in the file-settings editor. Seeding one
+    // means a set is never born empty (an empty set silently requires nothing),
+    // while leaving the admin a single row to extend rather than a list to prune.
+    const fieldRepository = this.dataSource.getRepository(FileUploadField);
+    const firstFields = inserted.flatMap((setting) => {
+      const reference = missing.find((s) => s.code === setting.code)?.fields[0];
+      return reference
+        ? [fieldRepository.create({ ...reference, settingId: setting.id })]
+        : [];
+    });
+    if (firstFields.length > 0) await fieldRepository.save(firstFields);
+
     this.logger.log(
-      `Seeded ${allSettings.length} file upload settings with empty fields`,
+      `Seeded ${missing.length} file upload settings (${firstFields.length} with a default field): ${missing
+        .map((s) => s.code)
+        .join(", ")}`,
     );
   }
 }
diff --git a/apps/edr-freight-api/src/seed/freight-permissions.registry.ts b/apps/edr-freight-api/src/seed/freight-permissions.registry.ts
index 47fde9fb4..f0b719d63 100644
--- a/apps/edr-freight-api/src/seed/freight-permissions.registry.ts
+++ b/apps/edr-freight-api/src/seed/freight-permissions.registry.ts
@@ -1187,6 +1187,32 @@ export const CONFIG_SETTINGS_PERMISSIONS: FreightPermissionSeed[] = [
     "edr_freight_app:settings:dropdown:manage",
     "Manage dropdown settings",
   ),
+  perm(
+    "b4b00002-0001-4000-8000-000000000001",
+    "edr_freight_app:settings:stamp:view",
+    "View the company stamp",
+  ),
+  perm(
+    "b4b00002-0001-4000-8000-000000000002",
+    "edr_freight_app:settings:stamp:manage",
+    "Manage the company stamp",
+  ),
+  // The per-officer approval teeter (ማህተም) — an individual's own stamp +
+  // signature, not the company seal. It used to ride on settings:stamp:*, which
+  // now gates the ONE company stamp; this key was split out when the two were
+  // untangled. `settings:invoice_stamp:*` retired at the same time: it gated the
+  // company stamp before the fold and is deliberately left orphaned in any DB
+  // that already seeded it (the seeder upserts by key and never deletes).
+  perm(
+    "b4b00003-0001-4000-8000-000000000001",
+    "edr_freight_app:settings:teeter:view",
+    "View own approval teeter and signature",
+  ),
+  perm(
+    "b4b00003-0001-4000-8000-000000000002",
+    "edr_freight_app:settings:teeter:manage",
+    "Manage own approval teeter and signature",
+  ),
   perm(
     "b4c00001-0001-4000-8000-000000000001",
     "edr_freight_app:audit:view",
@@ -1304,7 +1330,10 @@ export const GRANULAR_SPLIT_PERMISSIONS: FreightPermissionSeed[] = [
     "Edit contract templates & articles",
   ),
   // Granular split of contract-template access. `view` opens the sidebar page;
-  // `read` is API-read-only for other pages that display template data.
+  // `read` is API-read-only for other pages that display template data — and is
+  // NOT written out here: deriveReadPermissions mints the `:read` twin of every
+  // `:view` key, so a hand-written one duplicates the key (Postgres 21000 on the
+  // seeder's ON CONFLICT (key) insert) and carries a v4 id where twins are v5.
   perm(
     "b4e00001-0001-4000-8000-000000000003",
     "edr_freight_app:settings:contract_templates:create",
@@ -1320,11 +1349,6 @@ export const GRANULAR_SPLIT_PERMISSIONS: FreightPermissionSeed[] = [
     "edr_freight_app:settings:contract_templates:delete",
     "Delete bulk contract templates",
   ),
-  perm(
-    "b4e00001-0001-4000-8000-000000000006",
-    "edr_freight_app:settings:contract_templates:read",
-    "Read contract template data (API only)",
-  ),
   perm(
     "b4f00001-0001-4000-8000-000000000001",
     "edr_freight_app:settings:support_content:view",
@@ -1627,11 +1651,24 @@ export const FREIGHT_PERMS = {
     dispatch: "edr_freight_app:train_scheduling:dispatch",
     markPaid: "edr_freight_app:train_scheduling:mark_paid",
     expireBooking: "edr_freight_app:train_scheduling:expire_booking",
+    /**
+     * Edit a schedule's operational run numbers (train + voyage) before
+     * dispatch. Separate from `update`: these numbers are what yards and
+     * customs quote, so changing them is narrower than general scheduling edits.
+     */
+    editTrainNumber: "edr_freight_app:train_scheduling:edit_train_number",
   },
   fleet: {
     view: "edr_freight_app:fleet:view",
     manage: "edr_freight_app:fleet:manage",
   },
+  /**
+   * Audit trail. View-only: the module has no write routes, so this is the
+   * only key it needs — see AUDIT_LOG_PERMISSIONS in edr-freight.seed.ts.
+   */
+  auditLog: {
+    view: "edr_freight_app:audit_log:view",
+  },
   admin: "edr_freight_app:admin",
   ruleEngine: {
     view: (slug: RuleEngineResourceSlug) =>
@@ -1876,6 +1913,19 @@ export const FREIGHT_PERMS = {
       view: "edr_freight_app:settings:dropdown:view",
       manage: "edr_freight_app:settings:dropdown:manage",
     },
+    // The ONE company stamp/seal, applied to every generated document
+    // (invoices, receipts, warehouse papers, the EDR side of contracts).
+    stamp: {
+      view: "edr_freight_app:settings:stamp:view",
+      manage: "edr_freight_app:settings:stamp:manage",
+    },
+    // The per-officer approval teeter (ማህተም) + signature — genuinely per-person,
+    // and NOT the company seal above. Retired: `invoiceStamp`, which used to
+    // gate the company stamp before the two were untangled.
+    teeter: {
+      view: "edr_freight_app:settings:teeter:view",
+      manage: "edr_freight_app:settings:teeter:manage",
+    },
     exchangeRate: {
       view: "edr_freight_app:settings:exchange_rate:view",
       manage: "edr_freight_app:settings:exchange_rate:manage",
@@ -1894,9 +1944,6 @@ export const FREIGHT_PERMS = {
       manage: "edr_freight_app:settings:support_content:manage",
     },
   },
-  audit: {
-    view: "edr_freight_app:audit:view",
-  },
   support: {
     agentView: "edr_freight_app:support:agent_view",
     agentSend: "edr_freight_app:support:agent_send",
@@ -2132,6 +2179,7 @@ export const ROLE_PERMISSION_PRESETS = {
     FREIGHT_PERMS.trainScheduling.dispatch,
     FREIGHT_PERMS.trainScheduling.markPaid,
     FREIGHT_PERMS.trainScheduling.expireBooking,
+    FREIGHT_PERMS.trainScheduling.editTrainNumber,
     FREIGHT_PERMS.fleet.view,
     FREIGHT_PERMS.fleet.manage,
     ...FLEET_GRANULAR_KEYS,
@@ -2287,7 +2335,8 @@ export const POSITION_PERMISSION_PRESETS = {
     FREIGHT_PERMS.payments.view,
   ]),
   // Director additionally manages train scheduling + rail fleet (same block the
-  // operation officer/chief hold), on top of the approval-chain role preset.
+  // operation officer/chief hold), on top of the approval-chain role preset,
+  // and carries the same full warehouse authority the chief tier holds.
   director: dedupe([
     ...ROLE_PERMISSION_PRESETS.director,
     FREIGHT_PERMS.trainScheduling.view,
@@ -2296,9 +2345,22 @@ export const POSITION_PERMISSION_PRESETS = {
     FREIGHT_PERMS.trainScheduling.cancel,
     FREIGHT_PERMS.trainScheduling.reschedule,
     FREIGHT_PERMS.trainScheduling.rulesManage,
+    FREIGHT_PERMS.trainScheduling.editTrainNumber,
     FREIGHT_PERMS.fleet.view,
     FREIGHT_PERMS.fleet.manage,
     ...FLEET_GRANULAR_KEYS,
+    // Warehouse — full CRUD, matching the chief tier. Unlike the dispatcher,
+    // the director also owns the allocation and fee rules themselves.
+    FREIGHT_PERMS.warehouseDashboard.view,
+    ...Object.values(FREIGHT_PERMS.warehouses),
+    ...Object.values(FREIGHT_PERMS.warehouseYards),
+    ...Object.values(FREIGHT_PERMS.warehouseZones),
+    ...Object.values(FREIGHT_PERMS.warehouseAllocationRules),
+    ...Object.values(FREIGHT_PERMS.warehouseFeeRules),
+    ...Object.values(FREIGHT_PERMS.warehouseInventory),
+    ...Object.values(FREIGHT_PERMS.warehouseInspectionReports),
+    ...Object.values(FREIGHT_PERMS.interchangeDocuments),
+    ...Object.values(FREIGHT_PERMS.warehouseFeeInvoices),
   ]),
   ceo: dedupe([...ROLE_PERMISSION_PRESETS.ceo]),
   ethiopianGl: dedupe([...ROLE_PERMISSION_PRESETS.glEthiopia]),
diff --git a/apps/edr-freight-api/src/seed/freight-positions.seeder.ts b/apps/edr-freight-api/src/seed/freight-positions.seeder.ts
index 09901b502..81df21a17 100644
--- a/apps/edr-freight-api/src/seed/freight-positions.seeder.ts
+++ b/apps/edr-freight-api/src/seed/freight-positions.seeder.ts
@@ -1,5 +1,6 @@
 import { Injectable, Logger } from '@nestjs/common';
 import {
+  Application,
   Organization,
   Permission,
   Position,
@@ -8,7 +9,23 @@ import {
 } from '@tria-plc/iamapi-common';
 import { DataSource, EntityManager, In } from 'typeorm';
 
-import { EDR_FREIGHT_POSITIONS } from './edr-freight.seed';
+import { EDR_FREIGHT_APPLICATION, EDR_FREIGHT_POSITIONS } from './edr-freight.seed';
+
+/**
+ * Turn a permission key into a readable fallback name for a row this seeder has
+ * to mint itself: `edr_freight_app:train_scheduling:edit_train_number` becomes
+ * "Train scheduling: edit train number". Only used for keys absent from the
+ * catalog — a key that IS catalogued keeps its curated Amharic/English name.
+ */
+const nameForKey = (key: string): { en: string } => {
+  const [, ...rest] = key.split(':');
+  const [resource, ...action] = rest;
+  const humanize = (s: string) => s.replace(/_/g, ' ');
+  const label = action.length
+    ? `${humanize(resource)}: ${humanize(action.join(' '))}`
+    : humanize(resource);
+  return { en: label.charAt(0).toUpperCase() + label.slice(1) };
+};
 
 const SEED_FLAG = 'SEED_EDR_ORG';
 const EDR_ORG_KEY = 'edr_freight';
@@ -83,7 +100,19 @@ export class FreightPositionsSeeder {
     );
   }
 
-  /** Resolve every permission key referenced by any position to its id. */
+  /**
+   * Resolve every permission key referenced by any position to its id, minting
+   * the rows that do not exist yet.
+   *
+   * The position presets draw from FREIGHT_PERMS (the registry), which is
+   * broader than the EDR_FREIGHT_PERMISSIONS catalog EdrOrgSeeder inserts —
+   * module keys like `train_scheduling:*` live only in the registry. So every
+   * newly-added preset key would otherwise abort boot with
+   * `missing_permissions:<key>` until someone hand-inserted it. Ensuring them
+   * here keeps this seeder self-sufficient: it declares the keys it needs, so
+   * it is the one that guarantees they exist. Same approach, and the same
+   * id-less insert reasoning, as FreightNotificationPermissionsSeeder.
+   */
   private async loadPermissionIds(
     manager: EntityManager,
   ): Promise<Map<string, string>> {
@@ -91,16 +120,54 @@ export class FreightPositionsSeeder {
       ...new Set(EDR_FREIGHT_POSITIONS.flatMap((p) => p.permissionKeys)),
     ];
 
-    const permissions = await manager.getRepository(Permission).find({
-      where: { key: In(keys) },
-      select: { id: true, key: true },
-    });
-
-    const map = new Map(permissions.map((p) => [p.key, p.id as string]));
+    const read = async () => {
+      const rows = await manager.getRepository(Permission).find({
+        where: { key: In(keys) },
+        select: { id: true, key: true },
+      });
+      return new Map(rows.map((p) => [p.key, p.id as string]));
+    };
 
+    let map = await read();
     const missing = keys.filter((key) => !map.has(key));
-    if (missing.length > 0) {
-      throw new Error(`missing_permissions:${missing.join(',')}`);
+    if (missing.length === 0) {
+      return map;
+    }
+
+    const application = await manager.getRepository(Application).findOne({
+      where: { key: EDR_FREIGHT_APPLICATION.key },
+      select: { id: true },
+    });
+    if (!application?.id) {
+      throw new Error(`missing_application:${EDR_FREIGHT_APPLICATION.key}`);
+    }
+
+    // Ids are left to the column default and never sent: iam.permissions has
+    // two unique columns (PK id, UQ key) and ON CONFLICT can only target one,
+    // so a hand-minted id already owned by a retired key would slip past
+    // ON CONFLICT (key) and die on the PK.
+    await manager
+      .createQueryBuilder()
+      .insert()
+      .into(Permission)
+      .values(
+        missing.map((key) => ({
+          key,
+          name: nameForKey(key),
+          applicationId: application.id as string,
+        })),
+      )
+      .orIgnore()
+      .execute();
+
+    this.logger.log(
+      `Seeded ${missing.length} permission(s) referenced by positions but absent from the catalog: ${missing.join(', ')}`,
+    );
+
+    map = await read();
+    const stillMissing = keys.filter((key) => !map.has(key));
+    if (stillMissing.length > 0) {
+      throw new Error(`missing_permissions:${stillMissing.join(',')}`);
     }
 
     return map;
diff --git a/apps/edr-freight-api/src/seed/paid-import-export-mile-demo.seeder.ts b/apps/edr-freight-api/src/seed/paid-import-export-mile-demo.seeder.ts
index 654f4f77f..a658ec13d 100644
--- a/apps/edr-freight-api/src/seed/paid-import-export-mile-demo.seeder.ts
+++ b/apps/edr-freight-api/src/seed/paid-import-export-mile-demo.seeder.ts
@@ -175,9 +175,6 @@ export class PaidImportExportMileDemoSeeder {
           website: null,
           contactPersonName: 'Paid Mile Demo',
           contactPersonPhone: '251900000202',
-          generalManagerName: 'Demo Manager',
-          generalManagerEmail: COMPANY_EMAIL,
-          generalManagerPhone: '251900000202',
         },
         { conflictPaths: { tin: true } },
       );
diff --git a/apps/edr-freight-web/backoffice/src/App.tsx b/apps/edr-freight-web/backoffice/src/App.tsx
index 00d5e0ddb..64f91da72 100644
--- a/apps/edr-freight-web/backoffice/src/App.tsx
+++ b/apps/edr-freight-web/backoffice/src/App.tsx
@@ -41,9 +41,9 @@ import MyProfilePage from "./pages/dashboard/MyProfilePage";
 import OverviewPage from "./pages/dashboard/OverviewPage";
 import ReportsHubPage from "./pages/reports/ReportsHubPage";
 import ReportPage from "./pages/reports/ReportPage";
+import AuditLogsPage from "./pages/AuditLogsPage";
 import AiBookingMockTestPage from "./pages/ai/AiBookingMockTestPage";
 import PaymentsPage from "./pages/payments/PaymentsPage";
-import AuditLogsPage from "./pages/audit/AuditLogsPage";
 //import EmployeesPage from "./pages/dashboard/user-management/EmployeesPage";
 import { RequirePermission } from "./components/auth/RequirePermission";
 import { FREIGHT_PERMS } from "./lib/permissions";
@@ -51,6 +51,7 @@ import { NO_ACCESS_PATH, resolveLandingPath } from "./lib/landing";
 import NoAccessPage from "./pages/NoAccessPage";
 import FileUploadSettingsPage from "./pages/documents/FileUploadSettingsPage";
 import DropdownSettingsPage from "./pages/dropdown_settings/DropdownSettingsPage";
+import CompanyStampSettingsPage from "./pages/settings/CompanyStampSettingsPage";
 import ContractTemplatesPage from "./pages/contract_templates/ContractTemplatesPage";
 import PortalContentPage from "./pages/portal_content/PortalContentPage";
 import ContractTemplateEditorPage from "./pages/contract_templates/ContractTemplateEditorPage";
@@ -117,6 +118,20 @@ import {
   findActiveSidebarLabel,
 } from "@/components/layout/sidebar-sections";
 
+/**
+ * The per-shipment clearance detail page is the shared destination of three
+ * hubs (Operations → Clearance, Clearance Documents, Self-Clearance Review),
+ * none of which are gated on `bookings:clearance_view`. Gating the detail on
+ * that key alone bounced reviewers back to their landing page (Bookings) the
+ * moment they opened a row, so accept any key that can reach a hub.
+ */
+const CLEARANCE_DETAIL_PERMS = [
+  FREIGHT_PERMS.bookings.clearanceView,
+  FREIGHT_PERMS.contracts.clearanceReview,
+  FREIGHT_PERMS.contracts.clearanceEtActions,
+  FREIGHT_PERMS.contracts.opsClearanceReview,
+];
+
 const DashboardShell = () => {
   const navigate = useNavigate();
   const location = useLocation();
@@ -189,6 +204,7 @@ const App = () => {
         <Route path="overview" element={<RequirePermission permission={FREIGHT_PERMS.overview.view}><OverviewPage /></RequirePermission>} />
         <Route path="reports" element={<RequirePermission permission={FREIGHT_PERMS.reports.view}><ReportsHubPage /></RequirePermission>} />
         <Route path="reports/:reportKey" element={<RequirePermission permission={FREIGHT_PERMS.reports.view}><ReportPage /></RequirePermission>} />
+        <Route path="audit-logs" element={<RequirePermission permission={FREIGHT_PERMS.auditLog.view}><AuditLogsPage /></RequirePermission>} />
         {/* Dev/testing page for the mock AI booking assistant. */}
         <Route
           path="ai-booking-mock-test"
@@ -285,9 +301,7 @@ const App = () => {
         <Route
           path="clearance/:id"
           element={
-            <RequirePermission
-              permission={FREIGHT_PERMS.bookings.clearanceView}
-            >
+            <RequirePermission permission={CLEARANCE_DETAIL_PERMS}>
               <DocumentClearanceDetailPage />
             </RequirePermission>
           }
@@ -321,9 +335,7 @@ const App = () => {
         <Route
           path="bookings/:bookingId/clearance"
           element={
-            <RequirePermission
-              permission={FREIGHT_PERMS.bookings.clearanceView}
-            >
+            <RequirePermission permission={CLEARANCE_DETAIL_PERMS}>
               <DocumentClearanceDetailPage />
             </RequirePermission>
           }
@@ -773,14 +785,28 @@ const App = () => {
             </RequirePermission>
           }
         />
+        {/*
+          The ONE company stamp, for every generated document. The per-officer
+          teeter (ማህተም) that used to sit beside it at /dashboard/stamp-settings
+          now lives at /user-management/teeter-and-signature — it is a different
+          thing (an individual's approval stamp), and pairing the two here was
+          the duplication.
+        */}
         <Route
-          path="audit-logs"
+          path="stamp-settings"
           element={
-            <RequirePermission permission={FREIGHT_PERMS.audit.view}>
-              <AuditLogsPage />
+            <RequirePermission
+              permission={FREIGHT_PERMS.settings.stamp.view}
+            >
+              <CompanyStampSettingsPage />
             </RequirePermission>
           }
         />
+        {/* Old URL kept alive so existing links/bookmarks do not 404. */}
+        <Route
+          path="invoice-stamp-settings"
+          element={<Navigate to="/dashboard/stamp-settings" replace />}
+        />
         <Route
           path="contract-templates"
           element={
diff --git a/apps/edr-freight-web/backoffice/src/complaints/services/etradeTinService.ts b/apps/edr-freight-web/backoffice/src/complaints/services/etradeTinService.ts
index 3bdc653c4..8feb7cfb8 100644
--- a/apps/edr-freight-web/backoffice/src/complaints/services/etradeTinService.ts
+++ b/apps/edr-freight-web/backoffice/src/complaints/services/etradeTinService.ts
@@ -101,7 +101,8 @@ export function mapEtradeBusinessLicenses(
     const tradeName = String(business.TradesName ?? "").trim();
     const tradeNameAmh = String(business.TradeNameAmh ?? "").trim();
     const activities = (business.SubGroups ?? [])
-      .map((group) => String(group.Description ?? "").trim())
+      // eTrade returns null entries in this array, not just a null array.
+      .map((group) => String(group?.Description ?? "").trim())
       .filter(Boolean);
 
     const displayTradeName =
diff --git a/apps/edr-freight-web/backoffice/src/components/bookings/detail/BookingSchedulingWindowCard.tsx b/apps/edr-freight-web/backoffice/src/components/bookings/detail/BookingSchedulingWindowCard.tsx
index 9b5cf91f2..7f5a4af23 100644
--- a/apps/edr-freight-web/backoffice/src/components/bookings/detail/BookingSchedulingWindowCard.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/bookings/detail/BookingSchedulingWindowCard.tsx
@@ -142,6 +142,21 @@ export function BookingSchedulingWindowCard({
     schedule?.reference ??
     (schedule ? "Assigned train" : null);
 
+  // Before the batch engine allocates, the only train on the booking is the one
+  // the customer picked at day-commit — staff review that during Operation
+  // Review, so it is labelled as a request, not as a confirmed allocation.
+  const isRequested = schedule?.isRequested === true;
+  const trainRowLabel = isRequested ? "Requested train" : "Scheduled on train";
+
+  // A train that has already left (or is past its planned departure) can no
+  // longer carry this booking, so accepting onto it would be wrong. Called out
+  // here because this card sits above the staff-actions toolbar.
+  const departureIso =
+    schedule?.actualDepartureAt ?? schedule?.scheduledDepartureDate ?? null;
+  const hasDeparted = schedule?.actualDepartureAt
+    ? true
+    : departureIso !== null && new Date(departureIso).getTime() <= nowMs;
+
   return (
     <SectionCard
       icon={CalendarClock}
@@ -153,7 +168,7 @@ export function BookingSchedulingWindowCard({
       <Stack gap="sm">
         {trainLabel ? (
           <Row
-            label="Scheduled on train"
+            label={trainRowLabel}
             value={trainLabel}
             hint={
               schedule?.reference && schedule.reference !== trainLabel
@@ -163,13 +178,21 @@ export function BookingSchedulingWindowCard({
           />
         ) : (
           <Row
-            label="Scheduled on train"
+            label={trainRowLabel}
             value="Not yet allocated"
             tone="muted"
             hint="The booking has not been placed on a train schedule"
           />
         )}
 
+        {isRequested && trainLabel ? (
+          <Text size="xs" c="dimmed">
+            {hasDeparted
+              ? "This train has already departed — accepting the operation will not place the booking on it."
+              : "Picked by the customer at day-commit. Accepting the operation releases the booking to the batch pool for this train."}
+          </Text>
+        ) : null}
+
         {schedule?.status ? (
           <Group justify="space-between" wrap="nowrap">
             <Text size="sm" c="dimmed">
@@ -231,10 +254,15 @@ export function BookingSchedulingWindowCard({
                 formatStamp(schedule.scheduledDepartureDate) ??
                 "—"
               }
+              tone={isRequested && hasDeparted ? "danger" : undefined}
               hint={
                 schedule.actualDepartureAt
                   ? `Actual · planned ${formatStamp(schedule.scheduledDepartureDate) ?? "—"}`
-                  : "Planned"
+                  : departureIso && !hasDeparted
+                    ? `Planned · departs ${formatRelative(departureIso, nowMs)}`
+                    : hasDeparted
+                      ? "Planned — already past"
+                      : "Planned"
               }
             />
             <Row
diff --git a/apps/edr-freight-web/backoffice/src/components/contracts/ExportClearanceStepper.tsx b/apps/edr-freight-web/backoffice/src/components/contracts/ExportClearanceStepper.tsx
index f665f388b..af68d0f55 100644
--- a/apps/edr-freight-web/backoffice/src/components/contracts/ExportClearanceStepper.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/contracts/ExportClearanceStepper.tsx
@@ -1006,7 +1006,7 @@ export function ReleaseOrderCard({
   clearance: ClearanceViewLike & { vesselDepartureDate?: string | null };
   onChanged?: () => void;
 }) {
-  const [file, setFile] = useState<File | null>(null);
+  const [files, setFiles] = useState<File[]>([]);
   const [vesselDate, setVesselDate] = useState<Date | null>(
     clearance.vesselDepartureDate ? new Date(clearance.vesselDepartureDate) : null,
   );
@@ -1020,7 +1020,14 @@ export function ReleaseOrderCard({
         Release Order
       </Text>
       <Stack gap="sm">
-        <FileInput label="Release Order" value={file} onChange={setFile} size="sm" />
+        <FileInput
+          label="Release Order"
+          placeholder="Select one or more files"
+          multiple
+          value={files}
+          onChange={setFiles}
+          size="sm"
+        />
         <DateInput
           label="Vessel departure date"
           value={vesselDate}
@@ -1032,15 +1039,15 @@ export function ReleaseOrderCard({
           <Button
             color="edr-green"
             loading={loading}
-            disabled={!file || !vesselDate}
+            disabled={files.length === 0 || !vesselDate}
             onClick={async () => {
-              if (!file || !vesselDate) return;
+              if (files.length === 0 || !vesselDate) return;
               setLoading(true);
               try {
                 const iso = vesselDate.toISOString().slice(0, 10);
                 const result = isBooking
-                  ? await bookingsService.uploadReleaseOrder(entityId, file, iso)
-                  : await contractsService.uploadReleaseOrder(entityId, file, iso);
+                  ? await bookingsService.uploadReleaseOrder(entityId, files, iso)
+                  : await contractsService.uploadReleaseOrder(entityId, files, iso);
                 if (result.hold) {
                   toast.error(result.holdReason ?? "Vessel date too soon");
                 } else {
diff --git a/apps/edr-freight-web/backoffice/src/components/contracts/GlClearanceUploadModal.tsx b/apps/edr-freight-web/backoffice/src/components/contracts/GlClearanceUploadModal.tsx
index dfe0bf0e4..95dbc787e 100644
--- a/apps/edr-freight-web/backoffice/src/components/contracts/GlClearanceUploadModal.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/contracts/GlClearanceUploadModal.tsx
@@ -10,11 +10,10 @@ import {
   toIsoDate,
   useDoCollectionDates,
 } from "@/components/contracts/DoCollectionDateFields";
-import { PhasedFileDropzone } from "@/components/contracts/PhasedFileDropzone";
-import { findWorkflowFile } from "@/components/contracts/PhasedUploadedFileRow";
+import { PhasedMultiFileDropzone } from "@/components/contracts/PhasedFileDropzone";
 import { contractsService } from "@/services/contracts.service";
 import { bookingsService } from "@/services/bookings.service";
-import type { Freight } from "@edr/types";
+import { isDeliveryOrderFileCode, isReleaseOrderFileCode, type Freight } from "@edr/types";
 
 export type GlClearanceUploadKind = "do" | "ro";
 
@@ -44,9 +43,8 @@ export function GlClearanceUploadModal({
   vesselArrivalDate,
   doCollectedDate,
   onSuccess,
-  onPreview,
 }: GlClearanceUploadModalProps) {
-  const [file, setFile] = useState<File | null>(null);
+  const [files, setFiles] = useState<File[]>([]);
   const [vesselDate, setVesselDate] = useState<Date | null>(
     vesselDepartureDate ? new Date(vesselDepartureDate) : null,
   );
@@ -66,16 +64,16 @@ export function GlClearanceUploadModal({
   const isDo = kind === "do";
   const isRo = kind === "ro";
   const replaceMode = isDo
-    ? Boolean(findWorkflowFile(workflowFiles, "delivery_order"))
-    : Boolean(findWorkflowFile(workflowFiles, "release_order"));
+    ? workflowFiles.some((f) => isDeliveryOrderFileCode(f.code) && f.file)
+    : workflowFiles.some((f) => isReleaseOrderFileCode(f.code) && f.file);
 
   const close = () => {
-    setFile(null);
+    setFiles([]);
     onClose();
   };
 
   const submit = async () => {
-    if (!file || !kind) return;
+    if (files.length === 0 || !kind) return;
     if (isRo && !vesselDate) {
       toast.error("Vessel departure date is required.");
       return;
@@ -93,23 +91,23 @@ export function GlClearanceUploadModal({
           doCollectedDate: toIsoDate(doDates.doCollected)!,
         };
         if (isBooking) {
-          await bookingsService.uploadDeliveryOrder(entityId, file, dates);
+          await bookingsService.uploadDeliveryOrder(entityId, files, dates);
         } else {
-          await contractsService.uploadDeliveryOrder(entityId, file, dates);
+          await contractsService.uploadDeliveryOrder(entityId, files, dates);
         }
         toast.success(replaceMode ? "Delivery Order updated" : "Delivery Order uploaded");
       } else {
         const iso = vesselDate!.toISOString().slice(0, 10);
         const result = isBooking
-          ? await bookingsService.uploadReleaseOrder(entityId, file, iso)
-          : await contractsService.uploadReleaseOrder(entityId, file, iso);
+          ? await bookingsService.uploadReleaseOrder(entityId, files, iso)
+          : await contractsService.uploadReleaseOrder(entityId, files, iso);
         if (result.hold) {
           toast.error(result.holdReason ?? "Vessel date too soon");
         } else {
           toast.success(replaceMode ? "Release Order updated" : "Release Order uploaded");
         }
       }
-      setFile(null);
+      setFiles([]);
       onSuccess?.();
       close();
     } catch (e) {
@@ -152,14 +150,15 @@ export function GlClearanceUploadModal({
           <DoCollectionDateFields value={doDates} onChange={setDoDates} />
         )}
 
-        <PhasedFileDropzone
-          label={isDo ? "Delivery Order file" : "Release Order file"}
-          description={isDo ? "Any file type." : "PDF or image."}
+        <PhasedMultiFileDropzone
+          label={isDo ? "Delivery Order files" : "Release Order files"}
+          description={
+            isDo ? "Any file type. Add as many files as needed." : "PDF or image. Add as many files as needed."
+          }
           accept={isDo ? "*/*" : undefined}
-          value={file}
-          onChange={setFile}
+          value={files}
+          onChange={setFiles}
           replaceMode={replaceMode}
-          onPreview={onPreview}
         />
 
         <Group justify="flex-end" gap="sm">
@@ -170,7 +169,7 @@ export function GlClearanceUploadModal({
             color="edr-green"
             loading={loading}
             disabled={
-              !file ||
+              files.length === 0 ||
               (isRo && !vesselDate) ||
               (isDo && !doDatesComplete(doDates))
             }
diff --git a/apps/edr-freight-web/backoffice/src/components/contracts/PhasedClearanceActionPanel.tsx b/apps/edr-freight-web/backoffice/src/components/contracts/PhasedClearanceActionPanel.tsx
index 926637db2..4b44edda6 100644
--- a/apps/edr-freight-web/backoffice/src/components/contracts/PhasedClearanceActionPanel.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/contracts/PhasedClearanceActionPanel.tsx
@@ -34,12 +34,15 @@ import {
   Truck,
   Upload,
 } from "lucide-react";
-import type { Freight } from "@edr/types";
+import {
+  deliveryOrderFileLabel,
+  isDeliveryOrderFileCode,
+  type Freight,
+} from "@edr/types";
 import toast from "react-hot-toast";
 
 import { SectionCard } from "@/components/bookings/detail/SectionCard";
 import { ExportClearanceStepper } from "@/components/contracts/ExportClearanceStepper";
-import { PhasedDocumentUploadField } from "@/components/contracts/PhasedDocumentUploadField";
 import {
   DoCollectionDateFields,
   doDatesComplete,
@@ -2133,56 +2136,82 @@ function DeliveryOrderStep({
   onViewFile?: (file: { name: string; url: string }) => void;
   onDownloadFile?: (file: { id: string; name: string }) => void;
 }) {
-  const [files, setFiles] = useState<Record<string, File | null>>({
-    delivery_order: null,
-  });
+  const [files, setFiles] = useState<File[]>([]);
   const [doDates, setDoDates] = useDoCollectionDates({
     vesselArrivalDate,
     doCollectedDate,
   });
   const [loading, setLoading] = useState(false);
-  const hasFile = Boolean(files.delivery_order);
+
+  const submit = async () => {
+    if (files.length === 0 || !doDatesComplete(doDates)) return;
+    const dates = {
+      vesselArrivalDate: toIsoDate(doDates.vesselArrival)!,
+      doCollectedDate: toIsoDate(doDates.doCollected)!,
+    };
+    setLoading(true);
+    try {
+      if (isBooking) {
+        await bookingsService.uploadDeliveryOrder(entityId, files, dates);
+      } else {
+        await contractsService.uploadDeliveryOrder(entityId, files, dates);
+      }
+      setFiles([]);
+      toast.success(replaceMode ? "Delivery Order updated" : "Delivery Order uploaded");
+      onChanged?.();
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : "Upload failed");
+    } finally {
+      setLoading(false);
+    }
+  };
 
   return (
-    <PhasedDocumentUploadField
-      fields={[{ key: "delivery_order", label: "Delivery Order" }]}
-      files={files}
-      onChange={(key, file) => setFiles((prev) => ({ ...prev, [key]: file }))}
-      workflowFiles={workflowFiles}
-      replaceMode={replaceMode}
-      loading={loading}
-      disabled={!hasFile || !doDatesComplete(doDates)}
-      helperText="Upload the Djibouti Delivery Order (DO) and record when the vessel arrived and when the DO was collected."
-      submitLabel={replaceMode ? "Replace DO" : "Upload DO"}
-      extraFields={
-        <DoCollectionDateFields value={doDates} onChange={setDoDates} />
-      }
-      onViewFile={onViewFile}
-      onDownloadFile={onDownloadFile}
-      onSubmit={async () => {
-        const file = files.delivery_order;
-        if (!file || !doDatesComplete(doDates)) return;
-        const dates = {
-          vesselArrivalDate: toIsoDate(doDates.vesselArrival)!,
-          doCollectedDate: toIsoDate(doDates.doCollected)!,
-        };
-        setLoading(true);
-        try {
-          if (isBooking) {
-            await bookingsService.uploadDeliveryOrder(entityId, file, dates);
-          } else {
-            await contractsService.uploadDeliveryOrder(entityId, file, dates);
-          }
-          setFiles({ delivery_order: null });
-          toast.success(replaceMode ? "Delivery Order updated" : "Delivery Order uploaded");
-          onChanged?.();
-        } catch (e) {
-          toast.error(e instanceof Error ? e.message : "Upload failed");
-        } finally {
-          setLoading(false);
+    <Stack gap="sm">
+      <Text size="sm" c="dimmed">
+        Upload the Djibouti Delivery Order (DO) and record when the vessel arrived and when the
+        DO was collected. Add as many files as needed.
+      </Text>
+
+      {workflowFiles
+        .filter((wf) => isDeliveryOrderFileCode(wf.code) && wf.file)
+        .map((wf, index) => (
+          <PhasedUploadedFileRow
+            key={wf.code}
+            label={deliveryOrderFileLabel(wf.code, index)}
+            file={wf.file!}
+            onView={onViewFile}
+            onDownload={onDownloadFile}
+          />
+        ))}
+
+      <DoCollectionDateFields value={doDates} onChange={setDoDates} />
+
+      <PhasedMultiFileDropzone
+        label="Delivery Order files"
+        description={
+          replaceMode
+            ? "Replace the DO — upload one or more files (any file type)."
+            : "Upload one or more Delivery Order files (any file type)."
         }
-      }}
-    />
+        accept="*/*"
+        value={files}
+        onChange={setFiles}
+        replaceMode={replaceMode}
+        disabled={loading}
+      />
+
+      <Button
+        color="edr-green"
+        loading={loading}
+        disabled={files.length === 0 || !doDatesComplete(doDates)}
+        leftSection={<Upload size={16} />}
+        fullWidth
+        onClick={() => void submit()}
+      >
+        {replaceMode ? "Replace DO" : "Upload DO"}
+      </Button>
+    </Stack>
   );
 }
 
diff --git a/apps/edr-freight-web/backoffice/src/components/contracts/detail/ContractDetailTabCards.tsx b/apps/edr-freight-web/backoffice/src/components/contracts/detail/ContractDetailTabCards.tsx
index de8ff1953..d29e045c4 100644
--- a/apps/edr-freight-web/backoffice/src/components/contracts/detail/ContractDetailTabCards.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/contracts/detail/ContractDetailTabCards.tsx
@@ -170,12 +170,13 @@ export function ContractCustomerCard({
         />
       </SectionCard>
 
-      <SectionCard icon={User} title="General manager" accent="grape">
+      {/* Whoever the eTrade licence names as the business's manager. */}
+      <SectionCard icon={User} title="Owner" accent="grape">
         <InfoRows
           rows={[
-            { icon: User, label: "Name", value: company.generalManagerName },
-            { icon: Mail, label: "Email", value: company.generalManagerEmail },
-            { icon: Phone, label: "Phone", value: company.generalManagerPhone },
+            { icon: User, label: "Name", value: company.ownerName },
+            { icon: Mail, label: "Email", value: company.ownerEmail },
+            { icon: Phone, label: "Phone", value: company.ownerPhone },
           ]}
         />
       </SectionCard>
diff --git a/apps/edr-freight-web/backoffice/src/components/customers/ChangeRequestReview.tsx b/apps/edr-freight-web/backoffice/src/components/customers/ChangeRequestReview.tsx
index d86e0079c..65c4f25e3 100644
--- a/apps/edr-freight-web/backoffice/src/components/customers/ChangeRequestReview.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/customers/ChangeRequestReview.tsx
@@ -43,9 +43,17 @@ export const FIELD_LABELS: Record<string, string> = {
   contactPersonPosition: "Contact position",
   contactPersonEmail: "Contact email",
   contactPersonPhone: "Contact phone",
-  generalManagerName: "General manager",
-  generalManagerEmail: "GM email",
-  generalManagerPhone: "GM phone",
+  ownerName: "Owner name",
+  ownerEmail: "Owner email",
+  ownerPhone: "Owner phone",
+  poaDeclared: "Has a Power of Attorney",
+  poaPassportNumber: "PoA passport number",
+  // Nothing writes these any more — the general manager was removed — but
+  // change requests filed before that still carry them, and without a label
+  // the reviewer sees a raw attribute key.
+  generalManagerName: "General manager (retired)",
+  generalManagerEmail: "GM email (retired)",
+  generalManagerPhone: "GM phone (retired)",
   poaName: "PoA name",
   poaPhone: "PoA phone",
   poaEmail: "PoA email",
@@ -79,9 +87,9 @@ export function currentValue(company: Company, key: string): string {
     nationality: c.nationality,
     contactPersonName: c.contactPersonName ?? attrs.contactPersonName,
     contactPersonPhone: c.contactPersonPhone ?? attrs.contactPersonPhone,
-    generalManagerName: c.generalManagerName ?? attrs.generalManagerName,
-    generalManagerEmail: c.generalManagerEmail ?? attrs.generalManagerEmail,
-    generalManagerPhone: c.generalManagerPhone ?? attrs.generalManagerPhone,
+    ownerName: c.ownerName ?? attrs.ownerName,
+    ownerEmail: c.ownerEmail ?? attrs.ownerEmail,
+    ownerPhone: c.ownerPhone ?? attrs.ownerPhone,
   };
   const v = key in map ? map[key] : (c[key] ?? attrs[key]);
   return v === null || v === undefined || v === "" ? "—" : String(v);
diff --git a/apps/edr-freight-web/backoffice/src/components/customers/PersonCard.tsx b/apps/edr-freight-web/backoffice/src/components/customers/PersonCard.tsx
new file mode 100644
index 000000000..b4a201fd1
--- /dev/null
+++ b/apps/edr-freight-web/backoffice/src/components/customers/PersonCard.tsx
@@ -0,0 +1,112 @@
+import { Badge, Card, Divider, Group, Stack, Text } from "@mantine/core";
+import type { ReactNode } from "react";
+
+export interface PersonField {
+  label: string;
+  value?: string | null;
+}
+
+export interface PersonCardProps {
+  /** OWNER / POA / CONTACT PERSON — the person's role, not their name. */
+  title: string;
+  icon?: ReactNode;
+  /**
+   * Identity state. `undefined` = this person has no identity check at all
+   * (contact person), so no badge is rendered rather than a misleading "not
+   * verified" one.
+   */
+  verified?: boolean;
+  /** Extra pills after the verification badge (e.g. "Verifies for this company"). */
+  badges?: ReactNode;
+  /** Rendered between the header and the fields — alerts, match warnings. */
+  notice?: ReactNode;
+  fields: PersonField[];
+  /** Shown when the API returned nothing for every field. */
+  emptyMessage: string;
+  /** Attachments or anything else that belongs to this person. */
+  children?: ReactNode;
+}
+
+/**
+ * One person in the customer's people column: owner, power of attorney, contact
+ * person. Empty fields are dropped rather than rendered as "—", so a field the
+ * API stops sending simply disappears instead of leaving a dead row behind.
+ */
+export function PersonCard({
+  title,
+  icon,
+  verified,
+  badges,
+  notice,
+  fields,
+  emptyMessage,
+  children,
+}: PersonCardProps) {
+  const filled = fields.filter(
+    (f) => f.value != null && String(f.value).trim(),
+  );
+
+  return (
+    <Card>
+      <Stack gap="sm">
+        <Group gap={8} wrap="wrap">
+          {icon}
+          <Text
+            size="xs"
+            fw={700}
+            c="edr-muted"
+            tt="uppercase"
+            style={{ letterSpacing: "0.06em" }}
+          >
+            {title}
+          </Text>
+          {verified !== undefined &&
+            (verified ? (
+              <Badge size="xs" color="edr-green" variant="light">
+                Fayda verified
+              </Badge>
+            ) : (
+              <Badge size="xs" color="gray" variant="light">
+                Not verified
+              </Badge>
+            ))}
+          {badges}
+        </Group>
+
+        {notice}
+
+        {filled.length > 0 ? (
+          <Stack gap="xs">
+            {filled.map((f) => (
+              <Stack key={f.label} gap={0}>
+                <Text size="xs" c="edr-muted">
+                  {f.label}
+                </Text>
+                <Text
+                  size="sm"
+                  c="edr-text"
+                  style={{ wordBreak: "break-word" }}
+                >
+                  {f.value}
+                </Text>
+              </Stack>
+            ))}
+          </Stack>
+        ) : (
+          <Text size="sm" c="dimmed">
+            {emptyMessage}
+          </Text>
+        )}
+
+        {children && (
+          <>
+            <Divider />
+            {children}
+          </>
+        )}
+      </Stack>
+    </Card>
+  );
+}
+
+export default PersonCard;
diff --git a/apps/edr-freight-web/backoffice/src/components/customers/index.ts b/apps/edr-freight-web/backoffice/src/components/customers/index.ts
index 81f25fcb2..daeb11311 100644
--- a/apps/edr-freight-web/backoffice/src/components/customers/index.ts
+++ b/apps/edr-freight-web/backoffice/src/components/customers/index.ts
@@ -24,4 +24,9 @@ export {
   type ResetPasswordActionProps,
 } from "./ResetPasswordAction";
 export { formatBytes, formatDate, formatMoney, humanize } from "./format";
+export {
+  PersonCard,
+  type PersonCardProps,
+  type PersonField,
+} from "./PersonCard";
 export { TableCard, type TableCardProps } from "./TableCard";
diff --git a/apps/edr-freight-web/backoffice/src/components/layout/route-meta.ts b/apps/edr-freight-web/backoffice/src/components/layout/route-meta.ts
index 9aa11043b..9b75f35f5 100644
--- a/apps/edr-freight-web/backoffice/src/components/layout/route-meta.ts
+++ b/apps/edr-freight-web/backoffice/src/components/layout/route-meta.ts
@@ -184,13 +184,6 @@ const ROUTE_META: Array<{ prefix: string; meta: PageMeta }> = [
       subtitle: "Manage dropdown options used across the platform",
     },
   },
-  {
-    prefix: "/dashboard/audit-logs",
-    meta: {
-      title: "Audit Logs",
-      subtitle: "Request and entity-level activity recorded across the freight API",
-    },
-  },
   {
     prefix: "/dashboard/configuration/contract-validity-periods",
     meta: {
diff --git a/apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx b/apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx
index 83e80d11e..95608b6db 100644
--- a/apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/layout/sidebar-sections.tsx
@@ -19,6 +19,7 @@ import {
   PackageOpen,
   Paperclip,
   Receipt,
+  Stamp,
   ScrollText,
   Send,
   Settings,
@@ -485,6 +486,15 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
         icon: <Settings />,
         permission: FREIGHT_PERMS.settings.dropdown.view,
       },
+      {
+        // One entry, one stamp. The former "Stamp settings" entry here pointed
+        // at the per-officer teeter (ማህተም), not a company seal — it moved to
+        // /user-management/teeter-and-signature.
+        label: "Company stamp",
+        href: "/dashboard/stamp-settings",
+        icon: <Stamp />,
+        permission: FREIGHT_PERMS.settings.stamp.view,
+      },
       {
         label: "Contract templates",
         href: "/dashboard/contract-templates",
@@ -505,7 +515,7 @@ export const buildSidebarSections = (demoItems: SidebarItem[]): SidebarSection[]
         label: "Audit logs",
         href: "/dashboard/audit-logs",
         icon: <History />,
-        permission: FREIGHT_PERMS.audit.view,
+        permission: FREIGHT_PERMS.auditLog.view,
       },
       {
         label: "Configuration",
diff --git a/apps/edr-freight-web/backoffice/src/components/profile/MySignatureCard.tsx b/apps/edr-freight-web/backoffice/src/components/profile/MySignatureCard.tsx
index 0a70b3aec..b13ba4291 100644
--- a/apps/edr-freight-web/backoffice/src/components/profile/MySignatureCard.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/profile/MySignatureCard.tsx
@@ -1,11 +1,10 @@
 import { useState } from "react";
-import { FileSignature, Loader2, Stamp } from "lucide-react";
+import { FileSignature, Loader2 } from "lucide-react";
 import { useMutation, useQuery } from "@tanstack/react-query";
 import toast from "react-hot-toast";
 
 import { api } from "@/services/api";
 import { ContractSignaturePad } from "@/components/bookings/ContractSignaturePad";
-import { StampUpload } from "@/components/contracts/StampUpload";
 import {
   Card,
   CardContent,
@@ -27,9 +26,13 @@ import {
 } from "@edr/ui-common";
 
 /**
- * Lets the signed-in user view and update the reusable signature and company
- * stamp stored on their profile — managed independently of each other. Both
- * are offered when signing a booking contract.
+ * Lets the signed-in user view and update the reusable signature stored on
+ * their profile, offered for approval when signing a contract.
+ *
+ * Signature only — there is no per-employee stamp. EDR seals with ONE global
+ * company stamp, managed under Settings and applied server-side, so a staff
+ * member never uploads or picks a stamp. (Customers do upload their own, in
+ * the portal — that is a different card.)
  */
 export function MySignatureCard() {
   const { user } = useAuth();
@@ -39,10 +42,8 @@ export function MySignatureCard() {
   const saveMutation = useMutation(api.signatures.save.mutationOptions());
 
   const [signatureOpen, setSignatureOpen] = useState(false);
-  const [stampOpen, setStampOpen] = useState(false);
   const [signerName, setSignerName] = useState("");
   const [signatureData, setSignatureData] = useState<string | null>(null);
-  const [stampData, setStampData] = useState<string | null>(null);
 
   const defaultName =
     user?.name?.en || user?.username || user?.email || "";
@@ -60,7 +61,6 @@ export function MySignatureCard() {
       {
         signerDisplayName: signerName.trim(),
         signatureImageBase64: signatureData,
-        // Stamp untouched — it is managed by its own dialog.
       },
       {
         onSuccess: () => {
@@ -72,38 +72,16 @@ export function MySignatureCard() {
     );
   };
 
-  const openStampDialog = () => {
-    setStampData(saved?.stampImageUrl ?? null);
-    setStampOpen(true);
-  };
-
-  const saveStamp = () => {
-    if (!stampData) return;
-    saveMutation.mutate(
-      {
-        signerDisplayName: savedName || defaultName,
-        // Signature untouched — stamp-only update.
-        stampImageBase64: stampData,
-      },
-      {
-        onSuccess: () => {
-          toast.success("Stamp saved");
-          setStampOpen(false);
-        },
-        onError: () => toast.error("Failed to save stamp"),
-      },
-    );
-  };
-
   return (
     <Card>
       <CardHeader>
         <CardTitle className="flex items-center gap-2">
           <FileSignature className="size-4" />
-          Signature &amp; Stamp
+          Signature
         </CardTitle>
         <CardDescription>
-          This signature can be reused to sign booking contracts.
+          This signature can be reused to sign booking contracts. The EDR
+          company stamp is applied automatically — you do not upload one.
         </CardDescription>
       </CardHeader>
       <CardContent className="space-y-6">
@@ -112,54 +90,29 @@ export function MySignatureCard() {
             <Loader2 className="size-6 animate-spin text-primary" />
           </div>
         ) : (
-          <>
-            <div className="space-y-2">
-              {saved?.signatureImageUrl ? (
-                <>
-                  <div className="overflow-hidden rounded-lg border-2 border-dashed border-border bg-white">
-                    <img
-                      src={saved.signatureImageUrl}
-                      alt="My saved signature"
-                      className="mx-auto h-36 w-full object-contain"
-                    />
-                  </div>
-                  <p className="text-xs text-muted-foreground">
-                    Saved as {saved.signerDisplayName}
-                  </p>
-                </>
-              ) : (
-                <p className="text-sm text-muted-foreground">
-                  You have not saved a signature yet.
+          <div className="space-y-2">
+            {saved?.signatureImageUrl ? (
+              <>
+                <div className="overflow-hidden rounded-lg border-2 border-dashed border-border bg-white">
+                  <img
+                    src={saved.signatureImageUrl}
+                    alt="My saved signature"
+                    className="mx-auto h-36 w-full object-contain"
+                  />
+                </div>
+                <p className="text-xs text-muted-foreground">
+                  Saved as {saved.signerDisplayName}
                 </p>
-              )}
-              <Button variant="outline" size="sm" onClick={openSignatureDialog}>
-                {saved?.signatureImageUrl ? "Update signature" : "Add signature"}
-              </Button>
-            </div>
-
-            <div className="space-y-2">
-              {saved?.stampImageUrl ? (
-                <>
-                  <div className="overflow-hidden rounded-lg border-2 border-dashed border-border bg-white">
-                    <img
-                      src={saved.stampImageUrl}
-                      alt="My saved company stamp"
-                      className="mx-auto h-24 w-full object-contain"
-                    />
-                  </div>
-                  <p className="text-xs text-muted-foreground">Company stamp</p>
-                </>
-              ) : (
-                <p className="text-sm text-muted-foreground">
-                  You have not uploaded a company stamp yet.
-                </p>
-              )}
-              <Button variant="outline" size="sm" onClick={openStampDialog}>
-                <Stamp className="size-4" />
-                {saved?.stampImageUrl ? "Update stamp" : "Upload stamp"}
-              </Button>
-            </div>
-          </>
+              </>
+            ) : (
+              <p className="text-sm text-muted-foreground">
+                You have not saved a signature yet.
+              </p>
+            )}
+            <Button variant="outline" size="sm" onClick={openSignatureDialog}>
+              {saved?.signatureImageUrl ? "Update signature" : "Add signature"}
+            </Button>
+          </div>
         )}
       </CardContent>
 
@@ -203,39 +156,6 @@ export function MySignatureCard() {
           </DialogFooter>
         </DialogContent>
       </Dialog>
-
-      <Dialog open={stampOpen} onOpenChange={setStampOpen}>
-        <DialogContent className="sm:max-w-md">
-          <DialogHeader>
-            <DialogTitle>Company stamp</DialogTitle>
-            <DialogDescription>
-              Upload your official company stamp or seal as an image. It is
-              stored on your profile and applied next to your signature on
-              contracts.
-            </DialogDescription>
-          </DialogHeader>
-          <StampUpload
-            value={stampData}
-            onChange={setStampData}
-            description="Stored on your profile and prefilled when you sign contracts."
-          />
-          <DialogFooter>
-            <Button variant="outline" onClick={() => setStampOpen(false)}>
-              Cancel
-            </Button>
-            <Button
-              disabled={saveMutation.isPending || !stampData}
-              onClick={saveStamp}
-            >
-              {saveMutation.isPending ? (
-                <Loader2 className="size-4 animate-spin" />
-              ) : (
-                "Save stamp"
-              )}
-            </Button>
-          </DialogFooter>
-        </DialogContent>
-      </Dialog>
     </Card>
   );
 }
diff --git a/apps/edr-freight-web/backoffice/src/components/trainBuilder/BuildTrainModal.tsx b/apps/edr-freight-web/backoffice/src/components/trainBuilder/BuildTrainModal.tsx
index 21033e7fe..23c6fb220 100644
--- a/apps/edr-freight-web/backoffice/src/components/trainBuilder/BuildTrainModal.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/trainBuilder/BuildTrainModal.tsx
@@ -88,7 +88,7 @@ export default function BuildTrainModal({ opened, onClose, onBuilt }: BuildTrain
   const handleBuild = async () => {
     if (!trainName.trim()) {
       toast({
-        title: "Enter the vogue number",
+        title: "Enter the voyage number",
         variant: "destructive",
       });
       return;
@@ -150,8 +150,8 @@ export default function BuildTrainModal({ opened, onClose, onBuilt }: BuildTrain
           wagons are attached on the next screen.
         </Text>
         <TextInput
-          label="Vogue number"
-          placeholder="Enter vogue number"
+          label="Voyage number"
+          placeholder="Enter voyage number"
           value={trainName}
           onChange={(e) => setTrainName(e.currentTarget.value)}
           maxLength={100}
diff --git a/apps/edr-freight-web/backoffice/src/components/trainScheduling/EligibleBookingsPanel.tsx b/apps/edr-freight-web/backoffice/src/components/trainScheduling/EligibleBookingsPanel.tsx
index 27122d68c..641903b58 100644
--- a/apps/edr-freight-web/backoffice/src/components/trainScheduling/EligibleBookingsPanel.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/trainScheduling/EligibleBookingsPanel.tsx
@@ -1,7 +1,9 @@
 import { useMemo } from "react";
+import { Link } from "react-router-dom";
 import { ArrowRight, Landmark, Package } from "lucide-react";
 import {
   Accordion,
+  Anchor,
   Badge,
   Button,
   Checkbox,
@@ -50,9 +52,20 @@ function EligibleBookingRow({
       <Stack gap={4} style={{ flex: 1 }}>
         <Group gap="xs" wrap="wrap">
           <Package size={14} />
-          <Text fw={600} size="sm">
+          {/* Opens the booking in a new tab: the row is a selection control in
+              an allocation flow, so navigating away would lose staff's picks. */}
+          <Anchor
+            component={Link}
+            to={`/dashboard/booking-requests/${booking.id}`}
+            target="_blank"
+            fw={600}
+            size="sm"
+            c="edr-green.8"
+            underline="hover"
+            onClick={(e) => e.stopPropagation()}
+          >
             {booking.reference}
-          </Text>
+          </Anchor>
           {resolvedFreightType ? (
             <Badge variant="outline" size="xs">
               {resolvedFreightType}
diff --git a/apps/edr-freight-web/backoffice/src/components/trainScheduling/MergeScheduleTrainModal.tsx b/apps/edr-freight-web/backoffice/src/components/trainScheduling/MergeScheduleTrainModal.tsx
new file mode 100644
index 000000000..a713918b4
--- /dev/null
+++ b/apps/edr-freight-web/backoffice/src/components/trainScheduling/MergeScheduleTrainModal.tsx
@@ -0,0 +1,344 @@
+import {
+  Alert,
+  Badge,
+  Box,
+  Button,
+  Card,
+  Group,
+  Loader,
+  Modal,
+  Stack,
+  Text,
+  Textarea,
+  TextInput,
+  ThemeIcon,
+} from "@mantine/core";
+import { useMutation, useQuery } from "@tanstack/react-query";
+import { isAxiosError } from "axios";
+import {
+  ArrowRight,
+  Ban,
+  CircleAlert,
+  Merge,
+  Search,
+  TriangleAlert,
+} from "lucide-react";
+import { useMemo, useState } from "react";
+
+import { api } from "@/services/api";
+import { useToast } from "@/hooks/use-toast";
+
+function parseError(error: unknown, fallback: string): string {
+  if (isAxiosError(error)) {
+    const message = error.response?.data?.message;
+    if (Array.isArray(message)) return message.join(", ");
+    if (typeof message === "string") return message;
+  }
+  return fallback;
+}
+
+const fmtDate = (iso: string) =>
+  new Date(iso).toLocaleDateString("en-GB", {
+    day: "numeric",
+    month: "short",
+    year: "numeric",
+  });
+
+export interface MergeScheduleTrainModalProps {
+  scheduleId: string | null;
+  /** This schedule's current train — excluded from the picker. */
+  currentTrainId: string | null;
+  scheduleReference?: string | null;
+  opened: boolean;
+  onClose: () => void;
+  onMerged?: () => void;
+}
+
+/**
+ * Merge another train into this schedule.
+ *
+ * This schedule always survives: its train set is repointed at the chosen
+ * train, that train's wagons join this consist, and the emptied train is
+ * deactivated. When the chosen train also runs a schedule on the SAME DAY, that
+ * schedule's bookings move here and it is removed — its other-day schedules
+ * gain the wagons only. The server computes all of that in `previewMerge`, so
+ * the summary below is exactly what the commit will perform.
+ */
+export default function MergeScheduleTrainModal({
+  scheduleId,
+  currentTrainId,
+  scheduleReference,
+  opened,
+  onClose,
+  onMerged,
+}: MergeScheduleTrainModalProps) {
+  const { toast } = useToast();
+  const [selectedTrainId, setSelectedTrainId] = useState<string | null>(null);
+  const [search, setSearch] = useState("");
+  const [reason, setReason] = useState("");
+
+  const { data: trains = [], isLoading: trainsLoading } = useQuery({
+    ...api.trains.list.queryOptions(),
+    enabled: opened,
+  });
+
+  // The schedule's own train cannot be merged into itself.
+  const options = useMemo(() => {
+    const q = search.trim().toLowerCase();
+    return trains
+      .filter((t) => t.id !== currentTrainId)
+      .filter((t) =>
+        q
+          ? `${t.code} ${t.trainNumber ?? ""} ${t.trainName ?? ""}`
+              .toLowerCase()
+              .includes(q)
+          : true,
+      );
+  }, [trains, currentTrainId, search]);
+
+  const { data: preview, isFetching: previewLoading } = useQuery({
+    ...api.trainScheduling.previewScheduleMerge.queryOptions({
+      input: { id: scheduleId ?? "", targetTrainId: selectedTrainId ?? "" },
+    }),
+    enabled: opened && Boolean(scheduleId && selectedTrainId),
+  });
+
+  const merge = useMutation(api.trainScheduling.mergeScheduleTrain.mutationOptions());
+
+  const close = () => {
+    setSelectedTrainId(null);
+    setSearch("");
+    setReason("");
+    onClose();
+  };
+
+  const submit = async () => {
+    if (!scheduleId || !selectedTrainId || !preview?.canMerge) return;
+    try {
+      await merge.mutateAsync({
+        id: scheduleId,
+        targetTrainId: selectedTrainId,
+        ...(reason.trim() ? { reason: reason.trim() } : {}),
+      });
+      toast({ title: "Trains merged" });
+      onMerged?.();
+      close();
+    } catch (err) {
+      toast({
+        title: "Merge failed",
+        description: parseError(err, "Could not merge the trains"),
+        variant: "destructive",
+      });
+    }
+  };
+
+  return (
+    <Modal
+      opened={opened}
+      onClose={close}
+      centered
+      size="lg"
+      radius="lg"
+      title={
+        <Group gap="sm">
+          <ThemeIcon variant="light" color="edr-green" radius="md" size={34}>
+            <Merge size={18} />
+          </ThemeIcon>
+          <Box>
+            <Text fw={600} lh={1.2}>
+              Merge another train into this one
+            </Text>
+            <Text size="xs" c="dimmed" lh={1.2}>
+              {scheduleReference ?? "This departure survives the merge"}
+            </Text>
+          </Box>
+        </Group>
+      }
+    >
+      <Stack gap="md">
+        <TextInput
+          placeholder="Search train code or number…"
+          leftSection={<Search size={15} />}
+          value={search}
+          onChange={(e) => setSearch(e.currentTarget.value)}
+          radius="md"
+        />
+
+        {trainsLoading ? (
+          <Group justify="center" py="lg">
+            <Loader size="sm" />
+          </Group>
+        ) : options.length === 0 ? (
+          <Text size="sm" c="dimmed" py="sm">
+            No other trains available to merge.
+          </Text>
+        ) : (
+          <Box
+            style={{
+              display: "grid",
+              gridTemplateColumns: "repeat(auto-fill, minmax(160px, 1fr))",
+              gap: 8,
+              maxHeight: 190,
+              overflowY: "auto",
+            }}
+          >
+            {options.map((t) => {
+              const on = t.id === selectedTrainId;
+              return (
+                <Card
+                  key={t.id}
+                  withBorder
+                  radius="md"
+                  padding="xs"
+                  onClick={() => setSelectedTrainId(t.id)}
+                  style={{
+                    cursor: "pointer",
+                    borderColor: on
+                      ? "var(--mantine-color-edr-green-5)"
+                      : undefined,
+                    background: on
+                      ? "var(--mantine-color-edr-green-0)"
+                      : undefined,
+                  }}
+                >
+                  <Text size="sm" fw={on ? 700 : 600} truncate>
+                    {t.code}
+                  </Text>
+                  <Text size="xs" c="dimmed" truncate>
+                    {t.trainNumber ? `No. ${t.trainNumber}` : "—"}
+                  </Text>
+                </Card>
+              );
+            })}
+          </Box>
+        )}
+
+        {selectedTrainId && previewLoading ? (
+          <Group justify="center" py="md">
+            <Loader size="sm" />
+          </Group>
+        ) : null}
+
+        {selectedTrainId && preview && !previewLoading ? (
+          <Stack gap="sm">
+            {preview.blockers.length ? (
+              <Alert
+                variant="light"
+                color="red"
+                icon={<CircleAlert size={16} />}
+                title="This merge is blocked"
+              >
+                <Stack gap={4}>
+                  {preview.blockers.map((b) => (
+                    <Text size="sm" key={b}>
+                      {b}
+                    </Text>
+                  ))}
+                </Stack>
+              </Alert>
+            ) : (
+              <Alert
+                variant="light"
+                color="orange"
+                icon={<TriangleAlert size={16} />}
+              >
+                This cannot be undone. Wagons are appended last — reorder them
+                afterwards in the train builder.
+              </Alert>
+            )}
+
+            <Card withBorder radius="md" padding="sm">
+              <Group gap={8} wrap="nowrap" mb={8}>
+                <Text size="sm" fw={700}>
+                  {preview.wagons.current} wagons
+                </Text>
+                <ArrowRight size={15} />
+                <Text size="sm" fw={700} c="edr-green.8">
+                  {preview.wagons.merged} wagons
+                </Text>
+                <Badge variant="light" color="edr-green" radius="sm">
+                  +{preview.wagons.incoming} from {preview.targetTrain.code}
+                </Badge>
+              </Group>
+
+              {preview.absorbedSchedule ? (
+                <Group gap={6} wrap="nowrap" mb={6}>
+                  <Badge size="sm" color="grape" variant="light" radius="sm">
+                    {fmtDate(preview.absorbedSchedule.scheduledDepartureDate)}
+                  </Badge>
+                  <Text size="sm">
+                    {preview.absorbedSchedule.reference ?? "Same-day schedule"} —{" "}
+                    <Text span fw={700}>
+                      {preview.absorbedSchedule.bookingsMoving} booking(s)
+                    </Text>{" "}
+                    move here, then it is removed
+                  </Text>
+                </Group>
+              ) : null}
+
+              {preview.affectedSchedules.map((s) => (
+                <Group gap={6} wrap="nowrap" mb={4} key={s.id}>
+                  <Badge size="sm" color="blue" variant="light" radius="sm">
+                    {fmtDate(s.scheduledDepartureDate)}
+                  </Badge>
+                  <Text size="sm" c="dimmed">
+                    {s.reference ?? s.id.slice(0, 8)} — gains the wagons, keeps
+                    its own bookings
+                  </Text>
+                </Group>
+              ))}
+
+              {preview.untouchedSchedules.map((s) => (
+                <Group gap={6} wrap="nowrap" mb={4} key={s.id}>
+                  <Badge size="sm" color="gray" variant="light" radius="sm">
+                    {fmtDate(s.scheduledDepartureDate)}
+                  </Badge>
+                  <Text size="sm" c="dimmed">
+                    {s.reference ?? s.id.slice(0, 8)} — {s.status.toLowerCase()},
+                    not affected
+                  </Text>
+                </Group>
+              ))}
+
+              {preview.sourceTrainWillDeactivate ? (
+                <Group gap={6} mt={6} wrap="nowrap">
+                  <Ban size={14} color="var(--mantine-color-red-6)" />
+                  <Text size="sm" c="red.7">
+                    This schedule&apos;s current train is emptied and deactivated.
+                  </Text>
+                </Group>
+              ) : null}
+            </Card>
+
+            {preview.canMerge ? (
+              <Textarea
+                label="Reason"
+                placeholder="Why the trains are being merged (kept on the audit trail)"
+                maxLength={500}
+                autosize
+                minRows={2}
+                value={reason}
+                onChange={(e) => setReason(e.currentTarget.value)}
+              />
+            ) : null}
+          </Stack>
+        ) : null}
+
+        <Group justify="flex-end" mt="xs">
+          <Button variant="default" onClick={close}>
+            Cancel
+          </Button>
+          <Button
+            color="edr-green"
+            leftSection={<Merge size={16} />}
+            loading={merge.isPending}
+            disabled={!preview?.canMerge || previewLoading}
+            onClick={() => void submit()}
+          >
+            Merge trains
+          </Button>
+        </Group>
+      </Stack>
+    </Modal>
+  );
+}
diff --git a/apps/edr-freight-web/backoffice/src/components/trainScheduling/ScheduleBookingsStep.tsx b/apps/edr-freight-web/backoffice/src/components/trainScheduling/ScheduleBookingsStep.tsx
index fec3d78e9..777003545 100644
--- a/apps/edr-freight-web/backoffice/src/components/trainScheduling/ScheduleBookingsStep.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/trainScheduling/ScheduleBookingsStep.tsx
@@ -1,4 +1,5 @@
 import {
+  Anchor,
   Badge,
   Button,
   Group,
@@ -7,7 +8,16 @@ import {
   Tabs,
   Text,
 } from "@mantine/core";
-import { ArrowRight, FileText, Landmark, MapPin, Package, Train } from "lucide-react";
+import { Link } from "react-router-dom";
+import {
+  ArrowRight,
+  Building2,
+  FileText,
+  Landmark,
+  MapPin,
+  Package,
+  Train,
+} from "lucide-react";
 
 import type { EligibleContainerBooking, FreightType } from "@/types/trainScheduling";
 
@@ -16,6 +26,8 @@ import { EligibleBookingsPanel } from "./EligibleBookingsPanel";
 export type AssignedBookingRow = {
   id: string;
   reference: string;
+  /** Who booked it — staff scan this list by customer, not by reference. */
+  customer?: string | null;
   weightTons?: number;
   isGovernment?: boolean;
   wagonsRequired?: number | null;
@@ -90,9 +102,19 @@ export function ScheduleBookingsStep({
                 >
                   <Stack gap={4}>
                     <Group gap="xs">
-                      <Text fw={600} size="sm">
+                      {/* Only the reference is the link — the row also carries a
+                          Remove button, so an interactive control must not nest
+                          inside the anchor. */}
+                      <Anchor
+                        component={Link}
+                        to={`/dashboard/booking-requests/${booking.id}`}
+                        fw={600}
+                        size="sm"
+                        c="edr-green.8"
+                        underline="hover"
+                      >
                         {booking.reference}
-                      </Text>
+                      </Anchor>
                       {booking.weightTons != null ? (
                         <Badge variant="outline" size="xs" color="edr-green">
                           {booking.weightTons}T
@@ -119,6 +141,14 @@ export function ScheduleBookingsStep({
                         </Badge>
                       ) : null}
                     </Group>
+                    {booking.customer ? (
+                      <Group gap={4}>
+                        <Building2 size={12} />
+                        <Text size="xs" c="dimmed">
+                          {booking.customer}
+                        </Text>
+                      </Group>
+                    ) : null}
                     {booking.contractReference || booking.origin || booking.destination ? (
                       <Group gap="xs">
                         {booking.contractReference ? (
diff --git a/apps/edr-freight-web/backoffice/src/components/wagons/WagonPicker.tsx b/apps/edr-freight-web/backoffice/src/components/wagons/WagonPicker.tsx
new file mode 100644
index 000000000..e0bfdc0a3
--- /dev/null
+++ b/apps/edr-freight-web/backoffice/src/components/wagons/WagonPicker.tsx
@@ -0,0 +1,209 @@
+import {
+  Badge,
+  Box,
+  Button,
+  Checkbox,
+  Group,
+  ScrollArea,
+  Stack,
+  Text,
+  TextInput,
+  ThemeIcon,
+  UnstyledButton,
+} from "@mantine/core";
+import { Check, Search, Train, X } from "lucide-react";
+import { useMemo, useState } from "react";
+
+import type { Wagon } from "@/services/wagon.service";
+
+export interface WagonPickerProps {
+  /** The wagons on offer — already filtered to what the yard can hand over. */
+  wagons: Wagon[];
+  selected: Set<string>;
+  onChange: (next: Set<string>) => void;
+  /** Hard ceiling on the selection; further picks are refused once reached. */
+  max?: number;
+  emptyMessage?: string;
+  maxHeight?: number;
+}
+
+/**
+ * Searchable multi-select over a list of wagons, used wherever staff name the
+ * physical wagons rather than a count. Search matches the wagon number as typed
+ * (case-insensitively, ignoring the dashes and spaces operators leave out) so
+ * "1042" finds "GON-1042".
+ */
+export function WagonPicker({
+  wagons,
+  selected,
+  onChange,
+  max,
+  emptyMessage = "No wagons available here right now.",
+  maxHeight = 260,
+}: WagonPickerProps) {
+  const [query, setQuery] = useState("");
+
+  const normalise = (s: string) => s.toLowerCase().replace(/[\s-]/g, "");
+
+  const shown = useMemo(() => {
+    const q = normalise(query.trim());
+    if (!q) return wagons;
+    return wagons.filter((w) => normalise(w.wagonNumber).includes(q));
+  }, [wagons, query]);
+
+  const ceiling = max ?? Number.MAX_SAFE_INTEGER;
+  const full = selected.size >= ceiling;
+
+  const toggle = (id: string) => {
+    const next = new Set(selected);
+    if (next.has(id)) next.delete(id);
+    else if (next.size >= ceiling) return; // at the cap — ignore the click
+    else next.add(id);
+    onChange(next);
+  };
+
+  /** Select as many of the currently-visible wagons as the cap allows. */
+  const selectShown = () => {
+    const next = new Set(selected);
+    for (const w of shown) {
+      if (next.size >= ceiling) break;
+      next.add(w.id);
+    }
+    onChange(next);
+  };
+
+  return (
+    <Stack gap="xs">
+      <Group gap="xs" wrap="nowrap">
+        <TextInput
+          style={{ flex: 1 }}
+          placeholder="Search wagon number…"
+          leftSection={<Search size={15} />}
+          value={query}
+          onChange={(e) => setQuery(e.currentTarget.value)}
+          rightSection={
+            query ? (
+              <UnstyledButton onClick={() => setQuery("")} aria-label="Clear search">
+                <X size={14} />
+              </UnstyledButton>
+            ) : null
+          }
+          radius="md"
+          size="sm"
+        />
+        <Button
+          size="compact-sm"
+          variant="light"
+          radius="md"
+          onClick={selectShown}
+          disabled={shown.length === 0 || full}
+        >
+          Select {query ? "matches" : "all"}
+        </Button>
+        {selected.size > 0 ? (
+          <Button
+            size="compact-sm"
+            variant="subtle"
+            color="gray"
+            radius="md"
+            onClick={() => onChange(new Set())}
+          >
+            Clear
+          </Button>
+        ) : null}
+      </Group>
+
+      <Group gap="xs" justify="space-between">
+        <Text size="xs" c="dimmed">
+          {shown.length} of {wagons.length} shown
+        </Text>
+        <Badge
+          variant="light"
+          color={full ? "orange" : selected.size > 0 ? "teal" : "gray"}
+          radius="sm"
+        >
+          {selected.size} selected{max != null ? ` / ${max}` : ""}
+        </Badge>
+      </Group>
+
+      {wagons.length === 0 ? (
+        <Text size="sm" c="dimmed" py="sm">
+          {emptyMessage}
+        </Text>
+      ) : shown.length === 0 ? (
+        <Text size="sm" c="dimmed" py="sm">
+          No wagon matches “{query}”.
+        </Text>
+      ) : (
+        <ScrollArea.Autosize mah={maxHeight} type="auto">
+          <Box
+            style={{
+              display: "grid",
+              gridTemplateColumns: "repeat(auto-fill, minmax(150px, 1fr))",
+              gap: 8,
+              paddingRight: 4,
+            }}
+          >
+            {shown.map((w) => {
+              const on = selected.has(w.id);
+              // At the cap, unpicked wagons stop responding — grey them out so
+              // the dead click is explained before it happens.
+              const blocked = !on && full;
+              return (
+                <UnstyledButton
+                  key={w.id}
+                  onClick={() => toggle(w.id)}
+                  disabled={blocked}
+                  style={{
+                    display: "flex",
+                    alignItems: "center",
+                    gap: 8,
+                    padding: "8px 10px",
+                    borderRadius: 8,
+                    border: `1px solid var(--mantine-color-${
+                      on ? "edr-green-5" : "gray-3"
+                    })`,
+                    background: on
+                      ? "var(--mantine-color-edr-green-0)"
+                      : "var(--mantine-color-body)",
+                    opacity: blocked ? 0.45 : 1,
+                    cursor: blocked ? "not-allowed" : "pointer",
+                    transition: "border-color 120ms, background 120ms",
+                  }}
+                >
+                  <Checkbox
+                    checked={on}
+                    onChange={() => toggle(w.id)}
+                    disabled={blocked}
+                    size="xs"
+                    color="edr-green"
+                    tabIndex={-1}
+                    styles={{ input: { cursor: blocked ? "not-allowed" : "pointer" } }}
+                  />
+                  <ThemeIcon
+                    variant="light"
+                    color={on ? "edr-green" : "gray"}
+                    size="sm"
+                    radius="sm"
+                  >
+                    {on ? <Check size={12} /> : <Train size={12} />}
+                  </ThemeIcon>
+                  <Text
+                    size="sm"
+                    fw={on ? 700 : 500}
+                    style={{ fontVariantNumeric: "tabular-nums" }}
+                    truncate
+                  >
+                    {w.wagonNumber}
+                  </Text>
+                </UnstyledButton>
+              );
+            })}
+          </Box>
+        </ScrollArea.Autosize>
+      )}
+    </Stack>
+  );
+}
+
+export default WagonPicker;
diff --git a/apps/edr-freight-web/backoffice/src/components/wagons/WagonYardWorkspaceModal.tsx b/apps/edr-freight-web/backoffice/src/components/wagons/WagonYardWorkspaceModal.tsx
index cb9fdf86b..336b9e4ee 100644
--- a/apps/edr-freight-web/backoffice/src/components/wagons/WagonYardWorkspaceModal.tsx
+++ b/apps/edr-freight-web/backoffice/src/components/wagons/WagonYardWorkspaceModal.tsx
@@ -26,6 +26,8 @@ import { api } from "@/services/api";
 import { useToast } from "@/hooks/use-toast";
 import type { Wagon } from "@/services/wagon.service";
 
+import WagonPicker from "./WagonPicker";
+
 const stripHtml = (html: string) => html.replace(/<[^>]*>/g, "").trim();
 
 export interface WagonYardWorkspaceModalProps {
@@ -140,6 +142,8 @@ const WagonYardWorkspaceModal = ({ opened, onClose }: WagonYardWorkspaceModalPro
   const [transferYardId, setTransferYardId] = useState<string | null>(null);
   const [transferQty, setTransferQty] = useState(0);
   const [transferReason, setTransferReason] = useState("");
+  /** Specific wagons the requester named — optional; empty means "any N". */
+  const [pickedWagons, setPickedWagons] = useState<Set<string>>(new Set());
 
   const createRequest = useMutation(
     api.wagonTransferRequests.create.mutationOptions(),
@@ -240,8 +244,25 @@ const WagonYardWorkspaceModal = ({ opened, onClose }: WagonYardWorkspaceModalPro
     setTransferYardId(null);
     setTransferQty(0);
     setTransferReason("");
+    setPickedWagons(new Set());
   }, [yardId, typeId]);
 
+  // Naming wagons IS the ask: the count follows the picks so the two can never
+  // disagree. Lowering the count by hand (below) trims the selection instead.
+  const handlePick = (next: Set<string>) => {
+    setPickedWagons(next);
+    if (next.size > 0) setTransferQty(next.size);
+  };
+
+  const handleQtyChange = (n: number) => {
+    setTransferQty(n);
+    // Asking for fewer than were picked would send a selection the API rejects
+    // (picks may not exceed quantity) — drop the extras, keeping pick order.
+    if (pickedWagons.size > n) {
+      setPickedWagons(new Set([...pickedWagons].slice(0, n)));
+    }
+  };
+
   // Reset the whole workspace when closed.
   useEffect(() => {
     if (!opened) {
@@ -274,16 +295,23 @@ const WagonYardWorkspaceModal = ({ opened, onClose }: WagonYardWorkspaceModalPro
         wagonTypeId: typeId,
         quantity: transferQty,
         reason: transferReason,
+        ...(pickedWagons.size > 0
+          ? { preferredWagonIds: [...pickedWagons] }
+          : {}),
       });
       toast({
         title: `Requested ${transferQty} ${typeInfo.code(typeId)} wagon(s) · ${yardName(
           yardId,
         )} → ${yardName(transferYardId)}`,
-        description: "OCC will pick the wagons and complete the move.",
+        description:
+          pickedWagons.size > 0
+            ? `OCC will send the ${pickedWagons.size} wagon(s) you named where it can.`
+            : "OCC will pick the wagons and complete the move.",
       });
       setTransferQty(0);
       setTransferYardId(null);
       setTransferReason("");
+      setPickedWagons(new Set());
     } catch (err) {
       showError(err, "Request failed");
     }
@@ -438,10 +466,36 @@ const WagonYardWorkspaceModal = ({ opened, onClose }: WagonYardWorkspaceModalPro
                           ask for more than the yard can hand over. */}
                       <QuantityField
                         value={transferQty}
-                        onChange={setTransferQty}
+                        onChange={handleQtyChange}
                         max={availableCount}
                       />
                     </div>
+
+                    {/* Optional: name the exact wagons. Leaving this empty files
+                        a plain count request and OCC picks whatever is free. */}
+                    <div>
+                      <Group justify="space-between" mb={4} wrap="wrap" gap={4}>
+                        <Text size="sm" fw={500}>
+                          Which wagons{" "}
+                          <Text span size="xs" c="dimmed" fw={400}>
+                            (optional)
+                          </Text>
+                        </Text>
+                        <Text size="xs" c="dimmed">
+                          {pickedWagons.size > 0
+                            ? `${pickedWagons.size} named — OCC will prioritise these`
+                            : "Leave empty and OCC picks any available"}
+                        </Text>
+                      </Group>
+                      <WagonPicker
+                        wagons={availableWagons}
+                        selected={pickedWagons}
+                        onChange={handlePick}
+                        max={availableCount}
+                        emptyMessage="No available wagons of this type in this yard right now."
+                      />
+                    </div>
+
                     <Select
                       label="Destination yard"
                       placeholder="Select destination"
@@ -464,23 +518,42 @@ const WagonYardWorkspaceModal = ({ opened, onClose }: WagonYardWorkspaceModalPro
                     </div>
                     {transferYardId && transferQty > 0 ? (
                       <Card bg="var(--mantine-color-gray-0)" radius="md" padding="sm" withBorder>
-                        <Group gap={8} wrap="nowrap">
-                          <Text size="sm" fw={600}>
-                            {yardName(yardId!)} {total}
-                            <Text span c="red.6" fw={700}>
-                              {" "}
-                              −{transferQty}
+                        <Stack gap={6}>
+                          <Group gap={8} wrap="nowrap">
+                            <Text size="sm" fw={600}>
+                              {yardName(yardId!)} {total}
+                              <Text span c="red.6" fw={700}>
+                                {" "}
+                                −{transferQty}
+                              </Text>
                             </Text>
-                          </Text>
-                          <ArrowRight size={16} />
-                          <Text size="sm" fw={600}>
-                            {yardName(transferYardId)}
-                            <Text span c="teal.7" fw={700}>
-                              {" "}
-                              +{transferQty}
+                            <ArrowRight size={16} />
+                            <Text size="sm" fw={600}>
+                              {yardName(transferYardId)}
+                              <Text span c="teal.7" fw={700}>
+                                {" "}
+                                +{transferQty}
+                              </Text>
                             </Text>
-                          </Text>
-                        </Group>
+                          </Group>
+                          {pickedWagons.size > 0 ? (
+                            <Group gap={4} wrap="wrap">
+                              {availableWagons
+                                .filter((w) => pickedWagons.has(w.id))
+                                .map((w) => (
+                                  <Badge
+                                    key={w.id}
+                                    size="sm"
+                                    variant="light"
+                                    color="edr-green"
+                                    radius="sm"
+                                  >
+                                    {w.wagonNumber}
+                                  </Badge>
+                                ))}
+                            </Group>
+                          ) : null}
+                        </Stack>
                       </Card>
                     ) : null}
                     <Button
diff --git a/apps/edr-freight-web/backoffice/src/constants/URLS.ts b/apps/edr-freight-web/backoffice/src/constants/URLS.ts
index 3b482571c..d3566645e 100644
--- a/apps/edr-freight-web/backoffice/src/constants/URLS.ts
+++ b/apps/edr-freight-web/backoffice/src/constants/URLS.ts
@@ -57,6 +57,10 @@ export const URL_CONSTANTS = {
     BASE: "/exchange-settings",
   },
 
+  AUDIT_LOGS: {
+    BASE: "/audit",
+  },
+
   DROPDOWN_SETTINGS: {
     BASE: "/dropdown-settings",
     BY_ID: (id: string) => `/api/dropdown-settings/${id}`,
@@ -321,10 +325,6 @@ export const URL_CONSTANTS = {
     SUMMARY: "/payments/summary",
   },
 
-  AUDIT: {
-    LOGS: "/audit/logs",
-  },
-
   LOCOMOTIVES: {
     BASE: "/locomotives",
     BY_ID: (id: string) => `/locomotives/${id}`,
@@ -359,6 +359,9 @@ export const URL_CONSTANTS = {
       `/train-scheduling/schedules/${id}/window-rule`,
     SCHEDULE_DATE: (id: string) =>
       `/train-scheduling/schedules/${id}/schedule-date`,
+    MERGE_PREVIEW: (id: string, targetTrainId: string) =>
+      `/train-scheduling/schedules/${id}/merge-preview/${targetTrainId}`,
+    MERGE_TRAIN: (id: string) => `/train-scheduling/schedules/${id}/merge`,
     CONTRACT_BOOKING_WINDOWS: (contractId: string) =>
       `/train-scheduling/contracts/${contractId}/booking-windows`,
     MARK_BOOKING_PAID: (bookingId: string) =>
diff --git a/apps/edr-freight-web/backoffice/src/hooks/useStampSettings.ts b/apps/edr-freight-web/backoffice/src/hooks/useStampSettings.ts
new file mode 100644
index 000000000..9d1594602
--- /dev/null
+++ b/apps/edr-freight-web/backoffice/src/hooks/useStampSettings.ts
@@ -0,0 +1,45 @@
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { useTranslation } from "react-i18next";
+import { toast } from "sonner";
+
+import { stampSettingsService } from "@/services/stampSettings.service";
+import { useErrorHandler } from "@/shared/hooks/useErrorHandler";
+
+const QUERY_KEY = ["stampSettings"];
+
+export const useStampSettingsQuery = () =>
+  useQuery({
+    queryKey: QUERY_KEY,
+    queryFn: () => stampSettingsService.get(),
+  });
+
+export const useSetStamp = () => {
+  const queryClient = useQueryClient();
+  const { t } = useTranslation();
+  const { handleError } = useErrorHandler(t);
+
+  return useMutation({
+    mutationFn: (stampImageBase64: string) =>
+      stampSettingsService.set(stampImageBase64),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: QUERY_KEY });
+      toast.success(t("stampSettings.updated", "Company stamp updated"));
+    },
+    onError: handleError,
+  });
+};
+
+export const useClearStamp = () => {
+  const queryClient = useQueryClient();
+  const { t } = useTranslation();
+  const { handleError } = useErrorHandler(t);
+
+  return useMutation({
+    mutationFn: () => stampSettingsService.clear(),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: QUERY_KEY });
+      toast.success(t("stampSettings.cleared", "Company stamp removed"));
+    },
+    onError: handleError,
+  });
+};
diff --git a/apps/edr-freight-web/backoffice/src/lib/permissions.ts b/apps/edr-freight-web/backoffice/src/lib/permissions.ts
index b74c7bef9..c69aa5d1b 100644
--- a/apps/edr-freight-web/backoffice/src/lib/permissions.ts
+++ b/apps/edr-freight-web/backoffice/src/lib/permissions.ts
@@ -105,6 +105,7 @@ export const FREIGHT_PERMS = {
     dispatch: "edr_freight_app:train_scheduling:dispatch",
     markPaid: "edr_freight_app:train_scheduling:mark_paid",
     expireBooking: "edr_freight_app:train_scheduling:expire_booking",
+    editTrainNumber: "edr_freight_app:train_scheduling:edit_train_number",
   },
   fleet: {
     view: "edr_freight_app:fleet:view",
@@ -311,6 +312,13 @@ export const FREIGHT_PERMS = {
     cancel: "edr_freight_app:warehouse_fee_invoices:cancel",
     pay: "edr_freight_app:warehouse_fee_invoices:pay",
   },
+  /**
+   * Audit trail. View-only — the API exposes no write routes for audit rows,
+   * so there is no manage/delete counterpart to grant.
+   */
+  auditLog: {
+    view: "edr_freight_app:audit_log:view",
+  },
   settings: {
     fileUpload: {
       view: "edr_freight_app:settings:file_upload:view",
@@ -320,6 +328,19 @@ export const FREIGHT_PERMS = {
       view: "edr_freight_app:settings:dropdown:view",
       manage: "edr_freight_app:settings:dropdown:manage",
     },
+    // The ONE company stamp/seal, applied to every generated document
+    // (invoices, receipts, warehouse papers, the EDR side of contracts).
+    stamp: {
+      view: "edr_freight_app:settings:stamp:view",
+      manage: "edr_freight_app:settings:stamp:manage",
+    },
+    // The per-officer approval teeter (ማህተም) + signature — genuinely per-person,
+    // and NOT the company seal above. Retired: `invoiceStamp`, which used to
+    // gate the company stamp before the two were untangled.
+    teeter: {
+      view: "edr_freight_app:settings:teeter:view",
+      manage: "edr_freight_app:settings:teeter:manage",
+    },
     exchangeRate: {
       view: "edr_freight_app:settings:exchange_rate:view",
       manage: "edr_freight_app:settings:exchange_rate:manage",
@@ -338,9 +359,6 @@ export const FREIGHT_PERMS = {
       manage: "edr_freight_app:settings:support_content:manage",
     },
   },
-  audit: {
-    view: "edr_freight_app:audit:view",
-  },
   staff: {
     roles: {
       view: "edr_freight_app:staff:roles:view",
diff --git a/apps/edr-freight-web/backoffice/src/pages/AuditLogsPage.tsx b/apps/edr-freight-web/backoffice/src/pages/AuditLogsPage.tsx
new file mode 100644
index 000000000..eac18ca2a
--- /dev/null
+++ b/apps/edr-freight-web/backoffice/src/pages/AuditLogsPage.tsx
@@ -0,0 +1,340 @@
+import { useMemo, useState } from "react";
+import { useQuery } from "@tanstack/react-query";
+import {
+  Badge,
+  Card,
+  Code,
+  Group,
+  Loader,
+  Modal,
+  Select,
+  Stack,
+  Table,
+  Text,
+  Tooltip,
+} from "@mantine/core";
+import {
+  usePagination,
+  type OnChangeFn,
+  type PaginationState,
+} from "@edr/ui-common";
+
+import { PageContainer, PageHeader } from "@/components/page";
+import ListControls from "@/components/common/ListControls";
+import RuleEngineListFooter from "@/components/ruleEngine/RuleEngineListFooter";
+import {
+  AUDIT_METHODS,
+  auditLogsService,
+  type AuditLog,
+  type AuditMethod,
+} from "@/services/auditLogs.service";
+
+/** Method → badge colour. Destructive actions read as the loudest. */
+const METHOD_COLORS: Record<AuditMethod, string> = {
+  POST: "green",
+  PUT: "blue",
+  PATCH: "yellow",
+  DELETE: "red",
+};
+
+const OUTCOME_OPTIONS = [
+  { value: "true", label: "Succeeded" },
+  { value: "false", label: "Failed" },
+];
+
+/** `YYYY-MM-DD` → inclusive ISO bounds, so a single day covers its full range. */
+const startOfDay = (date: string) => `${date}T00:00:00.000Z`;
+const endOfDay = (date: string) => `${date}T23:59:59.999Z`;
+
+const formatTimestamp = (value: string) => new Date(value).toLocaleString();
+
+const AuditLogsPage = () => {
+  // Server-side filters. Unlike most freight lists (which filter an
+  // already-fetched array via useListControls), audit_logs is append-only and
+  // grows without bound, so filtering and paging both happen in the API.
+  const [search, setSearch] = useState("");
+  const [dateFrom, setDateFrom] = useState<string | null>(null);
+  const [dateTo, setDateTo] = useState<string | null>(null);
+  const [type, setType] = useState<string | null>(null);
+  const [method, setMethod] = useState<string | null>(null);
+  const [outcome, setOutcome] = useState<string | null>(null);
+  const [selected, setSelected] = useState<AuditLog | null>(null);
+
+  const { pagination, setPagination } = usePagination({ pageIndex: 0, pageSize: 25 });
+
+  const query = useMemo(
+    () => ({
+      page: pagination.pageIndex + 1,
+      pageSize: pagination.pageSize,
+      type: type ?? undefined,
+      method: (method as AuditMethod | null) ?? undefined,
+      isSuccess: outcome === null ? undefined : outcome === "true",
+      // The API filters by record id; the search box is the natural place to
+      // paste one when tracing what happened to a specific contract/booking.
+      resourceId: search.trim() || undefined,
+      from: dateFrom ? startOfDay(dateFrom) : undefined,
+      to: dateTo ? endOfDay(dateTo) : undefined,
+    }),
+    [pagination, type, method, outcome, search, dateFrom, dateTo],
+  );
+
+  const logsQuery = useQuery({
+    queryKey: ["audit-logs", query],
+    queryFn: () => auditLogsService.list(query),
+  });
+
+  const typesQuery = useQuery({
+    queryKey: ["audit-logs", "types"],
+    queryFn: () => auditLogsService.types(),
+  });
+
+  const rows = logsQuery.data?.items ?? [];
+  const totalCount = logsQuery.data?.meta.total ?? 0;
+  const pageCount = logsQuery.data?.meta.totalPages ?? 0;
+
+  const hasFilters = Boolean(
+    search || dateFrom || dateTo || type || method || outcome,
+  );
+
+  const resetFilters = () => {
+    setSearch("");
+    setDateFrom(null);
+    setDateTo(null);
+    setType(null);
+    setMethod(null);
+    setOutcome(null);
+    setPagination({ pageIndex: 0, pageSize: pagination.pageSize });
+  };
+
+  /** Any filter change must return to page 1, or the view can land out of range. */
+  const onFilterChange = <T,>(setter: (value: T) => void) => (value: T) => {
+    setter(value);
+    setPagination({ pageIndex: 0, pageSize: pagination.pageSize });
+  };
+
+  // `OnChangeFn` may hand back either a new value or an updater, so both forms
+  // are resolved before storing.
+  const handlePaginationChange: OnChangeFn<PaginationState> = (updater) => {
+    setPagination((prev) =>
+      typeof updater === "function" ? updater(prev) : updater,
+    );
+  };
+
+  // `PageContainer` gives the page the same horizontal inset and vertical
+  // rhythm as every other dashboard screen; `fluid` lifts the max-width cap
+  // because the log table is wide.
+  return (
+    <PageContainer fluid>
+      <PageHeader
+        title="Audit logs"
+        subtitle="Every state-changing action taken by backoffice staff. Read-only — entries cannot be edited or removed."
+      />
+
+      <Card withBorder padding="md">
+        <Stack gap="md">
+          <ListControls
+            search={search}
+            onSearchChange={onFilterChange(setSearch)}
+            searchPlaceholder="Filter by record id…"
+            dateFrom={dateFrom}
+            onDateFromChange={onFilterChange(setDateFrom)}
+            dateTo={dateTo}
+            onDateToChange={onFilterChange(setDateTo)}
+            dateLabel="Action date"
+            hasFilters={hasFilters}
+            onReset={resetFilters}
+          >
+            <Select
+              label="Entity"
+              placeholder="All entities"
+              data={typesQuery.data ?? []}
+              value={type}
+              onChange={onFilterChange(setType)}
+              clearable
+              searchable
+              w={200}
+            />
+            <Select
+              label="Method"
+              placeholder="All methods"
+              data={[...AUDIT_METHODS]}
+              value={method}
+              onChange={onFilterChange(setMethod)}
+              clearable
+              w={150}
+            />
+            <Select
+              label="Outcome"
+              placeholder="Any outcome"
+              data={OUTCOME_OPTIONS}
+              value={outcome}
+              onChange={onFilterChange(setOutcome)}
+              clearable
+              w={160}
+            />
+          </ListControls>
+
+          {logsQuery.isLoading ? (
+            <Group justify="center" py="xl">
+              <Loader />
+            </Group>
+          ) : logsQuery.isError ? (
+            <Text c="red" ta="center" py="xl">
+              Could not load audit logs.
+            </Text>
+          ) : rows.length === 0 ? (
+            <Text c="dimmed" ta="center" py="xl">
+              No audit entries match these filters.
+            </Text>
+          ) : (
+            <Table.ScrollContainer minWidth={900}>
+              <Table highlightOnHover striped>
+                <Table.Thead>
+                  <Table.Tr>
+                    <Table.Th>Action</Table.Th>
+                    <Table.Th>Entity</Table.Th>
+                    <Table.Th>Method</Table.Th>
+                    <Table.Th>User</Table.Th>
+                    <Table.Th>Outcome</Table.Th>
+                    <Table.Th>When</Table.Th>
+                  </Table.Tr>
+                </Table.Thead>
+                <Table.Tbody>
+                  {rows.map((log) => (
+                    <Table.Tr
+                      key={log.id}
+                      onClick={() => setSelected(log)}
+                      style={{ cursor: "pointer" }}
+                    >
+                      <Table.Td maw={340}>
+                        <Text size="sm" lineClamp={2}>
+                          {log.title}
+                        </Text>
+                      </Table.Td>
+                      <Table.Td>
+                        <Badge variant="light">{log.type}</Badge>
+                      </Table.Td>
+                      <Table.Td>
+                        <Badge color={METHOD_COLORS[log.method]} variant="light">
+                          {log.method}
+                        </Badge>
+                      </Table.Td>
+                      <Table.Td>
+                        <Text size="sm">{log.userName ?? "—"}</Text>
+                        {log.userRole ? (
+                          <Text size="xs" c="dimmed">
+                            {log.userRole}
+                          </Text>
+                        ) : null}
+                      </Table.Td>
+                      <Table.Td>
+                        {log.isSuccess ? (
+                          <Badge color="green" variant="light">
+                            Success
+                          </Badge>
+                        ) : (
+                          // The status code separates "denied" (403) from
+                          // "broke" (500) — both are simply a failure here.
+                          <Tooltip
+                            label={log.errorMessage ?? "Failed"}
+                            multiline
+                            w={280}
+                            disabled={!log.errorMessage}
+                          >
+                            <Badge color="red" variant="light">
+                              Failed{log.statusCode ? ` · ${log.statusCode}` : ""}
+                            </Badge>
+                          </Tooltip>
+                        )}
+                      </Table.Td>
+                      <Table.Td>
+                        <Text size="sm">{formatTimestamp(log.createdAt)}</Text>
+                      </Table.Td>
+                    </Table.Tr>
+                  ))}
+                </Table.Tbody>
+              </Table>
+            </Table.ScrollContainer>
+          )}
+
+          <RuleEngineListFooter
+            pagination={pagination}
+            pageCount={pageCount}
+            totalCount={totalCount}
+            itemLabel="entries"
+            onPaginationChange={handlePaginationChange}
+          />
+        </Stack>
+        </Card>
+
+      <Modal
+        opened={selected !== null}
+        onClose={() => setSelected(null)}
+        title="Audit entry"
+        size="lg"
+      >
+        {selected ? (
+          <Stack gap="sm">
+            <DetailRow label="Action" value={selected.title} />
+            <DetailRow label="Entity" value={selected.type} />
+            <DetailRow label="Record id" value={selected.resourceId} />
+            <DetailRow label="Method" value={selected.method} />
+            <DetailRow label="URL" value={selected.url} />
+            <DetailRow label="Route" value={selected.routePath} />
+            <DetailRow
+              label="Outcome"
+              value={
+                selected.isSuccess
+                  ? `Success${selected.statusCode ? ` (${selected.statusCode})` : ""}`
+                  : `Failed${selected.statusCode ? ` (${selected.statusCode})` : ""}`
+              }
+            />
+            {selected.errorMessage ? (
+              <DetailRow label="Error" value={selected.errorMessage} />
+            ) : null}
+            <DetailRow label="User" value={selected.userName} />
+            <DetailRow label="Role" value={selected.userRole} />
+            <DetailRow label="User id" value={selected.userId} />
+            <DetailRow label="IP address" value={selected.ipAddress} />
+            <DetailRow label="Request id" value={selected.requestId} />
+            <DetailRow
+              label="Duration"
+              value={selected.durationMs === null ? null : `${selected.durationMs} ms`}
+            />
+            <DetailRow label="When" value={formatTimestamp(selected.createdAt)} />
+
+            <div>
+              <Text size="sm" fw={600} mb={4}>
+                Request payload
+              </Text>
+              {selected.request ? (
+                // Secrets are already redacted and uploads reduced to
+                // descriptors by the API before storage.
+                <Code block style={{ maxHeight: 320, overflow: "auto" }}>
+                  {JSON.stringify(selected.request, null, 2)}
+                </Code>
+              ) : (
+                <Text size="sm" c="dimmed">
+                  No payload recorded.
+                </Text>
+              )}
+            </div>
+          </Stack>
+        ) : null}
+      </Modal>
+    </PageContainer>
+  );
+};
+
+const DetailRow = ({ label, value }: { label: string; value: string | null }) => (
+  <Group gap="xs" wrap="nowrap" align="flex-start">
+    <Text size="sm" fw={600} w={120} style={{ flexShrink: 0 }}>
+      {label}
+    </Text>
+    <Text size="sm" style={{ wordBreak: "break-all" }}>
+      {value ?? "—"}
+    </Text>
+  </Group>
+);
+
+export default AuditLogsPage;
diff --git a/apps/edr-freight-web/backoffice/src/pages/audit/AuditLogsPage.tsx b/apps/edr-freight-web/backoffice/src/pages/audit/AuditLogsPage.tsx
deleted file mode 100644
index ef3412a3a..000000000
--- a/apps/edr-freight-web/backoffice/src/pages/audit/AuditLogsPage.tsx
+++ /dev/null
@@ -1,190 +0,0 @@
-import { Badge, Box, Card, Stack, Text } from "@mantine/core";
-import { useQuery } from "@tanstack/react-query";
-
-import { PageContainer, PageHeader } from "@/components/page";
-import { api } from "@/services/api";
-import type {
-  AuditLogRow,
-  AuditQueryMethod,
-  AuditUser,
-  LocalizedText,
-} from "@/services/audit.service";
-import {
-  DataTable,
-  DataTableFooter,
-  usePagination,
-  type ColumnDef,
-} from "@edr/ui-common";
-
-const ACTION_LABELS: Record<AuditQueryMethod, string> = {
-  INSERT: "Created",
-  UPDATE: "Updated",
-  DELETE: "Deleted",
-  INSERT_CHILD: "Linked child",
-  DELETE_CHILD: "Unlinked child",
-};
-
-const ACTION_COLORS: Record<AuditQueryMethod, string> = {
-  INSERT: "edr-green",
-  UPDATE: "yellow",
-  DELETE: "red",
-  INSERT_CHILD: "indigo",
-  DELETE_CHILD: "gray",
-};
-
-function formatDateTime(iso: string): string {
-  const d = new Date(iso);
-  return Number.isNaN(d.getTime())
-    ? "—"
-    : d.toLocaleString(undefined, {
-      year: "numeric",
-      month: "short",
-      day: "numeric",
-      hour: "2-digit",
-      minute: "2-digit",
-    });
-}
-
-// See LocalizedText: `name`/`title` lifted from a raw audited entity can be
-// a plain string or IAM's { am, en } — never render either directly.
-// "undefined  undefined" is the producer's own broken template when no user
-// was attached at all (unauthenticated/customer flows, e.g. Fayda
-// verification) — filtered out here rather than shown as raw garbage.
-function localize(value: LocalizedText | null | undefined): string | undefined {
-  if (!value) return undefined;
-  if (typeof value === "object") return value.en ?? value.am ?? undefined;
-  if (/^undefined(\s+undefined)?$/.test(value.trim())) return undefined;
-  return value;
-}
-
-function formatUser(user: AuditUser | null | undefined): string {
-  return localize(user?.name) ?? user?.id ?? "—";
-}
-
-function summarize(row: AuditLogRow): string {
-  if (row.changes?.length) {
-    return row.changes
-      .slice(0, 2)
-      .map((c) => c.field)
-      .join(", ") + (row.changes.length > 2 ? `, +${row.changes.length - 2} more` : "");
-  }
-  if (row.payload) {
-    return (
-      localize(row.payload.name) ?? localize(row.payload.title) ?? row.payload.id ?? "—"
-    );
-  }
-  return "—";
-}
-
-const tableHeader =
-  "text-xs font-semibold uppercase tracking-wide text-muted-foreground";
-
-export default function AuditLogsPage() {
-  const { pagination, setPagination } = usePagination({ pageSize: 20 });
-
-  const filter = {
-    skip: pagination.pageIndex * pagination.pageSize,
-    take: pagination.pageSize,
-  };
-
-  const { data, isLoading, isError } = useQuery(
-    api.audit.list.queryOptions({ input: { filter } }),
-  );
-
-  const rows = data?.items ?? [];
-  const total = data?.count ?? 0;
-  const pageCount = Math.max(1, Math.ceil(total / pagination.pageSize));
-
-  const columns: ColumnDef<AuditLogRow>[] = [
-    {
-      id: "time",
-      header: () => <span className={tableHeader}>Time</span>,
-      cell: ({ row }) => (
-        <span className="text-sm text-muted-foreground">
-          {formatDateTime(row.original.createdAt)}
-        </span>
-      ),
-    },
-    {
-      id: "action",
-      header: () => <span className={tableHeader}>Action</span>,
-      cell: ({ row }) => (
-        <Badge
-          color={ACTION_COLORS[row.original.queryMethod] ?? "gray"}
-          variant="light"
-          radius="sm"
-        >
-          {ACTION_LABELS[row.original.queryMethod] ?? row.original.queryMethod}
-        </Badge>
-      ),
-    },
-    {
-      id: "entity",
-      header: () => <span className={tableHeader}>Entity</span>,
-      cell: ({ row }) => (
-        <span className="font-mono text-sm text-foreground">
-          {row.original.entityName}
-        </span>
-      ),
-    },
-    {
-      id: "user",
-      header: () => <span className={tableHeader}>User</span>,
-      cell: ({ row }) => (
-        <span className="text-sm text-foreground">
-          {formatUser(row.original.auditLog?.user)}
-        </span>
-      ),
-    },
-    {
-      id: "summary",
-      header: () => <span className={tableHeader}>Summary</span>,
-      cell: ({ row }) => (
-        <span className="truncate text-sm text-muted-foreground">
-          {summarize(row.original)}
-        </span>
-      ),
-    },
-  ];
-
-  return (
-    <PageContainer>
-      <PageHeader
-        title="Audit Logs"
-        subtitle="Request and entity-level activity recorded across the freight API."
-      />
-
-      <Card p={0}>
-        <Stack gap={0}>
-          <Box px="md" pt="md" pb="sm" w="100%">
-            <Text size="sm" c="dimmed">
-              {total} record{total !== 1 ? "s" : ""}
-            </Text>
-          </Box>
-
-          <Box style={{ overflowX: "auto" }} w="100%">
-            <DataTable
-              columns={columns}
-              data={rows}
-              status={isLoading ? "loading" : isError ? "error" : "success"}
-              pagination={{
-                pageIndex: pagination.pageIndex,
-                pageSize: pagination.pageSize,
-                pageCount,
-                totalCount: total,
-              }}
-              tableOptions={{
-                state: { pagination },
-                onPaginationChange: setPagination,
-                manualPagination: true,
-                pageCount,
-              }}
-              containerClassName="border-0 shadow-none bg-transparent"
-              footer={DataTableFooter}
-            />
-          </Box>
-        </Stack>
-      </Card>
-    </PageContainer>
-  );
-}
diff --git a/apps/edr-freight-web/backoffice/src/pages/bookings/BookingContractPage.tsx b/apps/edr-freight-web/backoffice/src/pages/bookings/BookingContractPage.tsx
index f176fc05d..e4d570da6 100644
--- a/apps/edr-freight-web/backoffice/src/pages/bookings/BookingContractPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/bookings/BookingContractPage.tsx
@@ -12,7 +12,6 @@ import toast from "react-hot-toast";
 
 import Breadcrumbs from "@/components/ui/Breadcrumbs";
 import { ContractSignaturePad } from "@/components/bookings/ContractSignaturePad";
-import { StampUpload } from "@/components/contracts/StampUpload";
 import { bookingSurface } from "@/components/bookings/booking-ui.styles";
 import { QUERY_KEYS } from "@/constants/QUERY_KEYS";
 import { invalidateBookingDetail } from "@/utils/queryInvalidation";
@@ -41,9 +40,6 @@ export default function BookingContractPage() {
   const [signOpen, setSignOpen] = useState(false);
   const [signerName, setSignerName] = useState("");
   const [signatureData, setSignatureData] = useState<string | null>(null);
-  // Company stamp: prefilled from the profile, or uploaded here when none is
-  // saved yet.
-  const [stampData, setStampData] = useState<string | null>(null);
   // When the user has a saved signature we offer it for approval first; they
   // can switch to drawing a fresh one.
   const [drawNew, setDrawNew] = useState(false);
@@ -59,7 +55,6 @@ export default function BookingContractPage() {
 
   const savedSignature = data?.savedSignature ?? null;
   const savedSignatureImage = savedSignature?.signatureImageUrl ?? null;
-  const savedStampImage = savedSignature?.stampImageUrl ?? null;
   // Show the approval view only while a saved signature exists and the user
   // hasn't opted to draw a new one.
   const usingSaved = Boolean(savedSignatureImage) && !drawNew;
@@ -103,8 +98,6 @@ export default function BookingContractPage() {
     // approve it; otherwise start with an empty pad.
     setSignerName(savedSignature?.signerDisplayName ?? "");
     setSignatureData(null);
-    // Prefill with the reusable stamp saved on the profile; still replaceable.
-    setStampData(savedStampImage);
     setDrawNew(false);
     setSignOpen(true);
   };
@@ -113,12 +106,12 @@ export default function BookingContractPage() {
     if (!canSign || !signerName.trim()) return;
     // Approve the saved signature, or submit the freshly drawn one.
     const image = usingSaved ? savedSignatureImage : signatureData;
-    // The API rejects a STAFF signature without a stamp.
-    if (!image || !stampData) return;
+    if (!image) return;
+    // No stamp is sent: EDR's seal is the ONE global company stamp, applied
+    // server-side at render time (see StampSettingsService).
     signMutation.mutate({
       role: "STAFF",
       signatureImageBase64: image,
-      stampImageBase64: stampData,
       signerDisplayName: signerName.trim(),
       consentText: "I agree to the terms of this contract.",
     });
@@ -243,15 +236,6 @@ export default function BookingContractPage() {
               ) : (
                 <ContractSignaturePad onChange={setSignatureData} />
               )}
-              <StampUpload
-                value={stampData}
-                onChange={setStampData}
-                description={
-                  savedStampImage
-                    ? "Your saved company stamp — replace it for this contract if needed."
-                    : "Required. Attach your official company stamp or seal."
-                }
-              />
             </div>
             <DialogFooter>
               <Button variant="outline" onClick={() => setSignOpen(false)}>
@@ -261,7 +245,6 @@ export default function BookingContractPage() {
                 disabled={
                   signMutation.isPending ||
                   (!usingSaved && !signatureData) ||
-                  !stampData ||
                   !signerName.trim()
                 }
                 onClick={confirmSign}
diff --git a/apps/edr-freight-web/backoffice/src/pages/bookings/BookingRequestDetailPage.tsx b/apps/edr-freight-web/backoffice/src/pages/bookings/BookingRequestDetailPage.tsx
index 4367fc708..d64b07a45 100644
--- a/apps/edr-freight-web/backoffice/src/pages/bookings/BookingRequestDetailPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/bookings/BookingRequestDetailPage.tsx
@@ -247,7 +247,6 @@ export default function BookingRequestDetailPage() {
             <Box style={{ position: "sticky", top: 24 }}>
               <Stack gap="lg">
                 <BookingCompanyCard booking={booking} />
-                <BookingSchedulingWindowCard booking={booking} />
                 <BookingPricingSummary booking={booking} />
                 <Box id="warehouse-payments">
                   <WarehouseInfoCard
@@ -257,6 +256,11 @@ export default function BookingRequestDetailPage() {
                     tradeDirection={booking.tradeDirection}
                   />
                 </Box>
+                {/* Sits directly above the staff actions: reviewing an operation
+                    request means approving the booking onto a specific train, so
+                    that train and its clock must be readable before the approve
+                    button. */}
+                <BookingSchedulingWindowCard booking={booking} />
                 <BookingActionsToolbar
                   booking={booking}
                   mutations={mutations}
diff --git a/apps/edr-freight-web/backoffice/src/pages/contracts/ContractViewPage.tsx b/apps/edr-freight-web/backoffice/src/pages/contracts/ContractViewPage.tsx
index b49b0e25c..205413891 100644
--- a/apps/edr-freight-web/backoffice/src/pages/contracts/ContractViewPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/contracts/ContractViewPage.tsx
@@ -18,7 +18,6 @@ import toast from "react-hot-toast";
 
 import { ContractSignSuccessModal } from "@/components/contracts/ContractSignSuccessModal";
 import { ContractSignaturePad } from "@/components/bookings/ContractSignaturePad";
-import { StampUpload } from "@/components/contracts/StampUpload";
 import { contractsService } from "@/services/contracts.service";
 import { extractApiError } from "@/utils/result";
 import { QUERY_KEYS } from "@/constants/QUERY_KEYS";
@@ -40,7 +39,6 @@ export default function ContractViewPage() {
   const [successOpen, setSuccessOpen] = useState(false);
   const [signerName, setSignerName] = useState("");
   const [signatureData, setSignatureData] = useState<string | null>(null);
-  const [stampData, setStampData] = useState<string | null>(null);
   const [drawNew, setDrawNew] = useState(false);
 
   const { data, isLoading, isError, refetch } = useQuery({
@@ -56,10 +54,11 @@ export default function ContractViewPage() {
     mutationFn: () =>
       contractsService.signContract(id!, {
         role: "STAFF",
+        // No stamp is sent: EDR's seal is the ONE global company stamp, applied
+        // server-side from StampSettingsService when the signature is stored.
         signatureImageBase64: usingSaved
           ? (savedSignatureImage as string)
           : (signatureData ?? ""),
-        stampImageBase64: stampData ?? "",
         signerDisplayName: signerName.trim(),
         consentText: "I confirm this contract on behalf of EDR.",
       }),
@@ -98,14 +97,12 @@ export default function ContractViewPage() {
   const openSign = () => {
     setSignerName(data?.savedSignature?.signerDisplayName ?? "");
     setSignatureData(null);
-    // Prefill with the reusable stamp saved on the profile; still replaceable.
-    setStampData(data?.savedSignature?.stampImageUrl ?? null);
     setDrawNew(false);
     setSignOpen(true);
   };
 
   const confirmSign = () => {
-    if (!signerName.trim() || !stampData) return;
+    if (!signerName.trim()) return;
     const image = usingSaved ? savedSignatureImage : signatureData;
     if (!image) return;
     signMutation.mutate();
@@ -243,13 +240,6 @@ export default function ContractViewPage() {
             <ContractSignaturePad onChange={setSignatureData} />
           )}
 
-          <StampUpload
-            value={stampData}
-            onChange={setStampData}
-            label="EDR company stamp"
-            description="Attach the official EDR stamp or seal — it is applied to the contract next to the signature."
-          />
-
           <Group justify="flex-end" gap="sm">
             <Button variant="default" onClick={() => setSignOpen(false)}>
               Cancel
@@ -260,8 +250,7 @@ export default function ContractViewPage() {
               disabled={
                 signMutation.isPending ||
                 !signerName.trim() ||
-                (!usingSaved && !signatureData) ||
-                !stampData
+                (!usingSaved && !signatureData)
               }
               onClick={confirmSign}
             >
diff --git a/apps/edr-freight-web/backoffice/src/pages/customers/CustomerDetailPage.tsx b/apps/edr-freight-web/backoffice/src/pages/customers/CustomerDetailPage.tsx
index f31ce02e9..73f6a618b 100644
--- a/apps/edr-freight-web/backoffice/src/pages/customers/CustomerDetailPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/customers/CustomerDetailPage.tsx
@@ -8,7 +8,7 @@ import {
   Card,
   Center,
   Container,
-  Divider,
+  Grid,
   Group,
   Loader,
   SimpleGrid,
@@ -17,9 +17,11 @@ import {
   Text,
 } from "@mantine/core";
 import {
+  AlertTriangle,
   ArrowLeft,
   ArrowRight,
   Banknote,
+  Contact,
   Download,
   Eye,
   FileText,
@@ -31,6 +33,8 @@ import {
   FilePen,
   Paperclip,
   Receipt,
+  UserCheck,
+  UserRound,
 } from "lucide-react";
 import { useQuery } from "@tanstack/react-query";
 import { useMemo, useState } from "react";
@@ -45,6 +49,7 @@ import {
   CompanyTypeBadge,
   InvoiceStatusBadge,
   PaymentStatusBadge,
+  PersonCard,
   ProfileApprovalActions,
   ProfileChips,
   ProfileStatusBadge,
@@ -258,7 +263,9 @@ export default function CustomerDetailPage() {
                     variant="subtle"
                     color="gray"
                     aria-label={`View ${f.name}`}
-                    onClick={() => void fetchViewableFile(f.id, f.name).then(view)}
+                    onClick={() =>
+                      void fetchViewableFile(f.id, f.name).then(view)
+                    }
                   >
                     <Eye size={14} />
                   </ActionIcon>
@@ -267,7 +274,9 @@ export default function CustomerDetailPage() {
                     type="button"
                     size="xs"
                     lineClamp={1}
-                    onClick={() => void fetchViewableFile(f.id, f.name).then(view)}
+                    onClick={() =>
+                      void fetchViewableFile(f.id, f.name).then(view)
+                    }
                     style={{
                       maxWidth: 170,
                       textAlign: "left",
@@ -614,7 +623,10 @@ export default function CustomerDetailPage() {
     [],
   );
 
-  const licenseProfiles = (company?.companyProfiles ?? []).filter(
+  /** Never read `company.companyProfiles` directly — an endpoint that stops
+   *  loading the relation would otherwise crash the whole page. */
+  const profiles = company?.companyProfiles ?? [];
+  const licenseProfiles = profiles.filter(
     (p) => p.licenseFiles && p.licenseFiles.length > 0,
   );
 
@@ -628,26 +640,24 @@ export default function CustomerDetailPage() {
     [documents],
   );
   const poaLive = poaDocuments.filter((d) => d.code === POA_DELEGATION_CODE);
-  const poaFields = [
-    { label: "PoA name", value: company?.poaName },
-    { label: "PoA email", value: company?.poaEmail },
-    { label: "PoA phone", value: company?.poaPhone },
-    { label: "PoA location", value: company?.poaLocation },
-    { label: "PoA address", value: company?.poaAddress },
-  ];
-  const hasPoaDetails = poaFields.some((f) => f.value?.trim());
+  const hasPoaDetails = [
+    company?.poaName,
+    company?.poaEmail,
+    company?.poaPhone,
+    company?.poaLocation,
+    company?.poaAddress,
+  ].some((v) => v?.trim());
   // Shared with the portal (buildCompanyIdentityState) — same derivation, so
   // this page can never disagree with the rule the API actually enforces.
-  const ownerIdentity = company?.identity?.owner;
-  const poaIdentity = company?.identity?.poa;
+  const identityState = company?.identity;
+  const ownerIdentity = identityState?.owner;
+  const poaIdentity = identityState?.poa;
   const hasEtradeRecord = Boolean(company?.licenceNumber?.trim());
   // A freight forwarder acts on other companies' behalf, so its PoA — details
   // and DARS delegation paper both — is mandatory rather than optional.
-  const poaMandatory = (company?.companyProfiles ?? []).some(
-    (p) => p.type === "freight_forwarder",
-  );
+  const poaMandatory = profiles.some((p) => p.type === "freight_forwarder");
   const delegationMissing =
-    (hasPoaDetails || poaMandatory) && poaLive.length === 0;
+    company?.identity?.poaDeclared === "yes" && poaLive.length === 0;
 
   if (isLoading) {
     return (
@@ -683,8 +693,9 @@ export default function CustomerDetailPage() {
         ]}
         backTo="/dashboard/customers"
         title={company.name}
-        subtitle={`TIN ${company.tin}${company.country ? ` · ${company.country}` : ""
-          }`}
+        subtitle={`TIN ${company.tin}${
+          company.country ? ` · ${company.country}` : ""
+        }`}
         meta={
           <Group gap="xs" wrap="nowrap">
             <CompanyTypeBadge type={company.type} />
@@ -747,7 +758,7 @@ export default function CustomerDetailPage() {
               items={[
                 {
                   label: "Profiles",
-                  value: company.companyProfiles.length,
+                  value: profiles.length,
                   icon: IdCard,
                   color: "edr-green",
                 },
@@ -759,9 +770,7 @@ export default function CustomerDetailPage() {
                     : "Pending approval",
                   value: stillOnboarding
                     ? "—"
-                    : company.companyProfiles.filter(
-                        (p) => p.status === "pending",
-                      ).length,
+                    : profiles.filter((p) => p.status === "pending").length,
                   icon: IdCard,
                   color: "yellow",
                 },
@@ -780,366 +789,392 @@ export default function CustomerDetailPage() {
               ]}
             />
 
-            <Card>
-              <Stack gap="lg">
-                <Text fw={600} c="edr-text">
-                  Company information
-                </Text>
-                <SimpleGrid cols={{ base: 1, sm: 2, lg: 3 }} spacing="lg">
-                  <InfoField label="TIN" value={company.tin} />
-                  <InfoField label="VAT number" value={company.vatNumber} />
-                  <InfoField label="FAN number" value={company.fanNumber} />
-                  <InfoField
-                    label="Submitted on"
-                    value={formatDate(company.createdAt)}
-                  />
-                  <InfoField
-                    label="Approved on"
-                    value={
-                      company.approvedAt
-                        ? formatDate(company.approvedAt)
-                        : "Not yet approved"
-                    }
-                  />
-                  <InfoField
-                    label="Owner identity"
-                    value={
-                      ownerIdentity?.verified
-                        ? "Fayda verified"
-                        : ownerIdentity?.passportNumber
-                          ? `Passport ${ownerIdentity.passportNumber}`
-                          : "Not verified"
-                    }
-                  />
-                  <InfoField label="Country" value={company.country} />
-                  <InfoField
-                    label="Nationality"
-                    value={
-                      company.nationality
-                        ? humanize(company.nationality)
-                        : undefined
-                    }
-                  />
-                  <InfoField label="Address" value={company.address} />
-                  <InfoField label="Website" value={company.website} />
-                  <InfoField label="Email" value={company.email} />
-                  <InfoField label="Phone" value={company.phone} />
-                  <Box />
-                  <InfoField
-                    label="Contact person"
-                    value={company.contactPersonName}
-                  />
-                  <InfoField
-                    label="Contact phone"
-                    value={company.contactPersonPhone}
-                  />
-                  <Box />
-                  <InfoField
-                    label="General manager"
-                    value={company.generalManagerName}
-                  />
-                  <InfoField
-                    label="GM email"
-                    value={company.generalManagerEmail}
-                  />
-                  <InfoField
-                    label="GM phone"
-                    value={company.generalManagerPhone}
-                  />
-                </SimpleGrid>
-              </Stack>
-            </Card>
-
-            <Card>
-              <Stack gap="lg">
-                <Group gap="xs" wrap="nowrap" justify="space-between">
-                  <Group gap="xs" wrap="nowrap">
-                    <Text fw={600} c="edr-text">
-                      eTrade registration
-                    </Text>
-                    {hasEtradeRecord ? (
-                      <Badge size="sm" color="edr-green" variant="light">
-                        Verified with eTrade
-                      </Badge>
-                    ) : (
-                      <Badge size="sm" color="gray" variant="light">
-                        No eTrade record
-                      </Badge>
-                    )}
-                  </Group>
-                  {hasEtradeRecord && (
-                    <ActionIcon
-                      variant="default"
-                      aria-label="Download TIN record"
-                      onClick={() => downloadTinRecord(company)}
-                    >
-                      <Download size={16} />
-                    </ActionIcon>
-                  )}
-                </Group>
-                {hasEtradeRecord ? (
-                  <SimpleGrid cols={{ base: 1, sm: 2, lg: 3 }} spacing="lg">
-                    <InfoField
-                      label="License number"
-                      value={company.licenceNumber}
-                    />
-                    <InfoField label="Status" value={company.statusDescription} />
-                    <InfoField
-                      label="Date registered"
-                      value={company.dateRegistered}
-                    />
-                    <InfoField label="Renewed from" value={company.renewedFrom} />
-                    <InfoField label="Renewal date" value={company.renewalDate} />
-                    <InfoField label="Renewed to" value={company.renewedTo} />
-                    <InfoField label="Region" value={company.region} />
-                    <InfoField label="Zone" value={company.zone} />
-                    <InfoField label="Woreda" value={company.woreda} />
-                    <InfoField label="Kebele" value={company.kebele} />
-                    <InfoField label="House No" value={company.houseNo} />
-                  </SimpleGrid>
-                ) : (
-                  <Text size="sm" c="dimmed">
-                    No eTrade registration record on file for this customer's
-                    TIN.
-                  </Text>
-                )}
-              </Stack>
-            </Card>
-
-            <Card>
-              <Stack gap="lg">
-                <Group gap="xs" wrap="nowrap">
-                  <Text fw={600} c="edr-text">
-                    Owner identity
-                  </Text>
-                  {ownerIdentity?.verified ? (
-                    <Badge size="sm" color="edr-green" variant="light">
-                      Fayda verified
-                    </Badge>
-                  ) : (
-                    <Badge size="sm" color="gray" variant="light">
-                      Not verified
-                    </Badge>
-                  )}
-                </Group>
-                {ownerIdentity?.verified ? (
-                  <SimpleGrid cols={{ base: 1, sm: 2, lg: 3 }} spacing="lg">
-                    <InfoField label="Name" value={ownerIdentity.name} />
-                    <InfoField label="Phone" value={ownerIdentity.phone} />
-                    <InfoField label="Email" value={ownerIdentity.email} />
-                    <InfoField label="Address" value={ownerIdentity.address} />
-                    <InfoField
-                      label="Verified at"
-                      value={formatDate(ownerIdentity.verifiedAt)}
-                    />
-                    <InfoField
-                      label="Birthdate"
-                      value={ownerIdentity.birthdate}
-                    />
-                    <InfoField label="Gender" value={ownerIdentity.gender} />
-                    <InfoField
-                      label="Passport number"
-                      value={ownerIdentity.passportNumber}
-                    />
-                  </SimpleGrid>
-                ) : (
-                  <Text size="sm" c="dimmed">
-                    {ownerIdentity?.passportNumber
-                      ? `Not Fayda verified — identified by passport ${ownerIdentity.passportNumber}.`
-                      : "The company owner has not verified their identity with Fayda."}
-                  </Text>
-                )}
-              </Stack>
-            </Card>
-
-            <Card>
-              <Stack gap="lg">
-                <Group justify="space-between" wrap="nowrap">
-                  <Group gap="xs" wrap="nowrap">
-                    <Text fw={600} c="edr-text">
-                      Power of Attorney
-                    </Text>
-                    {poaMandatory && (
-                      <Badge size="xs" color="blue" variant="light">
-                        Required for freight forwarder
-                      </Badge>
-                    )}
-                  </Group>
-                  {delegationMissing ? (
-                    <Badge size="sm" color="red" variant="light">
-                      DARS delegation paper missing
-                    </Badge>
-                  ) : poaLive.length > 0 ? (
-                    <Badge size="sm" color="edr-green" variant="light">
-                      DARS delegation paper on file
-                    </Badge>
-                  ) : (
-                    <Badge size="sm" color="gray" variant="light">
-                      Not provided
-                    </Badge>
-                  )}
-                </Group>
-
-                {hasPoaDetails ? (
-                  <SimpleGrid cols={{ base: 1, sm: 2, lg: 3 }} spacing="lg">
-                    {poaFields.map((f) => (
-                      <InfoField
-                        key={f.label}
-                        label={f.label}
-                        value={f.value}
-                      />
-                    ))}
-                    <InfoField
-                      label="PoA Fayda"
-                      value={
-                        poaIdentity?.verified ? "Verified" : "Not verified"
-                      }
-                    />
-                    {poaIdentity?.verified && (
-                      <>
+            <Grid gap="lg" align="flex-start">
+              {/* Company facts — the wide column. People live in the narrow one
+                  beside it, so nothing about a person is stated twice. */}
+              <Grid.Col span={{ base: 12, lg: 8 }}>
+                <Stack gap="lg">
+                  <Card>
+                    <Stack gap="lg">
+                      <Text fw={600} c="edr-text">
+                        Company information
+                      </Text>
+                      <SimpleGrid cols={{ base: 1, sm: 2 }} spacing="lg">
+                        <InfoField label="TIN" value={company.tin} />
                         <InfoField
-                          label="PoA verified at"
-                          value={formatDate(poaIdentity.verifiedAt)}
+                          label="VAT number"
+                          value={company.vatNumber}
+                        />
+                        <InfoField label="Country" value={company.country} />
+                        <InfoField
+                          label="Nationality"
+                          value={
+                            company.nationality
+                              ? humanize(company.nationality)
+                              : undefined
+                          }
+                        />
+                        {/* Why this company's registration was typed rather
+                            than fetched, and why it carries no licence. */}
+                        <InfoField
+                          label="Registration"
+                          value={
+                            company.cooperative
+                              ? "Co-operative union / farm (no trade licence)"
+                              : "eTrade trade licence"
+                          }
+                        />
+                        <InfoField label="Address" value={company.address} />
+                        <InfoField label="Email" value={company.email} />
+                        <InfoField label="Phone" value={company.phone} />
+                        <InfoField label="Website" value={company.website} />
+                        <InfoField
+                          label="Submitted on"
+                          value={formatDate(company.createdAt)}
                         />
                         <InfoField
-                          label="PoA birthdate"
-                          value={poaIdentity.birthdate}
+                          label="Approved on"
+                          value={
+                            company.approvedAt
+                              ? formatDate(company.approvedAt)
+                              : "Not yet approved"
+                          }
                         />
-                        <InfoField label="PoA gender" value={poaIdentity.gender} />
-                      </>
-                    )}
-                  </SimpleGrid>
-                ) : (
-                  <Text size="sm" c="dimmed">
-                    No Power of Attorney representative recorded for this
-                    customer.
-                  </Text>
-                )}
+                      </SimpleGrid>
+                    </Stack>
+                  </Card>
 
-                <Divider />
-
-                <Stack gap="sm">
-                  <Text
-                    size="xs"
-                    fw={600}
-                    c="edr-muted"
-                    tt="uppercase"
-                    style={{ letterSpacing: "0.04em" }}
-                  >
-                    DARS delegation paper
-                  </Text>
-
-                  {documentsQuery.isLoading ? (
-                    <Group gap="xs">
-                      <Loader size="xs" />
-                      <Text size="sm" c="dimmed">
-                        Loading documents…
-                      </Text>
-                    </Group>
-                  ) : documentsQuery.isError ? (
-                    <Group gap="sm">
-                      <Text size="sm" c="red">
-                        Failed to load documents.
-                      </Text>
-                      <Anchor
-                        component="button"
-                        type="button"
-                        size="xs"
-                        onClick={() => void documentsQuery.refetch()}
-                      >
-                        Retry
-                      </Anchor>
-                    </Group>
-                  ) : poaDocuments.length === 0 ? (
-                    <Text size="sm" c="dimmed">
-                      No DARS delegation paper uploaded.
-                    </Text>
-                  ) : (
-                    poaDocuments.map((doc) => (
-                      <Group key={doc.id} justify="space-between" wrap="nowrap">
-                        <Group gap="sm" wrap="nowrap" style={{ minWidth: 0 }}>
-                          <Paperclip
-                            size={14}
-                            className="shrink-0 text-edr-muted"
-                          />
-                          <Anchor
-                            component="button"
-                            type="button"
-                            size="sm"
-                            lineClamp={1}
-                            onClick={() =>
-                              void fetchViewableFile(doc.id, doc.name).then(view)
-                            }
-                          >
-                            {doc.name}
-                          </Anchor>
-                          <Text size="xs" c="dimmed" className="shrink-0">
-                            {formatBytes(doc.size)} ·{" "}
-                            {formatDate(doc.uploadedAt)}
+                  <Card>
+                    <Stack gap="lg">
+                      <Group gap="xs" wrap="nowrap" justify="space-between">
+                        <Group gap="xs" wrap="nowrap">
+                          <Text fw={600} c="edr-text">
+                            eTrade registration
                           </Text>
-                          {doc.code === POA_DELEGATION_PENDING_CODE && (
-                            <Badge
-                              size="xs"
-                              color="yellow"
-                              variant="light"
-                              className="shrink-0"
-                            >
-                              Pending approval
+                          {hasEtradeRecord ? (
+                            <Badge size="sm" color="edr-green" variant="light">
+                              Verified with eTrade
+                            </Badge>
+                          ) : (
+                            <Badge size="sm" color="gray" variant="light">
+                              No eTrade record
                             </Badge>
                           )}
                         </Group>
-                        <Group gap={4} wrap="nowrap">
+                        {hasEtradeRecord && (
                           <ActionIcon
-                            variant="subtle"
-                            color="gray"
-                            aria-label={`Preview ${doc.name}`}
-                            onClick={() =>
-                              void fetchViewableFile(doc.id, doc.name).then(view)
-                            }
-                          >
-                            <Eye size={16} />
-                          </ActionIcon>
-                          <ActionIcon
-                            component="button"
-                            type="button"
-                            onClick={() =>
-                              void downloadBookingFile(doc.id, doc.name)
-                            }
-                            variant="subtle"
-                            color="gray"
-                            aria-label={`Download ${doc.name}`}
+                            variant="default"
+                            aria-label="Download TIN record"
+                            onClick={() => downloadTinRecord(company)}
                           >
                             <Download size={16} />
                           </ActionIcon>
-                        </Group>
+                        )}
                       </Group>
-                    ))
-                  )}
-                </Stack>
-              </Stack>
-            </Card>
+                      {hasEtradeRecord ? (
+                        <SimpleGrid
+                          cols={{ base: 1, sm: 2, lg: 3 }}
+                          spacing="lg"
+                        >
+                          <InfoField
+                            label="License number"
+                            value={company.licenceNumber}
+                          />
+                          <InfoField
+                            label="Status"
+                            value={company.statusDescription}
+                          />
+                          <InfoField
+                            label="Date registered"
+                            value={company.dateRegistered}
+                          />
+                          <InfoField
+                            label="Renewed from"
+                            value={company.renewedFrom}
+                          />
+                          <InfoField
+                            label="Renewal date"
+                            value={company.renewalDate}
+                          />
+                          <InfoField
+                            label="Renewed to"
+                            value={company.renewedTo}
+                          />
+                          <InfoField label="Region" value={company.region} />
+                          <InfoField label="Zone" value={company.zone} />
+                          <InfoField label="Woreda" value={company.woreda} />
+                          <InfoField label="Kebele" value={company.kebele} />
+                          <InfoField label="House No" value={company.houseNo} />
+                        </SimpleGrid>
+                      ) : (
+                        <Text size="sm" c="dimmed">
+                          No eTrade registration record on file for this
+                          customer's TIN.
+                        </Text>
+                      )}
+                    </Stack>
+                  </Card>
 
-            <Card>
-              <Stack gap="md">
-                <Group justify="space-between">
-                  <Text fw={600} c="edr-text">
-                    Role profiles
-                  </Text>
-                  <ProfileChips profiles={company.companyProfiles} />
-                </Group>
-                <Box style={{ overflowX: "auto" }} w="100%">
-                  <Box miw={1040}>
-                    <DataTable
-                      columns={profileColumns}
-                      data={company.companyProfiles}
-                      status="success"
-                      emptyMessage="No profiles registered."
-                      containerClassName="border-0 shadow-none bg-transparent"
-                    />
-                  </Box>
-                </Box>
-              </Stack>
-            </Card>
+                  <Card>
+                    <Stack gap="md">
+                      <Group justify="space-between">
+                        <Text fw={600} c="edr-text">
+                          Role profiles
+                        </Text>
+                        <ProfileChips profiles={profiles} />
+                      </Group>
+                      {/* Narrower than the old full-width layout — the table
+                          shares the row with the people column now. */}
+                      <Box style={{ overflowX: "auto" }} w="100%">
+                        <Box miw={760}>
+                          <DataTable
+                            columns={profileColumns}
+                            data={profiles}
+                            status="success"
+                            emptyMessage="No profiles registered."
+                            containerClassName="border-0 shadow-none bg-transparent"
+                          />
+                        </Box>
+                      </Box>
+                    </Stack>
+                  </Card>
+                </Stack>
+              </Grid.Col>
+
+              {/* People: owner, then power of attorney, then contact person —
+                  the order a reviewer checks them in. */}
+              <Grid.Col span={{ base: 12, lg: 4 }}>
+                <Stack gap="md">
+                  <PersonCard
+                    title="Owner"
+                    icon={<UserRound size={15} className="text-edr-muted" />}
+                    verified={Boolean(ownerIdentity?.verified)}
+                    badges={
+                      <>
+                        {identityState?.subject === "owner" && (
+                          <Badge size="xs" color="blue" variant="light">
+                            Verifies for this company
+                          </Badge>
+                        )}
+                        {identityState?.ownerMatchesEtrade === true && (
+                          <Badge size="xs" color="edr-green" variant="light">
+                            Matches eTrade licence
+                          </Badge>
+                        )}
+                      </>
+                    }
+                    notice={
+                      /* THE check: is the owner the company put forward the
+                         person the eTrade licence actually names? Advisory —
+                         eTrade and Fayda transliterate Amharic names
+                         differently, so this is a prompt to look, not a
+                         verdict. */
+                      identityState?.ownerMatchesEtrade === false ? (
+                        <Alert
+                          color="amber"
+                          variant="light"
+                          p="xs"
+                          icon={<AlertTriangle size={16} />}
+                          title="Does not match the eTrade licence"
+                        >
+                          <Text size="xs">
+                            The licence names{" "}
+                            <strong>{identityState.etradeManagerName}</strong>,
+                            but this company recorded{" "}
+                            <strong>{company.ownerName ?? "nobody"}</strong>.
+                          </Text>
+                        </Alert>
+                      ) : !ownerIdentity?.verified &&
+                        ownerIdentity?.passportNumber ? (
+                        <Text size="xs" c="dimmed">
+                          Identified by passport rather than Fayda.
+                        </Text>
+                      ) : null
+                    }
+                    fields={[
+                      {
+                        label: "Name",
+                        value: company.ownerName ?? ownerIdentity?.name,
+                      },
+                      {
+                        label: "Email",
+                        value: company.ownerEmail ?? ownerIdentity?.email,
+                      },
+                      {
+                        label: "Phone",
+                        value: company.ownerPhone ?? ownerIdentity?.phone,
+                      },
+                      {
+                        label: "Passport number",
+                        value: ownerIdentity?.passportNumber,
+                      },
+                      { label: "Address", value: ownerIdentity?.address },
+                      { label: "Birthdate", value: ownerIdentity?.birthdate },
+                      { label: "Gender", value: ownerIdentity?.gender },
+                      {
+                        label: "Verified on",
+                        value: ownerIdentity?.verifiedAt
+                          ? formatDate(ownerIdentity.verifiedAt)
+                          : null,
+                      },
+                    ]}
+                    emptyMessage="No owner recorded for this company."
+                  />
+
+                  <PersonCard
+                    title="Power of attorney"
+                    icon={<UserCheck size={15} className="text-edr-muted" />}
+                    verified={
+                      // No PoA at all → no badge, rather than a "not verified"
+                      // that reads as a problem where none exists.
+                      hasPoaDetails || identityState?.poaDeclared === "yes"
+                        ? Boolean(poaIdentity?.verified)
+                        : undefined
+                    }
+                    badges={
+                      <>
+                        {identityState?.subject === "poa" && (
+                          <Badge size="xs" color="blue" variant="light">
+                            Verifies for this company
+                          </Badge>
+                        )}
+                        {poaMandatory && (
+                          <Badge size="xs" color="blue" variant="light">
+                            Required for freight forwarder
+                          </Badge>
+                        )}
+                        {delegationMissing && (
+                          <Badge size="xs" color="red" variant="light">
+                            Delegation paper missing
+                          </Badge>
+                        )}
+                      </>
+                    }
+                    fields={[
+                      { label: "Name", value: company.poaName },
+                      { label: "Email", value: company.poaEmail },
+                      { label: "Phone", value: company.poaPhone },
+                      { label: "Location", value: company.poaLocation },
+                      { label: "Address", value: company.poaAddress },
+                      { label: "Birthdate", value: poaIdentity?.birthdate },
+                      { label: "Gender", value: poaIdentity?.gender },
+                      {
+                        label: "Verified on",
+                        value: poaIdentity?.verifiedAt
+                          ? formatDate(poaIdentity.verifiedAt)
+                          : null,
+                      },
+                    ]}
+                    emptyMessage="No representative recorded for this customer."
+                  >
+                    <Stack gap="xs">
+                      <Text size="xs" c="edr-muted">
+                        DARS delegation paper
+                      </Text>
+
+                      {documentsQuery.isLoading ? (
+                        <Group gap="xs">
+                          <Loader size="xs" />
+                          <Text size="sm" c="dimmed">
+                            Loading…
+                          </Text>
+                        </Group>
+                      ) : documentsQuery.isError ? (
+                        <Group gap="sm">
+                          <Text size="sm" c="red">
+                            Failed to load documents.
+                          </Text>
+                          <Anchor
+                            component="button"
+                            type="button"
+                            size="xs"
+                            onClick={() => void documentsQuery.refetch()}
+                          >
+                            Retry
+                          </Anchor>
+                        </Group>
+                      ) : poaDocuments.length === 0 ? (
+                        <Text size="sm" c="dimmed">
+                          Not uploaded.
+                        </Text>
+                      ) : (
+                        poaDocuments.map((doc) => (
+                          <Stack key={doc.id} gap={2}>
+                            <Group gap={6} wrap="nowrap">
+                              <Paperclip
+                                size={13}
+                                className="shrink-0 text-edr-muted"
+                              />
+                              <Anchor
+                                component="button"
+                                type="button"
+                                size="sm"
+                                lineClamp={1}
+                                style={{ flex: 1, textAlign: "left" }}
+                                onClick={() =>
+                                  void fetchViewableFile(doc.id, doc.name).then(
+                                    view,
+                                  )
+                                }
+                              >
+                                {doc.name}
+                              </Anchor>
+                              <ActionIcon
+                                size="sm"
+                                variant="subtle"
+                                color="gray"
+                                aria-label={`Preview ${doc.name}`}
+                                onClick={() =>
+                                  void fetchViewableFile(doc.id, doc.name).then(
+                                    view,
+                                  )
+                                }
+                              >
+                                <Eye size={15} />
+                              </ActionIcon>
+                              <ActionIcon
+                                size="sm"
+                                component="button"
+                                type="button"
+                                variant="subtle"
+                                color="gray"
+                                aria-label={`Download ${doc.name}`}
+                                onClick={() =>
+                                  void downloadBookingFile(doc.id, doc.name)
+                                }
+                              >
+                                <Download size={15} />
+                              </ActionIcon>
+                            </Group>
+                            <Group gap={6} pl={19} wrap="wrap">
+                              <Text size="xs" c="dimmed">
+                                {formatBytes(doc.size)} ·{" "}
+                                {formatDate(doc.uploadedAt)}
+                              </Text>
+                              {doc.code === POA_DELEGATION_PENDING_CODE && (
+                                <Badge size="xs" color="yellow" variant="light">
+                                  Pending approval
+                                </Badge>
+                              )}
+                            </Group>
+                          </Stack>
+                        ))
+                      )}
+                    </Stack>
+                  </PersonCard>
+
+                  <PersonCard
+                    title="Contact person"
+                    icon={<Contact size={15} className="text-edr-muted" />}
+                    fields={[
+                      { label: "Name", value: company.contactPersonName },
+                      { label: "Phone", value: company.contactPersonPhone },
+                    ]}
+                    emptyMessage="No contact person recorded."
+                  />
+                </Stack>
+              </Grid.Col>
+            </Grid>
           </Stack>
         </Tabs.Panel>
 
@@ -1155,9 +1190,9 @@ export default function CustomerDetailPage() {
               error={
                 bookingsQuery.isError
                   ? {
-                    message: "Failed to load bookings.",
-                    onRetry: () => void bookingsQuery.refetch(),
-                  }
+                      message: "Failed to load bookings.",
+                      onRetry: () => void bookingsQuery.refetch(),
+                    }
                   : undefined
               }
             />
@@ -1177,9 +1212,9 @@ export default function CustomerDetailPage() {
                 error={
                   documentsQuery.isError
                     ? {
-                      message: "Failed to load documents.",
-                      onRetry: () => void documentsQuery.refetch(),
-                    }
+                        message: "Failed to load documents.",
+                        onRetry: () => void documentsQuery.refetch(),
+                      }
                     : undefined
                 }
               />
@@ -1254,9 +1289,9 @@ export default function CustomerDetailPage() {
               error={
                 paymentsQuery.isError
                   ? {
-                    message: "Failed to load payments.",
-                    onRetry: () => void paymentsQuery.refetch(),
-                  }
+                      message: "Failed to load payments.",
+                      onRetry: () => void paymentsQuery.refetch(),
+                    }
                   : undefined
               }
             />
@@ -1277,9 +1312,9 @@ export default function CustomerDetailPage() {
                 error={
                   invoicesQuery.isError
                     ? {
-                      message: "Failed to load invoices.",
-                      onRetry: () => void invoicesQuery.refetch(),
-                    }
+                        message: "Failed to load invoices.",
+                        onRetry: () => void invoicesQuery.refetch(),
+                      }
                     : undefined
                 }
                 pagination={{
diff --git a/apps/edr-freight-web/backoffice/src/pages/settings/CompanyStampSettingsPage.tsx b/apps/edr-freight-web/backoffice/src/pages/settings/CompanyStampSettingsPage.tsx
new file mode 100644
index 000000000..730458f2a
--- /dev/null
+++ b/apps/edr-freight-web/backoffice/src/pages/settings/CompanyStampSettingsPage.tsx
@@ -0,0 +1,96 @@
+import { useEffect, useState } from "react";
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from "@/shared/common/ui/card";
+import { Button } from "@/shared/common/ui/button";
+import { Save, Trash2 } from "lucide-react";
+
+import { StampUpload } from "@/components/contracts/StampUpload";
+import {
+  useClearStamp,
+  useSetStamp,
+  useStampSettingsQuery,
+} from "@/hooks/useStampSettings";
+
+/**
+ * The ONE company stamp/seal, read by every document path server-side via
+ * StampSettingsService: invoices and receipts (InvoiceDocumentService),
+ * warehouse release + handover papers, and the EDR side of contract signature
+ * blocks. Single global image — no per-employee choice, and staff never upload
+ * one when signing.
+ *
+ * Not to be confused with the per-officer teeter (ማህተም) at
+ * /user-management/teeter-and-signature, which is genuinely per-person.
+ */
+export default function CompanyStampSettingsPage() {
+  const { data, isLoading } = useStampSettingsQuery();
+  const setStamp = useSetStamp();
+  const clearStamp = useClearStamp();
+  const [draft, setDraft] = useState<string | null>(null);
+
+  useEffect(() => {
+    setDraft(null);
+  }, [data?.stampImageUrl]);
+
+  const value = draft !== null ? draft : (data?.stampImageUrl ?? null);
+  const dirty = draft !== null && draft !== data?.stampImageUrl;
+
+  const handleSave = async () => {
+    if (!draft) return;
+    await setStamp.mutateAsync(draft);
+  };
+
+  const handleClear = async () => {
+    if (!data?.stampImageUrl) return;
+    await clearStamp.mutateAsync();
+  };
+
+  return (
+    <div className="p-4 w-full max-w-screen-sm mx-auto">
+      <Card className="shadow-lg border-gray-200 dark:border-gray-700">
+        <CardHeader>
+          <CardTitle>Company stamp</CardTitle>
+          <CardDescription>
+            The single EDR seal, applied to every generated document — invoices
+            and receipts, warehouse release and handover papers, and the EDR
+            side of signed contracts. Replacing it here changes it everywhere at
+            once; there is no per-document, per-invoice or per-employee choice.
+            Staff do not upload their own.
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <StampUpload
+            value={isLoading ? null : value}
+            onChange={setDraft}
+            label="Company stamp"
+            description="Shown on every invoice/receipt PDF in place of the plain seal."
+          />
+
+          <div className="flex items-center gap-2">
+            <Button
+              onClick={handleSave}
+              disabled={!dirty || setStamp.isPending}
+            >
+              <Save className="mr-2 h-4 w-4" />
+              Save
+            </Button>
+            {data?.stampImageUrl && !dirty && (
+              <Button
+                variant="outline"
+                onClick={handleClear}
+                disabled={clearStamp.isPending}
+              >
+                <Trash2 className="mr-2 h-4 w-4" />
+                Remove
+              </Button>
+            )}
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}
diff --git a/apps/edr-freight-web/backoffice/src/pages/trainBuilder/TrainBuilderDetailPage.tsx b/apps/edr-freight-web/backoffice/src/pages/trainBuilder/TrainBuilderDetailPage.tsx
index 400bfc1e5..b740a6688 100644
--- a/apps/edr-freight-web/backoffice/src/pages/trainBuilder/TrainBuilderDetailPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/trainBuilder/TrainBuilderDetailPage.tsx
@@ -10,6 +10,7 @@ import {
   Progress,
   Stack,
   Text,
+  Textarea,
 } from "@mantine/core";
 import { useMutation, useQuery } from "@tanstack/react-query";
 import { isAxiosError } from "axios";
@@ -82,6 +83,13 @@ export default function TrainBuilderDetailPage() {
   const [deactivateOpen, setDeactivateOpen] = useState(false);
   const [maintenanceTarget, setMaintenanceTarget] =
     useState<TrainCompositionWagon | null>(null);
+  const [maintenanceNote, setMaintenanceNote] = useState("");
+  // Clearing the note with the target stops one wagon's reason being carried
+  // over onto the next wagon sent to maintenance.
+  const closeMaintenance = () => {
+    setMaintenanceTarget(null);
+    setMaintenanceNote("");
+  };
   const { user } = useAuth();
   const canAssign = hasPermission(user, FREIGHT_PERMS.trains.assignWagons);
   const canChangeLocomotives = hasPermission(user, FREIGHT_PERMS.trains.changeLocomotives);
@@ -103,6 +111,19 @@ export default function TrainBuilderDetailPage() {
   const activate = useMutation(api.trainBuilder.activate.mutationOptions());
 
   const composition = compositionQuery.data;
+  // Staff identify a train by its operational run numbers, not the internal
+  // code — mirrors formatTrainRunLabel on the API, which writes the history note.
+  const trainRunLabel =
+    [
+      composition?.exportTrainNumber?.trim()
+        ? `export ${composition.exportTrainNumber.trim()}`
+        : null,
+      composition?.importTrainNumber?.trim()
+        ? `import ${composition.importTrainNumber.trim()}`
+        : null,
+    ]
+      .filter(Boolean)
+      .join(" / ") || composition?.code;
   const busy =
     assignWagons.isPending ||
     removeWagon.isPending ||
@@ -463,7 +484,7 @@ export default function TrainBuilderDetailPage() {
 
       <Modal
         opened={Boolean(maintenanceTarget)}
-        onClose={() => setMaintenanceTarget(null)}
+        onClose={closeMaintenance}
         title={<Text fw={600}>Send wagon to maintenance?</Text>}
         radius="lg"
         centered
@@ -476,14 +497,22 @@ export default function TrainBuilderDetailPage() {
             </Text>{" "}
             is detached from train{" "}
             <Text span fw={700} c="dark">
-              {composition.code}
+              {trainRunLabel}
             </Text>{" "}
             and set to MAINTENANCE — it stays out of the available pool until it
-            clears. The detach is stamped with the time and this train number in
-            the wagon's history.
+            clears. The detach is stamped with the time and this train's run
+            numbers in the wagon's history.
           </Text>
+          <Textarea
+            label="Note"
+            placeholder="Optional note (e.g. reason for maintenance)"
+            value={maintenanceNote}
+            onChange={(e) => setMaintenanceNote(e.currentTarget.value)}
+            autosize
+            minRows={2}
+          />
           <Group justify="flex-end">
-            <Button variant="default" onClick={() => setMaintenanceTarget(null)}>
+            <Button variant="default" onClick={closeMaintenance}>
               Keep in consist
             </Button>
             <Button
@@ -495,11 +524,12 @@ export default function TrainBuilderDetailPage() {
                   await maintenanceWagon.mutateAsync({
                     id: composition.id,
                     wagonId: maintenanceTarget!.id,
+                    note: maintenanceNote.trim() || undefined,
                   });
                   toast({
                     title: `Wagon ${maintenanceTarget!.wagonNumber} sent to maintenance`,
                   });
-                  setMaintenanceTarget(null);
+                  closeMaintenance();
                 }, "Could not send wagon to maintenance")
               }
             >
diff --git a/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2DetailPage.tsx b/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2DetailPage.tsx
index 9b32d19b6..cf6c37e80 100644
--- a/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2DetailPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2DetailPage.tsx
@@ -23,6 +23,7 @@ import {
   CalendarClock,
   CheckCircle2,
   Clock,
+  Merge,
   Container as ContainerIcon,
   Eye,
   FileText,
@@ -54,6 +55,7 @@ import { ContainerPlacementGrid } from "@/components/trainScheduling/ContainerPl
 import { FleetAvailabilitySummary } from "@/components/trainScheduling/FleetAvailabilitySummary";
 import { IntercityRideAlongPanel } from "@/components/trainScheduling/IntercityRideAlongPanel";
 import { LegCapacityPanel } from "@/components/trainScheduling/LegCapacityPanel";
+import MergeScheduleTrainModal from "@/components/trainScheduling/MergeScheduleTrainModal";
 import ScheduleHistoryPanel from "@/components/trainScheduling/ScheduleHistoryPanel";
 // import { ImportLoadingConfirmationPanel } from "@/components/trainScheduling/ImportLoadingConfirmationPanel";
 import { RescheduleTrainDialog } from "@/components/trainScheduling/RescheduleTrainDialog";
@@ -114,6 +116,7 @@ export default function TrainScheduleV2DetailPage() {
   const [containerPlacements, setContainerPlacements] = useState<ContainerPlacement[]>([]);
   const [maintenanceOpen, setMaintenanceOpen] = useState(false);
   const [windowSettingsOpen, setWindowSettingsOpen] = useState(false);
+  const [mergeModalOpen, setMergeModalOpen] = useState(false);
   const [gatepassSecuredAt, setGatepassSecuredAt] = useState("");
   const [gatepassReference, setGatepassReference] = useState("");
   const [gatepassFileUrl, setGatepassFileUrl] = useState("");
@@ -400,7 +403,6 @@ export default function TrainScheduleV2DetailPage() {
   const canDispatch =
     schedule.status === "SCHEDULED" &&
     hasPermission(authUser, FREIGHT_PERMS.trainScheduling.dispatch);
-
   // Dispatch readiness: bookings with no wagon, and wagon-loaded bookings whose
   // cargo staff never marked loaded. Both are warnings, not blockers — staff can
   // still dispatch after confirming.
@@ -667,6 +669,7 @@ export default function TrainScheduleV2DetailPage() {
             assignedBookings={(schedule.bookings ?? []).map((b) => ({
               id: b.id,
               reference: b.reference ?? b.id.slice(0, 8),
+              customer: b.customer,
               weightTons: b.weightTons,
               isGovernment: b.isGovernment,
               wagonsRequired: b.wagonsRequired,
@@ -940,7 +943,7 @@ export default function TrainScheduleV2DetailPage() {
                   {schedule.trainNumber ? (
                     <Box>
                       <Text size="xs" c="dimmed" fw={600} tt="uppercase" lh={1.2}>
-                        Voyage No.
+                        Train No.
                       </Text>
                       <Text
                         ff="monospace"
@@ -952,6 +955,33 @@ export default function TrainScheduleV2DetailPage() {
                       </Text>
                     </Box>
                   ) : null}
+                  {schedule.voyageNumber ? (
+                    <Box>
+                      <Text size="xs" c="dimmed" fw={600} tt="uppercase" lh={1.2}>
+                        Voyage No.
+                      </Text>
+                      <Text
+                        ff="monospace"
+                        fw={800}
+                        lh={1.1}
+                        style={{ fontSize: 32, color: "#0f172a" }}
+                      >
+                        {schedule.voyageNumber}
+                      </Text>
+                    </Box>
+                  ) : null}
+                  {/* Merging rewrites the consist, so it is offered only while
+                      the departure can still be edited. */}
+                  {canEditBookings ? (
+                    <Button
+                      variant="light"
+                      size="compact-sm"
+                      leftSection={<Merge size={14} />}
+                      onClick={() => setMergeModalOpen(true)}
+                    >
+                      Merge
+                    </Button>
+                  ) : null}
                   {schedule.direction ? (
                     <Box>
                       <Text size="xs" c="dimmed" fw={600} tt="uppercase" lh={1.2}>
@@ -1369,6 +1399,15 @@ export default function TrainScheduleV2DetailPage() {
         onSaved={() => void detailQuery.refetch()}
       />
 
+      <MergeScheduleTrainModal
+        scheduleId={scheduleId ?? null}
+        currentTrainId={schedule.trainSet?.trainId ?? null}
+        scheduleReference={schedule.reference ?? null}
+        opened={mergeModalOpen}
+        onClose={() => setMergeModalOpen(false)}
+        onMerged={() => void detailQuery.refetch()}
+      />
+
       <SwitchGovernmentBookingModal
         key={switchTarget?.id ?? "none"}
         opened={Boolean(switchTarget)}
diff --git a/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2ListPage.tsx b/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2ListPage.tsx
index c132c2534..9755e6bee 100644
--- a/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2ListPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/trainScheduling/TrainScheduleV2ListPage.tsx
@@ -134,6 +134,9 @@ export default function TrainScheduleV2ListPage() {
   // confirmation.
   const [dispatchTarget, setDispatchTarget] =
     useState<TrainScheduleListItem | null>(null);
+  // Cancelling is likewise irreversible — confirmed before the mutation fires.
+  const [cancelTarget, setCancelTarget] =
+    useState<TrainScheduleListItem | null>(null);
   const [editDateSchedule, setEditDateSchedule] =
     useState<TrainScheduleListItem | null>(null);
   const [routeId, setRouteId] = useState("");
@@ -424,9 +427,7 @@ export default function TrainScheduleV2ListPage() {
         cell: ({ row }) => (
           <Group gap={6} wrap="nowrap">
             <MetricChip value={row.original.bookingsCount} label="bkg" />
-            {/* Wagon SLOTS this schedule's bookings occupy — not the coupled
-                consist. A built train shows 0 here until bookings are allocated. */}
-            <MetricChip value={row.original.wagonCount} label="wgn used" />
+            <WagonChips schedule={row.original} />
             <MetricChip value={`${row.original.totalWeightTons}T`} label="" subtle />
           </Group>
         ),
@@ -503,21 +504,7 @@ export default function TrainScheduleV2ListPage() {
                     <Menu.Item
                       color="red"
                       leftSection={<Ban size={15} />}
-                      onClick={async () => {
-                        try {
-                          await cancel.mutateAsync({
-                            id: schedule.id,
-                            freightType: schedule.freightType ?? "CONTAINER",
-                          });
-                          toast({ title: "Schedule cancelled" });
-                        } catch (err) {
-                          toast({
-                            title: "Cancel failed",
-                            description: parseError(err, "Could not cancel"),
-                            variant: "destructive",
-                          });
-                        }
-                      }}
+                      onClick={() => setCancelTarget(schedule)}
                     >
                       Cancel schedule
                     </Menu.Item>
@@ -969,10 +956,118 @@ export default function TrainScheduleV2ListPage() {
           </Group>
         </Stack>
       </Modal>
+
+      {/* Cancelling a schedule is destructive and cannot be undone, so it is
+          confirmed here rather than firing straight from the row menu. */}
+      <Modal
+        opened={cancelTarget != null}
+        onClose={() => setCancelTarget(null)}
+        title="Cancel this schedule?"
+        centered
+        radius="md"
+      >
+        <Stack gap="md">
+          <Text size="sm" c="dimmed">
+            <Text span fw={600} c="dark">
+              {cancelTarget?.trainNumber ?? cancelTarget?.reference ?? "This train"}
+            </Text>{" "}
+            will be cancelled and removed from the active schedule board. This
+            cannot be undone.
+          </Text>
+          {cancelTarget?.bookingsCount ? (
+            <Text size="sm" c="red.7" fw={500}>
+              {cancelTarget.bookingsCount} booking
+              {cancelTarget.bookingsCount === 1 ? "" : "s"} on this train will
+              need to be moved to another schedule.
+            </Text>
+          ) : null}
+          <Group justify="flex-end" gap="sm">
+            <Button variant="default" onClick={() => setCancelTarget(null)}>
+              Keep schedule
+            </Button>
+            <Button
+              color="red"
+              leftSection={<Ban size={16} />}
+              loading={cancel.isPending}
+              onClick={async () => {
+                if (!cancelTarget) return;
+                try {
+                  await cancel.mutateAsync({
+                    id: cancelTarget.id,
+                    freightType: cancelTarget.freightType ?? "CONTAINER",
+                  });
+                  toast({ title: "Schedule cancelled" });
+                  setCancelTarget(null);
+                  void schedulesQuery.refetch();
+                } catch (err) {
+                  toast({
+                    title: "Cancel failed",
+                    description: parseError(err, "Could not cancel"),
+                    variant: "destructive",
+                  });
+                }
+              }}
+            >
+              Cancel schedule
+            </Button>
+          </Group>
+        </Stack>
+      </Modal>
     </PageContainer>
   );
 }
 
+/**
+ * The row's wagon chips, matching the detail page's wagon plan: used is slots
+ * carrying a booking allocation (never the coupled consist size), and remaining
+ * excludes wagons reserved by bookings that have not paid yet — that space is
+ * claimed, so it is not bookable.
+ *
+ * Schedules whose train set has not been built yet have no consist to measure,
+ * so both figures fall back to the schedule's planned `maxWagons` ceiling.
+ * Without that fallback an unbuilt 37-wagon schedule reads "0 bookable" even
+ * though every one of its wagons is still free.
+ */
+function WagonChips({ schedule }: { schedule: TrainScheduleListItem }) {
+  // Pre-deploy API rows carry only wagonCount; fall back so the chip still
+  // renders rather than reading 0 used on every train.
+  const total = schedule.wagonsTotal ?? schedule.wagonCount;
+  const used = schedule.wagonsUsed;
+  const reserved = schedule.wagonsReserved ?? 0;
+
+  // Until the train set is built there is no consist to measure against, so
+  // `wagonsRemaining` (consist minus claimed) is 0 on every unbuilt schedule —
+  // which reads as "fully booked" when in fact nothing is booked at all. Before
+  // a consist exists, capacity is the planned ceiling minus what bookings have
+  // already claimed.
+  const planCeiling = schedule.maxWagons ?? 0;
+  const remaining =
+    total === 0 && planCeiling > 0
+      ? Math.max(0, planCeiling - Math.max(used ?? 0, reserved))
+      : schedule.wagonsRemaining;
+
+  if (used == null) {
+    return <MetricChip value={total} label="wgn" subtle />;
+  }
+
+  return (
+    <>
+      {/* An unbuilt consist has no "used out of coupled" to show; the plan
+          ceiling is the only meaningful denominator at that point. */}
+      <MetricChip
+        value={total === 0 && planCeiling > 0 ? `${used}/${planCeiling}` : `${used}/${total}`}
+        label={total === 0 && planCeiling > 0 ? "wgn planned" : "wgn used"}
+      />
+      {reserved > used ? (
+        <MetricChip value={reserved} label="reserved" subtle />
+      ) : null}
+      {remaining != null ? (
+        <MetricChip value={remaining} label="bookable" subtle />
+      ) : null}
+    </>
+  );
+}
+
 function MetricChip({
   value,
   label,
@@ -1078,7 +1173,7 @@ function ScheduleCard({
           </Group>
           <Group gap={6} wrap="nowrap">
             <MetricChip value={schedule.bookingsCount} label="bkg" />
-            <MetricChip value={schedule.wagonCount} label="wgn used" />
+            <WagonChips schedule={schedule} />
             <MetricChip value={`${schedule.totalWeightTons}T`} label="" subtle />
           </Group>
         </Group>
diff --git a/apps/edr-freight-web/backoffice/src/pages/wagons/TransferFulfillModal.tsx b/apps/edr-freight-web/backoffice/src/pages/wagons/TransferFulfillModal.tsx
index 6f5a0c129..4a4a3d870 100644
--- a/apps/edr-freight-web/backoffice/src/pages/wagons/TransferFulfillModal.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/wagons/TransferFulfillModal.tsx
@@ -2,19 +2,18 @@ import { Freight } from "@edr/types";
 import {
   Alert,
   Button,
-  Checkbox,
   Group,
   Loader,
   Modal,
-  ScrollArea,
   Stack,
   Text,
 } from "@mantine/core";
 import { useMutation, useQuery } from "@tanstack/react-query";
 import { AlertTriangle, ArrowRight, PackageCheck } from "lucide-react";
-import { useMemo, useState } from "react";
+import { useEffect, useMemo, useState } from "react";
 import toast from "react-hot-toast";
 
+import WagonPicker from "@/components/wagons/WagonPicker";
 import { api } from "@/services/api";
 import type { WagonTransferRequest } from "@/services/wagon.service";
 
@@ -59,23 +58,21 @@ export function TransferFulfillModal({
 
   const fulfill = useMutation(api.wagonTransferRequests.fulfill.mutationOptions());
 
-  const canTake = useMemo(
-    () => Math.min(outstanding, wagons.length),
-    [outstanding, wagons.length],
-  );
+  /** The requester's picks that are still in this yard and still available. */
+  const preferredHere = useMemo(() => {
+    const asked = new Set(request?.preferredWagonIds ?? []);
+    return asked.size ? wagons.filter((w) => asked.has(w.id)) : [];
+  }, [request, wagons]);
 
-  const toggle = (id: string) =>
-    setPicked((prev) => {
-      const next = new Set(prev);
-      if (next.has(id)) next.delete(id);
-      // Never let staff pick more than is still owed — the API rejects it too.
-      else if (next.size >= outstanding) return prev;
-      else next.add(id);
-      return next;
-    });
+  const missingPreferred =
+    (request?.preferredWagonIds?.length ?? 0) - preferredHere.length;
 
-  const takeAllAvailable = () =>
-    setPicked(new Set(wagons.slice(0, canTake).map((w) => w.id)));
+  // Open on what the requester asked for: OCC confirms rather than re-picks.
+  // Re-runs when the wagon list arrives, and is capped at what is still owed.
+  useEffect(() => {
+    if (!request) return;
+    setPicked(new Set(preferredHere.slice(0, outstanding).map((w) => w.id)));
+  }, [request, preferredHere, outstanding]);
 
   const close = () => {
     setPicked(new Set());
@@ -120,27 +117,16 @@ export function TransferFulfillModal({
     >
       {!request ? null : (
         <Stack gap="sm">
-          <Group justify="space-between" wrap="wrap">
-            <Text size="sm">
-              <Text span fw={700}>
-                {outstanding}
-              </Text>{" "}
-              wagon(s) still owed ·{" "}
-              <Text span fw={700}>
-                {wagons.length}
-              </Text>{" "}
-              available in {yardLabel(request.fromYard)}
-            </Text>
-            <Button
-              variant="light"
-              size="xs"
-              radius="md"
-              disabled={canTake === 0}
-              onClick={takeAllAvailable}
-            >
-              Select {canTake}
-            </Button>
-          </Group>
+          <Text size="sm">
+            <Text span fw={700}>
+              {outstanding}
+            </Text>{" "}
+            wagon(s) still owed ·{" "}
+            <Text span fw={700}>
+              {wagons.length}
+            </Text>{" "}
+            available in {yardLabel(request.fromYard)}
+          </Text>
 
           {wagons.length < outstanding ? (
             <Alert color="yellow" radius="md" icon={<AlertTriangle size={15} />}>
@@ -150,27 +136,39 @@ export function TransferFulfillModal({
             </Alert>
           ) : null}
 
+          {preferredHere.length > 0 ? (
+            <Alert color="teal" radius="md" icon={<PackageCheck size={15} />}>
+              The requester named{" "}
+              <Text span fw={700}>
+                {preferredHere.length}
+              </Text>{" "}
+              specific wagon(s) — pre-selected below. You can change the
+              selection freely; the request is a count, not a reservation.
+            </Alert>
+          ) : null}
+
+          {missingPreferred > 0 ? (
+            <Alert color="orange" radius="md" icon={<AlertTriangle size={15} />}>
+              {missingPreferred} of the wagon(s) the requester named{" "}
+              {missingPreferred === 1 ? "is" : "are"} no longer available in this
+              yard. Pick replacements below.
+            </Alert>
+          ) : null}
+
           {isLoading ? (
             <Group justify="center" py="lg">
               <Loader size="sm" />
             </Group>
-          ) : wagons.length === 0 ? (
-            <Text c="dimmed" size="sm" py="md">
-              No available wagons of this type in the source yard right now.
-            </Text>
           ) : (
-            <ScrollArea.Autosize mah={320}>
-              <Stack gap={4}>
-                {wagons.map((w) => (
-                  <Checkbox
-                    key={w.id}
-                    checked={picked.has(w.id)}
-                    onChange={() => toggle(w.id)}
-                    label={w.wagonNumber}
-                  />
-                ))}
-              </Stack>
-            </ScrollArea.Autosize>
+            <WagonPicker
+              wagons={wagons}
+              selected={picked}
+              onChange={setPicked}
+              // Never let staff pick more than is still owed — the API rejects it too.
+              max={outstanding}
+              emptyMessage="No available wagons of this type in the source yard right now."
+              maxHeight={300}
+            />
           )}
 
           <Group justify="flex-end" gap="sm">
diff --git a/apps/edr-freight-web/backoffice/src/pages/wagons/TransferRequestModals.tsx b/apps/edr-freight-web/backoffice/src/pages/wagons/TransferRequestModals.tsx
index a58d49bf1..f23ea6ed9 100644
--- a/apps/edr-freight-web/backoffice/src/pages/wagons/TransferRequestModals.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/wagons/TransferRequestModals.tsx
@@ -15,6 +15,7 @@ import { AlertTriangle, Send, XCircle } from "lucide-react";
 import { useEffect, useState } from "react";
 import toast from "react-hot-toast";
 
+import WagonPicker from "@/components/wagons/WagonPicker";
 import { api } from "@/services/api";
 import type { WagonTransferRequest } from "@/services/wagon.service";
 
@@ -45,9 +46,11 @@ function useTransferOptions(enabled: boolean) {
 /**
  * Wagons the source yard can hand over right now — AVAILABLE and not coupled to
  * a built train. Mirrors `countAvailable` on the API, which rejects any request
- * asking for more than this, so the field must not let one be filed.
+ * asking for more than this, so the field must not let one be filed. Returns
+ * the wagons themselves so the form can also offer them for picking; `count` is
+ * null until both a yard and a type are chosen.
  */
-function useAvailableCount(
+function useAvailableWagons(
   enabled: boolean,
   fromYardId: string | null,
   wagonTypeId: string | null,
@@ -56,14 +59,15 @@ function useAvailableCount(
     ...api.wagons.list.queryOptions({ input: {} }),
     enabled: enabled && Boolean(fromYardId && wagonTypeId),
   });
-  if (!fromYardId || !wagonTypeId) return null;
-  return wagons.filter(
+  if (!fromYardId || !wagonTypeId) return { wagons: [], count: null };
+  const inYard = wagons.filter(
     (w) =>
       w.currentYardId === fromYardId &&
       w.wagonTypeId === wagonTypeId &&
       w.status === Freight.WagonStatus.Available &&
       !w.trainId,
-  ).length;
+  );
+  return { wagons: inYard, count: inYard.length };
 }
 
 export interface TransferRequestFormModalProps {
@@ -95,6 +99,8 @@ export function TransferRequestFormModal({
   const [wagonTypeId, setWagonTypeId] = useState<string | null>(null);
   const [quantity, setQuantity] = useState<number | string>(1);
   const [reason, setReason] = useState("");
+  /** Specific wagons the requester named — optional; empty means "any N". */
+  const [picked, setPicked] = useState<Set<string>>(new Set());
 
   // Re-seed on every open so a carry-over never leaks into the next request.
   useEffect(() => {
@@ -104,11 +110,27 @@ export function TransferRequestFormModal({
     setWagonTypeId(prefillFrom?.wagonTypeId ?? null);
     setQuantity(prefillFrom ? outstandingOn(prefillFrom) : 1);
     setReason(prefillFrom?.reason ?? "");
+    setPicked(new Set());
   }, [opened, prefillFrom]);
 
   const create = useMutation(api.wagonTransferRequests.create.mutationOptions());
 
-  const available = useAvailableCount(opened, fromYardId, wagonTypeId);
+  const { wagons: availableWagons, count: available } = useAvailableWagons(
+    opened,
+    fromYardId,
+    wagonTypeId,
+  );
+
+  // The picks belong to one yard+type pair; changing either invalidates them.
+  useEffect(() => {
+    setPicked(new Set());
+  }, [fromYardId, wagonTypeId]);
+
+  // Naming wagons IS the ask, so the count follows the picks.
+  const handlePick = (next: Set<string>) => {
+    setPicked(next);
+    if (next.size > 0) setQuantity(next.size);
+  };
 
   // A prefilled outstanding count (or a count typed before the yard was picked)
   // can exceed what the chosen source yard actually has — pull it back down so
@@ -118,6 +140,16 @@ export function TransferRequestFormModal({
     setQuantity((q) => (Number(q) > available ? available : q));
   }, [available]);
 
+  // Asking for fewer than were picked would send a selection the API rejects
+  // (picks may not exceed quantity) — drop the extras, keeping pick order.
+  const handleQuantityChange = (value: number | string) => {
+    setQuantity(value);
+    const n = Number(value);
+    if (Number.isFinite(n) && picked.size > n) {
+      setPicked(new Set([...picked].slice(0, Math.max(0, n))));
+    }
+  };
+
   const sameYard = Boolean(fromYardId && fromYardId === toYardId);
   const overAvailable = available != null && Number(quantity) > available;
   const valid =
@@ -136,6 +168,7 @@ export function TransferRequestFormModal({
         wagonTypeId: wagonTypeId!,
         quantity: Number(quantity),
         reason: reason.trim(),
+        ...(picked.size > 0 ? { preferredWagonIds: [...picked] } : {}),
       });
       toast.success("Transfer request filed");
       onClose();
@@ -203,7 +236,7 @@ export function TransferRequestFormModal({
           clampBehavior={available == null ? "none" : "strict"}
           allowNegative={false}
           value={quantity}
-          onChange={setQuantity}
+          onChange={handleQuantityChange}
           disabled={available === 0}
           error={
             available === 0
@@ -214,6 +247,34 @@ export function TransferRequestFormModal({
           }
           required
         />
+
+        {/* Optional: name the exact wagons. Leaving this empty files a plain
+            count request and OCC picks whatever is free. */}
+        {availableWagons.length > 0 ? (
+          <div>
+            <Group justify="space-between" mb={4} wrap="wrap" gap={4}>
+              <Text size="sm" fw={500}>
+                Which wagons{" "}
+                <Text span size="xs" c="dimmed" fw={400}>
+                  (optional)
+                </Text>
+              </Text>
+              <Text size="xs" c="dimmed">
+                {picked.size > 0
+                  ? `${picked.size} named — OCC will prioritise these`
+                  : "Leave empty and OCC picks any available"}
+              </Text>
+            </Group>
+            <WagonPicker
+              wagons={availableWagons}
+              selected={picked}
+              onChange={handlePick}
+              max={available ?? undefined}
+              maxHeight={200}
+            />
+          </div>
+        ) : null}
+
         <Textarea
           label="Reason"
           placeholder="Why the wagons are needed"
diff --git a/apps/edr-freight-web/backoffice/src/pages/wagons/WagonTransfersPage.tsx b/apps/edr-freight-web/backoffice/src/pages/wagons/WagonTransfersPage.tsx
index 1a08b5c54..323323da3 100644
--- a/apps/edr-freight-web/backoffice/src/pages/wagons/WagonTransfersPage.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/wagons/WagonTransfersPage.tsx
@@ -52,6 +52,7 @@ import {
   TransferRequestFormModal,
 } from "./TransferRequestModals";
 import {
+  PreferredWagonChips,
   TransferProgress,
   TransferStatusBadge,
   fmtDateTime,
@@ -195,6 +196,11 @@ export default function WagonTransfersPage() {
         <Text size="sm">{wagonTypeLabel(row.original.wagonType)}</Text>
       ),
     },
+    {
+      id: "wagons",
+      header: () => <span>Wagons requested</span>,
+      cell: ({ row }) => <PreferredWagonChips request={row.original} />,
+    },
     {
       id: "progress",
       header: () => <span>Delivered</span>,
@@ -564,6 +570,17 @@ export default function WagonTransfersPage() {
               {wagonTypeLabel(viewingReason.wagonType)} ·{" "}
               {viewingReason.quantity} wagon(s)
             </Text>
+            {viewingReason.preferredWagons?.length ? (
+              <div>
+                <Text size="xs" c="dimmed" mb={4}>
+                  Wagons requested
+                </Text>
+                <PreferredWagonChips
+                  request={viewingReason}
+                  limit={viewingReason.preferredWagons.length}
+                />
+              </div>
+            ) : null}
             <Box
               className="text-sm [&_p]:my-2 [&_ol]:list-decimal [&_ul]:list-disc [&_ol]:pl-5 [&_ul]:pl-5"
               dangerouslySetInnerHTML={{
diff --git a/apps/edr-freight-web/backoffice/src/pages/wagons/wagon-transfer-ui.tsx b/apps/edr-freight-web/backoffice/src/pages/wagons/wagon-transfer-ui.tsx
index ea73a95d2..130f37233 100644
--- a/apps/edr-freight-web/backoffice/src/pages/wagons/wagon-transfer-ui.tsx
+++ b/apps/edr-freight-web/backoffice/src/pages/wagons/wagon-transfer-ui.tsx
@@ -3,6 +3,65 @@ import { Badge, Box, Group, Progress, Text, Tooltip } from "@mantine/core";
 
 import type { WagonTransferRequest } from "@/services/wagon.service";
 
+/** How many wagon chips fit a table cell before the rest are rolled up. */
+const CHIP_LIMIT = 4;
+
+/**
+ * The wagons the requester actually named, when they picked any. Rendered as
+ * chips so a glance down the column separates "send me these 3" from a plain
+ * count request — the two are fulfilled differently.
+ */
+export function PreferredWagonChips({
+  request,
+  limit = CHIP_LIMIT,
+}: {
+  request: WagonTransferRequest;
+  limit?: number;
+}) {
+  const wagons = request.preferredWagons ?? [];
+  if (wagons.length === 0) {
+    return (
+      <Tooltip label="No specific wagons named — OCC picks any available" withArrow>
+        <Text size="xs" c="dimmed">
+          Any {request.quantity}
+        </Text>
+      </Tooltip>
+    );
+  }
+
+  const shown = wagons.slice(0, limit);
+  const rest = wagons.length - shown.length;
+
+  return (
+    <Tooltip
+      withArrow
+      multiline
+      maw={280}
+      label={`Requested: ${wagons.map((w) => w.wagonNumber).join(", ")}`}
+    >
+      <Group gap={4} wrap="wrap" maw={220}>
+        {shown.map((w) => (
+          <Badge
+            key={w.id}
+            size="sm"
+            variant="light"
+            color="edr-green"
+            radius="sm"
+            style={{ fontVariantNumeric: "tabular-nums" }}
+          >
+            {w.wagonNumber}
+          </Badge>
+        ))}
+        {rest > 0 ? (
+          <Badge size="sm" variant="outline" color="gray" radius="sm">
+            +{rest}
+          </Badge>
+        ) : null}
+      </Group>
+    </Tooltip>
+  );
+}
+
 /** Reason/note fields come from a rich-text editor and store HTML — this
  * gives a plain-text preview for list/table contexts (full formatting is
  * shown via `sanitizeHtml` + `dangerouslySetInnerHTML` where there's room). */
diff --git a/apps/edr-freight-web/backoffice/src/record-management/components/Settings/uploadTeeterandSingature.tsx b/apps/edr-freight-web/backoffice/src/record-management/components/Settings/uploadTeeterandSingature.tsx
index 3035d58c7..a6855f540 100644
--- a/apps/edr-freight-web/backoffice/src/record-management/components/Settings/uploadTeeterandSingature.tsx
+++ b/apps/edr-freight-web/backoffice/src/record-management/components/Settings/uploadTeeterandSingature.tsx
@@ -609,10 +609,18 @@ const UploadTeeterAndSignature = () => {
           )}
         </TabsContent>
 
-        {/* Teeter Tab */}
+        {/* Teeter Tab — single active stamp only: remove the current one to upload a replacement. */}
         <TabsContent value="teeter" className="p-4 space-y-6">
           {teeters.length > 0 && (
             <div className="space-y-6">
+              {teeters.length > 1 && (
+                <p className="rounded border border-amber-200 bg-amber-50 p-2 text-sm text-amber-700 dark:border-amber-900 dark:bg-amber-950 dark:text-amber-300">
+                  {t(
+                    "signatureUpload.multipleStampsWarning",
+                    "Only one stamp is allowed. Remove the extras below to keep a single active stamp.",
+                  )}
+                </p>
+              )}
               {teeters.map(({ id, url }) => (
                 <div key={id} className="space-y-3">
                   <p className="text-sm text-gray-600 dark:text-gray-300">
@@ -635,6 +643,7 @@ const UploadTeeterAndSignature = () => {
             </div>
           )}
 
+          {teeters.length === 0 && (
           <div className="border-2 border-dashed border-primary-300 dark:border-primary-600 rounded-lg p-6 text-center space-y-4">
             {!stampBlocks && !showLanguagePicker && (
               <Button
@@ -792,6 +801,7 @@ const UploadTeeterAndSignature = () => {
               </>
             )}
           </div>
+          )}
         </TabsContent>
       </Tabs>
 
diff --git a/apps/edr-freight-web/backoffice/src/services/api.ts b/apps/edr-freight-web/backoffice/src/services/api.ts
index 895a54070..6c9c69788 100644
--- a/apps/edr-freight-web/backoffice/src/services/api.ts
+++ b/apps/edr-freight-web/backoffice/src/services/api.ts
@@ -67,6 +67,7 @@ import type {
   PinWagonsPayload,
   RecordCheckpointPayload,
   StaffBookingWindow,
+  ScheduleMergePreview,
   TrainScheduleDetail,
   TrainScheduleFilters,
   TrainScheduleListFilters,
@@ -166,11 +167,6 @@ import {
   type SaveLocomotivePayload,
 } from "./locomotives.service";
 import { overviewService } from "./overview.service";
-import {
-  auditService,
-  type AuditLogListFilter,
-  type PaginatedAuditLogs,
-} from "./audit.service";
 import { reportsService } from "./reports.service";
 import type { ReportQueryInput, ReportResult } from "@/types/reports";
 import {
@@ -601,6 +597,36 @@ export const api = {
       () => TRAIN_SCHEDULING_INVALIDATIONS,
     ),
 
+    previewScheduleMerge: endpoint<
+      { id: string; targetTrainId: string },
+      ScheduleMergePreview
+    >(
+      "train-scheduling",
+      "merge-preview",
+      ({ id, targetTrainId }) =>
+        trainSchedulingService.previewScheduleMerge(id, targetTrainId),
+      ({ id, targetTrainId }) => [
+        "train-scheduling",
+        "merge-preview",
+        id,
+        targetTrainId,
+      ],
+    ),
+
+    mergeScheduleTrain: endpoint<
+      { id: string; targetTrainId: string; reason?: string },
+      TrainScheduleDetail
+    >(
+      "train-scheduling",
+      "merge-train",
+      ({ id, ...payload }) =>
+        trainSchedulingService.mergeScheduleTrain(id, payload),
+      undefined,
+      // Wagons and bookings move between trains and schedules, so the wagon and
+      // train caches are stale too — not just the scheduling ones.
+      () => [...TRAIN_SCHEDULING_INVALIDATIONS, ["wagons"], ["trains"]],
+    ),
+
     markBookingPaid: endpoint<string, void>(
       "train-scheduling",
       "mark-booking-paid",
@@ -2045,11 +2071,14 @@ export const api = {
       () => TRAIN_BUILDER_INVALIDATIONS,
     ),
 
-    sendWagonToMaintenance: endpoint<{ id: string; wagonId: string }, TrainComposition>(
+    sendWagonToMaintenance: endpoint<
+      { id: string; wagonId: string; note?: string },
+      TrainComposition
+    >(
       "train-builder",
       "sendWagonToMaintenance",
-      ({ id, wagonId }) =>
-        trainBuilderService.sendWagonToMaintenance(id, wagonId).then((r) => r.data),
+      ({ id, wagonId, note }) =>
+        trainBuilderService.sendWagonToMaintenance(id, wagonId, note).then((r) => r.data),
       undefined,
       () => TRAIN_BUILDER_INVALIDATIONS,
     ),
@@ -2153,15 +2182,6 @@ export const api = {
     ),
   },
 
-  audit: {
-    list: endpoint<{ filter?: AuditLogListFilter }, PaginatedAuditLogs>(
-      "audit",
-      "list",
-      ({ filter }) => auditService.list(filter),
-      ({ filter }) => ["audit", "list", filter ?? {}],
-    ),
-  },
-
   signatures: {
     mySignature: endpoint<void, SavedSignature | null>(
       "me",
diff --git a/apps/edr-freight-web/backoffice/src/services/audit.service.ts b/apps/edr-freight-web/backoffice/src/services/audit.service.ts
deleted file mode 100644
index ed0642d83..000000000
--- a/apps/edr-freight-web/backoffice/src/services/audit.service.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-import { api as client } from "../auth/http";
-import { unwrap } from "@/utils/endpoint";
-import { URL_CONSTANTS } from "@/constants/URLS";
-
-const A = URL_CONSTANTS.AUDIT;
-
-// Shape from @tria-plc/auditlog's AuditLogCommandController — see
-// local-packages/FRONTEND_GUIDE.md.
-export type AuditQueryMethod =
-  | "INSERT"
-  | "UPDATE"
-  | "DELETE"
-  | "INSERT_CHILD"
-  | "DELETE_CHILD";
-
-export interface AuditFieldChange {
-  field: string;
-  from: unknown;
-  to: unknown;
-}
-
-// IAM entities (users, orgs, positions, ...) name themselves bilingually —
-// see edr-org.seeder.ts. Any `name`/`title` field lifted from a raw audited
-// entity (auditLog.user, payload) can come back as either a plain string or
-// this shape; both `name` fields below reflect that.
-export type LocalizedText = string | { am?: string; en?: string };
-
-// The vendored interceptor's own broken template produces a plain string
-// ("undefined  undefined") when no user was attached at all (unauthenticated/
-// customer flows) — that's the non-bilingual string case for `name` here.
-export interface AuditUser {
-  id?: string;
-  name?: LocalizedText;
-  organizationId?: string;
-  organizationName?: string;
-  [key: string]: unknown;
-}
-
-export interface AuditLogRow {
-  id?: string;
-  createdAt: string;
-  deletedAt?: string | null;
-  entityName: string;
-  queryMethod: AuditQueryMethod;
-  changes?: AuditFieldChange[] | null;
-  payload?: { name?: LocalizedText; title?: LocalizedText; id?: string } | null;
-  auditLog?: { id?: string; user?: AuditUser | null };
-}
-
-export interface AuditLogListFilter {
-  skip?: number;
-  take?: number;
-}
-
-export interface PaginatedAuditLogs {
-  items: AuditLogRow[];
-  count: number;
-}
-
-export const auditService = {
-  list: async (filter?: AuditLogListFilter): Promise<PaginatedAuditLogs> => {
-    const params: Record<string, number | undefined> = {
-      skip: filter?.skip,
-      take: filter?.take,
-    };
-    const response = await client.get<PaginatedAuditLogs>(A.LOGS, { params });
-    const data = unwrap(response.data) as PaginatedAuditLogs;
-    return { items: data.items ?? [], count: data.count ?? 0 };
-  },
-};
diff --git a/apps/edr-freight-web/backoffice/src/services/auditLogs.service.ts b/apps/edr-freight-web/backoffice/src/services/auditLogs.service.ts
new file mode 100644
index 000000000..d52a60382
--- /dev/null
+++ b/apps/edr-freight-web/backoffice/src/services/auditLogs.service.ts
@@ -0,0 +1,97 @@
+import type { PaginatedResponse } from "@edr/types";
+
+import { api as client } from "../auth/http";
+import { unwrap } from "@/utils/endpoint";
+import { URL_CONSTANTS } from "@/constants/URLS";
+import type { ApiResponse } from "@/types/apiResponse";
+
+const BASE = URL_CONSTANTS.AUDIT_LOGS.BASE;
+
+/** Methods the audit trail records. Reads are never audited. */
+export const AUDIT_METHODS = ["POST", "PUT", "PATCH", "DELETE"] as const;
+export type AuditMethod = (typeof AUDIT_METHODS)[number];
+
+/**
+ * One recorded backoffice action.
+ *
+ * Mirrors `AuditLog` in the freight API. `userName` / `userRole` are snapshots
+ * taken when the action happened, not live lookups — an old row keeps the name
+ * and role the actor had at the time.
+ */
+export interface AuditLog {
+  id: string;
+  /** Readable action, e.g. "Approve contract". */
+  title: string;
+  method: AuditMethod;
+  /** URL as called, query string included (secrets already redacted server-side). */
+  url: string;
+  /** Route template, e.g. `/api/contracts/:id/cancel`. */
+  routePath: string | null;
+  /** Entity the action touched, e.g. "Contract". */
+  type: string;
+  isSuccess: boolean;
+  statusCode: number | null;
+  errorMessage: string | null;
+  userId: string | null;
+  userName: string | null;
+  userRole: string | null;
+  resourceId: string | null;
+  /** Sanitized request body; files appear as `__file` descriptors. */
+  request: Record<string, unknown> | null;
+  ipAddress: string | null;
+  userAgent: string | null;
+  requestId: string | null;
+  durationMs: number | null;
+  createdAt: string;
+}
+
+export interface AuditLogQuery {
+  page?: number;
+  pageSize?: number;
+  type?: string;
+  userId?: string;
+  method?: AuditMethod;
+  resourceId?: string;
+  /** Omit for "any outcome". */
+  isSuccess?: boolean;
+  /** Inclusive ISO 8601 bounds. */
+  from?: string;
+  to?: string;
+}
+
+/**
+ * Drop empty filters so the request carries only what the user actually set —
+ * an empty string would otherwise be sent and fail the API's validation.
+ */
+function toParams(query: AuditLogQuery): Record<string, string | number> {
+  const params: Record<string, string | number> = {};
+
+  if (query.page) params.page = query.page;
+  if (query.pageSize) params.pageSize = query.pageSize;
+  if (query.type) params.type = query.type;
+  if (query.userId) params.userId = query.userId;
+  if (query.method) params.method = query.method;
+  if (query.resourceId) params.resourceId = query.resourceId;
+  if (query.isSuccess !== undefined) params.isSuccess = String(query.isSuccess);
+  if (query.from) params.from = query.from;
+  if (query.to) params.to = query.to;
+
+  return params;
+}
+
+export const auditLogsService = {
+  /** Paginated audit history, newest first. */
+  list: async (query: AuditLogQuery = {}): Promise<PaginatedResponse<AuditLog>> => {
+    const response = await client.get<ApiResponse<PaginatedResponse<AuditLog>>>(
+      `${BASE}/logs`,
+      { params: toParams(query) },
+    );
+    return unwrap(response.data);
+  },
+
+  /** Distinct entity types present, for the filter dropdown. */
+  types: async (): Promise<string[]> => {
+    const response = await client.get<ApiResponse<string[]>>(`${BASE}/types`);
+    return unwrap(response.data);
+  },
+};
diff --git a/apps/edr-freight-web/backoffice/src/services/bookings.service.ts b/apps/edr-freight-web/backoffice/src/services/bookings.service.ts
index c1ce4e67d..b49a11f83 100644
--- a/apps/edr-freight-web/backoffice/src/services/bookings.service.ts
+++ b/apps/edr-freight-web/backoffice/src/services/bookings.service.ts
@@ -111,11 +111,14 @@ export interface ConsolidationDetails {
   splitBilling: { bookingShare: number; partnerShare: number } | null;
 }
 
+/**
+ * No stamp field: the backoffice only ever signs as STAFF, and EDR's seal is
+ * the ONE global company stamp applied server-side. Customer stamps are posted
+ * from the portal, not here.
+ */
 export interface SignContractPayload {
   role: "CUSTOMER" | "STAFF";
   signatureImageBase64: string;
-  /** Company stamp/seal image; the API requires one for CUSTOMER and STAFF. */
-  stampImageBase64?: string;
   signerDisplayName: string;
   consentText?: string;
 }
@@ -420,11 +423,11 @@ export const bookingsService = {
 
   uploadDeliveryOrder: async (
     id: string,
-    file: File,
+    files: File[],
     dates: { vesselArrivalDate: string; doCollectedDate: string },
   ): Promise<BookingDetail> => {
     const form = new FormData();
-    form.append("file", file);
+    files.forEach((file) => form.append("files", file));
     form.append("vesselArrivalDate", dates.vesselArrivalDate);
     form.append("doCollectedDate", dates.doCollectedDate);
     const response = await client.post(B.CLEARANCE_DELIVERY_ORDER(id), form, {
@@ -435,11 +438,11 @@ export const bookingsService = {
 
   uploadReleaseOrder: async (
     id: string,
-    file: File,
+    files: File[],
     vesselDepartureDate: string,
   ): Promise<{ hold?: boolean; holdReason?: string }> => {
     const form = new FormData();
-    form.append("file", file);
+    files.forEach((file) => form.append("files", file));
     form.append("vesselDepartureDate", vesselDepartureDate);
     const response = await client.post(B.CLEARANCE_RELEASE_ORDER(id), form, {
       headers: { "Content-Type": "multipart/form-data" },
diff --git a/apps/edr-freight-web/backoffice/src/services/contracts.service.ts b/apps/edr-freight-web/backoffice/src/services/contracts.service.ts
index 37971cb96..69ee89ca5 100644
--- a/apps/edr-freight-web/backoffice/src/services/contracts.service.ts
+++ b/apps/edr-freight-web/backoffice/src/services/contracts.service.ts
@@ -118,11 +118,14 @@ export interface ContractView {
   } | null;
 }
 
+/**
+ * No stamp field: the backoffice only ever counter-signs as STAFF, and EDR's
+ * seal is the ONE global company stamp, snapshotted server-side from
+ * StampSettingsService when the signature is stored.
+ */
 export interface SignContractPayload {
   role: "CUSTOMER" | "STAFF";
   signatureImageBase64: string;
-  /** Company stamp/seal image; required to sign a contract. */
-  stampImageBase64?: string;
   signerDisplayName: string;
   consentText?: string;
 }
@@ -468,11 +471,11 @@ export const contractsService = {
 
   uploadDeliveryOrder: async (
     id: string,
-    file: File,
+    files: File[],
     dates: { vesselArrivalDate: string; doCollectedDate: string },
   ): Promise<Freight.IContract> => {
     const form = new FormData();
-    form.append("file", file);
+    files.forEach((file) => form.append("files", file));
     form.append("vesselArrivalDate", dates.vesselArrivalDate);
     form.append("doCollectedDate", dates.doCollectedDate);
     const response = await client.post(C.CLEARANCE_DELIVERY_ORDER(id), form, {
@@ -483,11 +486,11 @@ export const contractsService = {
 
   uploadReleaseOrder: async (
     id: string,
-    file: File,
+    files: File[],
     vesselDepartureDate: string,
   ): Promise<{ contract: Freight.IContract; hold: boolean; holdReason?: string }> => {
     const form = new FormData();
-    form.append("file", file);
+    files.forEach((file) => form.append("files", file));
     form.append("vesselDepartureDate", vesselDepartureDate);
     const response = await client.post(C.CLEARANCE_RELEASE_ORDER(id), form, {
       headers: { "Content-Type": "multipart/form-data" },
diff --git a/apps/edr-freight-web/backoffice/src/services/customers.service.ts b/apps/edr-freight-web/backoffice/src/services/customers.service.ts
index eb86dd752..5b3cc4527 100644
--- a/apps/edr-freight-web/backoffice/src/services/customers.service.ts
+++ b/apps/edr-freight-web/backoffice/src/services/customers.service.ts
@@ -24,7 +24,7 @@ const cleanParams = (params: object) =>
     ),
   );
 
-/** Lift attributes JSONB into the flat contact/manager fields the UI reads. */
+/** Lift attributes JSONB into the flat contact/owner fields the UI reads. */
 function mapCompany(dto: Record<string, unknown>): Company {
   const attrs = (dto.attributes as Record<string, unknown> | null) ?? {};
   return {
@@ -32,9 +32,9 @@ function mapCompany(dto: Record<string, unknown>): Company {
     companyProfiles: (dto.companyProfiles as Company["companyProfiles"]) ?? [],
     contactPersonName: (attrs.contactPersonName as string | null) ?? null,
     contactPersonPhone: (attrs.contactPersonPhone as string | null) ?? null,
-    generalManagerName: (attrs.generalManagerName as string | null) ?? null,
-    generalManagerEmail: (attrs.generalManagerEmail as string | null) ?? null,
-    generalManagerPhone: (attrs.generalManagerPhone as string | null) ?? null,
+    ownerName: (attrs.ownerName as string | null) ?? null,
+    ownerEmail: (attrs.ownerEmail as string | null) ?? null,
+    ownerPhone: (attrs.ownerPhone as string | null) ?? null,
     poaName: (attrs.poaName as string | null) ?? null,
     poaEmail: (attrs.poaEmail as string | null) ?? null,
     poaPhone: (attrs.poaPhone as string | null) ?? null,
diff --git a/apps/edr-freight-web/backoffice/src/services/signatures.service.ts b/apps/edr-freight-web/backoffice/src/services/signatures.service.ts
index 6a71c1836..d0a2dfe17 100644
--- a/apps/edr-freight-web/backoffice/src/services/signatures.service.ts
+++ b/apps/edr-freight-web/backoffice/src/services/signatures.service.ts
@@ -9,12 +9,16 @@ export interface SavedSignature {
   stampImageUrl?: string | null;
 }
 
+/**
+ * Signature only. A backoffice employee has no personal stamp — EDR seals with
+ * the one global company stamp managed under Settings — so the stamp half of
+ * PUT /me/signature is deliberately not exposed here, even though the shared
+ * endpoint still accepts it for portal (customer) users.
+ */
 export interface SaveSignaturePayload {
   signerDisplayName: string;
-  /** Omit to keep the existing saved signature (stamp-only update). */
+  /** Omit to keep the existing saved signature. */
   signatureImageBase64?: string;
-  /** Omit to keep the existing saved stamp. */
-  stampImageBase64?: string;
 }
 
 export const signaturesService = {
diff --git a/apps/edr-freight-web/backoffice/src/services/stampSettings.service.ts b/apps/edr-freight-web/backoffice/src/services/stampSettings.service.ts
new file mode 100644
index 000000000..c88d4e08b
--- /dev/null
+++ b/apps/edr-freight-web/backoffice/src/services/stampSettings.service.ts
@@ -0,0 +1,31 @@
+import { api as client } from "../auth/http";
+import { unwrap } from "@/utils/endpoint";
+import type { ApiResponse } from "@/types/apiResponse";
+
+const BASE = "/stamp-settings";
+
+/** Company stamp/seal used on generated invoice/receipt PDFs. */
+export interface StampSettings {
+  stampImageUrl: string | null;
+  updatedById: string | null;
+  updatedAt: string | null;
+}
+
+export const stampSettingsService = {
+  get: async (): Promise<StampSettings> => {
+    const response = await client.get<ApiResponse<StampSettings>>(BASE);
+    return unwrap(response.data);
+  },
+
+  set: async (stampImageBase64: string): Promise<StampSettings> => {
+    const response = await client.put<ApiResponse<StampSettings>>(BASE, {
+      stampImageBase64,
+    });
+    return unwrap(response.data);
+  },
+
+  clear: async (): Promise<StampSettings> => {
+    const response = await client.delete<ApiResponse<StampSettings>>(BASE);
+    return unwrap(response.data);
+  },
+};
diff --git a/apps/edr-freight-web/backoffice/src/services/trainBuilder.service.ts b/apps/edr-freight-web/backoffice/src/services/trainBuilder.service.ts
index 3d2891415..2892cb0ec 100644
--- a/apps/edr-freight-web/backoffice/src/services/trainBuilder.service.ts
+++ b/apps/edr-freight-web/backoffice/src/services/trainBuilder.service.ts
@@ -309,8 +309,11 @@ export const trainBuilderService = {
   removeWagon: (id: string, wagonId: string) =>
     apiClient.delete<TrainComposition>(`${BASE}/${id}/wagons/${wagonId}`),
   /** Detach a wagon and move it to MAINTENANCE status. */
-  sendWagonToMaintenance: (id: string, wagonId: string) =>
-    apiClient.post<TrainComposition>(`${BASE}/${id}/wagons/${wagonId}/maintenance`),
+  /** `note` is the maintenance reason — recorded with the train it came off. */
+  sendWagonToMaintenance: (id: string, wagonId: string, note?: string) =>
+    apiClient.post<TrainComposition>(`${BASE}/${id}/wagons/${wagonId}/maintenance`, {
+      note,
+    }),
   reorderWagons: (id: string, wagonIds: string[]) =>
     apiClient.post<TrainComposition>(`${BASE}/${id}/reorder-wagons`, { wagonIds }),
   /** Park the train indefinitely — only allowed with no active schedule. */
diff --git a/apps/edr-freight-web/backoffice/src/services/trainScheduling.service.ts b/apps/edr-freight-web/backoffice/src/services/trainScheduling.service.ts
index 35dc23684..58e251196 100644
--- a/apps/edr-freight-web/backoffice/src/services/trainScheduling.service.ts
+++ b/apps/edr-freight-web/backoffice/src/services/trainScheduling.service.ts
@@ -29,6 +29,7 @@ import type {
   PinWagonsPayload,
   RecordCheckpointPayload,
   StaffBookingWindow,
+  ScheduleMergePreview,
   TrainScheduleDetail,
   UpdateScheduleWindowRulePayload,
   TrainScheduleFilters,
@@ -294,6 +295,29 @@ export const trainSchedulingService = {
     return unwrap(response.data);
   },
 
+  /** What a merge would do — drives the confirmation modal. Read-only. */
+  previewScheduleMerge: async (
+    scheduleId: string,
+    targetTrainId: string,
+  ): Promise<ScheduleMergePreview> => {
+    const response = await client.get<ScheduleMergePreview>(
+      URL_CONSTANTS.TRAIN_SCHEDULING.MERGE_PREVIEW(scheduleId, targetTrainId),
+    );
+    return unwrap(response.data);
+  },
+
+  /** Merge another train into this schedule. This schedule always survives. */
+  mergeScheduleTrain: async (
+    scheduleId: string,
+    payload: { targetTrainId: string; reason?: string },
+  ): Promise<TrainScheduleDetail> => {
+    const response = await client.post<TrainScheduleDetail>(
+      URL_CONSTANTS.TRAIN_SCHEDULING.MERGE_TRAIN(scheduleId),
+      payload,
+    );
+    return unwrap(response.data);
+  },
+
   markBookingPaid: async (bookingId: string): Promise<void> => {
     await client.post(
       URL_CONSTANTS.TRAIN_SCHEDULING.MARK_BOOKING_PAID(bookingId),
diff --git a/apps/edr-freight-web/backoffice/src/services/wagon.service.ts b/apps/edr-freight-web/backoffice/src/services/wagon.service.ts
index 858d26412..a2fc0c739 100644
--- a/apps/edr-freight-web/backoffice/src/services/wagon.service.ts
+++ b/apps/edr-freight-web/backoffice/src/services/wagon.service.ts
@@ -168,6 +168,10 @@ export interface WagonTransferRequest {
   closedShortByUserId?: string | null;
   /** Why the wagons are needed — required for new requests, shown on the queue. */
   reason?: string | null;
+  /** The wagons the requester hand-picked, if any. A preference, not a reservation. */
+  preferredWagonIds?: string[] | null;
+  /** Those same picks resolved to wagon numbers by the API, for display. */
+  preferredWagons?: Array<{ id: string; wagonNumber: string }>;
   note: string | null;
   fromYard?: { id: string; label?: string; code?: string } | null;
   toYard?: { id: string; label?: string; code?: string } | null;
@@ -182,6 +186,8 @@ export interface CreateTransferRequestPayload {
   quantity: number;
   /** Mandatory: why the wagons are needed. */
   reason: string;
+  /** Specific wagons the requester wants — at most `quantity` of them. */
+  preferredWagonIds?: string[];
   note?: string;
 }
 
diff --git a/apps/edr-freight-web/backoffice/src/types/booking.ts b/apps/edr-freight-web/backoffice/src/types/booking.ts
index 7ae93a1b7..e1c6b2cd6 100644
--- a/apps/edr-freight-web/backoffice/src/types/booking.ts
+++ b/apps/edr-freight-web/backoffice/src/types/booking.ts
@@ -64,9 +64,9 @@ export interface BookingCompany {
   email?: string | null;
   contactPersonName?: string | null;
   contactPersonPhone?: string | null;
-  generalManagerName?: string | null;
-  generalManagerEmail?: string | null;
-  generalManagerPhone?: string | null;
+  ownerName?: string | null;
+  ownerEmail?: string | null;
+  ownerPhone?: string | null;
   website?: string | null;
 }
 
@@ -143,6 +143,12 @@ export interface BookingTrainScheduleSummary {
   actualArrivalAt: string | null;
   windowPhase: string | null;
   paymentPhaseEndsAt: string | null;
+  /**
+   * True when this is the train the customer requested at day-commit rather
+   * than a confirmed allocation — what staff see while reviewing an operation
+   * request, before accepting puts the booking into the batch pool.
+   */
+  isRequested?: boolean;
 }
 
 export interface BookingDetail {
diff --git a/apps/edr-freight-web/backoffice/src/types/customer.ts b/apps/edr-freight-web/backoffice/src/types/customer.ts
index cd2d67842..87a71bf6e 100644
--- a/apps/edr-freight-web/backoffice/src/types/customer.ts
+++ b/apps/edr-freight-web/backoffice/src/types/customer.ts
@@ -179,23 +179,34 @@ export interface IdentityVerificationState {
   verifiedAt: string | null;
   birthdate: string | null;
   gender: string | null;
-}
-
-/** Mirrors `OwnerIdentityStateDto`. */
-export interface OwnerIdentityState extends IdentityVerificationState {
+  /** Typed passport number — the foreign-company alternative to Fayda. */
   passportNumber: string | null;
 }
 
 /**
- * Owner/PoA Fayda verification, shared with the portal's derivation
+ * The company's single identity verification, shared with the portal's derivation
  * (`buildCompanyIdentityState`) so backoffice never re-derives — or
  * disagrees with — the rule the API actually enforces.
  */
 export interface CompanyIdentityState {
-  faydaRequired: boolean;
-  passportRequired: boolean;
-  owner: OwnerIdentityState;
+  /** Foreign company: a passport number proves the person as Fayda would. */
+  passportAccepted: boolean;
+  /** Whether the company named a representative. Null = never answered. */
+  poaDeclared: "yes" | "no" | null;
+  /** Whose verification the company is gated on — PoA if declared, else owner. */
+  subject: "owner" | "poa" | null;
+  owner: IdentityVerificationState;
   poa: IdentityVerificationState;
+  identityProven: boolean;
+  /** The manager named on the eTrade licence, captured at lookup. */
+  etradeManagerName: string | null;
+  /**
+   * Does the owner the company put forward match the eTrade licence?
+   * THE reviewer check. Null when there is nothing to compare. Advisory —
+   * eTrade and Fayda transliterate Amharic names differently, so a `false` is
+   * "look at this", not "reject this".
+   */
+  ownerMatchesEtrade: boolean | null;
   complete: boolean;
 }
 
@@ -211,14 +222,21 @@ export interface Company {
   fanNumber?: string | null;
   country: string;
   nationality?: CompanyNationality | null;
+  /**
+   * A co-operative union or farm: a TIN but no trade licence, so its
+   * registration was typed rather than fetched from eTrade, there is no eTrade
+   * manager to check the owner against, and it holds no freight-forwarder role.
+   */
+  cooperative?: boolean;
   address?: string | null;
   phone?: string | null;
   email?: string | null;
   contactPersonName?: string | null;
   contactPersonPhone?: string | null;
-  generalManagerName?: string | null;
-  generalManagerEmail?: string | null;
-  generalManagerPhone?: string | null;
+  /** The owner — whoever the eTrade licence names as the business's manager. */
+  ownerName?: string | null;
+  ownerEmail?: string | null;
+  ownerPhone?: string | null;
   poaName?: string | null;
   poaEmail?: string | null;
   poaPhone?: string | null;
diff --git a/apps/edr-freight-web/backoffice/src/types/trainScheduling.ts b/apps/edr-freight-web/backoffice/src/types/trainScheduling.ts
index 94e393e1b..dd6508b73 100644
--- a/apps/edr-freight-web/backoffice/src/types/trainScheduling.ts
+++ b/apps/edr-freight-web/backoffice/src/types/trainScheduling.ts
@@ -217,7 +217,28 @@ export interface TrainScheduleListItem {
     name?: string | null;
     currentYardId?: string | null;
   }>;
+  /** Coupled consist size. NOT the used count — see `wagonsUsed`. */
   wagonCount: number;
+  /**
+   * Wagon slots actually carrying a booking allocation — the same figure the
+   * detail page's wagon plan shows. Optional until every API deploy carries it.
+   */
+  wagonsUsed?: number;
+  /** Coupled consist size; the denominator of `wagonsUsed`. */
+  wagonsTotal?: number;
+  /** Wagons claimed by bookings (including unpaid) — not bookable. */
+  wagonsReserved?: number;
+  /** Wagons still bookable: consist minus what bookings have claimed. */
+  wagonsRemaining?: number;
+  /**
+   * Planned wagon ceiling for the departure, set when the schedule is created.
+   * Independent of the coupled consist — a schedule can plan 37 wagons before a
+   * single one is coupled, which is why this is the bookable figure until the
+   * train set is built.
+   */
+  maxWagons?: number;
+  /** Plan ceiling minus the coupled consist — room left to couple. */
+  remainingWagons?: number;
   totalWeightTons: number;
   totalLengthMeters: number;
   bookingsCount: number;
@@ -571,6 +592,35 @@ export interface UpdateScheduleWindowRulePayload {
   exportBookingLeadHours?: number;
 }
 
+/** One schedule touched by a merge, as summarised for the confirmation modal. */
+export interface MergeAffectedSchedule {
+  id: string;
+  reference: string | null;
+  scheduledDepartureDate: string;
+  status: string;
+}
+
+/**
+ * What merging a train into a schedule would do, computed server-side so the
+ * modal shows exactly what the commit will perform.
+ */
+export interface ScheduleMergePreview {
+  canMerge: boolean;
+  /** Why the merge is refused. Empty when `canMerge` is true. */
+  blockers: string[];
+  targetTrain: { id: string; code: string; trainNumber: string | null };
+  wagons: { current: number; incoming: number; merged: number };
+  /** The same-day schedule whose bookings move here; it is then removed. */
+  absorbedSchedule:
+    | (MergeAffectedSchedule & { bookingsMoving: number })
+    | null;
+  /** Other draft/scheduled schedules on the target — they gain wagons only. */
+  affectedSchedules: MergeAffectedSchedule[];
+  /** On the target train but left alone (dispatched, cancelled, …). */
+  untouchedSchedules: MergeAffectedSchedule[];
+  sourceTrainWillDeactivate: boolean;
+}
+
 export interface TrainScheduleDetail {
   id: string;
   reference?: string | null;
@@ -578,6 +628,8 @@ export interface TrainScheduleDetail {
   deferredBookings?: DeferredBookingRow[];
   freightType?: FreightType | null;
   trainNumber?: string | null;
+  /** Voyage (sailing) number for this departure — editable until dispatch. */
+  voyageNumber?: string | null;
   /** Wagon cap for this departure (built-train consist size or configured limit). */
   maxWagons?: number | null;
   /** Built train (Train Builder) behind this departure, when scheduled by train. */
@@ -621,6 +673,8 @@ export interface TrainScheduleDetail {
   trainSet?: {
     id: string;
     status: string;
+    /** The built train this set runs on — null when it has none yet. */
+    trainId?: string | null;
     wagonCount: number;
     totalWeightTons: number;
     totalLengthMeters: number;
diff --git a/apps/edr-freight-web/backoffice/src/user-management/route.tsx b/apps/edr-freight-web/backoffice/src/user-management/route.tsx
index f1e2a8611..a336b3f9f 100644
--- a/apps/edr-freight-web/backoffice/src/user-management/route.tsx
+++ b/apps/edr-freight-web/backoffice/src/user-management/route.tsx
@@ -3,7 +3,7 @@ import { Navigate, Outlet, Route } from "react-router-dom";
 
 import { useAuth } from "@/auth/useAuth";
 import { NO_ACCESS_PATH, resolveLandingPath } from "@/lib/landing";
-import { isSuperAdmin } from "@/lib/permissions";
+import { FREIGHT_PERMS, isSuperAdmin } from "@/lib/permissions";
 import { WithPermission } from "@/shared/hooks/useHas";
 import PendingExternalUsers from "@/super-admin/components/externalUsers/PendingExternalUsers";
 import TemplatePage from "@/super-admin/components/templates/components/templates";
@@ -44,6 +44,8 @@ import { SidebarProvider } from "@/shared/common/ui/sidebar";
 import { AuthProvider as UmAuthProvider } from "@/shared/context/AuthContext";
 import { PermissionProvider } from "@/shared/context/PermissionContext";
 import UserManagementPage from "@/pages/UserManagementPage";
+import { RequirePermission } from "@/components/auth/RequirePermission";
+import UploadTeeterAndSignature from "@/record-management/components/Settings/uploadTeeterandSingature";
 
 /**
  * Provider shell for the vendored IAM UI. Feeds its Auth + Permission contexts
@@ -138,6 +140,29 @@ export function UserManagementRoutes(): ReactElement {
                           path="user-management/position-management"
                           element={<PositionManagementPage />}
                         />
+                        {/*
+                          The per-officer teeter (ማህተም) + signature upload. This
+                          is NOT the company stamp: it is the individual approval
+                          stamp a record officer applies to records, locale-aware
+                          (am/en) and genuinely per-person. It used to sit at
+                          /dashboard/stamp-settings under Settings, next to the
+                          single global company stamp, which read as duplication.
+
+                          Gated by settings:teeter:*, split out of settings:stamp:*
+                          when the two were untangled — settings:stamp:* now means
+                          the company stamp, so anyone who held it for the teeter
+                          needs the new key granted.
+                        */}
+                        <Route
+                          path="user-management/teeter-and-signature"
+                          element={
+                            <RequirePermission
+                              permission={FREIGHT_PERMS.settings.teeter.view}
+                            >
+                              <UploadTeeterAndSignature />
+                            </RequirePermission>
+                          }
+                        />
                         <Route
                           path="user-management/migrated-records-management"
                           element={<MigratedDataManagementPage />}
diff --git a/apps/edr-freight-web/portal/src/components/onboarding/ETradeInfo.tsx b/apps/edr-freight-web/portal/src/components/onboarding/ETradeInfo.tsx
index 56273351d..acedc57f5 100644
--- a/apps/edr-freight-web/portal/src/components/onboarding/ETradeInfo.tsx
+++ b/apps/edr-freight-web/portal/src/components/onboarding/ETradeInfo.tsx
@@ -11,7 +11,7 @@ import {
 } from "@mantine/core";
 import { useEffect, useRef, useState } from "react";
 import type { UseFormRegisterReturn } from "react-hook-form";
-import { AlertCircle, Building2, Download } from "lucide-react";
+import { AlertCircle, Building2, Download, Info } from "lucide-react";
 import { useETradeData } from "@/hooks/useETradeData";
 import { extractApiError } from "@/utils/result";
 import type { CompanyRegistrationData } from "@edr/types";
@@ -54,6 +54,14 @@ interface ETradeInfoProps {
    * than silently snapping to eTrade's first one.
    */
   selectedLicenceNumber?: string;
+  /**
+   * A record is worth having but not required — a co-operative union or farm
+   * registers on a TIN alone, so eTrade may legitimately hold nothing for it.
+   * The lookup still runs (plenty of co-operatives DO have a record, and it
+   * beats typing), but "not found" stops being a red dead end and becomes the
+   * expected outcome, with the form below to fill in by hand.
+   */
+  registrationOptional?: boolean;
 }
 
 // Digits, not just length: a 10-character non-numeric TIN used to fire a lookup
@@ -70,6 +78,7 @@ export default function ETradeInfo({
   onReset,
   alreadyVerified,
   selectedLicenceNumber,
+  registrationOptional = false,
 }: ETradeInfoProps) {
   const mutation = useETradeData();
   const isLoading = mutation.isPending;
@@ -327,16 +336,26 @@ export default function ETradeInfo({
         </Stack>
       )}
 
-      {notFound && (
-        <Alert
-          icon={<AlertCircle size={16} />}
-          color="red"
-          title="No matching business record"
-        >
-          This TIN isn't registered with eTrade. Check the number — we can't
-          continue without a matching business record.
-        </Alert>
-      )}
+      {notFound &&
+        (registrationOptional ? (
+          <Alert
+            icon={<Info size={16} />}
+            color="blue"
+            title="Nothing on file at eTrade for this TIN"
+          >
+            That's expected without a trade licence. Fill in your registration
+            details below and we'll take them as you give them.
+          </Alert>
+        ) : (
+          <Alert
+            icon={<AlertCircle size={16} />}
+            color="red"
+            title="No matching business record"
+          >
+            This TIN isn't registered with eTrade. Check the number — we can't
+            continue without a matching business record.
+          </Alert>
+        ))}
 
       {errorMessage && (
         <Alert
diff --git a/apps/edr-freight-web/portal/src/components/onboarding/OnboardingWizardDialog.tsx b/apps/edr-freight-web/portal/src/components/onboarding/OnboardingWizardDialog.tsx
index fa9c5919b..d5a87a4ee 100644
--- a/apps/edr-freight-web/portal/src/components/onboarding/OnboardingWizardDialog.tsx
+++ b/apps/edr-freight-web/portal/src/components/onboarding/OnboardingWizardDialog.tsx
@@ -1,6 +1,7 @@
 import {
   Box,
   Button,
+  Checkbox,
   Group,
   Modal,
   ScrollArea,
@@ -38,15 +39,21 @@ import type {
 } from "@/services/companies.service";
 import { companiesService } from "@/services/companies.service";
 import type { UpdateProfilePayload } from "@/types/profile";
+import { documentSettingCode } from "@/utils/documentSettingCode";
 import { extractApiError } from "@/utils/result";
 
 /** Form steps rendered by CompanyProfileForm. */
-type FormStep = "company" | "personnel" | "contact" | "poa" | "documents";
+type FormStep =
+  | "company"
+  | "owner"
+  | "representation"
+  | "contact"
+  | "documents";
 const FORM_STEPS: FormStep[] = [
   "company",
-  "personnel",
+  "owner",
+  "representation",
   "contact",
-  "poa",
   "documents",
 ];
 
@@ -68,23 +75,25 @@ const STEP_META: Record<
     icon: <Building2 size={20} />,
     title: "Company Information",
     description:
-      "Confirm your VAT number, verify the owner's identity, and we'll pull your registration from eTrade.",
+      "Confirm your VAT number and we'll pull your registration straight from eTrade.",
   },
-  personnel: {
+  owner: {
     icon: <User size={20} />,
-    title: "General Manager",
-    description: "Who is the general manager of the company?",
+    title: "Company Owner",
+    description:
+      "The person registered on your eTrade licence. We fill in what eTrade and Fayda gave us.",
+  },
+  representation: {
+    icon: <FileText size={20} />,
+    title: "Who Acts For You",
+    description:
+      "Tell us whether anyone holds power of attorney — your answer decides whose identity we verify.",
   },
   contact: {
     icon: <UserCheck size={20} />,
     title: "Contact Person",
     description: "Who should we reach out to about this account?",
   },
-  poa: {
-    icon: <FileText size={20} />,
-    title: "Power of Attorney",
-    description: "Optionally add a representative with power of attorney.",
-  },
   documents: {
     icon: <UploadCloud size={20} />,
     title: "Upload Documents",
@@ -108,13 +117,6 @@ function companyTypeForRoles(_roles: string[]): string {
   return "customer";
 }
 
-/** Document upload setting code per company nationality. */
-function documentSettingCode(nationality: CompanyNationality): string {
-  return nationality === "foreign"
-    ? "company_onboarding_documents_foreign"
-    : "company_onboarding_documents_ethiopian";
-}
-
 /**
  * First-run onboarding wizard with a "draft-first" flow: picking the role(s)
  * immediately creates a draft company + profile on the backend, so every
@@ -157,6 +159,20 @@ export default function OnboardingWizardDialog({
   const [roles, setRoles] = useState<string[]>(
     existingProfiles.map((p) => p.type),
   );
+  const [cooperative, setCooperative] = useState<boolean>(
+    company?.company?.attributes?.cooperative === true,
+  );
+  // Ticking the box drops the selections the company can no longer hold, rather
+  // than letting Continue fail on ones the API refuses: a co-op cannot forward
+  // freight, and is registered in Ethiopia so it is never foreign.
+  const handleCooperativeChange = useCallback((checked: boolean) => {
+    setCooperative(checked);
+    if (checked) {
+      setRoles((prev) => prev.filter((r) => r !== "freight_forwarder"));
+      // Ethiopian is then the only answer left, so it is made rather than asked.
+      setNationality("ethiopian");
+    }
+  }, []);
   const [documentFiles, setDocumentFiles] = useState<
     Record<string, File | File[] | null>
   >({});
@@ -207,10 +223,11 @@ export default function OnboardingWizardDialog({
       companyType: string;
       roles: ProfileTypeValue[];
       nationality?: CompanyNationality;
+      cooperative?: boolean;
     }) => api.companies.startOnboarding.call(vars),
     onSuccess: async () => {
       // Nationality drives the server-resolved identity requirements (Fayda vs
-      // passport), the document set and the GM/PoA copy — all read from
+      // passport), the document set and the PoA copy — all read from
       // onboardingRequirements/profile. Re-entering role selection can change
       // it, so both must be refetched alongside getInfo or the form step would
       // keep rendering the previous nationality's requirements.
@@ -289,6 +306,7 @@ export default function OnboardingWizardDialog({
     resumedRef.current = true;
     setRoles(existingProfiles.map((p) => p.type));
     setNationality(savedNationality);
+    setCooperative(company?.company?.attributes?.cooperative === true);
     // Resume into the form only when profiles exist; otherwise send the user to
     // role selection so the missing operational profiles get created.
     setPhase(hasOperationalProfiles ? "form" : "nationality-role");
@@ -303,8 +321,9 @@ export default function OnboardingWizardDialog({
       companyType: companyTypeForRoles(roles),
       roles: roles as ProfileTypeValue[],
       nationality: nationality ?? undefined,
+      cooperative,
     });
-  }, [roles, nationality, startMutation]);
+  }, [roles, nationality, cooperative, startMutation]);
 
   // Back from the form's first step returns to nationality/role selection.
   // Safe to re-enter: startOnboarding is idempotent — it reuses the existing
@@ -399,7 +418,7 @@ export default function OnboardingWizardDialog({
   // after the draft — and thus the requirements — exist).
   const resolvedDocumentSettingCode =
     requirementsQuery.data?.documentSettingCode ??
-    documentSettingCode(effectiveNationality);
+    documentSettingCode(effectiveNationality, cooperative);
 
   // Server-confirmed document state, used both to badge already-uploaded fields
   // and to keep a refreshed resume from over-shooting the documents step.
@@ -414,15 +433,21 @@ export default function OnboardingWizardDialog({
   const requiredDocsMissing = requirementDocuments.some(
     (d) => d.isRequired && !d.uploaded,
   );
-  // The PoA gets the same treatment: a resumed draft that predates the
-  // delegation-letter requirement (or a forwarder whose PoA is blank) must land
-  // back on the PoA step, where both the details and the letter are entered.
-  const poaIncomplete = requirementsQuery.data?.poa?.complete === false;
+  // The representation step gets the same treatment. An unanswered
+  // power-of-attorney question, or a declared representative still missing
+  // details or the DARS paper, must land the customer back on the step where
+  // all of that is entered — including a draft that predates the question
+  // existing at all, whose `declared` comes back null.
+  const representationIncomplete =
+    requirementsQuery.data?.poa?.declared == null ||
+    requirementsQuery.data?.poa?.complete === false ||
+    requirementsQuery.data?.identity?.identityProven === false;
   // Each unmet requirement lowers the ceiling; resume never moves forward.
   let ceiling = FORM_STEPS.length - 1;
   if (requiredDocsMissing)
     ceiling = Math.min(ceiling, FORM_STEPS.indexOf("documents"));
-  if (poaIncomplete) ceiling = Math.min(ceiling, FORM_STEPS.indexOf("poa"));
+  if (representationIncomplete)
+    ceiling = Math.min(ceiling, FORM_STEPS.indexOf("representation"));
   const effectiveResumeStep: FormStep =
     FORM_STEPS[
     Math.min(Math.max(FORM_STEPS.indexOf(resumeFormStep), 0), ceiling)
@@ -446,10 +471,17 @@ export default function OnboardingWizardDialog({
     onLicenseChange: setLicenseFiles,
     uploadedDocumentKeys,
     onUploadDocuments: handleUploadDocuments,
-    // Fayda verification state for the owner and the PoA — the general manager
-    // stays a plain typed role. Mandatory (Fayda) for an Ethiopian company;
-    // a foreign one requires a typed passport number for the owner instead.
+    // The company's single identity verification, and whose it is. Fayda is
+    // mandatory for an Ethiopian company; a foreign one may instead type a
+    // passport number for the same person.
     identity: requirementsQuery.data?.identity,
+    // Server-confirmed, not the local checkbox: the flag is only real once
+    // startOnboarding has persisted it, and the form's whole company step
+    // branches on it.
+    cooperative: requirementsQuery.data?.cooperative ?? cooperative,
+    // A freight forwarder cannot answer the power-of-attorney question — the
+    // API forces "yes" — so the step offers no way to change it.
+    declarationLocked: requirementsQuery.data?.poa?.locked ?? false,
     onIdentityChange: () => {
       void profileQuery.refetch();
       void requirementsQuery.refetch();
@@ -516,6 +548,20 @@ export default function OnboardingWizardDialog({
                 value={nationality}
                 onChange={setNationality}
                 embedded
+                // A co-op is registered in Ethiopia by the co-operative
+                // promotion agency — foreign is not on offer rather than
+                // refused later.
+                excludeForeign={cooperative}
+              />
+              {/* A co-operative union or farm registers on a TIN alone. It
+                  changes what the next step asks for (typed registration, no
+                  eTrade lookup), which documents apply, and which roles are on
+                  offer — so it is answered here, alongside the other two. */}
+              <Checkbox
+                checked={cooperative}
+                onChange={(e) => handleCooperativeChange(e.currentTarget.checked)}
+                label="We're a co-operative union or farm"
+                description="For members with a TIN but no business licence. You'll type your registration details instead of us pulling them from eTrade, and upload your co-operative papers in place of a trade licence."
               />
               <Text fw={600} size="lg" c="edr-text">
                 What does your company do?(multiple)
@@ -524,6 +570,9 @@ export default function OnboardingWizardDialog({
                 value={roles}
                 onChange={setRoles}
                 embedded
+                // Forwarding is licensed work — a co-op holds no licence, so
+                // the role is not offered rather than refused later.
+                excludeTypes={cooperative ? ["freight_forwarder"] : undefined}
               />
               {startError && (
                 <Text size="sm" c="red">
diff --git a/apps/edr-freight-web/portal/src/components/onboarding/RoleLicenseStep.tsx b/apps/edr-freight-web/portal/src/components/onboarding/RoleLicenseStep.tsx
index a485d40c1..8270bce74 100644
--- a/apps/edr-freight-web/portal/src/components/onboarding/RoleLicenseStep.tsx
+++ b/apps/edr-freight-web/portal/src/components/onboarding/RoleLicenseStep.tsx
@@ -50,7 +50,7 @@ function buildLicenseSetting(
         isMultiple: true,
         maxFiles: 10,
         allowedExtensions: ["pdf", "png", "jpg", "jpeg"],
-        maxSizeMb: 10,
+        maxSizeMb: 25,
         order: 1,
       },
     ],
diff --git a/apps/edr-freight-web/portal/src/pages/SettingsPage.tsx b/apps/edr-freight-web/portal/src/pages/SettingsPage.tsx
index 8a2f1d12f..13b0d4025 100644
--- a/apps/edr-freight-web/portal/src/pages/SettingsPage.tsx
+++ b/apps/edr-freight-web/portal/src/pages/SettingsPage.tsx
@@ -49,49 +49,46 @@ import TabAccount from "./settings/TabAccount";
 import TabCompanyProfile from "./settings/TabCompanyProfile";
 import TabContactPerson from "./settings/TabContactPerson";
 import TabDocuments from "./settings/TabDocuments";
-import TabGeneralManager from "./settings/TabGeneralManager";
+import TabOwner from "./settings/TabOwner";
 import TabPowerOfAttorney from "./settings/TabPowerOfAttorney";
 
 type SettingsTab =
   | "account"
   | "company"
   | "contact"
-  | "gm"
+  | "owner"
   | "poa"
   | "documents";
 
 /** A section is "incomplete" when its required fields aren't filled in yet. */
 function tabIncomplete(tabId: SettingsTab, profile: ProfileResponse): boolean {
   switch (tabId) {
-    case "company": {
-      // Identity proof lives here: the owner's Fayda verification for an
-      // Ethiopian company, or the owner's typed passport number for a foreign
-      // one.
-      const identity = profile.identity;
-      const identityIncomplete = identity
-        ? (identity.faydaRequired && !identity.owner.verified) ||
-        (identity.passportRequired && !identity.owner.passportNumber)
-        : false;
-      return !profile.companyAddress || identityIncomplete;
-    }
+    case "company":
+      return !profile.companyAddress;
     case "contact":
       return !profile.contactPersonName || !profile.contactPersonPhone;
-    case "gm":
-      // The GM is established through Fayda — verified in their own right or
-      // declared the same person as the owner — so the identity answers this,
-      // not the typed columns. A company that may still type them (foreign,
-      // whose manager may hold no Fayda ID) is judged on those instead.
-      if (profile.identity?.gm.verified) return false;
-      if (profile.identity?.faydaRequired) return true;
+    case "owner":
+      // The owner is whoever the eTrade licence names. All three details are
+      // required whatever supplied them, and the identity verification lives
+      // on whichever person the PoA declaration points at — flagged here when
+      // it is the owner and still unproven.
       return (
-        !profile.generalManagerName ||
-        !profile.generalManagerEmail ||
-        !profile.generalManagerPhone
+        !profile.ownerName ||
+        !profile.ownerEmail ||
+        !profile.ownerPhone ||
+        (profile.identity?.subject === "owner" &&
+          !profile.identity.identityProven)
+      );
+    case "poa":
+      // Unanswered is itself incomplete — the answer decides whose identity is
+      // verified — as is a declared representative who has not proved theirs.
+      if (profile.identity?.poaDeclared == null) return true;
+      return (
+        profile.identity.subject === "poa" && !profile.identity.identityProven
       );
     case "account":
     // Account fields live on the IAM user, not the company profile, and are
     // always populated (signup requires them) — nothing to nag about here.
-    case "poa":
     case "documents":
       return false;
   }
@@ -101,7 +98,7 @@ const TABS: { id: SettingsTab; label: string; icon: React.ReactNode }[] = [
   { id: "account", label: "Account", icon: <UserCog size={16} /> },
   { id: "company", label: "Company", icon: <Building2 size={16} /> },
   { id: "contact", label: "Contact Person", icon: <User size={16} /> },
-  { id: "gm", label: "General Manager", icon: <Briefcase size={16} /> },
+  { id: "owner", label: "Owner", icon: <Briefcase size={16} /> },
   { id: "poa", label: "Power of Attorney", icon: <UserCheck size={16} /> },
   { id: "documents", label: "Documents", icon: <FileCheck size={16} /> },
 ];
@@ -405,8 +402,8 @@ export default function SettingsPage() {
           <Tabs.Panel value="contact">
             <TabContactPerson profile={profile} mode="edit" />
           </Tabs.Panel>
-          <Tabs.Panel value="gm">
-            <TabGeneralManager profile={profile} mode="edit" />
+          <Tabs.Panel value="owner">
+            <TabOwner profile={profile} mode="edit" />
           </Tabs.Panel>
           <Tabs.Panel value="poa">
             <TabPowerOfAttorney profile={profile} mode="edit" />
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/CompanyProfileForm.tsx b/apps/edr-freight-web/portal/src/pages/accounts/CompanyProfileForm.tsx
index 92e1a7118..aa445974f 100644
--- a/apps/edr-freight-web/portal/src/pages/accounts/CompanyProfileForm.tsx
+++ b/apps/edr-freight-web/portal/src/pages/accounts/CompanyProfileForm.tsx
@@ -9,7 +9,6 @@ import type { AuthUser } from "@/types/auth";
 import type { CreateCompanyPayload } from "@/services/companies.service";
 import type { ProfileResponse, UpdateProfilePayload } from "@/types/profile";
 import type { CompanyRegistrationData } from "@edr/types";
-import { toEthiopianE164 } from "@/components/PhoneField";
 import { getMinFiles } from "@/types/fileUploadSettings";
 import { api } from "@/services/api";
 import type { RoleLicenseProfile } from "@/components/onboarding/RoleLicenseStep";
@@ -27,15 +26,21 @@ import {
   firstValidEmail,
   firstValidPhone,
   normalizeIdentityPhones,
+  resolveOwnerSources,
   stepPayload,
   toFormValues,
 } from "./companyProfileForm/helpers";
 import { verifaydaService } from "@/services/verifayda.service";
-import type { CompanyIdentityState } from "@/services/verifayda.service";
+import type {
+  CompanyIdentityState,
+  PoaDeclaration,
+} from "@/services/verifayda.service";
 import CompanyInfoStep from "./companyProfileForm/steps/CompanyInfoStep";
-import PersonnelStep from "./companyProfileForm/steps/PersonnelStep";
+import OwnerStep from "./companyProfileForm/steps/OwnerStep";
 import ContactStep from "./companyProfileForm/steps/ContactStep";
-import PoaStep from "./companyProfileForm/steps/PoaStep";
+import RepresentationStep, {
+  type IdentityMethod,
+} from "./companyProfileForm/steps/RepresentationStep";
 import DocumentsStep from "./companyProfileForm/steps/DocumentsStep";
 
 export default function CompanyProfileForm({
@@ -59,6 +64,8 @@ export default function CompanyProfileForm({
   onUploadDocuments,
   identity: rawIdentity,
   onIdentityChange,
+  cooperative = false,
+  declarationLocked = false,
 }: {
   documentSettingCode: string;
   documentFiles?: Record<string, File | File[] | null>;
@@ -96,7 +103,7 @@ export default function CompanyProfileForm({
   onUploadDocuments?: () => Promise<
     { ok: true } | { ok: false; error: string }
   >;
-  /** Fayda verification state for the owner and the PoA (undefined until loaded). */
+  /** The company's single identity verification (undefined until loaded). */
   identity?: CompanyIdentityState;
   /**
    * Refetch the profile + requirements. Only the in-page identity actions need
@@ -104,6 +111,18 @@ export default function CompanyProfileForm({
    * a freshly booted app, so it has nothing to notify.
    */
   onIdentityChange?: () => void;
+  /**
+   * The company trades as a co-operative: a TIN but no business licence, so the
+   * eTrade lookup is replaced by typed registration details, the per-role
+   * licence upload is not owed, and its own document set applies instead of the
+   * nationality one (resolved by the caller into `documentSettingCode`).
+   */
+  cooperative?: boolean;
+  /**
+   * The company operates as a freight forwarder, so the power-of-attorney
+   * answer is forced to "yes" and cannot be changed here.
+   */
+  declarationLocked?: boolean;
 }) {
   // A Fayda claim carries the phone as the national registry holds it, which is
   // often a local number the form's E.164 validation (and the API's
@@ -116,7 +135,24 @@ export default function CompanyProfileForm({
 
   const [step, setStep] = useState<CompanyStep>(initialStep ?? "company");
   const [saving, setSaving] = useState(false);
-  const [saveError, setSaveError] = useState<string | null>(null);
+  /**
+   * What is holding this step back.
+   *
+   * `kind` only picks the title. Most of these never reach the API at all —
+   * they are the step's own gates (a TIN eTrade hasn't confirmed, an
+   * unanswered declaration, a missing paper) — and heading every one of them
+   * "Couldn't save this step" told the customer a request failed when none was
+   * made, which reads as a bug on our side rather than a field to go fix.
+   */
+  const [saveError, setSaveError] = useState<{
+    kind: "check" | "save";
+    message: string;
+  } | null>(null);
+  /** A step gate or a validation failure: something on screen to correct. */
+  const failCheck = (message: string) =>
+    setSaveError({ kind: "check", message });
+  /** The API refused the save; the message is the server's, shown verbatim. */
+  const failSave = (message: string) => setSaveError({ kind: "save", message });
   // Live eTrade lookup status, reported up by ETradeInfo — drives the Continue
   // gate on the company step.
   const [tinStatus, setTinStatus] = useState<ETradeStatus>("idle");
@@ -148,7 +184,7 @@ export default function CompanyProfileForm({
 
   // Follow a parent-driven resume correction: if initialStep changes (the wizard
   // re-clamps it back once onboarding requirements load — e.g. a required
-  // document is still missing, so it must not skip ahead to Business License),
+  // document is still missing, so it must not skip ahead to the documents step),
   // adopt it, but only while the user hasn't started navigating themselves.
   const lastInitialStep = useRef(initialStep);
   useEffect(() => {
@@ -167,6 +203,9 @@ export default function CompanyProfileForm({
   const documentFiles = controlledFiles ?? internalFiles;
   const setDocumentFiles = onDocumentFilesChange ?? setInternalFiles;
 
+  // One set applies: the company's nationality set, or the co-operative one in
+  // its place — the caller resolves which (the API resolves the same way when
+  // it decides what is outstanding).
   const { data: uploadSetting, isLoading: loadingDocuments } = useQuery(
     api.fileUploadSettings.getByCode.queryOptions({
       input: { code: documentSettingCode },
@@ -174,16 +213,6 @@ export default function CompanyProfileForm({
     }),
   );
 
-  // A freight forwarder signs on other companies' behalf, so its Power of
-  // Attorney (details + DARS delegation paper) is mandatory rather than optional.
-  const requirePoa = (roleProfiles ?? []).some(
-    (p) => p.type === "freight_forwarder",
-  );
-  // Fayda is an Ethiopian national ID: an Ethiopian company verifies its owner
-  // and PoA instead of typing their details, a foreign one keeps the typed
-  // forms (plus a mandatory owner passport number).
-  const verifiedIdentity = identity?.faydaRequired === true;
-
   // Which fields the current step renders an input for and therefore requires.
   // Filled in further down (it depends on values this form owns), and read at
   // validation time rather than at render time — the resolver below runs on
@@ -192,16 +221,15 @@ export default function CompanyProfileForm({
 
   const form = useForm<FormData>({
     resolver: (values, context, options) =>
-      zodResolver(
-        buildOnboardingSchema(
-          identity?.passportRequired === true,
-          requiredKeysRef.current,
-        ),
-      )(values, context, options),
+      zodResolver(buildOnboardingSchema(requiredKeysRef.current))(
+        values,
+        context,
+        options,
+      ),
     // `values` below re-seeds the form whenever the profile is refetched — and
-    // an in-page identity action (ticking "same as owner") refetches it. Without
-    // this, that reset silently throws away whatever the customer was part-way
-    // through typing on the current step.
+    // an in-page identity action (answering the PoA question) refetches it.
+    // Without this, that reset silently throws away whatever the customer was
+    // part-way through typing on the current step.
     resetOptions: { keepDirtyValues: true, keepErrors: true },
     defaultValues: {
       companyName: "",
@@ -210,6 +238,7 @@ export default function CompanyProfileForm({
       tinNumber: "",
       vatNumber: "",
       ownerPassportNumber: "",
+      poaPassportNumber: "",
       licenceNumber: "",
       statusDescription: "",
       dateRegistered: "",
@@ -225,12 +254,11 @@ export default function CompanyProfileForm({
       contactPersonPosition: "",
       contactPersonEmail: "",
       contactPersonPhone: "",
-      generalManagerName: "",
-      generalManagerEmail: "",
-      generalManagerPhone: "",
+      ownerName: "",
+      ownerEmail: "",
+      ownerPhone: "",
       poaName: "",
       poaPhone: "",
-      poaAddress: "",
       poaEmail: "",
       poaLocation: "",
     },
@@ -248,14 +276,23 @@ export default function CompanyProfileForm({
     formState: { dirtyFields },
   } = form;
 
-  // The contact person's email still just seeds from the account and stays editable.
+  // Retire the alert the moment the customer starts acting on it. It was only
+  // ever cleared on navigation, so a red "fix these fields" banner sat above a
+  // form they had already fixed, right until they pressed Continue again —
+  // which reads as an error the page is refusing to let go of.
   useEffect(() => {
-    if (!user?.email) return;
-    if (!watch("contactPersonEmail")) {
-      setValue("contactPersonEmail", user.email);
-    }
+    const sub = watch(() => setSaveError(null));
+    return () => sub.unsubscribe();
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [user?.email, rehydrate]);
+  }, []);
+
+  // Nothing seeds the contact person's email. It used to be prefilled from the
+  // signed-in account, on the same assumption the owner fields were cleared of:
+  // the person doing the onboarding is routinely not the person the company
+  // wants contacted. Prefilled and editable is still prefilled — it is accepted
+  // as-is far more often than it is corrected, so the account address ends up on
+  // file as the company's contact by default rather than by anyone's decision.
+  // The field is optional, so an empty one costs nothing.
 
   // Keep the (hidden, derived) company address in sync with the editable address
   // fields — so it reflects both the eTrade auto-fill and any later user edits,
@@ -269,22 +306,63 @@ export default function CompanyProfileForm({
     const composed = [houseNo, kebele, woreda, zone, region]
       .filter((part) => part && part.trim())
       .join(", ");
+    // No parts means nothing to compose from — the lookup hasn't landed yet, or
+    // this is the render before rehydration. Writing "" here would replace a
+    // saved address with a blank on the next company-step save.
+    if (!composed) return;
     setValue("companyAddress", composed);
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [region, zone, woreda, kebele, houseNo]);
 
-  // The business owner/manager pulled from eTrade — powers "Use owner as
-  // manager" on the General Manager step. Null until a TIN lookup succeeds.
-  const [etradeOwner, setEtradeOwner] = useState<{
+  // The manager eTrade lists for this licence, as returned by a lookup made in
+  // THIS session. This is the person the owner step is about — "owner" here
+  // means whoever the licence names, and the backoffice checks the stored owner
+  // against exactly this.
+  const [liveEtradeOwner, setLiveEtradeOwner] = useState<{
     name: string;
     phone: string;
   } | null>(null);
+  // The TIN moved off the last verified lookup, so the persisted manager below
+  // describes a licence this company is no longer claiming. Without this, a
+  // reset would re-lock the owner fields against stale data the moment the
+  // memo below fell back to the server's copy.
+  const [etradeCleared, setEtradeCleared] = useState(false);
+
+  /**
+   * The eTrade manager, live lookup or not.
+   *
+   * The lookup result dies with the page, but the fact that the owner came from
+   * eTrade must not — a resumed wizard that has forgotten it renders the
+   * licence's own name and phone as empty, typeable inputs, which is both a
+   * regression of the read-only rule and an invitation to overwrite the record
+   * the backoffice checks against. The API captured the manager at lookup time
+   * for exactly this, so a resume reads it back from the identity state.
+   */
+  const etradeOwner = useMemo(() => {
+    if (liveEtradeOwner) return liveEtradeOwner;
+    if (etradeCleared) return null;
+    const name = identity?.etradeManagerName?.trim() ?? "";
+    // Normalized on the way out of storage, and dropped if it cannot be — the
+    // stored value is eTrade's free text, and a resume must reach the same
+    // conclusion about it as the lookup did.
+    const phone = firstValidPhone(identity?.etradeManagerPhone);
+    return name || phone ? { name, phone } : null;
+  }, [
+    liveEtradeOwner,
+    etradeCleared,
+    identity?.etradeManagerName,
+    identity?.etradeManagerPhone,
+  ]);
+
+  /** A lookup has actually filled the registration fields this session. */
+  const etradeFilledRef = useRef(false);
 
   // `shouldDirty` is what marks the eTrade bundle as "re-verified this session";
   // `stepPayload` sends those keys only when dirty, so an unchanged record is
   // never echoed back to the API (which would make it re-query eTrade).
   const handleETradeDataLoaded = (data: CompanyRegistrationData) => {
     const dirty = { shouldDirty: true } as const;
+    etradeFilledRef.current = true;
     if (data.companyName) {
       setValue("companyName", data.companyName, {
         shouldValidate: true,
@@ -302,32 +380,66 @@ export default function CompanyProfileForm({
     setValue("woreda", data.woreda, dirty);
     setValue("kebele", data.kebele, dirty);
     setValue("houseNo", data.houseNo, dirty);
-    // companyAddress is composed reactively from the address fields below, so
-    // setting region/zone/woreda/kebele/houseNo above is enough — no need to
-    // compose it here. companyPhone is derived below (identity → eTrade →
-    // account), not set directly here.
+    // companyAddress is composed reactively from the address fields above.
     // etradePhone is the raw number eTrade returned for this TIN — kept as its
-    // own field (distinct from companyPhone, which prefers the Fayda-verified
-    // owner's phone) so the backend's "matches eTrade's current record" check
-    // always compares against what eTrade actually said, not the owner's phone.
+    // own field (distinct from the owner's phone) so the backend's "matches
+    // eTrade's current record" check always compares against what eTrade
+    // actually said.
     setValue(
       "etradePhone",
       data.managerPhone || data.regularPhone || data.mobilePhone,
       dirty,
     );
 
-    setEtradeOwner({
+    // The owner's phone is only eTrade's to own if eTrade gave a usable one.
+    // The licence desk's field is free text, so it may hold "09        " — which
+    // normalizes to something non-empty and invalid. Dropping it here leaves the
+    // owner step with an empty, required, editable phone input, which is the
+    // honest state: eTrade has nothing we can use.
+    const owner = {
       name: data.managerName,
-      phone: toEthiopianE164(
+      phone: firstValidPhone(
         data.managerPhone || data.regularPhone || data.mobilePhone,
       ),
-    });
+    };
+    setEtradeCleared(false);
+    setLiveEtradeOwner(owner);
+
+    // What eTrade said, verbatim — this replaces whatever is in the field
+    // rather than only filling a gap. The owner step shows an eTrade-sourced
+    // name and phone read-only, so leaving an older value in place would send
+    // the API something the customer is no longer shown and cannot correct.
+    //
+    // A Fayda verification still outranks the licence: it owns those fields
+    // server-side, so overwriting them here would only produce a value the API
+    // discards on the way in.
+    if (owner.name && !identity?.owner.name?.trim()) {
+      setValue("ownerName", owner.name, { shouldValidate: true, ...dirty });
+    }
+    if (owner.phone && !identity?.owner.phone?.trim()) {
+      setValue("ownerPhone", owner.phone, { shouldValidate: true, ...dirty });
+    }
   };
 
   // TIN changed since the last successful lookup — the registration/address
   // fields it filled in describe the OLD TIN, not this one, so clear them
   // rather than leaving them stale on screen.
+  //
+  // The owner goes too: different licences under one TIN can list different
+  // managers, so a prefill from the previous pick is someone else's name.
+  // Only the prefill is cleared — a Fayda-verified owner is the API's to own.
   const handleETradeReset = () => {
+    // ...unless there was no prefill to clear. A co-operative now runs the same
+    // lookup as everyone else, but it types these fields itself when eTrade
+    // holds nothing — and wiping them because the customer went back to fix a
+    // digit of their TIN would throw away an address they had just typed by
+    // hand, over a lookup that never filled anything in the first place.
+    if (cooperative && !etradeFilledRef.current) {
+      setLiveEtradeOwner(null);
+      setEtradeCleared(true);
+      return;
+    }
+    etradeFilledRef.current = false;
     setValue("licenceNumber", "");
     setValue("statusDescription", "");
     setValue("dateRegistered", "");
@@ -340,273 +452,159 @@ export default function CompanyProfileForm({
     setValue("kebele", "");
     setValue("houseNo", "");
     setValue("etradePhone", "");
-    setEtradeOwner(null);
-  };
-
-  // "Same as …" links. A checked card prefills the target step's fields from the
-  // source step and disables them (kept mirrored while linked); unchecking clears
-  // them and re-enables editing.
-  // Seeded from the server so a resumed draft reopens with the declaration the
-  // company already made, rather than an unticked box over a linked GM.
-  const [gmSameAsOwner, setGmSameAsOwner] = useState(
-    identity?.gmSameAsOwner ?? false,
-  );
-  // `identity` is undefined on the first render (the requirements query is still
-  // in flight), so the initial state above freezes at `false` — adopt the
-  // server's declaration the moment it lands, or a resumed draft shows an
-  // unticked box over a GM that is linked server-side.
-  const [poaSameAsOwner, setPoaSameAsOwner] = useState(
-    identity?.poaSameAsOwner ?? false,
-  );
-  const identityLoaded = useRef(false);
-  useEffect(() => {
-    if (!identity || identityLoaded.current) return;
-    identityLoaded.current = true;
-    setGmSameAsOwner(identity.gmSameAsOwner);
-    setPoaSameAsOwner(identity.poaSameAsOwner);
-  }, [identity]);
-  const [contactSameAsGm, setContactSameAsGm] = useState(false);
-
-  // Where the owner's details come from when they are copied onto someone else
-  // — the GM, or the representative. A Fayda-verified owner outranks eTrade's
-  // registered owner: it's the higher-trust source, and the whole point of
-  // proving identity is to stop trusting typed/looked-up data for this.
-  const ownerSourceName = firstPresent(
-    identity?.owner.name,
-    etradeOwner?.name,
-    user.name?.en,
-  );
-
-  const ownerSourceEmail = firstValidEmail(identity?.owner.email, user.email);
-  // Same reason as `derivedPhone`: this value is written into
-  // `generalManagerPhone` / `poaPhone`, which the API validates with
-  // `@IsValidPhone()`, so an unusable eTrade number here 400s the step instead.
-  const ownerSourcePhone = firstValidPhone(
-    identity?.owner.phone,
-    etradeOwner?.phone,
-    user.phoneNumber,
-  );
-
-  useEffect(() => {
-    if (!gmSameAsOwner) return;
-    // A verified owner's identity is copied server-side and read back from
-    // `identity.gm`; mirroring it into form fields here would send typed
-    // values for something the API already owns.
-    if (identity?.owner.verified) return;
-    setValue("generalManagerName", ownerSourceName, { shouldValidate: true });
-    setValue("generalManagerEmail", ownerSourceEmail, { shouldValidate: true });
-    setValue("generalManagerPhone", ownerSourcePhone, {
-      shouldValidate: true,
-    });
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [gmSameAsOwner, ownerSourceName, ownerSourceEmail, ownerSourcePhone]);
-
-  // The representative's half of the same copy. A verified owner's identity is
-  // copied server-side and read back from `identity.poa`, so only an owner
-  // backed by a typed passport is mirrored into form fields here — the same
-  // split the GM makes above, for the same reason.
-  //
-  // Only non-empty sources are written. A source the owner does not have is a
-  // gap the step renders an input for (see `poaGaps`), and this effect re-runs
-  // whenever any *other* source changes — so blanking here would wipe what the
-  // customer is typing into that input the moment an eTrade lookup lands.
-  useEffect(() => {
-    if (!poaSameAsOwner || identity?.owner.verified) return;
-    if (ownerSourceName) setValue("poaName", ownerSourceName, { shouldValidate: true });
-    if (ownerSourceEmail) setValue("poaEmail", ownerSourceEmail, { shouldValidate: true });
-    if (ownerSourcePhone) setValue("poaPhone", ownerSourcePhone, { shouldValidate: true });
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [poaSameAsOwner, ownerSourceName, ownerSourceEmail, ownerSourcePhone]);
-
-  /**
-   * "Same as owner" has two meanings depending on what backs the owner.
-   *
-   * A Fayda-verified owner is a proven identity, so the declaration is made
-   * server-side: the API copies that identity onto the GM and records what it
-   * did. Anything typed here would arrive wearing a verified badge it hadn't
-   * earned, which is exactly what the verification exists to prevent.
-   *
-   * A foreign company's owner is backed by a typed passport instead, so there
-   * is nothing proven to copy — that stays the local field-mirroring it has
-   * always been.
-   */
-  const [gmLinkPending, setGmLinkPending] = useState(false);
-  const toggleGmSameAsOwner = async (checked: boolean) => {
-    setGmSameAsOwner(checked);
     if (!identity?.owner.verified) {
-      if (!checked) {
-        setValue("generalManagerName", "");
-        setValue("generalManagerEmail", "");
-        setValue("generalManagerPhone", "");
-      }
-      return;
-    }
-
-    setGmLinkPending(true);
-    try {
-      if (checked) await verifaydaService.setGmSameAsOwner();
-      else await verifaydaService.clearGmIdentity();
-      onIdentityChange?.();
-    } catch (err) {
-      setGmSameAsOwner(!checked);
-      setSaveError(
-        (err as { response?: { data?: { message?: string } } })?.response?.data
-          ?.message ??
-        (err instanceof Error
-          ? err.message
-          : "Could not update the general manager"),
-      );
-    } finally {
-      setGmLinkPending(false);
+      if (getValues("ownerName") === etradeOwner?.name) setValue("ownerName", "");
+      if (getValues("ownerPhone") === etradeOwner?.phone)
+        setValue("ownerPhone", "");
     }
+    setLiveEtradeOwner(null);
+    setEtradeCleared(true);
   };
 
   /**
-   * The representative is the owner. Unlike the GM's card this always goes to
-   * the API, whichever backs the owner: the declaration itself is what waives
-   * the DARS delegation paper, so it has to be recorded server-side even when
-   * there is no proven identity to copy and the details are mirrored locally.
+   * Answer the power-of-attorney question.
+   *
+   * Persisted server-side rather than held in form state: the answer decides
+   * whose identity the API gates on, and answering "no" tears down any
+   * representative already recorded (details, verification and DARS paper
+   * together) — none of which the form could do on its own.
    */
-  const [poaLinkPending, setPoaLinkPending] = useState(false);
-  const togglePoaSameAsOwner = async (checked: boolean) => {
+  const [declarePending, setDeclarePending] = useState(false);
+  const handleDeclare = async (declared: PoaDeclaration) => {
     setSaveError(null);
-    setPoaSameAsOwner(checked);
-    setPoaLinkPending(true);
+    setDeclarePending(true);
     try {
-      if (checked) await verifaydaService.setPoaSameAsOwner();
-      else {
-        await verifaydaService.clearPoaSameAsOwner();
-        // Only the locally mirrored values are ours to clear; a copied identity
-        // is cleared by the call above.
-        if (!identity?.owner.verified) {
-          setValue("poaName", "");
-          setValue("poaEmail", "");
-          setValue("poaPhone", "");
+      await verifaydaService.setPoaDeclared(declared);
+      if (declared === "no") {
+        // The paper is deleted server-side with the representative; a copy
+        // still sitting in the picker would be re-uploaded on the next step.
+        setDocumentFiles({ ...documentFiles, [POA_DELEGATION_FILE_KEY]: null });
+        // The representative's details go the same way. Answering "no" nulls
+        // every PoA attribute server-side, but the refetch below cannot undo
+        // what is still in the form: `keepDirtyValues` protects exactly the
+        // values the customer typed, so the next step save would send them
+        // straight back — and the API accepts them without complaint, because
+        // its PoA rules only run when the declaration is "yes". The company
+        // ended up on file with no representative and a full set of their
+        // details.
+        for (const field of [
+          "poaName",
+          "poaEmail",
+          "poaPhone",
+          "poaLocation",
+          "poaPassportNumber",
+        ] as const) {
+          setValue(field, "", { shouldDirty: false, shouldValidate: false });
         }
       }
       onIdentityChange?.();
     } catch (err) {
-      setPoaSameAsOwner(!checked);
-      setSaveError(
+      failSave(
         (err as { response?: { data?: { message?: string } } })?.response?.data
           ?.message ??
         (err instanceof Error
           ? err.message
-          : "Could not update the Power of Attorney"),
+          : "Could not save your answer"),
       );
     } finally {
-      setPoaLinkPending(false);
+      setDeclarePending(false);
     }
   };
 
-  // Where the GM's details come from depends on how they were established: a
-  // Fayda verification (or a "same as owner" declaration) owns them outright,
-  // and only a company that may still type them falls back to form state.
-  // A verified GM's identity wins, but Fayda's email and phone claims are
-  // optional: what the verification did not supply is typed on this step, and
-  // the API deliberately does not read those back onto the identity (they are
-  // not proven), so the form value is the only place they exist.
-  const gmVerified = identity?.gm.verified ?? false;
-  const gmName = gmVerified
-    ? firstPresent(identity?.gm.name, watch("generalManagerName"))
-    : watch("generalManagerName");
-  const gmEmail = gmVerified
-    ? firstPresent(identity?.gm.email, watch("generalManagerEmail"))
-    : watch("generalManagerEmail");
-  const gmPhone = gmVerified
-    ? firstPresent(identity?.gm.phone, watch("generalManagerPhone"))
-    : watch("generalManagerPhone");
-
   /**
-   * Whether the GM has been established at all — by verification, by the
-   * "same as owner" declaration, or (only where Fayda is optional) by typing.
-   * Fayda is an Ethiopian national ID, so a foreign company's GM may hold none.
+   * Who owns each of the owner's fields — and therefore which of them are shown
+   * read-only rather than as inputs. See `resolveOwnerSources`; the rule it
+   * encodes pairs with `requiredKeys` below, which requires exactly the fields
+   * no source owns.
    */
-  // Matches what the API actually demands (`REQUIRED_COMPANY_INFO`): a name and
-  // a phone. The email is collected but optional — a manager proved through
-  // Fayda may have no email claim, and the notify resolver no longer needs one.
-  const gmTyped = Boolean(
-    watch("generalManagerName")?.trim() &&
-    watch("generalManagerPhone")?.trim(),
+  const ownerVerified = identity?.owner.verified ?? false;
+  const poaVerified = identity?.poa.verified ?? false;
+  const usableEmail = (value?: string | null) => Boolean(firstValidEmail(value));
+  const usablePhone = (value?: string | null) => Boolean(firstValidPhone(value));
+  const { source: ownerSource, sourced: ownerSourced } = resolveOwnerSources(
+    identity,
+    etradeOwner,
   );
-  const gmEstablished =
-    gmVerified || (identity ? !identity.faydaRequired && gmTyped : gmTyped);
 
-  /**
-   * Same rule for the representative: verified, or entered where Fayda is
-   * optional.
-   *
-   * Matches the API's own rule (`REQUIRED_POA_FIELDS`): a typed representative
-   * counts once they have a name, an email and a phone. The step now renders
-   * inputs for all three, so this is something the customer can actually
-   * satisfy — previously it gated on `poaName`, for which no input existed
-   * anywhere, leaving a foreign freight forwarder permanently stuck.
-   */
-  const poaTyped = Boolean(
-    watch("poaName")?.trim() &&
-    watch("poaEmail")?.trim() &&
-    watch("poaPhone")?.trim(),
-  );
-  const poaEstablished =
-    (identity?.poa.verified ?? false) ||
-    (identity ? !identity.faydaRequired && poaTyped : false);
-
-  /**
-   * Drop an optional representative the company no longer wants.
-   *
-   * Verifying a PoA is one click on a step that calls itself optional, and it
-   * is not reversible from the form: the verification owns the fields (so
-   * blanking them is refused), and its mere existence makes the DARS paper due
-   * — which then blocks the submit AND clamps the resume back to this step. The
-   * settings page has the same escape hatch, but `/settings` is off-limits
-   * until onboarding finishes, so without this the customer is stuck.
-   *
-   * Not offered to a freight forwarder: the API refuses (they must have one).
-   */
-  const [poaRemovePending, setPoaRemovePending] = useState(false);
-  const removePoa = async () => {
-    setSaveError(null);
-    setPoaRemovePending(true);
-    try {
-      await verifaydaService.removePoa();
-      for (const key of [
-        "poaName",
-        "poaEmail",
-        "poaPhone",
-        "poaAddress",
-        "poaLocation",
-      ] as const) {
-        setValue(key, "", { shouldDirty: false });
-      }
-      // The paper is deleted server-side with the identity; a copy still
-      // sitting in the picker would be re-uploaded on the documents step.
-      setDocumentFiles({ ...documentFiles, [POA_DELEGATION_FILE_KEY]: null });
-      onIdentityChange?.();
-    } catch (err) {
-      setSaveError(
-        (err as { response?: { data?: { message?: string } } })?.response?.data
-          ?.message ??
-        (err instanceof Error
-          ? err.message
-          : "Could not remove the Power of Attorney"),
-      );
-    } finally {
-      setPoaRemovePending(false);
+  // Keep the form holding exactly what the read-only rows show. The two are
+  // filled from different places — the rows from the licence, the fields from
+  // the lookup that ran or from the rehydrated profile — and only the fields
+  // are submitted, so a divergence would send the API something the customer
+  // was never shown and had no input to correct. eTrade wins it, which is what
+  // "not editable" has to mean for a value already on file.
+  useEffect(() => {
+    if (ownerSource.name === "eTrade" && getValues("ownerName") !== ownerSourced.name) {
+      setValue("ownerName", ownerSourced.name, { shouldValidate: true });
     }
+    if (
+      ownerSource.phone === "eTrade" &&
+      getValues("ownerPhone") !== ownerSourced.phone
+    ) {
+      setValue("ownerPhone", ownerSourced.phone, { shouldValidate: true });
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [ownerSource.name, ownerSource.phone, ownerSourced.name, ownerSourced.phone]);
+  // No `address`: Fayda's address claim is `poaAddress`, which the portal never
+  // sends — the step's only address-shaped input writes `poaLocation`, which is
+  // the company's own statement and stays typeable however well Fayda knows
+  // where the person lives.
+  // Same validity test as the owner's: a Fayda claim the schema would reject is
+  // not a claim this step can hide the input behind.
+  const poaLocked = {
+    name: poaVerified && Boolean(identity?.poa.name?.trim()),
+    email: poaVerified && usableEmail(identity?.poa.email),
+    phone: poaVerified && usablePhone(identity?.poa.phone),
   };
 
+  /**
+   * How a foreign company chose to prove its subject: Fayda, or a passport.
+   *
+   * An either/or rather than a fallback, so nothing is asked until one side is
+   * picked. Seeded from what already happened — a completed verification or a
+   * saved passport number is itself the answer — and only then held locally,
+   * because the choice is a UI fork with nothing to persist: what the API
+   * stores is the proof, not the route taken to it.
+   */
+  const [identityMethod, setIdentityMethod] = useState<IdentityMethod | null>(
+    null,
+  );
+  const passportSaved = Boolean(
+    identity?.subject === "poa"
+      ? identity?.poa.passportNumber?.trim()
+      : identity?.owner.passportNumber?.trim(),
+  );
+  const subjectVerified = identity?.subject === "poa" ? poaVerified : ownerVerified;
+  const effectiveMethod: IdentityMethod | null = !identity?.passportAccepted
+    ? "fayda" // An Ethiopian company has no choice to make.
+    : subjectVerified
+      ? "fayda"
+      : (identityMethod ?? (passportSaved ? "passport" : null));
+
+  // The owner's name from whichever source established them — powers the
+  // contact step's "same as owner" card.
+  //
+  // Email and phone are picked by validity, not mere presence. Both are copied
+  // into contact fields the schema requires to be well-formed, and a Fayda
+  // claim or an eTrade record routinely carries something that is neither empty
+  // nor usable ("09        "). Taking it would fail the contact step on a value
+  // the customer never typed and — while the copy is linked — cannot edit.
+  const ownerName = firstPresent(identity?.owner.name, watch("ownerName"));
+  const ownerEmail = firstValidEmail(identity?.owner.email, watch("ownerEmail"));
+  const ownerPhone = firstValidPhone(identity?.owner.phone, watch("ownerPhone"));
+
+  const [contactSameAsOwner, setContactSameAsOwner] = useState(false);
   // While linked, mirror the source values into the (disabled) target fields so
   // the copy stays current even if the user goes back and edits the source.
   useEffect(() => {
-    if (!contactSameAsGm) return;
-    setValue("contactPersonName", gmName ?? "", { shouldValidate: true });
-    setValue("contactPersonEmail", gmEmail ?? "");
-    setValue("contactPersonPhone", gmPhone ?? "", { shouldValidate: true });
+    if (!contactSameAsOwner) return;
+    setValue("contactPersonName", ownerName, { shouldValidate: true });
+    setValue("contactPersonEmail", ownerEmail);
+    setValue("contactPersonPhone", ownerPhone, { shouldValidate: true });
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [contactSameAsGm, gmName, gmEmail, gmPhone]);
+  }, [contactSameAsOwner, ownerName, ownerEmail, ownerPhone]);
 
-  const toggleContactSameAsGm = (checked: boolean) => {
-    setContactSameAsGm(checked);
+  const toggleContactSameAsOwner = (checked: boolean) => {
+    setContactSameAsOwner(checked);
     // Checked → the mirror effect fills the fields; unchecked → reset them.
     if (!checked) {
       setValue("contactPersonName", "");
@@ -616,10 +614,10 @@ export default function CompanyProfileForm({
   };
 
   // The DARS delegation paper ships in the same nationality document set as the
-  // rest (the API guarantees it is there), but belongs on the PoA step next to
-  // the details it evidences — so it's split out here and the Documents step
-  // renders the remainder. Both halves share `documentFiles`, so the existing
-  // bulk upload still carries it.
+  // rest (the API guarantees it is there), but belongs on the representation
+  // step next to the details it evidences — so it's split out here and the
+  // Documents step renders the remainder. Both halves share `documentFiles`, so
+  // the existing bulk upload still carries it.
   const poaDocumentField = uploadSetting?.fields?.find(
     (f) => f.fileKey === POA_DELEGATION_FILE_KEY,
   );
@@ -643,8 +641,6 @@ export default function CompanyProfileForm({
     [uploadSetting, poaDocumentField],
   );
 
-  const hasDocuments = Boolean(documentsSetting?.fields?.length);
-
   // Hard verification for the documents step: required company-level
   // documents and a business license per operational profile must both be
   // present before the user can continue.
@@ -670,9 +666,12 @@ export default function CompanyProfileForm({
     return errs;
   };
 
-  // Every role needs at least one license file (existing or newly selected).
+  // Every role needs at least one license file (existing or newly selected) —
+  // except a co-operative's, which holds no business licence at all. Its own
+  // document set is what stands in, and the API lifts the same requirement.
   const validateLicenses = (): Record<string, string> => {
     const errs: Record<string, string> = {};
+    if (cooperative) return errs;
     for (const p of roleProfiles ?? []) {
       const hasNew = (licenseFiles?.[p.id]?.length ?? 0) > 0;
       const hasExisting = p.existingFiles.length > 0;
@@ -687,6 +686,9 @@ export default function CompanyProfileForm({
     next: Record<string, File | File[] | null>,
   ) => {
     setDocumentFiles(next);
+    // Files live outside the form, so the watch subscription above never sees
+    // them — the "upload the required documents" alert has to be retired here.
+    setSaveError(null);
     setDocumentFieldErrors((prev) => {
       if (Object.keys(prev).length === 0) return prev;
       const updated = { ...prev };
@@ -713,8 +715,7 @@ export default function CompanyProfileForm({
 
   // The registration/license details come straight from the eTrade lookup and
   // are not user-editable — shown as a read-only confirmation once a TIN lookup
-  // (or rehydration) has filled them in. The address fields below are separate:
-  // user-entered and required. We watch the values so the display stays current.
+  // (or rehydration) has filled them in.
   const registration = watch([
     "licenceNumber",
     "statusDescription",
@@ -726,57 +727,26 @@ export default function CompanyProfileForm({
   const hasRegistrationDetails = registration.some((v) => v && v.trim());
   // A previously-saved (rehydrated) TIN counts as verified without a refetch —
   // the registration fields being populated at all is proof it passed before.
-  const tinVerified = tinStatus === "verified" || hasRegistrationDetails;
+  // A co-operative never runs the lookup, so there is nothing to be verified
+  // against; its TIN is validated by the schema like any other typed field.
+  const tinVerified =
+    cooperative || tinStatus === "verified" || hasRegistrationDetails;
 
   // Single source of truth for step sequence — navigation, labels and the
   // progress bar all derive from this so adding/removing a step is one edit.
   const stepOrder: CompanyStep[] = [
     "company",
-    "personnel",
+    "owner",
+    "representation",
     "contact",
-    "poa",
     "documents",
   ];
   const currentIdx = stepOrder.indexOf(step);
 
-  // The DARS delegation paper is what proves the representative was actually
-  // delegated, so it's required the moment a PoA exists. The API enforces the
-  // same rule on save, so skipping it here only costs the customer a
-  // round-trip.
-  //
-  // "Exists" is the API's own test (`POA_ATTRIBUTES.some(...)`): ANY detail,
-  // verified or typed. Requiring a complete typed representative here instead
-  // hid the upload from a customer who had entered only a name — for whom the
-  // API still demands the paper, and whose resume would then be clamped back to
-  // this step with nothing on it to fill.
-  const poaAnyDetail = [
-    identity?.poa.name,
-    identity?.poa.email,
-    identity?.poa.phone,
-    identity?.poa.address,
-    watch("poaName"),
-    watch("poaEmail"),
-    watch("poaPhone"),
-    watch("poaLocation"),
-  ].some((v) => v?.trim());
-  const poaProvided = (identity?.poa.verified ?? false) || poaAnyDetail;
-  // A freight forwarder owes the paper whether or not its representative could
-  // verify with Fayda — the API demands it at completion either way. Keying
-  // this on the verification alone hid the upload from a foreign forwarder and
-  // then failed them on submit for a file they were never shown.
-  //
-  // Unless the owner represents the company themselves: nobody delegates to
-  // themselves, so there is no delegation to evidence. Mirrors the API's own
-  // waiver in `assertPoaDelegationSatisfied` — the two must agree, or this
-  // demands a file the server would accept the submission without.
-  //
-  // Split from `poaDue` — "there is a representative, so their details are
-  // owed" — because a self-PoA keeps the second while dropping the first. The
-  // API draws the same line (`poaDue` / `delegationDue` in
-  // getOnboardingRequirements); anything that is about the *details* must key
-  // on `poaDue`, only the paper keys on this.
-  const poaDue = poaProvided || requirePoa;
-  const delegationRequired = poaDue && !poaSameAsOwner;
+  // The DARS delegation paper is owed exactly when the company says it has a
+  // representative. The API enforces the same rule on save, so skipping it here
+  // only costs the customer a round-trip.
+  const delegationRequired = identity?.poaDeclared === "yes";
   const delegationPresent =
     (uploadedDocumentKeys ?? []).includes(POA_DELEGATION_FILE_KEY) ||
     (() => {
@@ -785,93 +755,44 @@ export default function CompanyProfileForm({
     })();
 
   /**
-   * What a Fayda verification did NOT supply, per person.
+   * Is the company's one identity proven?
    *
-   * Fayda's email, phone and address claims are optional and routinely come
-   * back empty, so a *verified* person can still be missing details the API
-   * demands (`REQUIRED_POA_FIELDS`, `REQUIRED_COMPANY_INFO`). Those gaps are
-   * typed instead — the API keeps exactly the keys a claim left empty typeable,
-   * since a claim that returned nothing owns no value to protect.
-   *
-   * Computed here, once, and handed to both the step (which renders an input
-   * per gap) and the schema (which requires exactly those) — a field is
-   * required if and only if there is an input on screen to fix it in.
+   * `identity.identityProven` is the server's verdict, but it is a step behind
+   * a passport number the customer has just typed and not yet saved — so the
+   * live form value counts too. Blocking on the stale server value would refuse
+   * to advance past a field the customer has visibly filled in.
    */
-  // Where Fayda is mandatory an unverified representative must verify rather
-  // than be typed, so nothing is offered until the verification lands.
-  const poaTypedAllowed =
-    !identity || identity.poa.verified || !identity.faydaRequired;
-  // A representative the verification never proved holds only typed details —
-  // the API leaves those unlocked, so the inputs stay on screen and stay
-  // editable. Only a *verified* PoA hides the fields their claim did fill,
-  // which is also the only case the API refuses to let anyone overwrite.
-  const poaGap = (v?: string | null) =>
-    poaTypedAllowed && (!identity?.poa.verified || !v?.trim());
-  /**
-   * "Same as owner" answers each field only as far as the owner actually has
-   * one. Fayda's name, email and phone claims are all optional, the account and
-   * eTrade fallbacks can be empty or unusable, and `REQUIRED_POA_FIELDS` still
-   * demands a name, an email and a phone — so anything the copy could not
-   * supply stays askable. Assuming the copy filled everything is what dead-ends
-   * the submit on "Add your poa phone" with no input anywhere to satisfy it.
-   *
-   * Keyed on the *source*, never on the field's current value: an input that
-   * disappears the moment the first character is typed into it is unusable.
-   * A verified owner's identity is copied server-side, so `identity.poa` is the
-   * source there; otherwise it is the same owner-derived values the mirror
-   * effect writes.
-   */
-  const poaCopyGap = (copied?: string | null, mirrored?: string | null) =>
-    identity?.owner.verified ? !copied?.trim() : !mirrored?.trim();
-  const poaGaps = poaSameAsOwner
-    ? {
-      name: poaCopyGap(identity?.poa.name, ownerSourceName),
-      email: poaCopyGap(identity?.poa.email, ownerSourceEmail),
-      phone: poaCopyGap(identity?.poa.phone, ownerSourcePhone),
-      // The location is the one detail the API never demands, so a blank one
-      // dead-ends nothing — and asking for the owner's city under a card that
-      // says "same as owner" reads as a contradiction.
-      address: false,
-    }
-    : {
-      name: poaGap(identity?.poa.name),
-      email: poaGap(identity?.poa.email),
-      phone: poaGap(identity?.poa.phone),
-      address: poaGap(identity?.poa.address),
-    };
-  // The GM's own verification never falls back to the signed-in account — that
-  // account is the person onboarding, not necessarily the manager — so a GM
-  // verified with no email claim has nowhere else for one to come from. The
-  // name claim is optional too, and `REQUIRED_COMPANY_INFO` demands it, so it
-  // gets the same treatment rather than dead-ending the submit.
-  // "Same as owner" is exempt: the API copies the owner's (account-backed)
-  // contact details across, so there is no gap and no input.
-  const gmGaps = {
-    name: !gmSameAsOwner && gmVerified && !identity?.gm.name?.trim(),
-    email: !gmSameAsOwner && gmVerified && !identity?.gm.email?.trim(),
-    phone: !gmSameAsOwner && gmVerified && !identity?.gm.phone?.trim(),
-  };
+  const passportField =
+    identity?.subject === "poa" ? "poaPassportNumber" : "ownerPassportNumber";
+  const identityProven =
+    (identity?.identityProven ?? false) ||
+    ((identity?.passportAccepted ?? false) &&
+      Boolean(watch(passportField)?.trim()));
 
   const requiredKeys: (keyof FormData)[] = [];
-  if (step === "personnel") {
-    // The manager's email is offered but not demanded: the API dropped it from
-    // `REQUIRED_COMPANY_INFO` once the notify resolver stopped depending on it.
-    // The name and phone are still required there, so they are still required
-    // here.
-    if (gmGaps.name) requiredKeys.push("generalManagerName");
-    if (gmGaps.phone) requiredKeys.push("generalManagerPhone");
-  } else if (step === "poa" && poaDue) {
-    // Only once a PoA is required or provided: an untouched optional PoA is
-    // still a step the customer may walk straight past.
-    //
-    // `poaDue`, NOT `delegationRequired`: the paper is waived for a self-PoA
-    // but `REQUIRED_POA_FIELDS` is not, and the API reports every one of them
-    // missing (`missingPoaFields` keys on its own `poaDue`) — which fails the
-    // submit and clamps the resume back here. Keying this on the paper let the
-    // customer walk past an input this step had already put on screen.
-    if (poaGaps.name) requiredKeys.push("poaName");
-    if (poaGaps.email) requiredKeys.push("poaEmail");
-    if (poaGaps.phone) requiredKeys.push("poaPhone");
+  if (step === "company" && cooperative) {
+    // A co-operative has no eTrade record, so the fields every other company
+    // gets read-only from the licence are typed here — and are therefore
+    // required here. House number stays optional: plenty of addresses have none.
+    requiredKeys.push("companyName", "region", "zone", "woreda", "kebele");
+  } else if (step === "owner") {
+    // All three are required by the API (`REQUIRED_COMPANY_INFO`), and an input
+    // is rendered for each one a Fayda verification does not own.
+    if (!ownerSource.name) requiredKeys.push("ownerName");
+    if (!ownerSource.email) requiredKeys.push("ownerEmail");
+    if (!ownerSource.phone) requiredKeys.push("ownerPhone");
+  } else if (
+    step === "representation" &&
+    identity?.poaDeclared === "yes" &&
+    // The details are only on screen once the person is established — before
+    // that the step is still asking how to prove them, and requiring a name
+    // with no input rendered is the dead Continue button this rule exists to
+    // prevent.
+    (poaVerified || effectiveMethod === "passport")
+  ) {
+    if (!poaLocked.name) requiredKeys.push("poaName");
+    if (!poaLocked.email) requiredKeys.push("poaEmail");
+    if (!poaLocked.phone) requiredKeys.push("poaPhone");
   }
   requiredKeysRef.current = requiredKeys;
 
@@ -879,19 +800,15 @@ export default function CompanyProfileForm({
    * Collect the messages for a set of fields into one sentence.
    *
    * A failed `trigger()` used to return silently, so Continue simply did
-   * nothing — and every field whose input is conditionally rendered (or derived
-   * and never rendered at all) turned into an invisible dead end. Naming the
-   * failures is the whole point: the ones worth reporting are exactly the ones
-   * with no error text on screen to read.
+   * nothing — and every field whose input is conditionally rendered turned into
+   * an invisible dead end. Naming the failures is the whole point: the ones
+   * worth reporting are exactly the ones with no error text on screen to read.
    */
   const describeErrors = (fields: (keyof FormData)[]): string => {
     // Re-parse rather than read `errors`: that's the render-time snapshot, and
     // this runs immediately after an `await trigger()` that has not re-rendered
     // yet, so the closure would still be holding the previous attempt's state.
-    const parsed = buildOnboardingSchema(
-      identity?.passportRequired === true,
-      requiredKeys,
-    ).safeParse(getValues());
+    const parsed = buildOnboardingSchema(requiredKeys).safeParse(getValues());
     const wanted = new Set<string>(fields as string[]);
     const messages = parsed.success
       ? []
@@ -903,24 +820,13 @@ export default function CompanyProfileForm({
       : "Some details on this step are incomplete. Please review the fields above.";
   };
 
-  /**
-   * The fields this step actually validates. `stepFields` covers what the step
-   * always renders; the company step additionally exposes company email/phone
-   * as inputs when nothing could be derived for them, and a field is validated
-   * exactly when the customer can see and fix it.
-   */
-  const fieldsForStep = (s: CompanyStep): (keyof FormData)[] => {
-    if (s !== "company" || !identity) return stepFields[s];
-    return [...stepFields.company];
-  };
-
   /** Validate + persist the current step, returning whether we may advance. */
   const saveCurrentStep = async (): Promise<boolean> => {
     setSaveError(null);
-    const fields = fieldsForStep(step);
+    const fields = stepFields[step];
     const isValid = await trigger(fields);
     if (!isValid) {
-      setSaveError(describeErrors(fields));
+      failCheck(describeErrors(fields));
       return false;
     }
     if (!onSaveStep) return true;
@@ -928,7 +834,7 @@ export default function CompanyProfileForm({
     try {
       const res = await onSaveStep(stepPayload(step, getValues(), dirtyFields));
       if (!res.ok) {
-        setSaveError(res.error);
+        failSave(res.error);
         return false;
       }
       return true;
@@ -951,7 +857,7 @@ export default function CompanyProfileForm({
       ) {
         setDocumentFieldErrors(docErrors);
         setLicenseFieldErrors(licenseErrors);
-        setSaveError("Please upload all required documents before continuing.");
+        failCheck("Please upload all required documents before continuing.");
         return;
       }
 
@@ -960,7 +866,7 @@ export default function CompanyProfileForm({
         try {
           const res = await onUploadDocuments();
           if (!res.ok) {
-            setSaveError(res.error);
+            failSave(res.error);
             return;
           }
         } finally {
@@ -969,92 +875,78 @@ export default function CompanyProfileForm({
       }
 
       setSaveError(null);
-      // Deliberately NOT `handleSubmit`: that re-validated all 34 schema fields
-      // — including every field belonging to a step that isn't on screen — and
-      // on failure did nothing at all, no alert and no navigation, which is the
+      // Deliberately NOT `handleSubmit`: that re-validated every schema field —
+      // including every field belonging to a step that isn't on screen — and on
+      // failure did nothing at all, no alert and no navigation, which is the
       // "Submit for review" button that appears dead. Each step has already
-      // validated and saved its own fields, and the API's `markOnboardingComplete`
-      // is the authority on what is still outstanding; its message reaches the
-      // customer through `submitError`.
+      // validated and saved its own fields, and the API's
+      // `markOnboardingComplete` is the authority on what is still outstanding;
+      // its message reaches the customer through `submitError`.
       onSubmit(buildPayload(getValues(), user));
       return;
     }
     // The TIN must resolve to a real eTrade record before anything else on
     // this step is even worth validating — gates here rather than through zod.
+    // A co-operative is exempt: it has no licence for eTrade to hold, so
+    // `tinVerified` is true for it and only the duplicate-TIN check applies.
     if (step === "company" && tinStatus === "taken") {
-      setSaveError(
+      failCheck(
         "This TIN is already registered to another company account.",
       );
       return;
     }
     if (step === "company" && !tinVerified) {
-      setSaveError(
+      failCheck(
         tinStatus === "choose-business"
           ? "This TIN holds more than one business licence — pick the one you're registering as."
           : "We need to confirm your TIN with eTrade before continuing.",
       );
       return;
     }
-    // Fayda verification is proved outside the form state, so it gates here
-    // rather than through zod. The passport number is a plain typed field —
-    // buildOnboardingSchema already requires it when passportRequired, so
-    // saveCurrentStep()'s trigger() below catches that; checking the stale
-    // server-side identity.owner.passportNumber here would block a value the
-    // user just typed but hasn't saved yet.
-    if (
-      step === "company" &&
-      identity?.faydaRequired &&
-      !identity.owner.verified
-    ) {
-      setSaveError(
-        "Verify the company owner's identity with Fayda before continuing.",
+    // The declaration decides whose identity is verified, so it has to be
+    // answered before the verification below can mean anything.
+    if (step === "representation" && !identity?.poaDeclared) {
+      failCheck(
+        "Tell us whether anyone holds power of attorney for this company.",
       );
       return;
     }
-    // The GM is established through Fayda now, so the step gates on the
-    // identity rather than on typed text — same strength as the old required
-    // fields, different evidence. A foreign company's GM may hold no Fayda ID,
-    // so typed details still satisfy it there.
-    if (step === "personnel" && !gmEstablished) {
-      setSaveError(
-        identity?.faydaRequired
-          ? "Verify the general manager with Fayda, or tick “same as owner” if they are the company's owner."
-          : "Add the general manager's details, or verify them with Fayda.",
+    // The verification itself is proved outside the form state, so it gates
+    // here rather than through zod.
+    if (step === "representation" && !identityProven) {
+      const who =
+        identity?.subject === "poa"
+          ? "your Power of Attorney"
+          : "the company owner";
+      failCheck(
+        identity?.passportAccepted
+          ? `Verify ${who} with Fayda, or enter their passport number.`
+          : `Verify ${who} with Fayda before continuing.`,
       );
       return;
     }
-    if (step === "poa" && requirePoa && !poaEstablished) {
-      setSaveError(
-        identity?.faydaRequired
-          ? "Freight forwarders act on other companies' behalf, so the Power of Attorney's identity must be verified with Fayda."
-          : "Freight forwarders act on other companies' behalf, so a Power of Attorney is required.",
-      );
-      return;
-    }
-    // The PoA step also gates on a file, which lives outside the form state.
-    if (step === "poa" && delegationRequired && !delegationPresent) {
+    // The step also gates on a file, which lives outside the form state.
+    if (step === "representation" && delegationRequired && !delegationPresent) {
       setDocumentFieldErrors({
         [POA_DELEGATION_FILE_KEY]: "DARS delegation paper is required",
       });
       // Validate the text fields too, so every problem shows at once.
-      const fieldsOk = await trigger(stepFields.poa);
-      setSaveError(
+      const fieldsOk = await trigger(stepFields.representation);
+      failCheck(
         [
-          requirePoa
-            ? "Freight forwarders must provide Power of Attorney details and the DARS delegation paper."
-            : "Upload the DARS delegation paper for the Power of Attorney you entered, or clear the PoA details to skip.",
-          fieldsOk ? null : describeErrors(stepFields.poa),
+          "Upload the DARS delegation paper for the representative you named.",
+          fieldsOk ? null : describeErrors(stepFields.representation),
         ]
           .filter(Boolean)
           .join(" "),
       );
       return;
     }
-    // The API will not accept the PoA's details until the paper evidencing the
-    // delegation is actually on file, so the selection made on this step has to
-    // be uploaded before the save — not held back until the documents step,
-    // which is unreachable while this save keeps failing.
-    if (step === "poa" && delegationRequired && onUploadDocuments) {
+    // The API will not accept the representative's details until the paper
+    // evidencing the delegation is actually on file, so the selection made on
+    // this step has to be uploaded before the save — not held back until the
+    // documents step, which is unreachable while this save keeps failing.
+    if (step === "representation" && delegationRequired && onUploadDocuments) {
       const pending = documentFiles[POA_DELEGATION_FILE_KEY];
       const hasPending = Array.isArray(pending)
         ? pending.length > 0
@@ -1064,7 +956,7 @@ export default function CompanyProfileForm({
         try {
           const res = await onUploadDocuments();
           if (!res.ok) {
-            setSaveError(res.error);
+            failSave(res.error);
             return;
           }
         } finally {
@@ -1092,57 +984,51 @@ export default function CompanyProfileForm({
           {step === "company" && (
             <CompanyInfoStep
               form={form}
-              identity={identity}
-              verifiedIdentity={verifiedIdentity}
               tinStatus={tinStatus}
               tinVerified={tinVerified}
               hasRegistrationDetails={hasRegistrationDetails}
+              cooperative={cooperative}
               onETradeDataLoaded={handleETradeDataLoaded}
               onETradeStatusChange={setTinStatus}
               onETradeReset={handleETradeReset}
             />
           )}
 
-          {step === "personnel" && (
-            <PersonnelStep
+          {step === "owner" && (
+            <OwnerStep
               form={form}
               identity={identity}
               etradeOwner={etradeOwner}
-              gmSameAsOwner={gmSameAsOwner}
-              onToggleGmSameAsOwner={toggleGmSameAsOwner}
-              gmLinkPending={gmLinkPending}
-              gmVerified={gmVerified}
-              gaps={gmGaps}
+              source={ownerSource}
+              sourced={ownerSourced}
+              cooperative={cooperative}
+            />
+          )}
+
+          {step === "representation" && (
+            <RepresentationStep
+              form={form}
+              identity={identity}
+              onDeclare={handleDeclare}
+              declarePending={declarePending}
+              declarationLocked={declarationLocked}
+              locked={poaLocked}
+              method={effectiveMethod}
+              onMethodChange={setIdentityMethod}
+              poaDocumentSetting={poaDocumentSetting}
+              documentFiles={documentFiles}
+              uploadedDocumentKeys={uploadedDocumentKeys}
+              documentFieldErrors={documentFieldErrors}
+              onDocumentFilesChange={handleDocumentFilesChange}
             />
           )}
 
           {step === "contact" && (
             <ContactStep
               form={form}
-              gmName={gmName}
-              contactSameAsGm={contactSameAsGm}
-              onToggleContactSameAsGm={toggleContactSameAsGm}
-            />
-          )}
-
-          {step === "poa" && (
-            <PoaStep
-              form={form}
-              identity={identity}
-              requirePoa={requirePoa}
-              poaSameAsOwner={poaSameAsOwner}
-              onTogglePoaSameAsOwner={togglePoaSameAsOwner}
-              poaLinkPending={poaLinkPending}
-              etradeOwner={etradeOwner}
-              gaps={poaGaps}
-              onRemovePoa={removePoa}
-              removePending={poaRemovePending}
-              delegationRequired={delegationRequired}
-              poaDocumentSetting={poaDocumentSetting}
-              documentFiles={documentFiles}
-              uploadedDocumentKeys={uploadedDocumentKeys}
-              documentFieldErrors={documentFieldErrors}
-              onDocumentFilesChange={handleDocumentFilesChange}
+              ownerName={ownerName}
+              contactSameAsOwner={contactSameAsOwner}
+              onToggleContactSameAsOwner={toggleContactSameAsOwner}
             />
           )}
 
@@ -1154,7 +1040,10 @@ export default function CompanyProfileForm({
               uploadedDocumentKeys={uploadedDocumentKeys}
               documentFieldErrors={documentFieldErrors}
               onDocumentFilesChange={handleDocumentFilesChange}
-              roleProfiles={roleProfiles}
+              // A co-operative union or farm holds no business licence, so the
+              // per-role upload cards are not shown at all — offering a slot
+              // nothing can fill reads as an unfinishable step.
+              roleProfiles={cooperative ? [] : roleProfiles}
               licenseFiles={licenseFiles}
               licenseFieldErrors={licenseFieldErrors}
               onLicenseFilesChange={handleLicenseFilesChange}
@@ -1166,9 +1055,13 @@ export default function CompanyProfileForm({
               color="red"
               variant="light"
               icon={<AlertCircle size={18} />}
-              title={"Couldn't save this step"}
+              title={
+                saveError.kind === "save"
+                  ? "Couldn't save this step"
+                  : "Please check this step"
+              }
             >
-              {saveError}
+              {saveError.message}
             </Alert>
           )}
 
@@ -1197,7 +1090,12 @@ export default function CompanyProfileForm({
               disabled={
                 isPending ||
                 saving ||
-                (step === "documents" && !hasDocuments && loadingDocuments)
+                declarePending ||
+                // Nothing to validate against until the document set lands, so
+                // pressing Continue now would report every required upload as
+                // satisfied. `hasDocuments` used to be in here too, which let
+                // the button go live mid-load the moment the set resolved.
+                (step === "documents" && loadingDocuments)
               }
               loading={isPending || saving}
               rightSection={
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/SourcedField.tsx b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/SourcedField.tsx
new file mode 100644
index 000000000..2a42c424a
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/SourcedField.tsx
@@ -0,0 +1,61 @@
+import { Badge, Group, Stack, Text } from "@mantine/core";
+import type { ReactNode } from "react";
+
+/** Where a locked value came from, shown as a badge next to it. */
+export type FieldSource = "eTrade" | "Fayda";
+
+const SOURCE_NOTE: Record<FieldSource, string> = {
+  eTrade: "From your eTrade licence",
+  Fayda: "From the Fayda verification",
+};
+
+/**
+ * One person-detail field that an outside source may have taken ownership of.
+ *
+ * `source` — not "does a value exist" — decides which side renders. That
+ * distinction is the whole point: `ownerName` holds a value the moment the
+ * customer types it and the step saves, and keying off presence meant the input
+ * they had just filled in turned into a read-only badge as soon as they
+ * navigated away and back, with no way to correct it. Only a real source owns a
+ * field: a Fayda verification (the API refuses to overwrite those) or the
+ * eTrade licence (the record the backoffice checks the company against).
+ *
+ * It pairs with `requiredKeys` in CompanyProfileForm, which requires exactly
+ * the fields that fall through to `children`: **a field is required if and only
+ * if there is an input on screen to satisfy it.**
+ */
+export default function SourcedField({
+  label,
+  value,
+  source,
+  children,
+}: {
+  label: string;
+  /** The value to display when a source owns this field. */
+  value?: string | null;
+  /** The owning source, or null while the field is still the customer's. */
+  source: FieldSource | null;
+  /** The input rendered whenever the field is still the customer's to fill. */
+  children: ReactNode;
+}) {
+  if (!source || !value?.trim()) return <>{children}</>;
+
+  return (
+    <Stack gap={2}>
+      <Group gap="xs" align="center">
+        <Text size="xs" c="dimmed">
+          {label}
+        </Text>
+        <Badge size="xs" variant="light" color="edr-green">
+          {source}
+        </Badge>
+      </Group>
+      <Text className="wrap-break-word" size="sm" c="edr-text" fw={500}>
+        {value}
+      </Text>
+      <Text size="xs" c="edr-muted">
+        {SOURCE_NOTE[source]}
+      </Text>
+    </Stack>
+  );
+}
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/helpers.ts b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/helpers.ts
index 20e889235..623f75e1a 100644
--- a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/helpers.ts
+++ b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/helpers.ts
@@ -4,6 +4,8 @@ import type { ProfileResponse, UpdateProfilePayload } from "@/types/profile";
 import type { CompanyIdentityState } from "@/services/verifayda.service";
 import { isValidPhone, toEthiopianE164 } from "@/components/PhoneField";
 
+import type { FieldSource } from "./SourcedField";
+
 import {
   ETRADE_BUNDLE_FIELDS,
   type CompanyStep,
@@ -69,7 +71,6 @@ export function normalizeIdentityPhones(
     ...identity,
     owner: fix(identity.owner),
     poa: fix(identity.poa),
-    gm: fix(identity.gm),
   };
 }
 
@@ -82,6 +83,73 @@ export const samePhone = (a?: string | null, b?: string | null) => {
   return da.length === 9 && da === phoneDigits(b);
 };
 
+/** The owner details an outside source can take ownership of. */
+export type OwnerField = "name" | "email" | "phone";
+
+export interface OwnerSources {
+  /** Which source owns each field, or null where it is still the customer's. */
+  source: Record<OwnerField, FieldSource | null>;
+  /** What to display for an owned field — normalized as the payload will be. */
+  sourced: Record<OwnerField, string>;
+}
+
+/**
+ * Who owns each of the owner's fields, and with what value.
+ *
+ * Two sources can own a field, and they rank. A Fayda verification owns
+ * whatever its claims filled (the API refuses to overwrite those), and the
+ * eTrade licence owns the manager's name and phone: that record is the thing
+ * the backoffice checks the company against, so it is reported, not proposed.
+ * Neither is typeable. Everything left over is the customer's — an editable
+ * input, required precisely because there is an input for it. Fayda outranks
+ * eTrade on the same person: the stronger claim, and the one the API keeps.
+ *
+ * Two things deliberately do NOT take ownership.
+ *
+ * A value merely being present. It exists the moment the customer types one and
+ * the step saves — so a presence test turned the input they had just filled
+ * into a read-only badge on the way back through the wizard, and dropped the
+ * field out of `requiredKeys` at the same time.
+ *
+ * And a value that isn't usable. Both sources hold contact details as free
+ * text: Fayda's phone is whatever the national registry recorded, eTrade's is
+ * whatever was typed at the licence desk ("09        " is a real answer, and it
+ * normalizes to a non-empty, invalid `+2519`). Locking one of those behind a
+ * read-only row leaves the customer told to fix a field with no input, or the
+ * step saved with a value the API rejects. So a source owns an email or a phone
+ * only if what it supplies holds up as one; otherwise the field falls through
+ * to an input and is required like any other. Names have no format to fail, so
+ * presence is the whole test there.
+ */
+export function resolveOwnerSources(
+  identity: CompanyIdentityState | undefined,
+  etradeOwner: { name: string; phone: string } | null,
+): OwnerSources {
+  const verified = identity?.owner.verified ?? false;
+  const faydaName = verified && Boolean(identity?.owner.name?.trim());
+  const faydaEmail = verified ? firstValidEmail(identity?.owner.email) : "";
+  const faydaPhone = verified ? firstValidPhone(identity?.owner.phone) : "";
+  const etradeName = etradeOwner?.name?.trim() ?? "";
+  const etradePhone = firstValidPhone(etradeOwner?.phone);
+
+  const source: Record<OwnerField, FieldSource | null> = {
+    name: faydaName ? "Fayda" : etradeName ? "eTrade" : null,
+    // eTrade never returns an email for the manager, so this one is Fayda's or
+    // it is the customer's to type.
+    email: faydaEmail ? "Fayda" : null,
+    phone: faydaPhone ? "Fayda" : etradePhone ? "eTrade" : null,
+  };
+
+  return {
+    source,
+    sourced: {
+      name: source.name === "Fayda" ? (identity?.owner.name?.trim() ?? "") : etradeName,
+      email: faydaEmail,
+      phone: source.phone === "Fayda" ? faydaPhone : etradePhone,
+    },
+  };
+}
+
 /** Mask all but the first 7 chars of an E.164 phone for display. */
 export const maskPhone = (p: string) =>
   p.length > 4 ? `${p.slice(0, 7)}${"*".repeat(Math.max(0, p.length - 7))}` : p;
@@ -97,15 +165,14 @@ export function buildPayload(
     vatNumber: data.vatNumber,
     attributes: {
       ownerPassportNumber: data.ownerPassportNumber || undefined,
+      poaPassportNumber: data.poaPassportNumber || undefined,
       contactPersonName: data.contactPersonName,
       contactPersonPosition: data.contactPersonPosition || undefined,
       contactPersonEmail: data.contactPersonEmail || undefined,
       contactPersonPhone: data.contactPersonPhone,
-      generalManagerName: data.generalManagerName,
-      generalManagerEmail: data.generalManagerEmail,
-      generalManagerPhone: data.generalManagerPhone,
-      // The representative's own details are written by their Fayda
-      // verification, so the city is all the form has to send.
+      ownerName: data.ownerName,
+      ownerEmail: data.ownerEmail,
+      ownerPhone: data.ownerPhone,
       poaLocation: data.poaLocation || undefined,
     },
   };
@@ -135,23 +202,28 @@ export function stepPayload(
       }
       if (dirty.tinNumber) etrade.tin = d.tinNumber;
       return {
-        companyAddress: d.companyAddress,
+        // Composed from the address parts, so it is only as complete as they
+        // are. Sending it while they are still empty (the lookup hasn't landed,
+        // or eTrade left them blank) would overwrite a stored address with a
+        // degraded version of itself — an absent key means "untouched".
+        ...(d.companyAddress?.trim()
+          ? { companyAddress: d.companyAddress }
+          : {}),
         vatNumber: d.vatNumber,
-        ownerPassportNumber: d.ownerPassportNumber || undefined,
         ...etrade,
       };
     }
-    case "personnel":
+    case "owner":
       // `|| undefined`, never "": the DTO's `@IsOptional()` only skips null and
       // undefined, so an empty string is validated and 400s with
-      // "generalManagerEmail must be an email". An Ethiopian company never types
-      // these — the GM comes from the Fayda verification (or the "same as owner"
-      // declaration), so the form fields are legitimately blank and would fail a
-      // step that has no input to fix.
+      // "ownerEmail must be an email". A field the eTrade lookup or the Fayda
+      // claim already filled is legitimately blank in the form — it has no
+      // input — so sending "" would fail a step with nothing on screen to fix.
       return {
-        generalManagerName: d.generalManagerName || undefined,
-        generalManagerEmail: d.generalManagerEmail || undefined,
-        generalManagerPhone: d.generalManagerPhone || undefined,
+        ownerName: d.ownerName || undefined,
+        ownerEmail: d.ownerEmail || undefined,
+        ownerPhone: d.ownerPhone || undefined,
+        ownerPassportNumber: d.ownerPassportNumber || undefined,
       };
     case "contact":
       return {
@@ -160,12 +232,16 @@ export function stepPayload(
         contactPersonEmail: d.contactPersonEmail || undefined,
         contactPersonPhone: d.contactPersonPhone,
       };
-    case "poa":
+    case "representation":
       return {
         poaName: d.poaName || undefined,
         poaEmail: d.poaEmail || undefined,
         poaPhone: d.poaPhone || undefined,
         poaLocation: d.poaLocation || undefined,
+        poaPassportNumber: d.poaPassportNumber || undefined,
+        // The step renders one passport input, for whichever person the
+        // declaration made the identity subject — so it has to save both.
+        ownerPassportNumber: d.ownerPassportNumber || undefined,
       };
     default:
       return {};
@@ -183,6 +259,7 @@ export function toFormValues(p: ProfileResponse): FormData {
     tinNumber: tin,
     vatNumber: p.vatNumber ?? "",
     ownerPassportNumber: p.identity?.owner.passportNumber ?? "",
+    poaPassportNumber: p.identity?.poa.passportNumber ?? "",
     licenceNumber: p.licenceNumber ?? "",
     statusDescription: p.statusDescription ?? "",
     dateRegistered: p.dateRegistered ?? "",
@@ -198,12 +275,11 @@ export function toFormValues(p: ProfileResponse): FormData {
     contactPersonPosition: p.contactPersonPosition ?? "",
     contactPersonEmail: p.contactPersonEmail ?? "",
     contactPersonPhone: p.contactPersonPhone ?? "",
-    generalManagerName: p.generalManagerName ?? "",
-    generalManagerEmail: p.generalManagerEmail ?? "",
-    generalManagerPhone: p.generalManagerPhone ?? "",
+    ownerName: p.ownerName ?? "",
+    ownerEmail: p.ownerEmail ?? "",
+    ownerPhone: p.ownerPhone ?? "",
     poaName: p.poaName ?? "",
     poaPhone: p.poaPhone ?? "",
-    poaAddress: p.poaAddress ?? "",
     poaEmail: p.poaEmail ?? "",
     poaLocation: p.poaLocation ?? "",
   };
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.test.ts b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.test.ts
index 95755e777..cd957eec7 100644
--- a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.test.ts
+++ b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.test.ts
@@ -6,6 +6,7 @@ import {
   firstValidEmail,
   firstValidPhone,
   normalizeIdentityPhones,
+  resolveOwnerSources,
   stepPayload,
 } from "./helpers";
 import type { FormData } from "./schema";
@@ -35,9 +36,9 @@ const values = (over: Partial<FormData> = {}): FormData =>
     contactPersonPosition: "",
     contactPersonEmail: "",
     contactPersonPhone: "+251911223344",
-    generalManagerName: "",
-    generalManagerEmail: "",
-    generalManagerPhone: "",
+    ownerName: "",
+    ownerEmail: "",
+    ownerPhone: "",
     poaName: "",
     poaPhone: "",
     poaAddress: "",
@@ -65,18 +66,16 @@ describe("VAT number", () => {
     ).toBeUndefined();
   });
 
-  it("rejects twelve digits", () => {
-    expect(errorFor(values({ vatNumber: "001234567890" }), "vatNumber")).toBe(
-      "VAT number must be 10 or 11 digits",
-    );
-  });
-
-  // `.length(10)` used to pass this, so a ten-letter string reached the API.
-  it("rejects ten non-digits", () => {
-    expect(errorFor(values({ vatNumber: "ABCDEFGHIJ" }), "vatNumber")).toBe(
-      "VAT number must be 10 or 11 digits",
-    );
-  });
+  // No shape rule any more: a foreign tax authority's VAT number carries
+  // letters and dashes, and a co-operative union's registration numbering
+  // follows the trade-licence pattern not at all. Length and alphabet are not
+  // ours to police — only presence is.
+  it.each(["001234567890", "GB123456789", "ET-2024/0091"])(
+    "accepts %s",
+    (vat) => {
+      expect(errorFor(values({ vatNumber: vat }), "vatNumber")).toBeUndefined();
+    },
+  );
 
   it("rejects blank", () => {
     expect(errorFor(values({ vatNumber: "" }), "vatNumber")).toBe(
@@ -104,25 +103,88 @@ describe("stepFields", () => {
   // The regression this whole change exists to prevent: a step must not gate on
   // a field it renders no input for, or Continue fails with the error attached
   // to nothing on screen.
-  it("never gates the company step on a derived or read-only field", () => {
-    const unreachable = [
-      "etradePhone",
+  //
+  // Listing a field on a step is no longer the gate — `requiredKeys` is. The
+  // registration fields appear on the company step because a co-operative union
+  // or farm types them, and a licensed company gets them read-only from eTrade;
+  // the base schema must accept them blank either way.
+  it("never gates the company step on a field with no input", () => {
+    const derived = ["etradePhone", "licenceNumber", "statusDescription"];
+    expect(stepFields.company.filter((f) => derived.includes(f))).toEqual([]);
+  });
+
+  it("leaves the registration fields optional in the base schema", () => {
+    for (const field of ["companyName", "region", "zone", "woreda", "kebele"] as const) {
+      expect(errorFor(values({ [field]: "" }), field)).toBeUndefined();
+    }
+  });
+
+  it("requires the registration fields once a co-operative types them", () => {
+    const parsed = buildOnboardingSchema([
       "companyName",
-      "licenceNumber",
-      "statusDescription",
-      "dateRegistered",
-      "renewedFrom",
-      "renewalDate",
-      "renewedTo",
       "region",
       "zone",
       "woreda",
       "kebele",
-      "houseNo",
-    ];
-    expect(stepFields.company.filter((f) => unreachable.includes(f))).toEqual(
-      [],
+    ]).safeParse(
+      values({ companyName: "", region: "", zone: "", woreda: "", kebele: "" }),
     );
+    expect(parsed.success).toBe(false);
+    const paths = parsed.success
+      ? []
+      : parsed.error.issues.map((i) => String(i.path[0]));
+    expect(paths).toEqual(
+      expect.arrayContaining([
+        "companyName",
+        "region",
+        "zone",
+        "woreda",
+        "kebele",
+      ]),
+    );
+  });
+});
+
+describe("the identity subject's passport", () => {
+  // The representation step renders ONE passport input, for whoever the
+  // power-of-attorney answer made the identity subject. When the answer is "no
+  // PoA" that is the owner — so the owner's passport number is typed on the
+  // representation step and has to be carried by it. It used to belong to the
+  // owner step alone, which is already behind the customer by then: the number
+  // was typed, dropped, and the final submit failed `assertIdentityVerified`
+  // naming a field they could see was filled in.
+  it("is carried by the step that renders the input", () => {
+    expect(stepFields.representation).toContain("ownerPassportNumber");
+    expect(stepFields.representation).toContain("poaPassportNumber");
+  });
+
+  it("saves the owner's passport from the representation step", () => {
+    const payload = stepPayload(
+      "representation",
+      values({ ownerPassportNumber: "P1234567" }),
+    );
+    expect(payload.ownerPassportNumber).toBe("P1234567");
+  });
+
+  it("still omits it when there is none, rather than sending an empty string", () => {
+    const payload = stepPayload(
+      "representation",
+      values({ ownerPassportNumber: "" }),
+    );
+    expect(payload.ownerPassportNumber).toBeUndefined();
+  });
+});
+
+describe("stepPayload (representation)", () => {
+  // `poaAddress` is a Fayda-owned claim (`IDENTITY_OWNED_FIELDS` server-side).
+  // The portal states `poaLocation` instead and must never send the other.
+  it("sends the company's stated location, never the Fayda address", () => {
+    const payload = stepPayload(
+      "representation",
+      values({ poaLocation: "Dire Dawa, Ethiopia" }),
+    );
+    expect(payload.poaLocation).toBe("Dire Dawa, Ethiopia");
+    expect("poaAddress" in payload).toBe(false);
   });
 });
 
@@ -131,31 +193,29 @@ describe("buildOnboardingSchema (conditionally required fields)", () => {
     data: FormData,
     required: (keyof FormData)[],
   ): (keyof FormData)[] => {
-    const parsed = buildOnboardingSchema(false, required).safeParse(data);
+    const parsed = buildOnboardingSchema(required).safeParse(data);
     return parsed.success
       ? []
       : (parsed.error.issues.map((i) => i.path[0]) as (keyof FormData)[]);
   };
 
-  // Fayda's email/phone claims are optional: the step renders an input for what
-  // the verification did not supply, and requires exactly those. Nothing else —
-  // a field with no input on screen must never fail Continue.
+  // eTrade returns no email and Fayda's email/phone claims are optional: the
+  // step renders an input for what no source supplied, and requires exactly
+  // those. Nothing else — a field with no input on screen must never fail
+  // Continue.
   it("requires only the keys it is handed", () => {
-    const issues = issuesFor(values(), [
-      "generalManagerEmail",
-      "generalManagerPhone",
-    ]);
-    expect(issues).toEqual(["generalManagerEmail", "generalManagerPhone"]);
+    const issues = issuesFor(values(), ["ownerEmail", "ownerPhone"]);
+    expect(issues).toEqual(["ownerEmail", "ownerPhone"]);
   });
 
   it("passes once those keys are filled", () => {
     expect(
       issuesFor(
         values({
-          generalManagerEmail: "gm@example.com",
-          generalManagerPhone: "+251911223344",
+          ownerEmail: "owner@example.com",
+          ownerPhone: "+251911223344",
         }),
-        ["generalManagerEmail", "generalManagerPhone"],
+        ["ownerEmail", "ownerPhone"],
       ),
     ).toEqual([]);
   });
@@ -165,9 +225,7 @@ describe("buildOnboardingSchema (conditionally required fields)", () => {
   });
 
   it("names the field in the message, so it reads under its own input", () => {
-    const parsed = buildOnboardingSchema(false, ["poaEmail"]).safeParse(
-      values(),
-    );
+    const parsed = buildOnboardingSchema(["poaEmail"]).safeParse(values());
     expect(parsed.success).toBe(false);
     if (parsed.success) return;
     expect(parsed.error.issues[0]?.message).toBe(
@@ -196,39 +254,43 @@ describe("stepPayload (company)", () => {
     // Still only the dirty ones.
     expect(payload.licenceNumber).toBeUndefined();
   });
+
+  // The address is composed from the parts, so it is only ever as complete as
+  // they are. An absent key means "untouched" to the API; sending a blank one
+  // would replace a stored address with nothing.
+  it("omits a blank composed address rather than clearing the stored one", () => {
+    const payload = stepPayload("company", values({ companyAddress: "" }), {});
+    expect("companyAddress" in payload).toBe(false);
+  });
 });
 
-describe("stepPayload (personnel)", () => {
-  // An Ethiopian company never types the GM — Fayda (or "same as owner") owns
-  // those fields — so the form holds "". `@IsOptional()` on the DTO skips only
-  // null/undefined, so an empty string is validated and comes back as
-  // "generalManagerEmail must be an email", on a step that renders no input.
-  it("omits blank GM fields instead of sending empty strings", () => {
+describe("stepPayload (owner)", () => {
+  // A Fayda claim owns whatever it supplied, so the form holds "" for those.
+  // `@IsOptional()` on the DTO skips only null/undefined, so an empty string is
+  // validated and comes back as "ownerEmail must be an email" — on a step that
+  // renders no input for it.
+  it("omits blank owner fields instead of sending empty strings", () => {
     const payload = stepPayload(
-      "personnel",
-      values({
-        generalManagerName: "",
-        generalManagerEmail: "",
-        generalManagerPhone: "",
-      }),
+      "owner",
+      values({ ownerName: "", ownerEmail: "", ownerPhone: "" }),
     );
-    expect(payload.generalManagerName).toBeUndefined();
-    expect(payload.generalManagerEmail).toBeUndefined();
-    expect(payload.generalManagerPhone).toBeUndefined();
+    expect(payload.ownerName).toBeUndefined();
+    expect(payload.ownerEmail).toBeUndefined();
+    expect(payload.ownerPhone).toBeUndefined();
   });
 
-  it("still sends typed GM details (foreign company)", () => {
+  it("sends the owner details the customer typed or eTrade prefilled", () => {
     const payload = stepPayload(
-      "personnel",
+      "owner",
       values({
-        generalManagerName: "Abebe Bikila",
-        generalManagerEmail: "gm@example.com",
-        generalManagerPhone: "+251911223344",
+        ownerName: "Abebe Bikila",
+        ownerEmail: "owner@example.com",
+        ownerPhone: "+251911223344",
       }),
     );
-    expect(payload.generalManagerName).toBe("Abebe Bikila");
-    expect(payload.generalManagerEmail).toBe("gm@example.com");
-    expect(payload.generalManagerPhone).toBe("+251911223344");
+    expect(payload.ownerName).toBe("Abebe Bikila");
+    expect(payload.ownerEmail).toBe("owner@example.com");
+    expect(payload.ownerPhone).toBe("+251911223344");
   });
 });
 
@@ -268,13 +330,117 @@ describe("firstValidEmail", () => {
   });
 });
 
+describe("resolveOwnerSources", () => {
+  const identity = (over: {
+    verified?: boolean;
+    name?: string | null;
+    email?: string | null;
+    phone?: string | null;
+  }): CompanyIdentityState =>
+    ({
+      passportAccepted: false,
+      poaDeclared: "no",
+      subject: "owner",
+      owner: {
+        verified: over.verified ?? true,
+        name: over.name ?? null,
+        email: over.email ?? null,
+        phone: over.phone ?? null,
+        address: null,
+        verifiedAt: null,
+        passportNumber: null,
+      },
+      poa: {
+        verified: false,
+        name: null,
+        email: null,
+        phone: null,
+        address: null,
+        verifiedAt: null,
+        passportNumber: null,
+      },
+      identityProven: false,
+      etradeManagerName: null,
+      etradeManagerPhone: null,
+      ownerMatchesEtrade: null,
+      complete: false,
+    }) as CompanyIdentityState;
+
+  it("locks what each source supplied, Fayda outranking eTrade", () => {
+    const { source, sourced } = resolveOwnerSources(
+      identity({
+        name: "Abebe Bikila",
+        email: "owner@example.com",
+        phone: "+251911223344",
+      }),
+      { name: "A. Bikila", phone: "+251911999888" },
+    );
+    expect(source).toEqual({ name: "Fayda", email: "Fayda", phone: "Fayda" });
+    expect(sourced.phone).toBe("+251911223344");
+  });
+
+  // The point of the whole exercise: a field is read-only only if what the
+  // source gave can actually be submitted. Otherwise the customer is shown a
+  // badge holding a value the API will reject, with no input to fix it.
+  it("falls back to an input when Fayda's phone claim is unusable", () => {
+    const { source, sourced } = resolveOwnerSources(
+      identity({ name: "Abebe Bikila", phone: "09        " }),
+      null,
+    );
+    expect(source.phone).toBeNull();
+    expect(sourced.phone).toBe("");
+  });
+
+  it("falls back to an input when Fayda's email claim is malformed", () => {
+    const { source } = resolveOwnerSources(
+      identity({ name: "Abebe Bikila", email: "not-an-email" }),
+      null,
+    );
+    expect(source.email).toBeNull();
+  });
+
+  it("falls back to an input when eTrade's manager phone is unusable", () => {
+    const { source, sourced } = resolveOwnerSources(undefined, {
+      name: "Abebe Bikila",
+      phone: "09        ",
+    });
+    // The name is still eTrade's — names have no format to fail.
+    expect(source.name).toBe("eTrade");
+    expect(source.phone).toBeNull();
+    expect(sourced.phone).toBe("");
+  });
+
+  it("takes eTrade's phone where Fayda has none, normalized", () => {
+    const { source, sourced } = resolveOwnerSources(
+      identity({ verified: false }),
+      { name: "Abebe Bikila", phone: "0911223344" },
+    );
+    expect(source.phone).toBe("eTrade");
+    expect(sourced.phone).toBe("+251911223344");
+  });
+
+  it("owns nothing when the verification never happened", () => {
+    const { source } = resolveOwnerSources(
+      identity({
+        verified: false,
+        name: "Abebe Bikila",
+        email: "owner@example.com",
+        phone: "+251911223344",
+      }),
+      null,
+    );
+    expect(source).toEqual({ name: null, email: null, phone: null });
+  });
+});
+
 describe("normalizeIdentityPhones", () => {
   it("converts a local Fayda phone claim to E.164", () => {
     const identity = {
-      faydaRequired: true,
-      passportRequired: false,
+      passportAccepted: false,
+      poaDeclared: "yes",
+      subject: "poa",
       owner: {
-        verified: true,
+        verified: false,
         name: "A",
         phone: "0911223344",
         email: null,
@@ -283,28 +449,22 @@ describe("normalizeIdentityPhones", () => {
         passportNumber: null,
       },
       poa: {
-        verified: false,
-        name: null,
-        phone: null,
-        email: null,
-        address: null,
-        verifiedAt: null,
-      },
-      gm: {
-        verified: false,
-        name: null,
+        verified: true,
+        name: "B",
         phone: "251911223344",
         email: null,
         address: null,
         verifiedAt: null,
+        passportNumber: null,
       },
-      gmSameAsOwner: false,
-      complete: false,
+      identityProven: true,
+      etradeManagerName: null,
+      ownerMatchesEtrade: null,
+      complete: true,
     } as CompanyIdentityState;
 
     const fixed = normalizeIdentityPhones(identity)!;
     expect(fixed.owner.phone).toBe("+251911223344");
-    expect(fixed.gm.phone).toBe("+251911223344");
-    expect(fixed.poa.phone).toBeNull();
+    expect(fixed.poa.phone).toBe("+251911223344");
   });
 });
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.ts b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.ts
index 0017598e9..b274761b0 100644
--- a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.ts
+++ b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/schema.ts
@@ -5,9 +5,9 @@ import { isValidPhone } from "@/components/PhoneField";
 
 export type CompanyStep =
   | "company"
-  | "personnel"
+  | "owner"
+  | "representation"
   | "contact"
-  | "poa"
   | "documents"
   | "additional";
 
@@ -22,25 +22,33 @@ export const onboardingSchema = z.object({
   // can diverge without the backend's eTrade-authenticity check misfiring.
   etradePhone: z.string().optional(),
   tinNumber: z.string().regex(/^\d{10}$/, "TIN must be exactly 10 digits"),
-  // `.length(10)` alone accepted "ABCDEFGHIJ" — the check has to be on digits.
-  vatNumber: z
-    .string()
-    .min(1, "VAT number is required")
-    .regex(/^\d{10,11}$/, "VAT number must be 10 or 11 digits"),
-  // The owner's passport number — the foreign-company identity credential
-  // (Fayda is an Ethiopian national ID). Required only for a foreign company;
-  // enforced in buildOnboardingSchema since that depends on `nationality`.
+  // Required, but no shape check. Ethiopian VAT numbers are usually 10 or 11
+  // digits; a foreign company's is whatever its own tax authority issues, and a
+  // co-operative's registration numbering follows neither. A format rule here
+  // only ever rejected valid numbers we had no business judging.
+  vatNumber: z.string().min(1, "VAT number is required"),
+  // Passport numbers — the alternative identity credential for a foreign
+  // company (Fayda is an Ethiopian national ID). Only the one belonging to the
+  // declared identity subject is ever asked for, and only when that person has
+  // not verified with Fayda — so requiredness is decided per render and lives
+  // in `requiredKeys`, not here.
   ownerPassportNumber: z.string().optional(),
+  poaPassportNumber: z.string().optional(),
   licenceNumber: z.string().optional(),
   statusDescription: z.string().optional(),
   dateRegistered: z.string().optional(),
   renewedFrom: z.string().optional(),
   renewalDate: z.string().optional(),
   renewedTo: z.string().optional(),
-  // The registered address comes from eTrade and nowhere else — the form
-  // renders these read-only, so requiring them would be a Continue button that
-  // fails on a field with no input to fix it. A gap in eTrade's own data stays
-  // a gap rather than becoming a customer-typed claim wearing eTrade's badge.
+  // The registered address normally comes from eTrade and nowhere else — the
+  // form renders these read-only, so requiring them would be a Continue button
+  // that fails on a field with no input to fix it. A gap in eTrade's own data
+  // stays a gap rather than becoming a customer-typed claim wearing eTrade's
+  // badge.
+  //
+  // A co-operative is the exception: it has no business licence, so there is no
+  // eTrade record at all and these ARE typed. Requiredness follows the same
+  // invariant as everywhere else — it is decided per render, in `requiredKeys`.
   region: z.string().optional(),
   zone: z.string().optional(),
   woreda: z.string().optional(),
@@ -57,21 +65,23 @@ export const onboardingSchema = z.object({
     .string()
     .min(1, "Contact person phone is required")
     .refine(isValidPhone, "Enter a valid phone number"),
-  // Optional here, not unrequired: the GM is now established by Fayda — either
-  // verified in their own right or declared the same person as the owner — so
-  // for an Ethiopian company these fields are never typed and would fail a
-  // blanket `min(1)`. Presence is gated per nationality in the step's own
-  // check, where the identity state is available; zod only polices format for
-  // the foreign companies that still type them.
-  generalManagerName: z.string().optional(),
-  generalManagerEmail: z
+  // The owner — whoever the eTrade licence names as the business's manager.
+  //
+  // Optional here, not unrequired: the eTrade lookup fills the name and phone,
+  // and a Fayda verification can fill all three, so on a well-supplied company
+  // none of them is typed and a blanket `min(1)` would fail a step with no
+  // input on screen. What IS required is decided per render — a field is
+  // required exactly when the step renders an input for it (`requiredKeys`).
+  // zod only polices format here.
+  ownerName: z.string().optional(),
+  ownerEmail: z
     .string()
     .optional()
     .refine(
       (v) => !v || z.string().email().safeParse(v).success,
-      "Invalid Manager email",
+      "Invalid owner email",
     ),
-  generalManagerPhone: z
+  ownerPhone: z
     .string()
     .optional()
     .refine((v) => !v || isValidPhone(v), "Enter a valid phone number"),
@@ -80,7 +90,6 @@ export const onboardingSchema = z.object({
     .string()
     .optional()
     .refine((v) => !v || isValidPhone(v), "Enter a valid phone number"),
-  poaAddress: z.string().optional(),
   poaEmail: z
     .string()
     .optional()
@@ -88,6 +97,10 @@ export const onboardingSchema = z.object({
       (v) => !v || z.string().email().safeParse(v).success,
       "Invalid email address",
     ),
+  // Where the representative is based, as the company states it. Deliberately
+  // NOT `poaAddress`: that one is a Fayda-owned claim (`IDENTITY_OWNED_FIELDS`)
+  // the verification writes and the portal must never send — the two used to
+  // sit side by side here, with the Fayda address silently hiding this input.
   poaLocation: z.string().optional(),
 });
 
@@ -102,45 +115,45 @@ export const POA_DELEGATION_FILE_KEY = "poa_delegation_letter";
  * message has to be built here rather than attached to the base schema.
  */
 const CONDITIONAL_LABELS: Partial<Record<keyof FormData, string>> = {
+  // Typed only by a co-operative — every other company gets these from eTrade.
+  companyName: "Company name",
+  region: "Region",
+  zone: "Zone",
+  woreda: "Woreda",
+  kebele: "Kebele",
   poaName: "Representative's name",
   poaEmail: "Representative's email",
   poaPhone: "Representative's phone",
-  generalManagerName: "General manager's name",
-  generalManagerEmail: "General manager's email",
-  generalManagerPhone: "General manager's phone",
+  poaPassportNumber: "Representative's passport number",
+  ownerName: "Owner's name",
+  ownerEmail: "Owner's email",
+  ownerPhone: "Owner's phone",
+  ownerPassportNumber: "Owner's passport number",
 };
 
 /**
- * The PoA's and GM's identifying fields normally come from their Fayda
- * verification, so nothing in the base schema requires them. But Fayda's email
- * and phone claims are optional and routinely come back empty, and the steps
- * render an input for whatever the verification did not supply — so those
- * fields become mandatory exactly then.
+ * The owner's and the representative's identifying fields arrive from three
+ * places — the eTrade lookup, a Fayda verification, or the customer typing them
+ * — and which one supplies what varies per company. eTrade returns no email at
+ * all; Fayda's email and phone claims are optional and routinely come back
+ * empty. So nothing in the base schema requires them, and the steps render an
+ * input for whatever no source supplied.
  *
  * `requiredKeys` is that decision, made by CompanyProfileForm from the same
- * state that drives the rendering: a field is required iff an input exists for
- * it. Passing it in (rather than deriving it here) is what keeps the two from
- * drifting into a Continue button that fails on a field nobody can see.
+ * state that drives the rendering: **a field is required iff an input exists
+ * for it**. Passing it in (rather than deriving it here) is what keeps the two
+ * from drifting into a Continue button that fails on a field nobody can see.
  */
 export function buildOnboardingSchema(
-  /** True for a foreign company: the owner's passport number is mandatory. */
-  passportRequired = false,
   /** Fields the current step renders an input for and must not leave blank. */
   requiredKeys: readonly (keyof FormData)[] = [],
 ) {
-  if (!passportRequired && requiredKeys.length === 0) return onboardingSchema;
+  if (requiredKeys.length === 0) return onboardingSchema;
   return onboardingSchema.superRefine((d, ctx) => {
-    if (passportRequired && !d.ownerPassportNumber?.trim()) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        path: ["ownerPassportNumber"],
-        message: "The owner's passport number is required",
-      });
-    }
     for (const key of requiredKeys) {
       if (d[key]?.trim()) continue;
       ctx.addIssue({
-        code: z.ZodIssueCode.custom,
+        code: "custom",
         path: [key],
         message: `${CONDITIONAL_LABELS[key] ?? key} is required`,
       });
@@ -184,25 +197,46 @@ export const ETRADE_BUNDLE_FIELDS = [
  * (`REQUIRED_COMPANY_INFO`), and reports it with a message.
  */
 export const stepFields: Record<CompanyStep, (keyof FormData)[]> = {
-  // Only the three fields this step actually renders an input for. The company
-  // name and the registered address are eTrade's, shown read-only.
-  company: ["tinNumber", "vatNumber", "ownerPassportNumber"],
-  personnel: [
-    "generalManagerName",
-    "generalManagerEmail",
-    "generalManagerPhone",
+  // Only what this step actually renders an input for. The company name and the
+  // registered address are eTrade's, shown read-only — except for a
+  // co-operative, which types them (added per render via `requiredKeys`).
+  company: [
+    "tinNumber",
+    "vatNumber",
+    "companyName",
+    "region",
+    "zone",
+    "woreda",
+    "kebele",
+    "houseNo",
   ],
+  // `REQUIRED_COMPANY_INFO` demands all three server-side, so the step offers
+  // an input wherever eTrade and Fayda between them left a gap.
+  owner: ["ownerName", "ownerEmail", "ownerPhone", "ownerPassportNumber"],
   contact: [
     "contactPersonName",
     "contactPersonPosition",
     "contactPersonEmail",
     "contactPersonPhone",
   ],
-  // The API requires poaName/poaEmail/poaPhone from a freight forwarder
-  // (`REQUIRED_POA_FIELDS`), so the step has to offer them wherever the
-  // representative isn't proven by Fayda — otherwise the save is rejected
-  // naming fields the form never rendered.
-  poa: ["poaName", "poaEmail", "poaPhone", "poaLocation"],
+  // The API requires poaName/poaEmail/poaPhone once a representative is
+  // declared (`REQUIRED_POA_FIELDS`), so the step has to offer them wherever
+  // Fayda didn't supply them — otherwise the save is rejected naming fields the
+  // form never rendered.
+  // `ownerPassportNumber` belongs here as much as the PoA's: the step renders
+  // whichever passport input the declaration calls for, and when the answer is
+  // "no PoA" that is the owner's. Leaving it out meant the number was typed on
+  // this step, validated by nothing, and dropped by `stepPayload` — so the
+  // final submit failed `assertIdentityVerified` over a field two steps back
+  // that the customer could see was filled in.
+  representation: [
+    "poaName",
+    "poaEmail",
+    "poaPhone",
+    "poaLocation",
+    "poaPassportNumber",
+    "ownerPassportNumber",
+  ],
   documents: [],
   additional: [],
 };
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/CompanyInfoStep.tsx b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/CompanyInfoStep.tsx
index 0473b26d1..b89e0e920 100644
--- a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/CompanyInfoStep.tsx
+++ b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/CompanyInfoStep.tsx
@@ -1,12 +1,10 @@
-import { Stack, TextInput } from "@mantine/core";
+import { Select, SimpleGrid, Stack, Text, TextInput } from "@mantine/core";
 import type { UseFormReturn } from "react-hook-form";
 
-import type { CompanyRegistrationData } from "@edr/types";
-import FaydaVerifyPanel from "@/components/FaydaVerifyPanel";
+import { ETHIOPIAN_REGIONS, type CompanyRegistrationData } from "@edr/types";
 import ETradeInfo, {
   type ETradeStatus,
 } from "@/components/onboarding/ETradeInfo";
-import type { CompanyIdentityState } from "@/services/verifayda.service";
 
 import type { FormData } from "../schema";
 import ETradeCompanyCard from "../ETradeCompanyCard";
@@ -14,14 +12,16 @@ import StepSection from "../StepSection";
 
 export interface CompanyInfoStepProps {
   form: UseFormReturn<FormData>;
-  /** Fayda verification state, phone-normalized by the parent. */
-  identity?: CompanyIdentityState;
-  /** True when Fayda (not a passport) is what this company must prove with. */
-  verifiedIdentity: boolean;
   tinStatus: ETradeStatus;
   tinVerified: boolean;
   /** Registration fields are already populated (a lookup passed, now or earlier). */
   hasRegistrationDetails: boolean;
+  /**
+   * The company is a co-operative union or farm: it has a TIN but no business
+   * licence, so eTrade holds no record to look up and the registration is typed
+   * here instead.
+   */
+  cooperative?: boolean;
   onETradeDataLoaded: (data: CompanyRegistrationData) => void;
   onETradeStatusChange: (status: ETradeStatus) => void;
   onETradeReset: () => void;
@@ -29,11 +29,10 @@ export interface CompanyInfoStepProps {
 
 export default function CompanyInfoStep({
   form,
-  identity,
-  verifiedIdentity,
   tinStatus,
   tinVerified,
   hasRegistrationDetails,
+  cooperative = false,
   onETradeDataLoaded,
   onETradeStatusChange,
   onETradeReset,
@@ -41,77 +40,51 @@ export default function CompanyInfoStep({
   const {
     register,
     watch,
+    setValue,
     formState: { errors },
   } = form;
 
+  const region = watch("region") ?? "";
+
   return (
     <Stack gap="xl">
       <StepSection
         index={1}
         title="VAT number"
-        status={
-          (watch("vatNumber")?.length ?? 0) >= 10 && !errors.vatNumber
-            ? "done"
-            : "todo"
-        }
+        status={watch("vatNumber")?.trim() && !errors.vatNumber ? "done" : "todo"}
       >
         <TextInput
           aria-label="VAT Number"
           placeholder="0012345678"
-          maxLength={11}
           error={errors.vatNumber?.message}
           {...register("vatNumber")}
         />
       </StepSection>
 
+      {/* The TIN lookup runs for everyone, co-operative included. A co-op has
+          no trade licence, but plenty of them are on eTrade all the same — and
+          when the record is there it is better data than anything typed, so we
+          ask for it first and fall back to the form below rather than deciding
+          in advance that nothing will be found. What differs for a co-op is
+          only the consequence of finding nothing: expected, not an error. */}
       <StepSection
         index={2}
-        title="Owner identity"
-        subtitle={
-          !identity?.owner.verified && !verifiedIdentity
-            ? "Provide the company owner's passport number."
-            : undefined
-        }
-        status={
-          verifiedIdentity
-            ? identity?.owner.verified
-              ? "done"
-              : identity?.faydaRequired
-                ? "blocked"
-                : "todo"
-            : (watch("ownerPassportNumber")?.trim()?.length ?? 0) > 0
-              ? "done"
-              : identity?.passportRequired
-                ? "blocked"
-                : "todo"
-        }
-      >
-        {identity && (
-          <>
-            <FaydaVerifyPanel
-              subject="owner"
-              title="Owner"
-              state={identity.owner}
-              required={identity.faydaRequired}
-            />
-            {identity.passportRequired && (
-              <TextInput
-                label="Owner Passport Number"
-                placeholder="P1234567"
-                error={errors.ownerPassportNumber?.message}
-                {...register("ownerPassportNumber")}
-              />
-            )}
-          </>
-        )}
-      </StepSection>
-
-      <StepSection
-        index={3}
         title="Company TIN"
-        subtitle="We'll pull your registration straight from eTrade — nothing to type by hand once it's found."
+        subtitle={
+          cooperative
+            ? "We'll check eTrade for your TIN. Co-operatives often aren't listed — if yours isn't, you'll fill the details in below."
+            : "We'll pull your registration straight from eTrade — nothing to type by hand once it's found."
+        }
         status={
-          tinVerified ? "done" : tinStatus === "taken" ? "blocked" : "todo"
+          tinStatus === "taken"
+            ? "blocked"
+            : cooperative
+              ? watch("tinNumber")?.trim() && !errors.tinNumber
+                ? "done"
+                : "todo"
+              : tinVerified
+                ? "done"
+                : "todo"
         }
       >
         <ETradeInfo
@@ -123,11 +96,87 @@ export default function CompanyInfoStep({
           onReset={onETradeReset}
           alreadyVerified={hasRegistrationDetails}
           selectedLicenceNumber={watch("licenceNumber")}
+          registrationOptional={cooperative}
         />
-        {tinVerified && (
+        {!cooperative && tinVerified && (
           <ETradeCompanyCard tin={watch("tinNumber")} watch={watch} />
         )}
       </StepSection>
+
+      {/* A co-operative keeps its typed registration section either way. When
+          the lookup found something these arrive prefilled — still editable,
+          because for a co-op they are the customer's own statement rather than
+          the licence's, and the API takes them as given (`applyEtradeSourcedFields`
+          skips co-operatives entirely). */}
+      {cooperative && (
+        <StepSection
+          index={3}
+          title="Registration details"
+          subtitle={
+            hasRegistrationDetails
+              ? "From eTrade. Correct anything that doesn't look right — for a co-operative these are yours to state."
+              : "Everything we'd normally read off an eTrade licence. We need it from you instead."
+          }
+          status={
+            watch("companyName")?.trim() && watch("region")?.trim()
+              ? "done"
+              : "todo"
+          }
+        >
+          <Stack gap="md">
+            <TextInput
+              label="Company Name"
+              placeholder="Registered name of the union or farm"
+              error={errors.companyName?.message}
+              {...register("companyName")}
+            />
+            <Text size="sm" c="edr-muted">
+              Registered address
+            </Text>
+            <SimpleGrid cols={{ base: 1, sm: 2 }} spacing="md">
+              <Select
+                label="Region"
+                placeholder="Select region"
+                // eTrade's own spelling may not be one of ours. Carrying it in
+                // as an option keeps the lookup's answer visible instead of
+                // silently blanking the field it just filled.
+                data={
+                  region &&
+                    !(ETHIOPIAN_REGIONS as readonly string[]).includes(region)
+                    ? [...ETHIOPIAN_REGIONS, region]
+                    : [...ETHIOPIAN_REGIONS]
+                }
+                searchable
+                value={region || null}
+                onChange={(v) =>
+                  setValue("region", v ?? "", { shouldValidate: true })
+                }
+                error={errors.region?.message}
+              />
+              <TextInput
+                label="Zone"
+                error={errors.zone?.message}
+                {...register("zone")}
+              />
+              <TextInput
+                label="Woreda"
+                error={errors.woreda?.message}
+                {...register("woreda")}
+              />
+              <TextInput
+                label="Kebele"
+                error={errors.kebele?.message}
+                {...register("kebele")}
+              />
+              <TextInput
+                label="House No."
+                error={errors.houseNo?.message}
+                {...register("houseNo")}
+              />
+            </SimpleGrid>
+          </Stack>
+        </StepSection>
+      )}
     </Stack>
   );
 }
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/ContactStep.tsx b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/ContactStep.tsx
index e5d16ea5f..6c28161b8 100644
--- a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/ContactStep.tsx
+++ b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/ContactStep.tsx
@@ -9,19 +9,19 @@ import { LinkCheckboxCard } from "../LinkCheckboxCard";
 export interface ContactStepProps {
   form: UseFormReturn<FormData>;
   /**
-   * The GM's name from whichever source established them (verification or form)
-   * — the "same as GM" card only makes sense once there is a GM.
+   * The owner's name from whichever source established them (eTrade, Fayda or
+   * typed) — the "same as owner" card only makes sense once there is one.
    */
-  gmName?: string;
-  contactSameAsGm: boolean;
-  onToggleContactSameAsGm: (checked: boolean) => void;
+  ownerName?: string;
+  contactSameAsOwner: boolean;
+  onToggleContactSameAsOwner: (checked: boolean) => void;
 }
 
 export default function ContactStep({
   form,
-  gmName,
-  contactSameAsGm,
-  onToggleContactSameAsGm,
+  ownerName,
+  contactSameAsOwner,
+  onToggleContactSameAsOwner,
 }: ContactStepProps) {
   const {
     register,
@@ -34,21 +34,26 @@ export default function ContactStep({
       <Text fw={600} size="sm" c="edr-text">
         Contact Person
       </Text>
-      {/* `gmName`, not the raw form field: a Fayda-verified GM never
-          fills `generalManagerName`, so gating on it hid this card from
-          every Ethiopian company — the majority case. */}
-      {gmName && (
+      {/* `ownerName`, not the raw form field: the owner's name usually comes
+          from the eTrade lookup or a Fayda claim rather than being typed, so
+          gating on the form value would hide this card from most companies. */}
+      {ownerName && (
         <LinkCheckboxCard
-          checked={contactSameAsGm}
-          onToggle={onToggleContactSameAsGm}
-          title="Same as General Manager"
-          description="Reuse the general manager's name, email and phone. Uncheck to enter different details."
+          checked={contactSameAsOwner}
+          onToggle={onToggleContactSameAsOwner}
+          title="Same as company owner"
+          description="Reuse the owner's name, email and phone. Uncheck to enter different details."
         />
       )}
       <SimpleGrid cols={2} spacing="md">
+        {/* Disabled while linked, not merely prefilled: the mirror effect
+            rewrites these from the owner whenever the owner changes, so an edit
+            made here would be silently thrown away the next time it fires.
+            Position is the customer's either way — the owner has no equivalent. */}
         <TextInput
           label="Name"
           placeholder="Jane Smith"
+          disabled={contactSameAsOwner}
           error={errors.contactPersonName?.message}
           {...register("contactPersonName")}
         />
@@ -64,6 +69,7 @@ export default function ContactStep({
           label="Email (Optional)"
           type="email"
           placeholder="contact@company.com"
+          disabled={contactSameAsOwner}
           error={errors.contactPersonEmail?.message}
           {...register("contactPersonEmail")}
         />
@@ -71,6 +77,7 @@ export default function ContactStep({
           control={control}
           name="contactPersonPhone"
           label="Phone"
+          disabled={contactSameAsOwner}
           required
         />
       </SimpleGrid>
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/OwnerStep.tsx b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/OwnerStep.tsx
new file mode 100644
index 000000000..4035b8aaf
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/OwnerStep.tsx
@@ -0,0 +1,151 @@
+import { Alert, SimpleGrid, Stack, Text, TextInput } from "@mantine/core";
+import { AlertTriangle, Info } from "lucide-react";
+import type { UseFormReturn } from "react-hook-form";
+
+import { ControlledPhoneField } from "@/components/PhoneField";
+import type { CompanyIdentityState } from "@/services/verifayda.service";
+
+import type { FormData } from "../schema";
+import SourcedField, { type FieldSource } from "../SourcedField";
+
+/** The owner details this step is responsible for. */
+type OwnerField = "name" | "email" | "phone";
+
+export interface OwnerStepProps {
+  form: UseFormReturn<FormData>;
+  identity?: CompanyIdentityState;
+  /** eTrade's registered manager, once a TIN lookup has succeeded. */
+  etradeOwner: { name: string; phone: string } | null;
+  /**
+   * Which source owns each of the owner's details, or null where none does.
+   *
+   * A sourced field is shown read-only with its provenance; every other one is
+   * an editable input. Neither the eTrade licence nor a Fayda verification is
+   * the customer's to retype — the first is the record the backoffice checks
+   * this company against, the second is the government's. CompanyProfileForm
+   * computes this and requires exactly the unsourced fields, so every input on
+   * screen is one the customer is actually asked to fill and nothing is
+   * required that has none.
+   */
+  source: Record<OwnerField, FieldSource | null>;
+  /** The value to display for a field its source owns. */
+  sourced: Record<OwnerField, string>;
+  /** A co-operative union or farm: no licence, so no eTrade record to match. */
+  cooperative?: boolean;
+}
+
+/**
+ * Who the company's owner is — meaning whoever the eTrade licence names as the
+ * business's manager. Not necessarily the legal owner, but the person the
+ * record has to match: the backoffice's check is precisely "is this the person
+ * on the licence".
+ *
+ * Nothing here falls back to the signed-in account. The person doing the
+ * onboarding is often not the person on the licence, and stamping their name,
+ * email and phone onto the owner turned three required fields into a guess
+ * wearing the licence's authority.
+ *
+ * A co-operative union or farm has no licence, so there is nobody named on one
+ * — the owner is simply the person who runs it, typed in full and compared
+ * against nothing.
+ */
+export default function OwnerStep({
+  form,
+  identity,
+  etradeOwner,
+  source,
+  sourced,
+  cooperative = false,
+}: OwnerStepProps) {
+  const {
+    register,
+    control,
+    formState: { errors },
+  } = form;
+
+  const ownerVerified = identity?.owner.verified ?? false;
+
+  // A Fayda verification that names someone other than the person on the
+  // licence is the one thing this step exists to catch. Advisory here — the two
+  // sources transliterate Amharic names differently, so the reviewer decides —
+  // but the customer should see it now rather than be rejected later.
+  const mismatch = identity?.ownerMatchesEtrade === false;
+
+  return (
+    <Stack gap="md">
+      <Text size="sm" c="edr-muted">
+        {cooperative && !etradeOwner
+          ? "The person who runs the co-operative union or farm. eTrade held no record for your TIN, so we need all of these from you."
+          : "These are the details of the person registered on your eTrade licence. What eTrade and Fayda gave us is shown as they gave it; anything they left blank we need from you."}
+      </Text>
+
+      {/* A co-operative is not told its licence listed no manager — it has no
+          licence. Its own "nothing came back" case is covered by the line
+          above. */}
+      {!cooperative && !etradeOwner && !ownerVerified && (
+        <Alert color="blue" variant="light" icon={<Info size={18} />}>
+          Your eTrade licence didn't list a manager, so there's nothing for us
+          to prefill. Enter the details of the person registered on it.
+        </Alert>
+      )}
+
+      {mismatch && (
+        <Alert
+          color="amber"
+          variant="light"
+          icon={<AlertTriangle size={18} />}
+          title="This doesn't match your eTrade licence"
+        >
+          Your licence lists <strong>{identity?.etradeManagerName}</strong>, but
+          the name here is <strong>{identity?.owner.name}</strong>. You can
+          continue, but our team will check this before approving your account —
+          so make sure it's the person the licence actually names.
+        </Alert>
+      )}
+
+      <SourcedField
+        label="Owner's Name"
+        value={sourced.name}
+        source={source.name}
+      >
+        <TextInput
+          label="Owner's Name"
+          placeholder="Abebe Bikila"
+          error={errors.ownerName?.message}
+          {...register("ownerName")}
+        />
+      </SourcedField>
+
+      <SimpleGrid cols={{ base: 1, sm: 2 }} spacing="md">
+        {/* eTrade never returns an email for the manager and Fayda's email
+            claim is optional, so this is the field most companies actually
+            type — it is required either way (`REQUIRED_COMPANY_INFO`). */}
+        <SourcedField
+          label="Owner's Email"
+          value={sourced.email}
+          source={source.email}
+        >
+          <TextInput
+            label="Owner's Email"
+            type="email"
+            placeholder="owner@company.com"
+            error={errors.ownerEmail?.message}
+            {...register("ownerEmail")}
+          />
+        </SourcedField>
+
+        <SourcedField
+          label="Owner's Phone"
+          value={sourced.phone}
+          source={source.phone}
+        >
+          <ControlledPhoneField
+            control={control}
+            name="ownerPhone"
+            label="Owner's Phone"
+          />
+        </SourcedField>
+      </SimpleGrid>
+    </Stack>
+  );
+}
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/PersonnelStep.tsx b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/PersonnelStep.tsx
deleted file mode 100644
index d3324e0a7..000000000
--- a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/PersonnelStep.tsx
+++ /dev/null
@@ -1,150 +0,0 @@
-import { SimpleGrid, Text, TextInput } from "@mantine/core";
-import type { UseFormReturn } from "react-hook-form";
-
-import { ControlledPhoneField } from "@/components/PhoneField";
-import FaydaVerifyPanel from "@/components/FaydaVerifyPanel";
-import type { CompanyIdentityState } from "@/services/verifayda.service";
-
-import type { FormData } from "../schema";
-import { LinkCheckboxCard } from "../LinkCheckboxCard";
-
-export interface PersonnelStepProps {
-  form: UseFormReturn<FormData>;
-  identity?: CompanyIdentityState;
-  /** eTrade-registered owner, once a TIN lookup has succeeded. */
-  etradeOwner: { name: string; phone: string } | null;
-  gmSameAsOwner: boolean;
-  onToggleGmSameAsOwner: (checked: boolean) => void;
-  /** A server-side "same as owner" declaration is in flight. */
-  gmLinkPending: boolean;
-  gmVerified: boolean;
-  /**
-   * Which of the manager's contact details their Fayda verification did not
-   * supply, and are therefore typed here. Computed by CompanyProfileForm, which
-   * requires exactly these in the schema.
-   */
-  gaps: { name: boolean; email: boolean; phone: boolean };
-}
-
-export default function PersonnelStep({
-  form,
-  identity,
-  etradeOwner,
-  gmSameAsOwner,
-  onToggleGmSameAsOwner,
-  gmLinkPending,
-  gmVerified,
-  gaps,
-}: PersonnelStepProps) {
-  const {
-    register,
-    control,
-    formState: { errors },
-  } = form;
-
-  return (
-    <>
-      <Text fw={600} size="sm" c="edr-text">
-        General Manager
-      </Text>
-      {/* The GM is very often the owner. Where the owner is
-          Fayda-verified this reuses that proven identity outright
-          rather than making the same human verify twice; where the
-          owner is backed by a typed passport there is nothing proven
-          to copy, so it stays a local prefill. */}
-      <LinkCheckboxCard
-        checked={gmSameAsOwner}
-        onToggle={onToggleGmSameAsOwner}
-        title={
-          identity?.owner.verified
-            ? "Same as verified owner"
-            : "Same as business owner"
-        }
-        description={
-          identity?.owner.verified
-            ? "Reuse the Fayda-verified owner's identity for the general manager. Uncheck to verify a different person."
-            : etradeOwner
-              ? "Reuse the eTrade-registered owner's name, plus the company email and phone as you entered them. Uncheck to enter different details."
-              : "Reuse your account's name and the company email and phone as you entered them. Uncheck to enter different details."
-        }
-      />
-
-      {/* Verifying a second person is only meaningful when the GM is
-          someone other than the owner. */}
-      {!gmSameAsOwner && identity && (
-        <FaydaVerifyPanel
-          subject="gm"
-          title="General Manager"
-          state={identity.gm}
-          required={identity.faydaRequired}
-          disabled={gmLinkPending}
-        />
-      )}
-
-      {/* Fayda's name, email and phone claims are all optional, and the
-          manager's own verification has no account to fall back on the way the
-          owner's does — the person onboarding is not necessarily the manager.
-          Whatever the verification left empty is typed here, and required:
-          without it the submit fails on "Add your general manager name" with no
-          field anywhere to satisfy it. */}
-      {gaps.name && (
-        <TextInput
-          label="Name"
-          placeholder="Abebe Bikila"
-          error={errors.generalManagerName?.message}
-          {...register("generalManagerName")}
-        />
-      )}
-      {(gaps.email || gaps.phone) && (
-        <SimpleGrid cols={gaps.email && gaps.phone ? 2 : 1} spacing="md">
-          {gaps.email && (
-            <TextInput
-              label="Email"
-              type="email"
-              placeholder="gm@company.com"
-              error={errors.generalManagerEmail?.message}
-              {...register("generalManagerEmail")}
-            />
-          )}
-          {gaps.phone && (
-            <ControlledPhoneField
-              control={control}
-              name="generalManagerPhone"
-              label="Phone"
-              required
-            />
-          )}
-        </SimpleGrid>
-      )}
-
-      {/* Typed details survive only where Fayda cannot be required —
-          a foreign company's manager may hold no Fayda ID. Once
-          verified the API owns these fields, so they go away. */}
-      {!gmSameAsOwner && !gmVerified && !identity?.faydaRequired && (
-        <>
-          <TextInput
-            label="Name"
-            placeholder="Abebe Bikila"
-            error={errors.generalManagerName?.message}
-            {...register("generalManagerName")}
-          />
-          <SimpleGrid cols={2} spacing="md">
-            <TextInput
-              label="Email"
-              type="email"
-              placeholder="gm@company.com"
-              error={errors.generalManagerEmail?.message}
-              {...register("generalManagerEmail")}
-            />
-            <ControlledPhoneField
-              control={control}
-              name="generalManagerPhone"
-              label="Phone"
-              required
-            />
-          </SimpleGrid>
-        </>
-      )}
-    </>
-  );
-}
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/PoaStep.tsx b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/PoaStep.tsx
deleted file mode 100644
index efece363b..000000000
--- a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/PoaStep.tsx
+++ /dev/null
@@ -1,217 +0,0 @@
-import { Button, Divider, Group, SimpleGrid, Text, TextInput } from "@mantine/core";
-import { Trash2 } from "lucide-react";
-import type { UseFormReturn } from "react-hook-form";
-
-import { SmartFileInput } from "@edr/ui-common";
-import { ControlledPhoneField } from "@/components/PhoneField";
-import FaydaVerifyPanel from "@/components/FaydaVerifyPanel";
-import type { FileUploadSetting } from "@/types/fileUploadSettings";
-import type { CompanyIdentityState } from "@/services/verifayda.service";
-
-import type { FormData } from "../schema";
-import { LinkCheckboxCard } from "../LinkCheckboxCard";
-
-export interface PoaStepProps {
-  form: UseFormReturn<FormData>;
-  identity?: CompanyIdentityState;
-  /** This company holds a freight-forwarder profile, so the PoA is mandatory. */
-  requirePoa: boolean;
-  /** The owner represents the company themselves. */
-  poaSameAsOwner: boolean;
-  onTogglePoaSameAsOwner: (checked: boolean) => void;
-  /** A server-side "same as owner" declaration is in flight. */
-  poaLinkPending: boolean;
-  /** eTrade-registered owner, once a TIN lookup has succeeded. */
-  etradeOwner: { name: string; phone: string } | null;
-  /**
-   * Which of the representative's details the Fayda verification did not
-   * supply, and are therefore typed here. Computed by CompanyProfileForm, which
-   * requires exactly these in the schema — so every input rendered below is one
-   * the customer is actually asked to fill.
-   */
-  gaps: { name: boolean; email: boolean; phone: boolean; address: boolean };
-  /** Drop a verified representative the company decided against. */
-  onRemovePoa: () => void;
-  removePending: boolean;
-  /** The DARS delegation paper is owed (a PoA exists, or the company forwards). */
-  delegationRequired: boolean;
-  /** Single-field upload setting carrying just the delegation letter. */
-  poaDocumentSetting?: FileUploadSetting;
-  documentFiles: Record<string, File | File[] | null>;
-  uploadedDocumentKeys?: string[];
-  documentFieldErrors: Record<string, string>;
-  onDocumentFilesChange: (next: Record<string, File | File[] | null>) => void;
-}
-
-export default function PoaStep({
-  form,
-  identity,
-  requirePoa,
-  poaSameAsOwner,
-  onTogglePoaSameAsOwner,
-  poaLinkPending,
-  etradeOwner,
-  gaps,
-  onRemovePoa,
-  removePending,
-  delegationRequired,
-  poaDocumentSetting,
-  documentFiles,
-  uploadedDocumentKeys,
-  documentFieldErrors,
-  onDocumentFilesChange,
-}: PoaStepProps) {
-  const {
-    register,
-    control,
-    formState: { errors },
-  } = form;
-
-  // Fayda's email/phone/address claims are optional and routinely come back
-  // empty, so a *verified* representative can still be missing the email and
-  // phone the API demands from a freight forwarder (`REQUIRED_POA_FIELDS`) —
-  // and the panel above renders no input for them, which dead-ends the step on
-  // "Add the poa email first". `gaps` is exactly what the verification did not
-  // supply: the API keeps those keys typeable, since a claim that returned
-  // nothing owns no value to protect (`faydaOwnedKeys`).
-  const needsEmail = gaps.email;
-  const needsPhone = gaps.phone;
-
-  // Fayda is mandatory for an Ethiopian company's representative, so there the
-  // link can only reuse a proven owner — with none there would be nothing to
-  // copy and the declaration could never satisfy the gate. A foreign company's
-  // owner is backed by a typed passport, so it prefills instead.
-  const linkNeedsVerifiedOwner =
-    (identity?.faydaRequired ?? false) && !identity?.owner.verified;
-
-  return (
-    <>
-      <Text size="sm" c="edr-muted">
-        {requirePoa
-          ? "As a freight forwarder you act on other companies' behalf, so Power of Attorney details are required."
-          : "Power of Attorney details are optional. Fill them in if you have them, or skip to continue."}{" "}
-        {poaSameAsOwner
-          ? "You represent the company yourself, so no delegation paper is needed."
-          : "If the representative is someone other than the owner, upload the delegation paper authenticated by DARS."}
-      </Text>
-
-      {/* An owner who represents their own company is the ordinary
-          small-business case. Where the owner is Fayda-verified this reuses
-          that proven identity outright rather than sending the same human
-          through Fayda twice; where they are backed by a typed passport there
-          is nothing proven to copy, so it stays a local prefill. Either way it
-          is the declaration that waives the DARS paper. */}
-      {identity && (
-        <LinkCheckboxCard
-          checked={poaSameAsOwner}
-          onToggle={onTogglePoaSameAsOwner}
-          disabled={poaLinkPending || (linkNeedsVerifiedOwner && !poaSameAsOwner)}
-          title={
-            identity.owner.verified
-              ? "Same as verified owner"
-              : "Same as business owner"
-          }
-          description={
-            linkNeedsVerifiedOwner
-              ? "Verify the company owner with Fayda first — then you can reuse that identity here."
-              : identity.owner.verified
-                ? "You represent the company yourself. Reuses the Fayda-verified owner's identity, and no DARS delegation paper is needed. Uncheck to name someone else."
-                : etradeOwner
-                  ? "You represent the company yourself. Reuses the eTrade-registered owner's name plus the company email and phone as you entered them, and no DARS delegation paper is needed. Uncheck to name someone else."
-                  : "You represent the company yourself. Reuses your account's name, email and phone, and no DARS delegation paper is needed. Uncheck to name someone else."
-          }
-        />
-      )}
-
-      {/* A representative acts for the company inside Ethiopia
-          whoever owns it, so the PoA is proven with Fayda regardless of
-          nationality — their name, email, phone and address all come
-          from the verification and are never typed here. Verifying a second
-          person is only meaningful when the representative is not the owner. */}
-      {identity && !poaSameAsOwner && (
-        <FaydaVerifyPanel
-          subject="poa"
-          title="Power of Attorney"
-          state={identity.poa}
-          required={requirePoa}
-          disabled={poaLinkPending}
-        />
-      )}
-      {/* A verification cannot be undone by clearing the form — it owns those
-          fields — and its mere existence makes the delegation paper due, which
-          then blocks the submit. So an optional representative needs a way
-          back out, here rather than only in settings (unreachable until
-          onboarding finishes). */}
-      {identity?.poa.verified && !requirePoa && !poaSameAsOwner && (
-        <Group justify="flex-end">
-          <Button
-            type="button"
-            variant="subtle"
-            color="red"
-            size="xs"
-            loading={removePending}
-            leftSection={<Trash2 size={14} />}
-            onClick={onRemovePoa}
-          >
-            Remove this representative
-          </Button>
-        </Group>
-      )}
-      {/* Whatever the Fayda claim did carry is shown on the panel above and
-          is never typed here — the verification owns it. */}
-      {gaps.name && (
-        <TextInput
-          label="Representative's Name"
-          placeholder="Abebe Bikila"
-          error={errors.poaName?.message}
-          {...register("poaName")}
-        />
-      )}
-      {(needsEmail || needsPhone) && (
-        <SimpleGrid cols={needsEmail && needsPhone ? 2 : 1} spacing="md">
-          {needsEmail && (
-            <TextInput
-              label="Representative's Email"
-              type="email"
-              placeholder="poa@company.com"
-              error={errors.poaEmail?.message}
-              {...register("poaEmail")}
-            />
-          )}
-          {needsPhone && (
-            <ControlledPhoneField
-              control={control}
-              name="poaPhone"
-              label="Representative's Phone"
-            />
-          )}
-        </SimpleGrid>
-      )}
-      {gaps.address && (
-        <TextInput
-          label="PoA Location"
-          placeholder="City, Country"
-          error={errors.poaLocation?.message}
-          {...register("poaLocation")}
-        />
-      )}
-
-      {/* The paper authorises the representative, so it shows once one
-          exists — or straight away for a freight forwarder, who owes it
-          either way and must not be failed on submit for a file the
-          step never offered. */}
-      {delegationRequired && poaDocumentSetting && (
-        <>
-          <Divider my="sm" />
-          <SmartFileInput
-            file={poaDocumentSetting}
-            value={documentFiles}
-            uploadedKeys={uploadedDocumentKeys}
-            errors={documentFieldErrors}
-            onChange={onDocumentFilesChange}
-          />
-        </>
-      )}
-    </>
-  );
-}
diff --git a/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/RepresentationStep.tsx b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/RepresentationStep.tsx
new file mode 100644
index 000000000..24391391a
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/accounts/companyProfileForm/steps/RepresentationStep.tsx
@@ -0,0 +1,363 @@
+import {
+  Button,
+  Card,
+  Divider,
+  Group,
+  Loader,
+  SimpleGrid,
+  Stack,
+  Text,
+  TextInput,
+} from "@mantine/core";
+import { IdCard, ShieldCheck, UserCheck, UserX } from "lucide-react";
+import type { UseFormReturn } from "react-hook-form";
+
+import { SmartFileInput } from "@edr/ui-common";
+import { ControlledPhoneField } from "@/components/PhoneField";
+import FaydaVerifyPanel from "@/components/FaydaVerifyPanel";
+import RoleCard from "@/pages/settings/RoleCard";
+import type { FileUploadSetting } from "@/types/fileUploadSettings";
+import type {
+  CompanyIdentityState,
+  PoaDeclaration,
+} from "@/services/verifayda.service";
+
+import type { FormData } from "../schema";
+
+/** How a foreign company chose to prove the person: Fayda, or a passport. */
+export type IdentityMethod = "fayda" | "passport";
+
+export interface RepresentationStepProps {
+  form: UseFormReturn<FormData>;
+  identity?: CompanyIdentityState;
+  /** Answer the power-of-attorney question (persisted server-side). */
+  onDeclare: (declared: PoaDeclaration) => void;
+  /** A declaration change is in flight. */
+  declarePending: boolean;
+  /**
+   * The answer is not the company's to change — it operates as a freight
+   * forwarder, which the API forces to "yes". No alert says so: the summary
+   * simply offers no way back, which is the same information without the
+   * lecture.
+   */
+  declarationLocked: boolean;
+  /**
+   * Which of the representative's details the Fayda verification owns. Same
+   * contract as OwnerStep's `locked`: a locked field is read-only, every other
+   * one is an input, and the schema requires exactly the unlocked ones.
+   *
+   * There is deliberately no `address` here. Fayda's address claim is stored as
+   * `poaAddress`, which the portal never sends; the input below writes
+   * `poaLocation`, a different field the company states itself. Gating one on
+   * the other hid the only input for `poaLocation` from every verified
+   * representative whose Fayda record happened to carry an address.
+   */
+  locked: { name: boolean; email: boolean; phone: boolean };
+  /**
+   * How a foreign company is proving the subject. Null until it picks — the
+   * either/or is a fork, not a fallback, so nothing below it renders until one
+   * side is chosen. Always "fayda" for an Ethiopian company, which has no
+   * choice to make.
+   */
+  method: IdentityMethod | null;
+  onMethodChange: (method: IdentityMethod) => void;
+  /** Single-field upload setting carrying just the DARS delegation letter. */
+  poaDocumentSetting?: FileUploadSetting;
+  documentFiles: Record<string, File | File[] | null>;
+  uploadedDocumentKeys?: string[];
+  documentFieldErrors: Record<string, string>;
+  onDocumentFilesChange: (next: Record<string, File | File[] | null>) => void;
+}
+
+/**
+ * Who acts for this company — and, as a direct consequence, whose identity gets
+ * verified.
+ *
+ * A company proves itself through exactly one person. This step asks which:
+ * name a Power of Attorney and it is the representative who verifies (plus the
+ * DARS paper evidencing the delegation); say there is none and the owner
+ * verifies here instead. There is no third answer — "the owner represents the
+ * company themselves" IS "no".
+ *
+ * A freight forwarder is never asked. It signs on other companies' behalf, so a
+ * representative and the paper behind them are non-negotiable; the API forces
+ * the answer regardless of what the portal sends.
+ */
+export default function RepresentationStep({
+  form,
+  identity,
+  onDeclare,
+  declarePending,
+  declarationLocked,
+  locked,
+  method,
+  onMethodChange,
+  poaDocumentSetting,
+  documentFiles,
+  uploadedDocumentKeys,
+  documentFieldErrors,
+  onDocumentFilesChange,
+}: RepresentationStepProps) {
+  const {
+    register,
+    control,
+    formState: { errors },
+  } = form;
+
+  if (!identity) {
+    return (
+      <Group justify="center" py="xl">
+        <Loader size="sm" />
+      </Group>
+    );
+  }
+
+  const declared = identity.poaDeclared;
+  const passportAccepted = identity.passportAccepted;
+  const subject = declared === "yes" ? identity.poa : identity.owner;
+  const verified = subject.verified;
+
+  // Nothing below the fork renders until the person is actually established:
+  // a Fayda claim that came back, or the passport path deliberately chosen.
+  // Asking for a name before the verification runs is asking for a value the
+  // verification is about to overwrite.
+  const established = verified || method === "passport";
+
+  const who = declared === "yes" ? "Representative" : "Owner";
+  const passportField =
+    declared === "yes" ? "poaPassportNumber" : "ownerPassportNumber";
+
+  return (
+    <Stack gap="lg">
+      {/* ------------------------------------------------------------------ */}
+      {/* The question. Once answered it collapses to its answer, so the step */}
+      {/* is about the person rather than re-presenting a settled choice.    */}
+      {/* ------------------------------------------------------------------ */}
+      {declared === null ? (
+        <>
+          <Stack gap="xs">
+            <Text fw={600} size="lg" c="edr-text">
+              Does anyone hold power of attorney for this company?
+            </Text>
+            <Text size="sm" c="edr-muted">
+              Your answer decides whose identity we verify — the
+              representative's, or the owner's.
+            </Text>
+          </Stack>
+
+          <SimpleGrid cols={{ base: 1, sm: 2 }} spacing="md">
+            <RoleCard
+              label="Yes, we have a representative"
+              description="Someone other than the owner is authorised to act for the company. We'll verify their identity and ask for the DARS delegation paper."
+              icon={<UserCheck size={20} />}
+              selected={false}
+              onClick={declarePending ? undefined : () => onDeclare("yes")}
+            />
+            <RoleCard
+              label="No, the owner acts for us"
+              description="Nobody holds power of attorney. We'll verify the owner instead, and no delegation paper is needed."
+              icon={<UserX size={20} />}
+              selected={false}
+              onClick={declarePending ? undefined : () => onDeclare("no")}
+            />
+          </SimpleGrid>
+        </>
+      ) : (
+        <ChoiceSummary
+          icon={declared === "yes" ? <UserCheck size={18} /> : <UserX size={18} />}
+          label={
+            declared === "yes"
+              ? "A representative holds power of attorney"
+              : "The owner acts for the company"
+          }
+          detail={
+            declared === "yes"
+              ? "We'll verify their identity and ask for the DARS delegation paper."
+              : "Nobody holds power of attorney, so we verify the owner."
+          }
+          onChange={
+            declarePending || declarationLocked
+              ? undefined
+              : () => onDeclare(declared === "yes" ? "no" : "yes")
+          }
+          changeLabel={declared === "yes" ? "We have no representative" : "We have a representative"}
+        />
+      )}
+
+      {declared !== null && (
+        <>
+          <Divider />
+
+          {/* -------------------------------------------------------------- */}
+          {/* How the person is proved. Ethiopian: Fayda, no choice. Foreign: */}
+          {/* Fayda or a passport — one or the other, picked outright.        */}
+          {/* -------------------------------------------------------------- */}
+          {passportAccepted && !verified && method === null ? (
+            <Stack gap="xs">
+              <Text fw={600} c="edr-text">
+                How would you like to prove {who.toLowerCase()}'s identity?
+              </Text>
+              <Text size="sm" c="edr-muted">
+                Either one is enough — you don't need both.
+              </Text>
+              <SimpleGrid cols={{ base: 1, sm: 2 }} spacing="md" mt="xs">
+                <RoleCard
+                  label="Verify with Fayda"
+                  description="Their name, phone and address come straight from the national ID — nothing to type."
+                  icon={<ShieldCheck size={20} />}
+                  selected={false}
+                  onClick={() => onMethodChange("fayda")}
+                />
+                <RoleCard
+                  label="Use a passport instead"
+                  description="For someone who holds no Fayda ID. You'll enter their passport number and details yourself."
+                  icon={<IdCard size={20} />}
+                  selected={false}
+                  onClick={() => onMethodChange("passport")}
+                />
+              </SimpleGrid>
+            </Stack>
+          ) : (
+            <>
+              {(method === "fayda" || !passportAccepted || verified) && (
+                <FaydaVerifyPanel
+                  subject={declared === "yes" ? "poa" : "owner"}
+                  title={declared === "yes" ? "Power of Attorney" : "Company owner"}
+                  state={subject}
+                  required={!passportAccepted}
+                />
+              )}
+
+              {passportAccepted && !verified && method === "passport" && (
+                <TextInput
+                  label={`${who}'s Passport Number`}
+                  description="Fayda is an Ethiopian national ID, so a passport number proves this person instead."
+                  placeholder="P1234567"
+                  error={errors[passportField]?.message}
+                  {...register(passportField)}
+                />
+              )}
+
+              {passportAccepted && !verified && method !== null && (
+                <Button
+                  variant="subtle"
+                  size="compact-xs"
+                  style={{ alignSelf: "flex-start" }}
+                  onClick={() =>
+                    onMethodChange(method === "fayda" ? "passport" : "fayda")
+                  }
+                >
+                  {method === "fayda"
+                    ? "Use a passport instead"
+                    : "Verify with Fayda instead"}
+                </Button>
+              )}
+            </>
+          )}
+
+          {/* -------------------------------------------------------------- */}
+          {/* The representative's own details — only once the person exists,  */}
+          {/* and only the parts the verification did not carry. What Fayda    */}
+          {/* supplied is on the card above; echoing it back here as read-only */}
+          {/* rows was the same data twice with nothing to do about either.    */}
+          {/* -------------------------------------------------------------- */}
+          {declared === "yes" && established && (
+            <>
+              {!locked.name && (
+                <TextInput
+                  label="Representative's Name"
+                  placeholder="Abebe Bikila"
+                  error={errors.poaName?.message}
+                  {...register("poaName")}
+                />
+              )}
+
+              {(!locked.email || !locked.phone) && (
+                <SimpleGrid
+                  cols={{ base: 1, sm: !locked.email && !locked.phone ? 2 : 1 }}
+                  spacing="md"
+                >
+                  {!locked.email && (
+                    <TextInput
+                      label="Representative's Email"
+                      type="email"
+                      placeholder="representative@company.com"
+                      error={errors.poaEmail?.message}
+                      {...register("poaEmail")}
+                    />
+                  )}
+
+                  {!locked.phone && (
+                    <ControlledPhoneField
+                      control={control}
+                      name="poaPhone"
+                      label="Representative's Phone"
+                    />
+                  )}
+                </SimpleGrid>
+              )}
+
+              <TextInput
+                label="Representative's Location"
+                placeholder="City, Country"
+                error={errors.poaLocation?.message}
+                {...register("poaLocation")}
+              />
+
+              {poaDocumentSetting && (
+                <>
+                  <Divider my="sm" />
+                  <SmartFileInput
+                    file={poaDocumentSetting}
+                    value={documentFiles}
+                    uploadedKeys={uploadedDocumentKeys}
+                    errors={documentFieldErrors}
+                    onChange={onDocumentFilesChange}
+                  />
+                </>
+              )}
+            </>
+          )}
+        </>
+      )}
+    </Stack>
+  );
+}
+
+/** A settled choice, shown as its answer with a way back to the question. */
+function ChoiceSummary({
+  icon,
+  label,
+  detail,
+  onChange,
+  changeLabel,
+}: {
+  icon: React.ReactNode;
+  label: string;
+  detail: string;
+  onChange?: () => void;
+  changeLabel: string;
+}) {
+  return (
+    <Card padding="md" radius="md" withBorder>
+      <Group justify="space-between" align="flex-start" wrap="nowrap">
+        <Group gap="sm" align="flex-start" wrap="nowrap">
+          <span style={{ display: "flex", marginTop: 2 }}>{icon}</span>
+          <Stack gap={2}>
+            <Text fw={600} size="sm" c="edr-text">
+              {label}
+            </Text>
+            <Text size="xs" c="edr-muted">
+              {detail}
+            </Text>
+          </Stack>
+        </Group>
+        {onChange && (
+          <Button variant="subtle" size="compact-xs" onClick={onChange}>
+            {changeLabel}
+          </Button>
+        )}
+      </Group>
+    </Card>
+  );
+}
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/new-booking-form/step-documents.tsx b/apps/edr-freight-web/portal/src/pages/bookings/new-booking-form/step-documents.tsx
index de105bf21..d75092655 100644
--- a/apps/edr-freight-web/portal/src/pages/bookings/new-booking-form/step-documents.tsx
+++ b/apps/edr-freight-web/portal/src/pages/bookings/new-booking-form/step-documents.tsx
@@ -6,6 +6,7 @@ import { type UseFormReturn } from "react-hook-form";
 
 import useAuth from "@/hooks/useAuth";
 import { api } from "@/services/api";
+import { documentSettingCode } from "@/utils/documentSettingCode";
 import {
   operationToProfileType,
   type BookingDocuments,
@@ -20,13 +21,6 @@ type BookingForm = UseFormReturn<
   BookingFormValues
 >;
 
-/** Onboarding document setting code for the company's nationality. */
-function documentSettingCode(nationality: string | null | undefined): string {
-  return nationality === "foreign"
-    ? "company_onboarding_documents_foreign"
-    : "company_onboarding_documents_ethiopian";
-}
-
 function formatSize(bytes?: number): string {
   if (!bytes) return "";
   if (bytes < 1024) return `${bytes} B`;
@@ -48,14 +42,17 @@ function formatSize(bytes?: number): string {
 export function StepDocuments({ form }: { form: BookingForm }) {
   const auth = useAuth();
 
-  const nationality = auth.company?.company?.nationality as
-    | string
-    | null
-    | undefined;
+  const company = auth.company?.company;
+  const nationality = company?.nationality as string | null | undefined;
 
   const docSettingQuery = useQuery(
     api.fileUploadSettings.getByCode.queryOptions({
-      input: { code: documentSettingCode(nationality) },
+      input: {
+        code: documentSettingCode(
+          nationality,
+          company?.attributes?.cooperative === true,
+        ),
+      },
     }),
   );
 
diff --git a/apps/edr-freight-web/portal/src/pages/bookings/resubmit/useBookingDocumentSetting.ts b/apps/edr-freight-web/portal/src/pages/bookings/resubmit/useBookingDocumentSetting.ts
index 65774f97f..31d42f6cd 100644
--- a/apps/edr-freight-web/portal/src/pages/bookings/resubmit/useBookingDocumentSetting.ts
+++ b/apps/edr-freight-web/portal/src/pages/bookings/resubmit/useBookingDocumentSetting.ts
@@ -2,15 +2,9 @@ import { useQuery } from "@tanstack/react-query";
 
 import useAuth from "@/hooks/useAuth";
 import { api } from "@/services/api";
+import { documentSettingCode } from "@/utils/documentSettingCode";
 
-/** Onboarding document setting code for the company's nationality. */
-export function documentSettingCode(
-  nationality: string | null | undefined,
-): string {
-  return nationality === "foreign"
-    ? "company_onboarding_documents_foreign"
-    : "company_onboarding_documents_ethiopian";
-}
+export { documentSettingCode };
 
 /**
  * Fetches the FileUploadSetting that describes the documents a booking requires
@@ -22,14 +16,17 @@ export function documentSettingCode(
  */
 export function useBookingDocumentSetting() {
   const auth = useAuth();
-  const nationality = auth.company?.company?.nationality as
-    | string
-    | null
-    | undefined;
+  const company = auth.company?.company;
+  const nationality = company?.nationality as string | null | undefined;
 
   return useQuery(
     api.fileUploadSettings.getByCode.queryOptions({
-      input: { code: documentSettingCode(nationality) },
+      input: {
+        code: documentSettingCode(
+          nationality,
+          company?.attributes?.cooperative === true,
+        ),
+      },
     }),
   );
 }
diff --git a/apps/edr-freight-web/portal/src/pages/contracts/new-contract-form/ContractDocsEditor.tsx b/apps/edr-freight-web/portal/src/pages/contracts/new-contract-form/ContractDocsEditor.tsx
index 4d966e010..9d045c4e7 100644
--- a/apps/edr-freight-web/portal/src/pages/contracts/new-contract-form/ContractDocsEditor.tsx
+++ b/apps/edr-freight-web/portal/src/pages/contracts/new-contract-form/ContractDocsEditor.tsx
@@ -7,6 +7,7 @@ import type { Freight } from "@edr/types";
 import { useQuery } from "@tanstack/react-query";
 import useAuth from "@/hooks/useAuth";
 import { api } from "@/services/api";
+import { documentSettingCode } from "@/utils/documentSettingCode";
 import type { CompanyDocument } from "@/services/companies.service";
 import { downloadStoredFile } from "@/services/files.service";
 import { labelForDocCode } from "@/pages/bookings/resubmit/resubmitDocs";
@@ -15,13 +16,6 @@ import { BORDER, GREEN, INK } from "../contract-ui";
 type DocumentsValue = Record<string, File | File[] | null>;
 type ContractFile = NonNullable<Freight.IContract["files"]>[number];
 
-/** Onboarding document setting code for the company's nationality. */
-function documentSettingCode(nationality: string | null | undefined): string {
-  return nationality === "foreign"
-    ? "company_onboarding_documents_foreign"
-    : "company_onboarding_documents_ethiopian";
-}
-
 function hasFile(value: File | File[] | null | undefined): boolean {
   if (!value) return false;
   return Array.isArray(value) ? value.length > 0 : true;
@@ -95,13 +89,16 @@ export function ContractDocsEditor({
 }) {
   const auth = useAuth();
 
-  const nationality = auth.company?.company?.nationality as
-    | string
-    | null
-    | undefined;
+  const company = auth.company?.company;
+  const nationality = company?.nationality as string | null | undefined;
   const settingQuery = useQuery(
     api.fileUploadSettings.getByCode.queryOptions({
-      input: { code: documentSettingCode(nationality) },
+      input: {
+        code: documentSettingCode(
+          nationality,
+          company?.attributes?.cooperative === true,
+        ),
+      },
     }),
   );
 
diff --git a/apps/edr-freight-web/portal/src/pages/contracts/new-contract-form/step-documents.tsx b/apps/edr-freight-web/portal/src/pages/contracts/new-contract-form/step-documents.tsx
index de4b2bd66..b0b870f72 100644
--- a/apps/edr-freight-web/portal/src/pages/contracts/new-contract-form/step-documents.tsx
+++ b/apps/edr-freight-web/portal/src/pages/contracts/new-contract-form/step-documents.tsx
@@ -7,6 +7,7 @@ import { type UseFormReturn } from "react-hook-form";
 
 import useAuth from "@/hooks/useAuth";
 import { api } from "@/services/api";
+import { documentSettingCode } from "@/utils/documentSettingCode";
 import {
   type ContractDocuments,
   type ContractFormInputValues,
@@ -21,12 +22,6 @@ type ContractForm = UseFormReturn<
   ContractFormValues
 >;
 
-function documentSettingCode(nationality: string | null | undefined): string {
-  return nationality === "foreign"
-    ? "company_onboarding_documents_foreign"
-    : "company_onboarding_documents_ethiopian";
-}
-
 function formatSize(bytes?: number): string {
   if (!bytes) return "";
   if (bytes < 1024) return `${bytes} B`;
@@ -61,14 +56,17 @@ export function StepDocuments({
   const auth = useAuth();
   const [errors, setErrors] = useState<Record<string, string>>({});
 
-  const nationality = auth.company?.company?.nationality as
-    | string
-    | null
-    | undefined;
+  const company = auth.company?.company;
+  const nationality = company?.nationality as string | null | undefined;
 
   const docSettingQuery = useQuery(
     api.fileUploadSettings.getByCode.queryOptions({
-      input: { code: documentSettingCode(nationality) },
+      input: {
+        code: documentSettingCode(
+          nationality,
+          company?.attributes?.cooperative === true,
+        ),
+      },
     }),
   );
 
diff --git a/apps/edr-freight-web/portal/src/pages/settings/NationalitySelect.tsx b/apps/edr-freight-web/portal/src/pages/settings/NationalitySelect.tsx
index 2115ec083..3eb7fd87e 100644
--- a/apps/edr-freight-web/portal/src/pages/settings/NationalitySelect.tsx
+++ b/apps/edr-freight-web/portal/src/pages/settings/NationalitySelect.tsx
@@ -9,6 +9,8 @@ interface NationalitySelectProps {
   onChange: (next: CompanyNationality) => void;
   /** Render only the option grid — the wizard supplies its own header/card. */
   embedded?: boolean;
+  /** Hide the foreign option (a co-operative union or farm is always Ethiopian). */
+  excludeForeign?: boolean;
 }
 
 /**
@@ -21,23 +23,30 @@ export default function NationalitySelect({
   value,
   onChange,
   embedded = false,
+  excludeForeign = false,
 }: NationalitySelectProps) {
   const grid = (
-    <SimpleGrid cols={{ base: 1, sm: 2 }} spacing="md">
+    <SimpleGrid cols={{ base: 1, sm: excludeForeign ? 1 : 2 }} spacing="md">
       <RoleCard
         label="Ethiopian Company"
-        description="Registered in Ethiopia. You'll provide a TIN certificate, commercial registration and national ID."
+        description={
+          excludeForeign
+            ? "Registered in Ethiopia. You'll provide a TIN certificate, your co-operative registration certificate and national ID."
+            : "Registered in Ethiopia. You'll provide a TIN certificate, commercial registration and national ID."
+        }
         icon={<MapPin size={22} />}
         selected={value === "ethiopian"}
         onClick={() => onChange("ethiopian")}
       />
-      <RoleCard
-        label="Foreign Company"
-        description="Registered abroad. You'll provide a passport and investment license."
-        icon={<Globe2 size={22} />}
-        selected={value === "foreign"}
-        onClick={() => onChange("foreign")}
-      />
+      {!excludeForeign && (
+        <RoleCard
+          label="Foreign Company"
+          description="Registered abroad. You'll provide a passport and investment license."
+          icon={<Globe2 size={22} />}
+          selected={value === "foreign"}
+          onClick={() => onChange("foreign")}
+        />
+      )}
     </SimpleGrid>
   );
 
diff --git a/apps/edr-freight-web/portal/src/pages/settings/OnboardingRoleSelect.tsx b/apps/edr-freight-web/portal/src/pages/settings/OnboardingRoleSelect.tsx
index ca4afb9b9..c6e46a507 100644
--- a/apps/edr-freight-web/portal/src/pages/settings/OnboardingRoleSelect.tsx
+++ b/apps/edr-freight-web/portal/src/pages/settings/OnboardingRoleSelect.tsx
@@ -9,6 +9,11 @@ interface OnboardingRoleSelectProps {
   onChange: (next: string[]) => void;
   /** Render only the option grid — the wizard supplies its own header/card. */
   embedded?: boolean;
+  /**
+   * Roles this company cannot hold, hidden rather than shown-and-refused. A
+   * co-operative has no business licence, so it cannot freight-forward.
+   */
+  excludeTypes?: readonly string[];
 }
 
 /**
@@ -22,8 +27,12 @@ export default function OnboardingRoleSelect({
   value,
   onChange,
   embedded = false,
+  excludeTypes,
 }: OnboardingRoleSelectProps) {
   const selected = new Set(value);
+  const roles = excludeTypes?.length
+    ? CUSTOMER_ROLES.filter((r) => !excludeTypes.includes(r.type))
+    : CUSTOMER_ROLES;
 
   const toggleRole = (type: string) => {
     const next = new Set(value);
@@ -34,7 +43,7 @@ export default function OnboardingRoleSelect({
 
   const grid = (
     <SimpleGrid cols={{ base: 1, sm: 2 }} spacing="md">
-      {CUSTOMER_ROLES.map((role) => (
+      {roles.map((role) => (
         <RoleCard
           key={role.type}
           label={role.label}
diff --git a/apps/edr-freight-web/portal/src/pages/settings/TabCompanyProfile.tsx b/apps/edr-freight-web/portal/src/pages/settings/TabCompanyProfile.tsx
index b11fecefc..a359a3ff0 100644
--- a/apps/edr-freight-web/portal/src/pages/settings/TabCompanyProfile.tsx
+++ b/apps/edr-freight-web/portal/src/pages/settings/TabCompanyProfile.tsx
@@ -24,14 +24,12 @@ import { useForm } from "react-hook-form";
 import { z } from "zod";
 import type { CompanyRegistrationData } from "@edr/types";
 import OnboardingRoleSelect from "./OnboardingRoleSelect";
-import FaydaVerifyPanel from "@/components/FaydaVerifyPanel";
 import ETradeInfo, {
   type ETradeStatus,
 } from "@/components/onboarding/ETradeInfo";
 import { ReadOnlyField } from "@/pages/accounts/companyProfileForm/ReadOnlyField";
 import StepSection from "@/pages/accounts/companyProfileForm/StepSection";
 import { ETRADE_BUNDLE_FIELDS as SHARED_ETRADE_FIELDS } from "@/pages/accounts/companyProfileForm/schema";
-import { normalizeIdentityPhones } from "@/pages/accounts/companyProfileForm/helpers";
 
 export const COMPANY_PROFILE_SCHEMA = z.object({
   // eTrade-sourced and read-only, like the registration block below.
@@ -149,11 +147,6 @@ export default function TabCompanyProfile({
   // Fayda stores the phone as the national registry holds it (often a local
   // number), which neither this form's E.164 validation nor the API's
   // `@IsValidPhone()` accepts. Normalize on read — same as the wizard.
-  const identity = useMemo(
-    () => normalizeIdentityPhones(profile?.identity),
-    [profile?.identity],
-  );
-  const verifiedIdentity = identity?.faydaRequired === true;
 
   // companyAddress is composed from the (locked) eTrade address parts, not
   // typed directly.
@@ -287,13 +280,6 @@ export default function TabCompanyProfile({
     validationError ??
     (mutation.isError ? extractApiError(mutation.error).message : null);
 
-  const pendingOwnerReview = Boolean(
-    (
-      profile?.pendingChanges as {
-        faydaIdentity?: Record<string, unknown>;
-      } | null
-    )?.faydaIdentity?.ownerFaydaSub,
-  );
 
   // During onboarding the role selection gates the form: nothing else shows
   // until the user picks Importer/Exporter or Freight Forwarder.
@@ -335,51 +321,9 @@ export default function TabCompanyProfile({
                 />
               </StepSection>
 
-              {identity && (
-                <StepSection
-                  index={2}
-                  title="Owner identity"
-                  subtitle={
-                    verifiedIdentity
-                      ? "Re-verify the company owner with Fayda — their name, phone, email and address are refreshed from the verification."
-                      : "The company owner's passport number."
-                  }
-                  status={
-                    verifiedIdentity
-                      ? identity.owner.verified
-                        ? "done"
-                        : identity.faydaRequired
-                          ? "blocked"
-                          : "todo"
-                      : (watch("ownerPassportNumber")?.trim()?.length ?? 0) > 0
-                        ? "done"
-                        : identity.passportRequired
-                          ? "blocked"
-                          : "todo"
-                  }
-                >
-                  <FaydaVerifyPanel
-                    subject="owner"
-                    title="Company owner"
-                    state={identity.owner}
-                    required={identity.faydaRequired}
-                    disabled={mutation.isPending}
-                    pendingReview={pendingOwnerReview}
-                  />
-                  {identity.passportRequired && (
-                    <TextInput
-                      label="Owner Passport Number"
-                      placeholder="P1234567"
-                      description="The owner's identity credential — Fayda is an Ethiopian national ID, so a foreign company's owner is identified by passport instead."
-                      error={errors.ownerPassportNumber?.message}
-                      {...register("ownerPassportNumber")}
-                    />
-                  )}
-                </StepSection>
-              )}
 
               <StepSection
-                index={3}
+                index={2}
                 title="Company TIN"
                 subtitle="Re-verify with eTrade to refresh your registration record — nothing here is typed by hand."
                 status={
diff --git a/apps/edr-freight-web/portal/src/pages/settings/TabDocuments.tsx b/apps/edr-freight-web/portal/src/pages/settings/TabDocuments.tsx
index 72d6738c8..584fb70d6 100644
--- a/apps/edr-freight-web/portal/src/pages/settings/TabDocuments.tsx
+++ b/apps/edr-freight-web/portal/src/pages/settings/TabDocuments.tsx
@@ -6,6 +6,7 @@ import {
   type LicenseFileStatus,
 } from "@/services/companies.service";
 import { getMinFiles } from "@/types/fileUploadSettings";
+import { documentSettingCode } from "@/utils/documentSettingCode";
 import type { ProfileResponse } from "@/types/profile";
 import {
   SmartFileInput,
@@ -57,14 +58,8 @@ interface TabDocumentsProps {
   onContinue?: () => void;
 }
 
-function documentSettingCode(nationality: string | null | undefined): string {
-  return nationality === "foreign"
-    ? "company_onboarding_documents_foreign"
-    : "company_onboarding_documents_ethiopian";
-}
-
 /**
- * The DARS delegation paper ships in the same nationality document set, but it is
+ * The DARS delegation paper ships in the same document set, but it is
  * edited on the Power of Attorney tab (where it is staged for review alongside
  * the PoA details), so it is excluded from this tab's uploader.
  */
@@ -83,7 +78,9 @@ export default function TabDocuments({
 
   const docSettingQuery = useQuery(
     api.fileUploadSettings.getByCode.queryOptions({
-      input: { code: documentSettingCode(profile.nationality) },
+      input: {
+        code: documentSettingCode(profile.nationality, profile.cooperative),
+      },
     }),
   );
 
diff --git a/apps/edr-freight-web/portal/src/pages/settings/TabGeneralManager.tsx b/apps/edr-freight-web/portal/src/pages/settings/TabGeneralManager.tsx
deleted file mode 100644
index ad680b010..000000000
--- a/apps/edr-freight-web/portal/src/pages/settings/TabGeneralManager.tsx
+++ /dev/null
@@ -1,333 +0,0 @@
-import { useMemo, useState } from "react";
-import { useMutation, useQueryClient } from "@tanstack/react-query";
-import { useForm } from "react-hook-form";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { z } from "zod";
-import { Briefcase, CheckCircle2, Save, XCircle } from "lucide-react";
-import {
-  Alert,
-  Card,
-  Group,
-  Stack,
-  Title,
-  Text,
-  TextInput,
-  Button,
-  Grid,
-} from "@mantine/core";
-import { api } from "@/services/api";
-import { verifaydaService } from "@/services/verifayda.service";
-import { ControlledPhoneField, isValidPhone } from "@/components/PhoneField";
-import { LinkCheckboxCard } from "@/pages/accounts/companyProfileForm/LinkCheckboxCard";
-import FaydaVerifyPanel from "@/components/FaydaVerifyPanel";
-import type { ProfileResponse } from "@/types/profile";
-
-// Optional, not unrequired: an Ethiopian company's GM is established through
-// Fayda and never types these, so a blanket `min(1)` would fail a form that is
-// correct. Presence is gated below, where the identity state says which route
-// applies; zod only polices format for the companies that still type them.
-const schema = z.object({
-  generalManagerName: z.string().optional(),
-  generalManagerEmail: z
-    .string()
-    .optional()
-    .refine(
-      (v) => !v || z.string().email().safeParse(v).success,
-      "Invalid GM email",
-    ),
-  generalManagerPhone: z
-    .string()
-    .optional()
-    .refine((v) => !v || isValidPhone(v), "Enter a valid phone number"),
-});
-
-type FormData = z.infer<typeof schema>;
-
-interface TabGeneralManagerProps {
-  profile: ProfileResponse;
-  mode?: "edit" | "onboarding";
-  onContinue?: () => void;
-}
-
-/**
- * The general manager's identity comes from Fayda: either verified in their
- * own right, or declared to be the owner — very often the same human, which is
- * what "Same as owner" is for. Typed details survive only for a foreign
- * company, whose manager may hold no Fayda ID at all.
- */
-export default function TabGeneralManager({ profile, mode = "edit", onContinue }: TabGeneralManagerProps) {
-  const queryClient = useQueryClient();
-  const owner = profile.identity?.owner;
-  const identity = profile.identity;
-  const gm = identity?.gm;
-  const faydaRequired = identity?.faydaRequired ?? false;
-  const [gmSameAsOwner, setGmSameAsOwner] = useState(
-    identity?.gmSameAsOwner ?? false,
-  );
-
-  const defaultValues = useMemo((): FormData => {
-    return {
-      generalManagerName: profile.generalManagerName ?? "",
-      generalManagerEmail: profile.generalManagerEmail ?? "",
-      generalManagerPhone: profile.generalManagerPhone ?? "",
-    };
-  }, [profile]);
-
-  const {
-    register,
-    control,
-    handleSubmit,
-    reset,
-    setValue,
-    formState: { errors, isDirty },
-  } = useForm<FormData>({
-    resolver: zodResolver(schema),
-    values: defaultValues,
-  });
-
-  /**
-   * With a Fayda-verified owner the declaration is made server-side — the API
-   * copies the proven identity onto the GM — so nothing is typed here. Without
-   * one (a foreign company, whose owner is backed by a passport) there is
-   * nothing proven to copy and this stays a local prefill.
-   */
-  const [linkPending, setLinkPending] = useState(false);
-  const [linkError, setLinkError] = useState<string | null>(null);
-  const toggleGmSameAsOwner = async (checked: boolean) => {
-    setGmSameAsOwner(checked);
-    setLinkError(null);
-    if (!owner?.verified) {
-      if (checked && owner) {
-        setValue("generalManagerName", owner.name ?? "", { shouldValidate: true });
-        setValue("generalManagerEmail", owner.email ?? "", { shouldValidate: true });
-        setValue("generalManagerPhone", owner.phone ?? "", { shouldValidate: true });
-      }
-      return;
-    }
-
-    setLinkPending(true);
-    try {
-      if (checked) await verifaydaService.setGmSameAsOwner();
-      else await verifaydaService.clearGmIdentity();
-      queryClient.invalidateQueries({
-        queryKey: api.companies.getProfile.queryKey(),
-      });
-    } catch (err) {
-      setGmSameAsOwner(!checked);
-      setLinkError(
-        (err as { response?: { data?: { message?: string } } })?.response?.data
-          ?.message ??
-          (err instanceof Error ? err.message : "Could not update the general manager"),
-      );
-    } finally {
-      setLinkPending(false);
-    }
-  };
-
-  const mutation = useMutation({
-    mutationFn: (data: FormData) =>
-      api.companies.updateProfile.call({
-        // `|| undefined`, never "": the DTO's `@IsOptional()` only skips null
-        // and undefined, so an empty string is validated and 400s with
-        // "generalManagerEmail must be an email". A verified manager legitimately
-        // leaves the fields Fayda did supply blank here.
-        generalManagerName: data.generalManagerName || undefined,
-        generalManagerEmail: data.generalManagerEmail || undefined,
-        generalManagerPhone: data.generalManagerPhone || undefined,
-      }),
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: api.companies.getProfile.queryKey() });
-      if (mode === "onboarding") onContinue?.();
-    },
-  });
-
-  const onSubmit = (data: FormData) => mutation.mutate(data);
-
-  // Nothing to save when Fayda owns the details: the verification and the
-  // "same as owner" declaration both write server-side, so the form would be
-  // posting empty strings over a proven identity.
-  const typedFieldsInUse = !gmSameAsOwner && !gm?.verified && !faydaRequired;
-
-  // Except for what the verification never supplied. Fayda's name, email and
-  // phone claims are all optional, and a manager verified without them has no
-  // account to fall back on the way the owner does — so those stay typed, here
-  // as well as in onboarding, or a wrong value could never be corrected.
-  const gmGaps = {
-    name: !gmSameAsOwner && Boolean(gm?.verified) && !gm?.name?.trim(),
-    email: !gmSameAsOwner && Boolean(gm?.verified) && !gm?.email?.trim(),
-    phone: !gmSameAsOwner && Boolean(gm?.verified) && !gm?.phone?.trim(),
-  };
-  const savable =
-    typedFieldsInUse || gmGaps.name || gmGaps.email || gmGaps.phone;
-
-  return (
-    <Card padding="lg">
-      <Group gap="sm" mb="xs">
-        <Briefcase size={20} />
-        <Title order={3}>General Manager</Title>
-      </Group>
-      <Text c="edr-muted" size="sm" mb="lg">
-        Manage the general manager information
-      </Text>
-
-      <form onSubmit={handleSubmit(onSubmit)}>
-        <Stack gap="md">
-          <LinkCheckboxCard
-            checked={gmSameAsOwner}
-            onToggle={toggleGmSameAsOwner}
-            title={
-              owner?.verified ? "Same as verified owner" : "Same as business owner"
-            }
-            description={
-              owner?.verified
-                ? "Reuse the Fayda-verified owner's identity for the general manager. Uncheck to verify a different person."
-                : "Reuse the owner's name, email and phone. Uncheck to enter different details."
-            }
-          />
-
-          {linkError && (
-            <Alert color="red" variant="light" icon={<XCircle size={18} />}>
-              {linkError}
-            </Alert>
-          )}
-
-          {/* Verifying a second person only means something when the manager
-              is someone other than the owner. */}
-          {!gmSameAsOwner && gm && (
-            <FaydaVerifyPanel
-              subject="gm"
-              title="General Manager"
-              state={gm}
-              required={faydaRequired}
-              disabled={linkPending || mutation.isPending}
-            />
-          )}
-
-          {/* Whatever the verification did not supply is typed instead — the
-              API keeps exactly those keys writable. */}
-          {gmGaps.name && (
-            <TextInput
-              label="Full Name"
-              placeholder="Abebe Bikila"
-              error={errors.generalManagerName?.message}
-              {...register("generalManagerName")}
-            />
-          )}
-          {(gmGaps.email || gmGaps.phone) && (
-            <Grid>
-              {gmGaps.email && (
-                <Grid.Col span={gmGaps.phone ? 6 : 12}>
-                  <TextInput
-                    label="Email Address"
-                    type="email"
-                    placeholder="gm@company.com"
-                    error={errors.generalManagerEmail?.message}
-                    {...register("generalManagerEmail")}
-                  />
-                </Grid.Col>
-              )}
-              {gmGaps.phone && (
-                <Grid.Col span={gmGaps.email ? 6 : 12}>
-                  <ControlledPhoneField
-                    control={control}
-                    name="generalManagerPhone"
-                    label="Phone Number"
-                    required
-                  />
-                </Grid.Col>
-              )}
-            </Grid>
-          )}
-
-          {/* Typed details survive only where Fayda cannot be required — a
-              foreign company's manager may hold no Fayda ID. Once verified the
-              API owns these fields and refuses edits, so they go away. */}
-          {!gmSameAsOwner && !gm?.verified && !faydaRequired && (
-            <>
-              <TextInput
-                label="Full Name"
-                placeholder="Abebe Bikila"
-                error={errors.generalManagerName?.message}
-                {...register("generalManagerName")}
-              />
-
-              <Grid>
-                <Grid.Col span={6}>
-                  <TextInput
-                    label="Email Address"
-                    type="email"
-                    placeholder="gm@company.com"
-                    error={errors.generalManagerEmail?.message}
-                    {...register("generalManagerEmail")}
-                  />
-                </Grid.Col>
-                <Grid.Col span={6}>
-                  <ControlledPhoneField
-                    control={control}
-                    name="generalManagerPhone"
-                    label="Phone Number"
-                    required
-                  />
-                </Grid.Col>
-              </Grid>
-            </>
-          )}
-        </Stack>
-
-        <Group
-          justify="space-between"
-          mt="xl"
-          pt="md"
-          style={{ borderTop: "1px solid var(--mantine-color-edr-border-0)" }}
-        >
-          <Group gap="xs">
-            {mutation.isSuccess && (
-              <Group gap={6} c="green">
-                <CheckCircle2 size={16} />
-                <Text size="sm" fw={500}>Saved successfully</Text>
-              </Group>
-            )}
-            {mutation.isError && (
-              <Group gap={6} c="red">
-                <XCircle size={16} />
-                <Text size="sm" fw={500}>Save failed</Text>
-              </Group>
-            )}
-          </Group>
-          <Group gap="md">
-            {mode === "edit" && typedFieldsInUse && (
-              <Button
-                type="button"
-                variant="outline"
-                disabled={mutation.isPending || !isDirty}
-                onClick={() => reset()}
-              >
-                Reset
-              </Button>
-            )}
-            {/* Saving only means something while the details are typed: under
-                Fayda both routes write server-side, so a submit would post
-                empty strings at an identity the API owns and refuses to
-                overwrite. Onboarding still needs a way forward, so the button
-                becomes a plain Continue rather than disappearing. */}
-            {savable ? (
-              <Button
-                type="submit"
-                leftSection={<Save size={16} />}
-                loading={mutation.isPending}
-              >
-                {mode === "onboarding" ? "Continue" : "Save Changes"}
-              </Button>
-            ) : (
-              mode === "onboarding" && (
-                <Button type="button" onClick={() => onContinue?.()}>
-                  Continue
-                </Button>
-              )
-            )}
-          </Group>
-        </Group>
-      </form>
-    </Card>
-  );
-}
diff --git a/apps/edr-freight-web/portal/src/pages/settings/TabOwner.tsx b/apps/edr-freight-web/portal/src/pages/settings/TabOwner.tsx
new file mode 100644
index 000000000..def3126f1
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/pages/settings/TabOwner.tsx
@@ -0,0 +1,219 @@
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+import { AlertTriangle, Briefcase, Save } from "lucide-react";
+import {
+  Alert,
+  Button,
+  Card,
+  Grid,
+  Group,
+  Stack,
+  Text,
+  TextInput,
+  Title,
+} from "@mantine/core";
+
+import { api } from "@/services/api";
+import { ControlledPhoneField, isValidPhone } from "@/components/PhoneField";
+import FaydaVerifyPanel from "@/components/FaydaVerifyPanel";
+import SourcedField from "@/pages/accounts/companyProfileForm/SourcedField";
+import type { ProfileResponse } from "@/types/profile";
+
+// Optional, not unrequired: whatever a Fayda verification supplied is owned by
+// the API and never typed here, so a blanket `min(1)` would fail a form that is
+// correct. Presence is gated below, where the identity state says which fields
+// are actually on screen; zod only polices format.
+const schema = z.object({
+  ownerName: z.string().optional(),
+  ownerEmail: z
+    .string()
+    .optional()
+    .refine(
+      (v) => !v || z.string().email().safeParse(v).success,
+      "Invalid owner email",
+    ),
+  ownerPhone: z
+    .string()
+    .optional()
+    .refine((v) => !v || isValidPhone(v), "Enter a valid phone number"),
+});
+
+type FormData = z.infer<typeof schema>;
+
+interface TabOwnerProps {
+  profile: ProfileResponse;
+  mode?: "edit" | "onboarding";
+  onContinue?: () => void;
+}
+
+/**
+ * The company's owner — meaning whoever the eTrade licence names as the
+ * business's manager. Not necessarily the legal owner, but the person the
+ * record has to match: the backoffice's check is that comparison.
+ *
+ * Their identity is Fayda-verified only when the company has NO Power of
+ * Attorney; when it names a representative it is the representative who
+ * verifies, and the owner's details are simply recorded (from eTrade, or typed
+ * here). Either way all three are required.
+ */
+export default function TabOwner({
+  profile,
+  mode = "edit",
+  onContinue,
+}: TabOwnerProps) {
+  const queryClient = useQueryClient();
+  const identity = profile.identity;
+  const owner = identity?.owner;
+  // Only the person the declaration points at carries the verification, so the
+  // panel is offered here only when that person is the owner.
+  const ownerIsSubject = identity?.subject === "owner";
+  // A Fayda verification owns what its claims filled — the API refuses to
+  // overwrite those, so they show read-only. Anything it left blank stays
+  // editable here, whatever value is currently stored.
+  const ownerVerified = owner?.verified ?? false;
+  const ownerLocked = {
+    name: ownerVerified && Boolean(owner?.name?.trim()),
+    email: ownerVerified && Boolean(owner?.email?.trim()),
+    phone: ownerVerified && Boolean(owner?.phone?.trim()),
+  };
+
+  const {
+    register,
+    control,
+    handleSubmit,
+    formState: { errors },
+  } = useForm<FormData>({
+    resolver: zodResolver(schema),
+    defaultValues: {
+      ownerName: profile.ownerName ?? "",
+      ownerEmail: profile.ownerEmail ?? "",
+      ownerPhone: profile.ownerPhone ?? "",
+    },
+  });
+
+  const mutation = useMutation({
+    mutationFn: (data: FormData) =>
+      api.companies.updateProfile.call({
+        // `|| undefined`, never "": the DTO's `@IsOptional()` only skips null
+        // and undefined, so an empty string is validated and 400s with
+        // "ownerEmail must be an email". A verified owner legitimately leaves
+        // the fields Fayda did supply blank here.
+        ownerName: data.ownerName || undefined,
+        ownerEmail: data.ownerEmail || undefined,
+        ownerPhone: data.ownerPhone || undefined,
+      }),
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: api.companies.getProfile.queryKey(),
+      });
+      if (mode === "onboarding") onContinue?.();
+    },
+  });
+
+  // What the verification did NOT supply. Fayda's email and phone claims are
+  // optional, so a verified owner can still be missing details the API demands
+  // — the API leaves exactly those keys typeable, and so does this form.
+  const gaps = {
+    name: !owner?.name?.trim(),
+    email: !owner?.email?.trim(),
+    phone: !owner?.phone?.trim(),
+  };
+  const savable = gaps.name || gaps.email || gaps.phone;
+
+  return (
+    <Card padding="lg">
+      <Group gap="sm" mb="xs">
+        <Briefcase size={20} />
+        <Title order={3}>Company Owner</Title>
+      </Group>
+      <Text c="edr-muted" size="sm" mb="lg">
+        The person registered on your eTrade licence.
+      </Text>
+
+      <form onSubmit={handleSubmit((data) => mutation.mutate(data))}>
+        <Stack gap="md">
+          {identity?.ownerMatchesEtrade === false && (
+            <Alert
+              color="amber"
+              variant="light"
+              icon={<AlertTriangle size={18} />}
+              title="This doesn't match your eTrade licence"
+            >
+              Your licence lists <strong>{identity.etradeManagerName}</strong>.
+              Our team checks this before approving changes.
+            </Alert>
+          )}
+
+          {ownerIsSubject && owner && (
+            <FaydaVerifyPanel
+              subject="owner"
+              title="Owner identity"
+              state={owner}
+              required={!identity?.passportAccepted}
+              pendingReview={profile.reviewStatus === "pending"}
+            />
+          )}
+
+          <SourcedField
+            label="Name"
+            value={owner?.name}
+            source={ownerLocked.name ? "Fayda" : null}
+          >
+            <TextInput
+              label="Name"
+              placeholder="Abebe Bikila"
+              error={errors.ownerName?.message}
+              {...register("ownerName")}
+            />
+          </SourcedField>
+
+          <Grid>
+            <Grid.Col span={{ base: 12, sm: 6 }}>
+              <SourcedField
+                label="Email"
+                value={owner?.email}
+                source={ownerLocked.email ? "Fayda" : null}
+              >
+                <TextInput
+                  label="Email"
+                  type="email"
+                  placeholder="owner@company.com"
+                  error={errors.ownerEmail?.message}
+                  {...register("ownerEmail")}
+                />
+              </SourcedField>
+            </Grid.Col>
+            <Grid.Col span={{ base: 12, sm: 6 }}>
+              <SourcedField
+                label="Phone"
+                value={owner?.phone}
+                source={ownerLocked.phone ? "Fayda" : null}
+              >
+                <ControlledPhoneField
+                  control={control}
+                  name="ownerPhone"
+                  label="Phone"
+                />
+              </SourcedField>
+            </Grid.Col>
+          </Grid>
+
+          {savable && (
+            <Group justify="flex-end">
+              <Button
+                type="submit"
+                color="edr-green"
+                loading={mutation.isPending}
+                leftSection={<Save size={16} />}
+              >
+                {mode === "onboarding" ? "Save & continue" : "Save changes"}
+              </Button>
+            </Group>
+          )}
+        </Stack>
+      </form>
+    </Card>
+  );
+}
diff --git a/apps/edr-freight-web/portal/src/pages/settings/TabPowerOfAttorney.tsx b/apps/edr-freight-web/portal/src/pages/settings/TabPowerOfAttorney.tsx
index 40f118580..63dc3b777 100644
--- a/apps/edr-freight-web/portal/src/pages/settings/TabPowerOfAttorney.tsx
+++ b/apps/edr-freight-web/portal/src/pages/settings/TabPowerOfAttorney.tsx
@@ -13,6 +13,7 @@ import {
   Undo2,
   UploadCloud,
   UserCheck,
+  UserX,
   XCircle,
 } from "lucide-react";
 import {
@@ -24,6 +25,7 @@ import {
   Card,
   Group,
   Loader,
+  SimpleGrid,
   Stack,
   Title,
   Text,
@@ -41,7 +43,7 @@ import {
 } from "@/services/companies.service";
 import FaydaVerifyPanel from "@/components/FaydaVerifyPanel";
 import { verifaydaService } from "@/services/verifayda.service";
-import { LinkCheckboxCard } from "@/pages/accounts/companyProfileForm/LinkCheckboxCard";
+import RoleCard from "@/pages/settings/RoleCard";
 import type { ProfileResponse } from "@/types/profile";
 
 // The representative's name, email, phone and address all come from their
@@ -136,21 +138,17 @@ export default function TabPowerOfAttorney({
   // company inside Ethiopia either way. A PoA therefore exists exactly when one
   // has been verified.
   const identity = profile.identity;
-  const owner = identity?.owner;
   const poaProvided = identity?.poa.verified ?? false;
-  const [poaSameAsOwner, setPoaSameAsOwner] = useState(
-    identity?.poaSameAsOwner ?? false,
-  );
-  // The paper authorises the representative named above, so there is nothing
-  // for it to authorise until one has been verified — the upload is hidden
-  // until then, and requiring it while hidden would block the save on a
-  // control the customer cannot see. A freight forwarder is still held to
-  // having a PoA at all, by the verification gate on the panel and by the API.
-  //
-  // And nobody delegates to themselves: an owner representing their own company
-  // has no delegation to evidence, which is the same waiver the API applies in
-  // `assertPoaDelegationSatisfied`.
-  const letterRequired = poaProvided && !poaSameAsOwner;
+  // Whether there is a representative at all is the company's own declaration,
+  // held server-side — it decides whose identity the API gates on, so it is
+  // never local state here.
+  const declared = identity?.poaDeclared ?? null;
+  // The paper is owed exactly when the company says it has a representative —
+  // the same single rule `assertPoaDelegationSatisfied` enforces. Keying it on
+  // the verification instead would hide the upload from a foreign company whose
+  // representative proves themselves by passport, then fail the save for a file
+  // that was never offered.
+  const letterRequired = declared === "yes";
   const letterMissing = letterRequired && !hasLetterAfterSave;
 
   const fileDirty = Boolean(pickedFile) || removeIds.length > 0;
@@ -191,11 +189,12 @@ export default function TabPowerOfAttorney({
 
   /**
    * A verified representative cannot be removed by blanking the form — their
-   * fields are owned by the verification — so removal is its own action that
-   * clears the identity and the delegation paper together.
+   * fields are owned by the verification — so removal is answering the
+   * declaration "no", which clears the identity, the details and the
+   * delegation paper together. Refused by the API for a freight forwarder.
    */
   const removeMutation = useMutation({
-    mutationFn: () => verifaydaService.removePoa(),
+    mutationFn: () => verifaydaService.setPoaDeclared("no"),
     onSuccess: () => {
       resetAll();
       queryClient.invalidateQueries({
@@ -208,25 +207,20 @@ export default function TabPowerOfAttorney({
   });
 
   /**
-   * "Same as owner": the owner represents the company themselves. Always goes
-   * to the API, whichever credential backs the owner — the declaration is what
-   * waives the DARS paper, so it has to be recorded server-side even when there
-   * is no proven identity to copy.
+   * Answer the power-of-attorney question.
    *
-   * Unchecking undoes the declaration only. It leaves the paper on file and is
-   * allowed for a freight forwarder, which is how one changes who represents
-   * it; "Remove representative" below is the harder action that takes the paper
-   * with it and is refused to a forwarder.
+   * "No" means the owner acts for the company themselves — there is no
+   * delegation, so no DARS paper is owed and it is the OWNER whose identity is
+   * verified. The API tears the representative down when this is answered, and
+   * refuses "no" outright for a freight forwarder.
    */
   const [linkPending, setLinkPending] = useState(false);
   const [linkError, setLinkError] = useState<string | null>(null);
-  const togglePoaSameAsOwner = async (checked: boolean) => {
-    setPoaSameAsOwner(checked);
+  const declare = async (next: "yes" | "no") => {
     setLinkError(null);
     setLinkPending(true);
     try {
-      if (checked) await verifaydaService.setPoaSameAsOwner();
-      else await verifaydaService.clearPoaSameAsOwner();
+      await verifaydaService.setPoaDeclared(next);
       queryClient.invalidateQueries({
         queryKey: api.companies.getProfile.queryKey(),
       });
@@ -234,7 +228,6 @@ export default function TabPowerOfAttorney({
         queryKey: api.companies.poaDelegation.queryKey(),
       });
     } catch (err) {
-      setPoaSameAsOwner(!checked);
       setLinkError(
         (err as { response?: { data?: { message?: string } } })?.response?.data
           ?.message ??
@@ -295,12 +288,14 @@ export default function TabPowerOfAttorney({
           )}
         </Group>
         <Text c="edr-muted" size="sm" mb="lg">
-          {requirePoa
-            ? "As a freight forwarder you act on other companies' behalf, so a Power of Attorney is required."
-            : "Power of Attorney details are optional."}{" "}
-          {poaSameAsOwner
-            ? "You represent the company yourself, so no delegation paper is needed."
-            : "If you name a representative, upload the DARS delegation paper authorising them."}
+          {/* The "Required for freight forwarder" badge above already says why
+              a forwarder has no choice here; repeating it in prose was a
+              lecture, not information. */}
+          {!requirePoa &&
+            "Tell us whether anyone is authorised to act for the company — your answer decides whose identity we verify. "}
+          {declared === "no"
+            ? "The owner acts for the company, so no delegation paper is needed."
+            : "A representative must be identified, and the DARS delegation paper authorising them uploaded."}
         </Text>
 
         {/* The owner representing their own company is the ordinary
@@ -309,30 +304,35 @@ export default function TabPowerOfAttorney({
             mandatory it needs a verified owner first — there would be nothing
             proven to copy, and a representative who could never satisfy the
             gate. */}
+        {/* The declaration itself. "No" is not a lesser answer — it means the
+            owner acts for the company, so it is the OWNER who verifies and no
+            delegation paper is owed. A freight forwarder cannot choose it; the
+            API refuses and the error lands in `linkError`. */}
         {identity && (
-          <LinkCheckboxCard
-            checked={poaSameAsOwner}
-            onToggle={togglePoaSameAsOwner}
-            disabled={
-              linkPending ||
-              mutation.isPending ||
-              (!poaSameAsOwner &&
-                (identity.faydaRequired ?? false) &&
-                !owner?.verified)
-            }
-            title={
-              owner?.verified
-                ? "Same as verified owner"
-                : "Same as business owner"
-            }
-            description={
-              (identity.faydaRequired ?? false) && !owner?.verified
-                ? "Verify the company owner with Fayda first — then you can reuse that identity here."
-                : owner?.verified
-                  ? "You represent the company yourself. Reuses the Fayda-verified owner's identity, and no DARS delegation paper is needed. Uncheck to name someone else."
-                  : "You represent the company yourself. Reuses the owner's name, email and phone, and no DARS delegation paper is needed. Uncheck to name someone else."
-            }
-          />
+          <SimpleGrid cols={{ base: 1, sm: 2 }} spacing="md" mb="md">
+            <RoleCard
+              label="Yes, we have a representative"
+              description="Someone other than the owner is authorised to act for the company. Their identity is verified and the DARS delegation paper is required."
+              icon={<UserCheck size={20} />}
+              selected={declared === "yes"}
+              onClick={
+                linkPending || declared === "yes"
+                  ? undefined
+                  : () => void declare("yes")
+              }
+            />
+            <RoleCard
+              label="No, the owner acts for us"
+              description="Nobody holds power of attorney. The owner's identity is verified instead, and no delegation paper is needed."
+              icon={<UserX size={20} />}
+              selected={declared === "no"}
+              onClick={
+                linkPending || declared === "no"
+                  ? undefined
+                  : () => void declare("no")
+              }
+            />
+          </SimpleGrid>
         )}
 
         {linkError && (
@@ -343,12 +343,12 @@ export default function TabPowerOfAttorney({
 
         {/* Verifying a second person only means something when the
             representative is someone other than the owner. */}
-        {identity && !poaSameAsOwner && (
+        {identity && declared === "yes" && (
           <FaydaVerifyPanel
             subject="poa"
             title="Power of Attorney"
             state={identity.poa}
-            required={requirePoa}
+            required={!identity.passportAccepted}
             disabled={mutation.isPending || linkPending}
           />
         )}
@@ -359,7 +359,7 @@ export default function TabPowerOfAttorney({
                 verification and are shown on the panel above. Only a company
                 whose representative may hold no Fayda ID still types a
                 location. */}
-            {!poaProvided && !(identity?.faydaRequired ?? false) && (
+            {declared === "yes" && !poaProvided && (
               <Grid>
                 <Grid.Col span={6}>
                   <TextInput
@@ -376,7 +376,7 @@ export default function TabPowerOfAttorney({
           {/* ------------------------ Delegation letter ------------------------ */}
           {/* The paper authorises the representative the verification named,
               so it only has meaning once one exists. */}
-          {poaProvided && !poaSameAsOwner && (
+          {declared === "yes" && (
           <Stack gap="sm" mt="xl">
             <Group justify="space-between" align="center">
               <Group gap="sm">
@@ -418,7 +418,7 @@ export default function TabPowerOfAttorney({
               >
                 {requirePoa
                   ? "Upload the DARS delegation paper before saving — it is required for freight forwarders."
-                  : "Upload the DARS delegation paper for the representative you named, or clear the PoA details."}
+                  : "Upload the DARS delegation paper for the representative you named, or answer \u201cthe owner acts for us\u201d instead."}
               </Alert>
             )}
 
@@ -551,12 +551,12 @@ export default function TabPowerOfAttorney({
               )}
             </Group>
             <Group gap="md">
-              {/* Not offered against a "same as owner" declaration: unchecking
-                  the card above is the way out of that one, and it leaves the
-                  paper alone. */}
+              {/* Answering "the owner acts for us" is the same teardown, so
+                  this is only a shortcut — and it is refused to a forwarder,
+                  which cannot be without a representative. */}
               {mode === "edit" &&
                 identity?.poa.verified &&
-                !poaSameAsOwner &&
+                declared === "yes" &&
                 !requirePoa && (
                   <Button
                     type="button"
diff --git a/apps/edr-freight-web/portal/src/services/api.ts b/apps/edr-freight-web/portal/src/services/api.ts
index 0d0035b87..0cec830c9 100644
--- a/apps/edr-freight-web/portal/src/services/api.ts
+++ b/apps/edr-freight-web/portal/src/services/api.ts
@@ -238,6 +238,8 @@ export const api = {
         companyType: string;
         roles: ProfileTypeValue[];
         nationality?: CompanyNationality;
+        /** No business licence: registration typed, no eTrade lookup, no forwarding. */
+        cooperative?: boolean;
       },
       CompanyInfoResponse
     >("companies", "startOnboarding", companiesService.startOnboarding),
diff --git a/apps/edr-freight-web/portal/src/services/companies.service.ts b/apps/edr-freight-web/portal/src/services/companies.service.ts
index d6a78f1af..4c1b93713 100644
--- a/apps/edr-freight-web/portal/src/services/companies.service.ts
+++ b/apps/edr-freight-web/portal/src/services/companies.service.ts
@@ -158,14 +158,17 @@ export interface OnboardingLicenseProfile {
   uploaded: boolean;
 }
 
-/** Power of Attorney state — mandatory for freight forwarders, optional otherwise. */
+/** Power of Attorney state, driven by the company's own declaration. */
 export interface OnboardingPoaState {
-  required: boolean;
-  provided: boolean;
   /**
-   * True when the DARS delegation paper is owed. False when the owner
-   * represents the company themselves — nobody delegates to themselves.
+   * True for a freight forwarder: it signs on other companies' behalf, so a
+   * representative is non-negotiable and the question is shown answered rather
+   * than asked.
    */
+  locked: boolean;
+  /** The company's answer. Null until it answers — itself an outstanding item. */
+  declared: "yes" | "no" | null;
+  /** True when the DARS delegation paper is owed — i.e. `declared === "yes"`. */
   delegationLetterRequired: boolean;
   delegationLetterUploaded: boolean;
   /** True when a reviewer sent the DARS delegation paper back for correction. */
@@ -180,8 +183,11 @@ export interface OnboardingPoaState {
  * outstanding, so the client never hardcodes required fields or document sets.
  */
 export interface OnboardingRequirements {
+  /** The set the docs came from: the nationality one, or the co-operative one. */
   documentSettingCode: string;
   nationality: string;
+  /** No business licence: registration typed by hand, no eTrade lookup. */
+  cooperative: boolean;
   companyInfo: {
     complete: boolean;
     missingFields: { key: string; label: string }[];
@@ -189,7 +195,7 @@ export interface OnboardingRequirements {
   documents: OnboardingDocumentField[];
   licenseProfiles: OnboardingLicenseProfile[];
   poa: OnboardingPoaState;
-  /** Fayda verification state; `required` is false for a foreign company. */
+  /** The company's single identity verification, and whose it is. */
   identity: CompanyIdentityState;
   progress: { completed: number; total: number };
   isComplete: boolean;
@@ -321,6 +327,7 @@ export const companiesService = {
     companyType: string;
     roles: ProfileTypeValue[];
     nationality?: CompanyNationality;
+    cooperative?: boolean;
   }): Promise<CompanyInfoResponse> => {
     const response = await client.post<ApiResponse<CompanyInfoResponse>>(
       URL_CONSTANTS.COMPANIES_API.ONBOARDING_START,
diff --git a/apps/edr-freight-web/portal/src/services/verifayda.service.ts b/apps/edr-freight-web/portal/src/services/verifayda.service.ts
index 7dd96c571..79dc14f40 100644
--- a/apps/edr-freight-web/portal/src/services/verifayda.service.ts
+++ b/apps/edr-freight-web/portal/src/services/verifayda.service.ts
@@ -3,14 +3,21 @@ import { unwrap } from "@/utils/endpoint";
 import type { ApiResponse } from "@/types/apiResponse";
 
 /**
- * Which of the company's people a verification is for. The owner is who the
- * company is proven through; the PoA and GM are personnel it names. The GM is
- * very often the owner — "same as owner" reuses that verification rather than
- * making the same human prove themselves twice.
+ * Which of the company's two people a verification is for.
+ *
+ * The **owner** is whoever the eTrade licence names as the business's manager
+ * — not necessarily the legal owner, but the person the record has to match.
+ * The **PoA** is who the company delegates to act for it.
+ *
+ * Exactly one of them is verified, chosen by the company's own answer to "does
+ * anyone hold power of attorney for you?" — see `poaDeclared`.
  */
-export type IdentitySubject = "owner" | "poa" | "gm";
+export type IdentitySubject = "owner" | "poa";
 
-/** One person's Fayda verification state, as the API reports it. */
+/** Whether the company named a representative. Null until it answers. */
+export type PoaDeclaration = "yes" | "no";
+
+/** One person's identity state, as the API reports it. */
 export interface IdentityVerificationState {
   verified: boolean;
   name: string | null;
@@ -18,43 +25,49 @@ export interface IdentityVerificationState {
   email: string | null;
   address: string | null;
   verifiedAt: string | null;
-}
-
-export interface OwnerIdentityState extends IdentityVerificationState {
   /**
-   * Typed passport number — the foreign-company identity credential.
-   * Independent of Fayda: never written by a verification, and still required
-   * even if the owner also verifies.
+   * Typed passport number — the ALTERNATIVE to Fayda for a foreign company,
+   * never written by a verification. Only asked of whichever person carries
+   * the company's identity, and only when `passportAccepted`.
    */
   passportNumber: string | null;
 }
 
 export interface CompanyIdentityState {
   /**
-   * True when Fayda verification is mandatory — Ethiopian companies only.
-   * Doubles as "may this person be typed instead": Fayda is an Ethiopian
-   * national ID, so a foreign company's GM and PoA are offered the
-   * verification but fall back to typed details when they hold none.
+   * True for a foreign company: a typed passport number proves the identity
+   * just as a Fayda verification does. Fayda is an Ethiopian national ID, so an
+   * Ethiopian company has no alternative to it.
    */
-  faydaRequired: boolean;
-  /** True when the owner's passport number is mandatory — foreign companies only. */
-  passportRequired: boolean;
-  owner: OwnerIdentityState;
+  passportAccepted: boolean;
+  /**
+   * The company's answer to the power-of-attorney question. Null until it
+   * answers — which is itself outstanding, since the answer decides who
+   * verifies. Always "yes" for a freight forwarder, which cannot operate
+   * without a representative and is never asked.
+   */
+  poaDeclared: PoaDeclaration | null;
+  /** Whose verification the company is gated on. Null while undeclared. */
+  subject: IdentitySubject | null;
+  owner: IdentityVerificationState;
   poa: IdentityVerificationState;
+  /** True once `subject` is proven — Fayda-verified, or passport where accepted. */
+  identityProven: boolean;
+  /** The manager named on the eTrade licence, captured at lookup. */
+  etradeManagerName: string | null;
   /**
-   * True when the representative is the owner themselves, declared through
-   * "same as owner". Waives the DARS delegation paper — nobody delegates to
-   * themselves — and, where the owner is Fayda-verified, backs `poa.verified`
-   * with the owner's sub.
+   * That manager's phone (E.164), from the same lookup. Together with the name
+   * this is what survives a refresh: the live lookup result does not, so
+   * without these two a resumed wizard cannot tell an eTrade-sourced owner from
+   * a typed one, and offers the licence's own data back as editable inputs.
    */
-  poaSameAsOwner: boolean;
+  etradeManagerPhone: string | null;
   /**
-   * General manager. `verified` covers both routes: the GM verifying in their
-   * own right, and the company declaring the GM is the owner (in which case
-   * `gmSameAsOwner` is set and the owner's Fayda sub backs it).
+   * Does the owner the company put forward match the eTrade licence? This is
+   * the backoffice's check. Null when there is nothing to compare. Advisory:
+   * eTrade's and Fayda's transliterations rarely agree exactly.
    */
-  gm: IdentityVerificationState;
-  gmSameAsOwner: boolean;
+  ownerMatchesEtrade: boolean | null;
   complete: boolean;
 }
 
@@ -127,65 +140,19 @@ export const verifaydaService = {
   },
 
   /**
-   * Declare the General Manager is the company's owner, reusing the owner's
-   * verified identity rather than making the same human verify twice. The copy
-   * happens server-side from the stored owner identity — the portal never
-   * supplies the values — and is refused until the owner is verified.
-   */
-  setGmSameAsOwner: async (): Promise<CompanyIdentityState> => {
-    const response = await client.post<ApiResponse<CompanyIdentityState>>(
-      "/api/companies/identity/gm/same-as-owner",
-    );
-    return unwrap(response.data);
-  },
-
-  /**
-   * Clear the GM's identity — the "same as owner" declaration or a verification
-   * of their own — leaving them open to be re-established either way.
-   */
-  clearGmIdentity: async (): Promise<CompanyIdentityState> => {
-    const response = await client.delete<ApiResponse<CompanyIdentityState>>(
-      "/api/companies/identity/gm",
-    );
-    return unwrap(response.data);
-  },
-
-  /**
-   * Declare the Power of Attorney is the company's owner. A Fayda-verified
-   * owner's identity is copied server-side (the portal never supplies it); a
-   * foreign company's owner has nothing proven to copy, so the API records the
-   * declaration and the form types the representative's details as usual.
+   * Answer whether anyone holds power of attorney for this company — the
+   * question that decides whose identity is verified.
    *
-   * Either way the declaration is what waives the DARS delegation paper.
+   * Answering "no" tears the representative down server-side: their details,
+   * their verification, their passport number and the DARS delegation paper.
+   * Refused for a freight forwarder, which cannot operate without one.
    */
-  setPoaSameAsOwner: async (): Promise<CompanyIdentityState> => {
-    const response = await client.post<ApiResponse<CompanyIdentityState>>(
-      "/api/companies/identity/poa/same-as-owner",
-    );
-    return unwrap(response.data);
-  },
-
-  /**
-   * Undo that declaration and the identity it copied, leaving the
-   * representative open to be verified in their own right. Unlike
-   * {@link removePoa} this is allowed for a freight forwarder — it is how they
-   * change who represents them — and leaves the delegation paper on file.
-   */
-  clearPoaSameAsOwner: async (): Promise<CompanyIdentityState> => {
-    const response = await client.delete<ApiResponse<CompanyIdentityState>>(
-      "/api/companies/identity/poa/same-as-owner",
-    );
-    return unwrap(response.data);
-  },
-
-  /**
-   * Drop the Power of Attorney — verified identity, details and delegation
-   * paper together. A verified person's fields are locked, so blanking the form
-   * is no longer a way to remove them. Refused for a freight forwarder.
-   */
-  removePoa: async (): Promise<CompanyIdentityState> => {
-    const response = await client.delete<ApiResponse<CompanyIdentityState>>(
-      "/api/companies/identity/fayda/poa",
+  setPoaDeclared: async (
+    declared: PoaDeclaration,
+  ): Promise<CompanyIdentityState> => {
+    const response = await client.patch<ApiResponse<CompanyIdentityState>>(
+      "/api/companies/identity/poa-declared",
+      { declared },
     );
     return unwrap(response.data);
   },
diff --git a/apps/edr-freight-web/portal/src/types/profile.ts b/apps/edr-freight-web/portal/src/types/profile.ts
index 732dd13cf..3839e3141 100644
--- a/apps/edr-freight-web/portal/src/types/profile.ts
+++ b/apps/edr-freight-web/portal/src/types/profile.ts
@@ -6,6 +6,8 @@ export interface ProfileResponse {
   companyName: string;
   companyType: string;
   nationality: string | null;
+  /** No business licence: the registration is typed, not fetched from eTrade. */
+  cooperative: boolean;
   companyProfiles: CompanyProfileResponse[];
   companyLocation: string;
   companyAddress: string | null;
@@ -30,19 +32,15 @@ export interface ProfileResponse {
   contactPersonPhone: string | null;
   /** Phone that passed SMS OTP verification (resumes the verify step's state). */
   contactVerifiedPhone: string | null;
-  generalManagerName: string | null;
-  generalManagerEmail: string | null;
-  generalManagerPhone: string | null;
+  /** The owner — whoever the eTrade licence names as the business's manager. */
+  ownerName: string | null;
+  ownerEmail: string | null;
+  ownerPhone: string | null;
   /**
-   * Fayda verification state for the owner, the PoA and the general manager.
-   * `identity.faydaRequired` / `identity.passportRequired` is the
-   * Ethiopian/foreign switch: an Ethiopian company verifies all three with
-   * Fayda, while a foreign one proves its owner with a typed passport number
-   * and may type its GM and PoA, whose holders may have no Fayda ID.
-   *
-   * The `generalManager*` fields above are the same person's details written
-   * flat — a verification keeps them in step, since the booking, contract and
-   * train-scheduling notifiers mail `generalManagerEmail` directly.
+   * The company's single identity verification. `identity.subject` says whose
+   * it is (the PoA when one is declared, otherwise the owner);
+   * `identity.passportAccepted` is the Ethiopian/foreign switch — a foreign
+   * company may prove the same person with a typed passport number instead.
    */
   identity: CompanyIdentityState;
   poaName: string | null;
@@ -88,14 +86,18 @@ export interface UpdateProfilePayload {
   contactPersonEmail?: string;
   contactPersonPhone?: string;
   contactVerifiedPhone?: string;
-  generalManagerName?: string;
-  generalManagerEmail?: string;
-  generalManagerPhone?: string;
+  ownerName?: string;
+  ownerEmail?: string;
+  ownerPhone?: string;
   poaName?: string;
   poaPhone?: string;
   poaEmail?: string;
   poaLocation?: string;
   poaAddress?: string;
-  /** The owner's passport number — the foreign-company identity credential. */
+  /**
+   * Passport numbers — the ALTERNATIVE to Fayda for a foreign company. Only the
+   * one belonging to the declared identity subject is ever collected.
+   */
   ownerPassportNumber?: string;
+  poaPassportNumber?: string;
 }
diff --git a/apps/edr-freight-web/portal/src/utils/documentSettingCode.test.ts b/apps/edr-freight-web/portal/src/utils/documentSettingCode.test.ts
new file mode 100644
index 000000000..6063f1b87
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/utils/documentSettingCode.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from "vitest";
+
+import { documentSettingCode } from "./documentSettingCode";
+
+describe("documentSettingCode", () => {
+  it("resolves the nationality set", () => {
+    expect(documentSettingCode("ethiopian")).toBe(
+      "company_onboarding_documents_ethiopian",
+    );
+    expect(documentSettingCode("foreign")).toBe(
+      "company_onboarding_documents_foreign",
+    );
+    expect(documentSettingCode(null)).toBe(
+      "company_onboarding_documents_ethiopian",
+    );
+  });
+
+  it("replaces the nationality set for a co-operative", () => {
+    expect(documentSettingCode("ethiopian", true)).toBe(
+      "company_onboarding_documents_cooperative",
+    );
+    // A co-op is never foreign, but a stale flag must not fall back to the
+    // foreign set — the co-op answer wins.
+    expect(documentSettingCode("foreign", true)).toBe(
+      "company_onboarding_documents_cooperative",
+    );
+  });
+});
diff --git a/apps/edr-freight-web/portal/src/utils/documentSettingCode.ts b/apps/edr-freight-web/portal/src/utils/documentSettingCode.ts
new file mode 100644
index 000000000..e27407c27
--- /dev/null
+++ b/apps/edr-freight-web/portal/src/utils/documentSettingCode.ts
@@ -0,0 +1,18 @@
+/**
+ * The company document set a company resolves to — one of three, never a
+ * combination: a co-operative union or farm uploads its own papers INSTEAD of
+ * its nationality's (it holds no business licence), and is always Ethiopian.
+ *
+ * Mirrors `CompaniesService.documentSettingCodeFor` on the API; prefer the
+ * server-resolved `documentSettingCode` from onboarding requirements where one
+ * is available, and use this where only the company is at hand.
+ */
+export function documentSettingCode(
+  nationality: string | null | undefined,
+  cooperative?: boolean | null,
+): string {
+  if (cooperative) return "company_onboarding_documents_cooperative";
+  return nationality === "foreign"
+    ? "company_onboarding_documents_foreign"
+    : "company_onboarding_documents_ethiopian";
+}
diff --git a/apps/edr-passenger-api/src/modules/fare-engine/fare-engine.service.ts b/apps/edr-passenger-api/src/modules/fare-engine/fare-engine.service.ts
index 69b0266ed..348e9d6be 100644
--- a/apps/edr-passenger-api/src/modules/fare-engine/fare-engine.service.ts
+++ b/apps/edr-passenger-api/src/modules/fare-engine/fare-engine.service.ts
@@ -88,20 +88,48 @@ export class FareEngineService {
       where: {
         routeId: route.id,
         seatClassId: dto.seatClassId,
-        originStopSequence: originStop.sequence,
-        destinationStopSequence: destStop.sequence,
+        AND: [
+          {
+            OR: [
+              {
+                originStopSequence: originStop.sequence,
+                destinationStopSequence: destStop.sequence,
+              },
+              {
+                originStopSequence: destStop.sequence,
+                destinationStopSequence: originStop.sequence,
+              },
+            ],
+          },
+          {
+            OR: [{ validUntil: null }, { validUntil: { gte: now } }],
+          },
+        ],
         validFrom: { lte: now },
-        OR: [{ validUntil: null }, { validUntil: { gte: now } }],
         nationality: dto.nationality ?? null,
       },
     }) ?? await this.prisma.segmentFareRule.findFirst({
       where: {
         routeId: route.id,
         seatClassId: dto.seatClassId,
-        originStopSequence: originStop.sequence,
-        destinationStopSequence: destStop.sequence,
+        AND: [
+          {
+            OR: [
+              {
+                originStopSequence: originStop.sequence,
+                destinationStopSequence: destStop.sequence,
+              },
+              {
+                originStopSequence: destStop.sequence,
+                destinationStopSequence: originStop.sequence,
+              },
+            ],
+          },
+          {
+            OR: [{ validUntil: null }, { validUntil: { gte: now } }],
+          },
+        ],
         validFrom: { lte: now },
-        OR: [{ validUntil: null }, { validUntil: { gte: now } }],
         nationality: null,
       },
     });
diff --git a/apps/edr-passenger-api/src/modules/reports/reports.controller.ts b/apps/edr-passenger-api/src/modules/reports/reports.controller.ts
index 1eea923fd..725ddbbfc 100644
--- a/apps/edr-passenger-api/src/modules/reports/reports.controller.ts
+++ b/apps/edr-passenger-api/src/modules/reports/reports.controller.ts
@@ -8,7 +8,7 @@ import {
   ApiProduces,
 } from "@nestjs/swagger";
 import { ReportsService } from "./reports.service";
-import { BlockedSeatsRevenueLossQueryDto, GenerateReportDto } from "./reports.dto";
+import { BlockedSeatsRevenueLossQueryDto, FinanceSummaryQueryDto, GenerateReportDto } from "./reports.dto";
 import { PassengerStaff } from "../../common/passenger-guards";
 import { PASSENGER_PERMS } from "../../seed/passenger-permissions.registry";
 
@@ -83,6 +83,35 @@ export class ReportsController {
     return this.service.getPaymentDiscrepancyBySchedule(scheduleId, { search, seatClass, sort });
   }
 
+  // ── Finance Summary ──────────────────────────────────────────────────────
+
+  @Get("finance")
+  @ApiOperation({
+    summary: "Finance summary — revenue by period, origin/destination segment, and payment method",
+    description:
+      "Revenue collected in the window (PaymentIntent.paidAt), grouped by day/week/month, origin → " +
+      "destination station pair, and payment method. Filter by originStationId and/or destinationStationId " +
+      "independently to query any station-pair segment (A→B, A→D, B→C), not just a whole predefined route. " +
+      "Returns per-bucket rows plus roll-ups by period, segment, and method for charting.",
+  })
+  getFinanceSummary(@Query() query: FinanceSummaryQueryDto) {
+    return this.service.getFinanceSummary(query);
+  }
+
+  @Get("finance/export")
+  @ApiOperation({ summary: "Finance summary as CSV — one row per period + route + payment method" })
+  @ApiProduces("text/csv")
+  @ApiOkResponse({ description: "CSV export", schema: { type: "string" } })
+  async exportFinanceSummary(@Query() query: FinanceSummaryQueryDto, @Res() res: Response): Promise<void> {
+    const csv = await this.service.exportFinanceSummaryCsv(query);
+    res.setHeader("Content-Type", "text/csv; charset=utf-8");
+    res.setHeader(
+      "Content-Disposition",
+      `attachment; filename="finance-summary-${new Date().toISOString().split("T")[0]}.csv"`,
+    );
+    res.send(csv);
+  }
+
   // ── Blocked Seat Revenue Loss ──────────────────────────────────────────────
 
   @Get("blocked-seats-revenue-loss")
diff --git a/apps/edr-passenger-api/src/modules/reports/reports.dto.ts b/apps/edr-passenger-api/src/modules/reports/reports.dto.ts
index 8b8049807..6c6b304d4 100644
--- a/apps/edr-passenger-api/src/modules/reports/reports.dto.ts
+++ b/apps/edr-passenger-api/src/modules/reports/reports.dto.ts
@@ -1,6 +1,7 @@
 import { IsString, IsDateString, IsOptional, IsEnum, IsInt, Min, Max } from 'class-validator';
 import { Type } from 'class-transformer';
 import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import { PaymentMethodType } from '@prisma/client';
 import { SeatBlockReasonCategory } from '../seats/seats.dto';
 
 export enum ReportType {
@@ -103,3 +104,31 @@ export class BlockedSeatsRevenueLossQueryDto {
   })
   @IsOptional() @IsEnum(BlockedSeatsLossSortBy) sortBy?: BlockedSeatsLossSortBy;
 }
+
+// ── Finance Summary ──────────────────────────────────────────────────────────
+
+export enum FinanceGranularity {
+  DAILY = 'daily',
+  WEEKLY = 'weekly',
+  MONTHLY = 'monthly',
+}
+
+export class FinanceSummaryQueryDto {
+  @ApiProperty({ example: '2026-07-01', description: 'Start of the window, inclusive, matched on PaymentIntent.paidAt.' })
+  @IsDateString() dateFrom: string;
+
+  @ApiProperty({ example: '2026-07-31', description: 'End of the window, inclusive, matched on PaymentIntent.paidAt.' })
+  @IsDateString() dateTo: string;
+
+  @ApiPropertyOptional({ enum: FinanceGranularity, default: FinanceGranularity.DAILY })
+  @IsOptional() @IsEnum(FinanceGranularity) granularity?: FinanceGranularity;
+
+  @ApiPropertyOptional({ description: 'Restrict to bookings departing from this station.' })
+  @IsOptional() @IsString() originStationId?: string;
+
+  @ApiPropertyOptional({ description: 'Restrict to bookings arriving at this station.' })
+  @IsOptional() @IsString() destinationStationId?: string;
+
+  @ApiPropertyOptional({ enum: PaymentMethodType, description: 'Restrict to payments made with this method.' })
+  @IsOptional() @IsEnum(PaymentMethodType) method?: PaymentMethodType;
+}
diff --git a/apps/edr-passenger-api/src/modules/reports/reports.service.ts b/apps/edr-passenger-api/src/modules/reports/reports.service.ts
index e899fdb4b..571df697e 100644
--- a/apps/edr-passenger-api/src/modules/reports/reports.service.ts
+++ b/apps/edr-passenger-api/src/modules/reports/reports.service.ts
@@ -10,6 +10,8 @@ import { FareEngineService } from "../fare-engine/fare-engine.service";
 import {
   BlockedSeatsLossSortBy,
   BlockedSeatsRevenueLossQueryDto,
+  FinanceGranularity,
+  FinanceSummaryQueryDto,
   GenerateReportDto,
   ReportType,
 } from "./reports.dto";
@@ -84,6 +86,33 @@ function toCsvCell(value: string | number): string {
   return `"${String(value).replace(/"/g, '""')}"`;
 }
 
+/**
+ * Buckets a paid-at timestamp into the requested reporting period, keyed so buckets sort
+ * chronologically as plain strings. Weekly buckets are labelled by their Monday (UTC).
+ */
+function periodKeyFor(date: Date, granularity: FinanceGranularity): string {
+  if (granularity === FinanceGranularity.MONTHLY) {
+    return date.toISOString().slice(0, 7);
+  }
+  if (granularity === FinanceGranularity.WEEKLY) {
+    const d = new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()));
+    const isoDay = d.getUTCDay() || 7; // Monday=1 .. Sunday=7
+    d.setUTCDate(d.getUTCDate() - (isoDay - 1));
+    return d.toISOString().split("T")[0];
+  }
+  return date.toISOString().split("T")[0];
+}
+
+export interface FinanceBucket {
+  period: string;
+  originStationId: string;
+  destinationStationId: string;
+  segmentLabel: string;
+  method: string;
+  bookingCount: number;
+  revenueEtbMinor: number;
+}
+
 @Injectable()
 export class ReportsService {
   private readonly logger = new Logger(ReportsService.name);
@@ -1051,6 +1080,161 @@ export class ReportsService {
     return { totalActualEtbMinor, totalPaidEtbMinor, byMethod, rows };
   }
 
+  // ── Finance Summary ────────────────────────────────────────────────────────
+
+  /**
+   * Revenue collected in the window, grouped by reporting period (day/week/month), origin →
+   * destination station pair, and payment method — the shape finance reconciles against
+   * provider settlement statements.
+   *
+   * Grouped by the booking's own origin/destination, not the parent Route — a route like
+   * "Sebeta - Dire Dawa" has intermediate stops, and a passenger may have booked any
+   * sub-segment of it (e.g. Lebu → Adama). Filtering by station lets finance ask about any
+   * A→B pair, not just whole routes.
+   *
+   * Bucketed on `PaymentIntent.paidAt` (cash actually received), not `Booking.createdAt`,
+   * so a booking made in one period but paid in another lands in the period it was paid.
+   */
+  async getFinanceSummary(query: FinanceSummaryQueryDto) {
+    const dateFrom = new Date(query.dateFrom + "T00:00:00.000Z");
+    const dateTo = new Date(query.dateTo + "T23:59:59.999Z");
+    const granularity = query.granularity ?? FinanceGranularity.DAILY;
+
+    const rateRows = await this.prisma.currencyExchangeRate.findMany({
+      where: { toCurrency: "ETB" as any },
+      orderBy: { effectiveDate: "desc" },
+    });
+    const rateToEtb = new Map<string, number>();
+    for (const r of rateRows) {
+      if (!rateToEtb.has(r.fromCurrency)) rateToEtb.set(r.fromCurrency, Number(r.rate));
+    }
+    const toEtbMinor = (minor: number, currency: string): number => {
+      if (currency === "ETB") return minor;
+      const rate = rateToEtb.get(currency);
+      return rate ? Math.round(minor * rate) : minor;
+    };
+
+    const bookings = await this.prisma.booking.findMany({
+      where: {
+        paymentIntent: {
+          paidAt: { gte: dateFrom, lte: dateTo },
+          ...(query.method ? { method: query.method } : {}),
+        },
+        ...(query.originStationId ? { originStationId: query.originStationId } : {}),
+        ...(query.destinationStationId ? { destinationStationId: query.destinationStationId } : {}),
+      },
+      select: {
+        totalMinor: true,
+        currency: true,
+        originStationId: true,
+        destinationStationId: true,
+        schedule: { select: { originStationId: true, destinationStationId: true } },
+        paymentIntent: { select: { paidAt: true, method: true } },
+      },
+    });
+
+    // Booking.originStationId/destinationStationId are set on every create path (guest and
+    // authenticated booking both pass them from the DTO); the schedule's own endpoints are
+    // only a fallback for the rare legacy row that predates those columns.
+    const stationIds = new Set<string>();
+    for (const b of bookings) {
+      const origin = b.originStationId ?? b.schedule.originStationId;
+      const destination = b.destinationStationId ?? b.schedule.destinationStationId;
+      if (origin) stationIds.add(origin);
+      if (destination) stationIds.add(destination);
+    }
+    const stations = stationIds.size > 0
+      ? await this.prisma.station.findMany({ where: { id: { in: [...stationIds] } }, select: { id: true, name: true } })
+      : [];
+    const stationName = new Map(stations.map((s) => [s.id, s.name]));
+
+    const buckets = new Map<string, FinanceBucket>();
+    const bucketFor = (
+      period: string,
+      originStationId: string,
+      destinationStationId: string,
+      segmentLabel: string,
+      method: string,
+    ): FinanceBucket => {
+      const key = `${period}|${originStationId}|${destinationStationId}|${method}`;
+      let bucket = buckets.get(key);
+      if (!bucket) {
+        bucket = { period, originStationId, destinationStationId, segmentLabel, method, bookingCount: 0, revenueEtbMinor: 0 };
+        buckets.set(key, bucket);
+      }
+      return bucket;
+    };
+
+    for (const b of bookings) {
+      const pi = b.paymentIntent!;
+      const period = periodKeyFor(pi.paidAt!, granularity);
+      const originStationId = b.originStationId ?? b.schedule.originStationId ?? "UNKNOWN";
+      const destinationStationId = b.destinationStationId ?? b.schedule.destinationStationId ?? "UNKNOWN";
+      const segmentLabel = `${stationName.get(originStationId) ?? "Unknown"} → ${stationName.get(destinationStationId) ?? "Unknown"}`;
+      const bucket = bucketFor(period, originStationId, destinationStationId, segmentLabel, pi.method);
+      bucket.bookingCount += 1;
+      bucket.revenueEtbMinor += toEtbMinor(b.totalMinor, b.currency);
+    }
+
+    const rows = [...buckets.values()].sort((a, b) =>
+      a.period === b.period
+        ? a.segmentLabel.localeCompare(b.segmentLabel) || a.method.localeCompare(b.method)
+        : a.period.localeCompare(b.period),
+    );
+
+    const totals = rows.reduce(
+      (acc, r) => {
+        acc.bookingCount += r.bookingCount;
+        acc.revenueEtbMinor += r.revenueEtbMinor;
+        return acc;
+      },
+      { bookingCount: 0, revenueEtbMinor: 0 },
+    );
+
+    const rollUp = (keyOf: (r: FinanceBucket) => string, labelOf: (r: FinanceBucket) => string) => {
+      const map = new Map<string, { key: string; label: string; revenueEtbMinor: number; bookingCount: number }>();
+      for (const r of rows) {
+        const key = keyOf(r);
+        let entry = map.get(key);
+        if (!entry) {
+          entry = { key, label: labelOf(r), revenueEtbMinor: 0, bookingCount: 0 };
+          map.set(key, entry);
+        }
+        entry.revenueEtbMinor += r.revenueEtbMinor;
+        entry.bookingCount += r.bookingCount;
+      }
+      return [...map.values()].sort((a, b) => b.revenueEtbMinor - a.revenueEtbMinor);
+    };
+
+    return {
+      granularity,
+      dateFrom: query.dateFrom,
+      dateTo: query.dateTo,
+      currency: "ETB",
+      totals,
+      byPeriod: rollUp((r) => r.period, (r) => r.period),
+      bySegment: rollUp((r) => `${r.originStationId}|${r.destinationStationId}`, (r) => r.segmentLabel),
+      byMethod: rollUp((r) => r.method, (r) => r.method),
+      rows,
+    };
+  }
+
+  /** CSV of the finance summary, one row per period + origin/destination segment + payment method. */
+  async exportFinanceSummaryCsv(query: FinanceSummaryQueryDto): Promise<string> {
+    const report = await this.getFinanceSummary(query);
+
+    const headers = ["Period", "Origin → Destination", "Payment Method", "Bookings", "Revenue (ETB)"];
+    const rows = report.rows.map((r) => [
+      r.period,
+      r.segmentLabel,
+      r.method,
+      r.bookingCount,
+      (r.revenueEtbMinor / 100).toFixed(2),
+    ]);
+
+    return [headers, ...rows].map((row) => row.map(toCsvCell).join(",")).join("\n");
+  }
+
   async getPaymentDiscrepancyBySchedule(scheduleId: string, params: {
     search?: string;
     seatClass?: string;
diff --git a/apps/edr-passenger-web/backoffice/package.json b/apps/edr-passenger-web/backoffice/package.json
index 9d4327a42..737baeda1 100644
--- a/apps/edr-passenger-web/backoffice/package.json
+++ b/apps/edr-passenger-web/backoffice/package.json
@@ -16,6 +16,8 @@
     "axios": "^1.7.7",
     "clsx": "^2.1.1",
     "date-fns": "^3.0.0",
+    "exceljs": "^4.4.0",
+    "html-to-image": "^1.11.11",
     "lucide-react": "^0.446.0",
     "next": "^14.2.0",
     "react": "^18.3.1",
diff --git a/apps/edr-passenger-web/backoffice/src/app/reports/finance/layout.tsx b/apps/edr-passenger-web/backoffice/src/app/reports/finance/layout.tsx
new file mode 100644
index 000000000..790272de1
--- /dev/null
+++ b/apps/edr-passenger-web/backoffice/src/app/reports/finance/layout.tsx
@@ -0,0 +1,3 @@
+export default function Layout({ children }: { children: React.ReactNode }) {
+  return <>{children}</>;
+}
diff --git a/apps/edr-passenger-web/backoffice/src/app/reports/finance/page.tsx b/apps/edr-passenger-web/backoffice/src/app/reports/finance/page.tsx
new file mode 100644
index 000000000..8e3e2a23b
--- /dev/null
+++ b/apps/edr-passenger-web/backoffice/src/app/reports/finance/page.tsx
@@ -0,0 +1,521 @@
+'use client';
+
+import { useMemo, useRef, useState } from 'react';
+import { useQuery } from '@tanstack/react-query';
+import { Banknote, BookOpen, FileSpreadsheet, Receipt } from 'lucide-react';
+import {
+  Bar, BarChart, CartesianGrid, Line, LineChart,
+  ResponsiveContainer, Tooltip as RechartsTooltip, XAxis, YAxis,
+} from 'recharts';
+import { toPng } from 'html-to-image';
+import { apiClient } from '@/lib/api-client';
+import { financeApi, type FinanceGranularity, type FinanceSummaryFilters } from '@/lib/api/finance';
+import { buildFinanceWorkbook, type ChartImage } from '@/lib/export/finance-workbook';
+import ActionButton from '@/components/ui/ActionButton';
+import Pagination from '@/components/ui/Pagination';
+import Skeleton from '@/components/ui/Skeleton';
+import { usePagination } from '@/lib/use-pagination';
+import { formatCurrency } from '@/lib/utils';
+import { categoricalColor, getChartPalette } from '@/lib/chart-palette';
+import { useTheme } from '@/lib/theme-store';
+
+interface StationOption {
+  id: string;
+  name: string;
+  code: string;
+}
+
+// Fixed order so a method keeps its colour/slot when the method filter narrows the set.
+const PAYMENT_METHOD_ORDER = ['TELEBIRR', 'CBE_BIRR', 'EBIRR', 'WAAFI', 'CARD', 'WALLET', 'DMONEY', 'CAC_BANK', 'CBE_BILL'] as const;
+const PAYMENT_METHOD_LABELS: Record<string, string> = {
+  TELEBIRR: 'Telebirr',
+  CBE_BIRR: 'CBE Birr',
+  EBIRR: 'eBirr',
+  WAAFI: 'Waafi',
+  CARD: 'Card',
+  WALLET: 'Wallet',
+  DMONEY: 'DMoney',
+  CAC_BANK: 'CAC Bank',
+  CBE_BILL: 'CBE Bill',
+};
+function methodLabel(method: string): string {
+  return PAYMENT_METHOD_LABELS[method] ?? method;
+}
+
+function periodLabel(period: string, granularity: FinanceGranularity): string {
+  if (granularity === 'monthly') {
+    return new Date(`${period}-01T00:00:00`).toLocaleDateString('en-US', { month: 'short', year: 'numeric' });
+  }
+  return new Date(`${period}T00:00:00`).toLocaleDateString('en-US', { month: 'short', day: 'numeric' });
+}
+
+const TABLE_PAGE_SIZE = 25;
+
+/** Mirrors the loaded layout's shape (KPI tiles, two charts, method breakdown, detail table) so nothing jumps when data arrives. */
+function FinanceReportSkeleton() {
+  return (
+    <div className="space-y-6">
+      <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4">
+        {Array.from({ length: 3 }).map((_, i) => (
+          <div key={i} className="card flex flex-col gap-3">
+            <div className="flex items-center justify-between">
+              <Skeleton className="h-3 w-24" />
+              <Skeleton className="h-7 w-7 rounded-lg" />
+            </div>
+            <Skeleton className="h-7 w-32" />
+          </div>
+        ))}
+      </div>
+
+      <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
+        {Array.from({ length: 2 }).map((_, i) => (
+          <div key={i} className="card">
+            <Skeleton className="h-4 w-40 mb-4" />
+            <Skeleton className="h-[280px] w-full" />
+          </div>
+        ))}
+      </div>
+
+      <div className="card">
+        <Skeleton className="h-4 w-56 mb-2" />
+        <Skeleton className="h-3 w-32 mb-4" />
+        <Skeleton className="h-7 w-full mb-4" />
+        <div className="space-y-2">
+          {Array.from({ length: 4 }).map((_, i) => (
+            <Skeleton key={i} className="h-5 w-full" />
+          ))}
+        </div>
+      </div>
+
+      <div className="card p-0">
+        <div className="px-4 pt-4 pb-3">
+          <Skeleton className="h-4 w-52" />
+        </div>
+        <div className="px-4 pb-4 space-y-2">
+          {Array.from({ length: 8 }).map((_, i) => (
+            <Skeleton key={i} className="h-8 w-full" />
+          ))}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export default function FinanceReportPage() {
+  const isDark = useTheme((s) => s.isDark);
+  const palette = getChartPalette(isDark);
+
+  const [dateRangePreset, setDateRangePreset] = useState('90');
+  const [customFrom, setCustomFrom] = useState('');
+  const [customTo, setCustomTo] = useState('');
+  const [granularity, setGranularity] = useState<FinanceGranularity>('daily');
+  const [originStationId, setOriginStationId] = useState('');
+  const [destinationStationId, setDestinationStationId] = useState('');
+  const [method, setMethod] = useState('');
+  const [exporting, setExporting] = useState(false);
+
+  const trendCardRef = useRef<HTMLDivElement>(null);
+  const segmentCardRef = useRef<HTMLDivElement>(null);
+  const methodCardRef = useRef<HTMLDivElement>(null);
+
+  const { dateFrom, dateTo } = useMemo(() => {
+    const end = new Date();
+    end.setHours(23, 59, 59, 999);
+
+    if (dateRangePreset === 'custom') {
+      if (customFrom && customTo) {
+        return customFrom <= customTo
+          ? { dateFrom: customFrom, dateTo: customTo }
+          : { dateFrom: customTo, dateTo: customFrom };
+      }
+      const fallbackStart = new Date(end);
+      fallbackStart.setDate(end.getDate() - 90);
+      return {
+        dateFrom: fallbackStart.toISOString().split('T')[0],
+        dateTo: end.toISOString().split('T')[0],
+      };
+    }
+
+    const start = new Date(end);
+    start.setDate(end.getDate() - Number(dateRangePreset));
+    return {
+      dateFrom: start.toISOString().split('T')[0],
+      dateTo: end.toISOString().split('T')[0],
+    };
+  }, [dateRangePreset, customFrom, customTo]);
+
+  const filters: FinanceSummaryFilters = useMemo(
+    () => ({
+      dateFrom,
+      dateTo,
+      granularity,
+      originStationId: originStationId || undefined,
+      destinationStationId: destinationStationId || undefined,
+      method: method || undefined,
+    }),
+    [dateFrom, dateTo, granularity, originStationId, destinationStationId, method],
+  );
+
+  const { data: stations = [] } = useQuery<StationOption[]>({
+    queryKey: ['stations'],
+    queryFn: () => apiClient.get<StationOption[]>('/stations'),
+  });
+
+  const { data, isLoading, isFetching, isError } = useQuery({
+    queryKey: ['reports-finance', filters],
+    placeholderData: (previous) => previous,
+    queryFn: () => financeApi.getSummary(filters),
+  });
+
+  const rows = data?.rows ?? [];
+  const pg = usePagination(rows, TABLE_PAGE_SIZE);
+
+  const resetFilters = () => {
+    setDateRangePreset('90');
+    setCustomFrom('');
+    setCustomTo('');
+    setGranularity('daily');
+    setOriginStationId('');
+    setDestinationStationId('');
+    setMethod('');
+  };
+
+  /** Captures a chart card as a PNG data URL, sized to the card's actual on-screen pixels. */
+  const captureCard = async (node: HTMLDivElement | null): Promise<ChartImage | undefined> => {
+    if (!node) return undefined;
+    const rect = node.getBoundingClientRect();
+    const dataUrl = await toPng(node, { pixelRatio: 2, cacheBust: true, backgroundColor: palette.surface });
+    return { dataUrl, width: Math.round(rect.width), height: Math.round(rect.height) };
+  };
+
+  const doExport = async () => {
+    if (!data) return;
+    setExporting(true);
+    try {
+      const [trend, segment, method_] = await Promise.all([
+        captureCard(trendCardRef.current),
+        captureCard(segmentCardRef.current),
+        captureCard(methodCardRef.current),
+      ]);
+
+      const stationLabel = (id: string) => stations.find((s) => s.id === id)?.name ?? 'Any';
+
+      const blob = await buildFinanceWorkbook({
+        report: data,
+        filters: {
+          dateFrom,
+          dateTo,
+          granularity,
+          originLabel: originStationId ? stationLabel(originStationId) : 'Any',
+          destinationLabel: destinationStationId ? stationLabel(destinationStationId) : 'Any',
+          methodLabel: method ? methodLabel(method) : 'All',
+        },
+        methodLabel,
+        periodLabel,
+        images: { trend, segment, method: method_ },
+      });
+
+      const url = URL.createObjectURL(blob);
+      const a = document.createElement('a');
+      a.href = url;
+      a.download = `finance-summary-${dateFrom}-to-${dateTo}.xlsx`;
+      a.click();
+      URL.revokeObjectURL(url);
+    } finally {
+      setExporting(false);
+    }
+  };
+
+  const trendData = useMemo(
+    () =>
+      (data?.byPeriod ?? [])
+        .slice()
+        .sort((a, b) => a.key.localeCompare(b.key))
+        .map((p) => ({
+          label: periodLabel(p.key, data!.granularity),
+          revenue: p.revenueEtbMinor / 100,
+        })),
+    [data],
+  );
+
+  const segmentData = useMemo(
+    () =>
+      (data?.bySegment ?? [])
+        .slice()
+        .sort((a, b) => b.revenueEtbMinor - a.revenueEtbMinor)
+        .map((r) => ({ label: r.label, revenue: r.revenueEtbMinor })),
+    [data],
+  );
+
+  const methodBreakdown = useMemo(() => {
+    const rowsByMethod = data?.byMethod ?? [];
+    const total = rowsByMethod.reduce((sum, r) => sum + r.revenueEtbMinor, 0);
+    return rowsByMethod
+      .slice()
+      .sort((a, b) => PAYMENT_METHOD_ORDER.indexOf(a.key as any) - PAYMENT_METHOD_ORDER.indexOf(b.key as any))
+      .map((r) => ({
+        ...r,
+        color: categoricalColor(palette, PAYMENT_METHOD_ORDER.indexOf(r.key as any)),
+        sharePercent: total > 0 ? (r.revenueEtbMinor / total) * 100 : 0,
+      }));
+  }, [data, palette]);
+
+  const totals = data?.totals;
+  const hasData = (totals?.bookingCount ?? 0) > 0;
+  const avgPerBookingMinor = hasData ? Math.round(totals!.revenueEtbMinor / totals!.bookingCount) : 0;
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-start justify-between gap-4 flex-wrap">
+        <div>
+          <h1 className="text-3xl font-bold text-foreground">Finance Summary</h1>
+          <p className="text-muted-foreground mt-1">
+            Revenue collected by period, origin/destination, and payment method — for daily, weekly, or monthly finance reporting.
+          </p>
+        </div>
+        <ActionButton icon={FileSpreadsheet} variant="secondary" onClick={doExport} loading={exporting} disabled={!hasData}>
+          Export
+        </ActionButton>
+      </div>
+
+      {/* Filters */}
+      <div className="card">
+        <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-6">
+          <div>
+            <label className="label">Date Range</label>
+            <select className="input" value={dateRangePreset} onChange={(e) => setDateRangePreset(e.target.value)}>
+              <option value="7">Last 7 Days</option>
+              <option value="30">Last 30 Days</option>
+              <option value="90">Last 90 Days</option>
+              <option value="custom">Custom Range</option>
+            </select>
+          </div>
+          {dateRangePreset === 'custom' && (
+            <>
+              <div>
+                <label className="label">Start Date</label>
+                <input type="date" className="input" value={customFrom} onChange={(e) => setCustomFrom(e.target.value)} />
+              </div>
+              <div>
+                <label className="label">End Date</label>
+                <input type="date" className="input" value={customTo} onChange={(e) => setCustomTo(e.target.value)} />
+              </div>
+            </>
+          )}
+          <div>
+            <label className="label">Granularity</label>
+            <select className="input" value={granularity} onChange={(e) => setGranularity(e.target.value as FinanceGranularity)}>
+              <option value="daily">Daily</option>
+              <option value="weekly">Weekly</option>
+              <option value="monthly">Monthly</option>
+            </select>
+          </div>
+          <div>
+            <label className="label">Origin</label>
+            <select className="input" value={originStationId} onChange={(e) => setOriginStationId(e.target.value)}>
+              <option value="">Any origin</option>
+              {stations.map((s) => (
+                <option key={s.id} value={s.id}>{s.name}</option>
+              ))}
+            </select>
+          </div>
+          <div>
+            <label className="label">Destination</label>
+            <select className="input" value={destinationStationId} onChange={(e) => setDestinationStationId(e.target.value)}>
+              <option value="">Any destination</option>
+              {stations.map((s) => (
+                <option key={s.id} value={s.id}>{s.name}</option>
+              ))}
+            </select>
+          </div>
+          <div>
+            <label className="label">Payment Method</label>
+            <select className="input" value={method} onChange={(e) => setMethod(e.target.value)}>
+              <option value="">All methods</option>
+              {PAYMENT_METHOD_ORDER.map((m) => (
+                <option key={m} value={m}>{methodLabel(m)}</option>
+              ))}
+            </select>
+          </div>
+        </div>
+        <div className="mt-4 flex items-center justify-between">
+          <button type="button" onClick={resetFilters} className="text-xs text-primary hover:underline">
+            Reset filters
+          </button>
+          {isFetching && <span className="text-xs text-muted-foreground">Refreshing…</span>}
+        </div>
+        {isError && <p className="text-xs text-red-500 mt-3">Failed to load the finance summary. Check the filters and try again.</p>}
+      </div>
+
+      {isLoading && !data ? (
+        <FinanceReportSkeleton />
+      ) : !hasData ? (
+        <div className="card py-16 text-center text-muted-foreground">
+          <Banknote className="h-10 w-10 mx-auto mb-3 opacity-30" />
+          <p>No paid bookings in this window.</p>
+          <p className="text-xs mt-1">Widen the date range, or clear the origin/destination/method filters.</p>
+        </div>
+      ) : (
+        <div className={isFetching ? 'opacity-60 transition-opacity space-y-6' : 'space-y-6'}>
+          {/* KPI tiles */}
+          <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4">
+            <div className="card flex flex-col gap-1">
+              <div className="flex items-center justify-between">
+                <p className="text-xs font-semibold uppercase tracking-wider text-muted-foreground">Revenue</p>
+                <div className="rounded-lg bg-emerald-100 dark:bg-emerald-900/30 p-1.5">
+                  <Banknote className="h-4 w-4 text-emerald-600 dark:text-emerald-400" />
+                </div>
+              </div>
+              <p className="text-2xl font-bold text-emerald-600 dark:text-emerald-400 tabular-nums mt-1">
+                {formatCurrency(totals!.revenueEtbMinor, 'ETB')}
+              </p>
+            </div>
+            <div className="card flex flex-col gap-1">
+              <div className="flex items-center justify-between">
+                <p className="text-xs font-semibold uppercase tracking-wider text-muted-foreground">Bookings</p>
+                <div className="rounded-lg bg-blue-100 dark:bg-blue-900/30 p-1.5">
+                  <BookOpen className="h-4 w-4 text-blue-600 dark:text-blue-400" />
+                </div>
+              </div>
+              <p className="text-2xl font-bold tabular-nums mt-1">{totals!.bookingCount.toLocaleString()}</p>
+            </div>
+            <div className="card flex flex-col gap-1">
+              <div className="flex items-center justify-between">
+                <p className="text-xs font-semibold uppercase tracking-wider text-muted-foreground">Avg. per Booking</p>
+                <div className="rounded-lg bg-amber-100 dark:bg-amber-900/30 p-1.5">
+                  <Receipt className="h-4 w-4 text-amber-600 dark:text-amber-400" />
+                </div>
+              </div>
+              <p className="text-2xl font-bold tabular-nums mt-1">{formatCurrency(avgPerBookingMinor, 'ETB')}</p>
+            </div>
+          </div>
+
+          {/* Trend + route charts */}
+          <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
+            <div className="card" ref={trendCardRef}>
+              <h3 className="text-base font-semibold mb-4">
+                Revenue Trend <span className="text-xs font-normal text-muted-foreground">(ETB, {granularity})</span>
+              </h3>
+              {trendData.length > 0 ? (
+                <ResponsiveContainer width="100%" height={280}>
+                  <LineChart data={trendData}>
+                    <CartesianGrid strokeDasharray="3 3" stroke={palette.grid} />
+                    <XAxis dataKey="label" tick={{ fontSize: 11, fill: palette.textMuted }} />
+                    <YAxis tick={{ fontSize: 11, fill: palette.textMuted }} />
+                    <RechartsTooltip formatter={(value: number) => `ETB ${Math.round(value).toLocaleString()}`} />
+                    <Line type="monotone" dataKey="revenue" name="Revenue" stroke={palette.sequential} dot={{ r: 3 }} strokeWidth={2} />
+                  </LineChart>
+                </ResponsiveContainer>
+              ) : (
+                <div className="h-[280px] flex items-center justify-center text-muted-foreground text-sm">No data for selected range</div>
+              )}
+            </div>
+
+            <div className="card" ref={segmentCardRef}>
+              <h3 className="text-base font-semibold mb-4">Revenue by Segment</h3>
+              {segmentData.length > 0 ? (
+                <ResponsiveContainer width="100%" height={280}>
+                  <BarChart data={segmentData}>
+                    <CartesianGrid strokeDasharray="3 3" stroke={palette.grid} />
+                    <XAxis dataKey="label" tick={{ fontSize: 11, fill: palette.textMuted }} />
+                    <YAxis tick={{ fontSize: 11, fill: palette.textMuted }} />
+                    <RechartsTooltip formatter={(value: number) => `ETB ${Math.round(value).toLocaleString()}`} />
+                    <Bar dataKey="revenue" fill={palette.sequential} radius={[3, 3, 0, 0]} />
+                  </BarChart>
+                </ResponsiveContainer>
+              ) : (
+                <div className="h-[280px] flex items-center justify-center text-muted-foreground text-sm">No data for selected range</div>
+              )}
+            </div>
+          </div>
+
+          {/* Payment method breakdown — part-to-whole stacked bar + legend table */}
+          <div className="card" ref={methodCardRef}>
+            <h3 className="text-base font-semibold text-foreground">Revenue by Payment Method</h3>
+            <p className="text-xs text-muted-foreground mt-1 mb-4">Share of revenue, in ETB</p>
+            <div
+              className="flex w-full h-7 rounded-md overflow-hidden"
+              role="img"
+              aria-label={`Revenue by payment method: ${methodBreakdown
+                .map((m) => `${methodLabel(m.key)} ${m.sharePercent.toFixed(0)}%`)
+                .join(', ')}`}
+            >
+              {methodBreakdown.map((m, i) => (
+                <div
+                  key={m.key}
+                  className="h-full"
+                  style={{ width: `${m.sharePercent}%`, background: m.color, marginRight: i < methodBreakdown.length - 1 ? 2 : 0 }}
+                  title={`${methodLabel(m.key)} — ${formatCurrency(m.revenueEtbMinor, 'ETB')}`}
+                />
+              ))}
+            </div>
+            <table className="w-full text-sm mt-4">
+              <thead>
+                <tr className="text-xs uppercase tracking-wider text-muted-foreground">
+                  <th className="text-left font-medium py-2">Method</th>
+                  <th className="text-right font-medium py-2">Bookings</th>
+                  <th className="text-right font-medium py-2">Share</th>
+                  <th className="text-right font-medium py-2">Revenue</th>
+                </tr>
+              </thead>
+              <tbody className="divide-y divide-border">
+                {methodBreakdown.map((m) => (
+                  <tr key={m.key}>
+                    <td className="py-2">
+                      <span className="flex items-center gap-2">
+                        <span className="h-2.5 w-2.5 rounded-sm shrink-0" style={{ background: m.color }} aria-hidden="true" />
+                        <span className="text-foreground">{methodLabel(m.key)}</span>
+                      </span>
+                    </td>
+                    <td className="py-2 text-right tabular-nums text-muted-foreground">{m.bookingCount.toLocaleString()}</td>
+                    <td className="py-2 text-right tabular-nums text-muted-foreground">{m.sharePercent.toFixed(1)}%</td>
+                    <td className="py-2 text-right tabular-nums text-foreground font-medium">{formatCurrency(m.revenueEtbMinor, 'ETB')}</td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          </div>
+
+          {/* Detail table */}
+          <div className="card p-0">
+            <div className="px-4 pt-4 pb-3">
+              <h3 className="text-sm font-semibold uppercase tracking-wider text-muted-foreground">
+                Period × Segment × Method detail
+              </h3>
+            </div>
+            <div className="overflow-x-auto">
+              <table className="w-full text-sm">
+                <thead className="bg-gray-50 dark:bg-gray-800">
+                  <tr>
+                    {['Period', 'Segment', 'Method', 'Bookings', 'Revenue'].map((h) => (
+                      <th key={h} className="px-4 py-3 text-left text-xs font-medium uppercase tracking-wider text-gray-500 dark:text-gray-400 whitespace-nowrap">
+                        {h}
+                      </th>
+                    ))}
+                  </tr>
+                </thead>
+                <tbody className="bg-white dark:bg-gray-900 divide-y divide-gray-200 dark:divide-gray-700">
+                  {pg.paged.map((r, i) => (
+                    <tr key={`${r.period}-${r.originStationId}-${r.destinationStationId}-${r.method}-${i}`} className="hover:bg-gray-50 dark:hover:bg-gray-800 transition-colors">
+                      <td className="px-4 py-3 whitespace-nowrap text-foreground">{periodLabel(r.period, granularity)}</td>
+                      <td className="px-4 py-3 whitespace-nowrap text-muted-foreground">{r.segmentLabel}</td>
+                      <td className="px-4 py-3 whitespace-nowrap text-muted-foreground">{methodLabel(r.method)}</td>
+                      <td className="px-4 py-3 tabular-nums whitespace-nowrap">{r.bookingCount.toLocaleString()}</td>
+                      <td className="px-4 py-3 tabular-nums whitespace-nowrap font-medium">{formatCurrency(r.revenueEtbMinor, 'ETB')}</td>
+                    </tr>
+                  ))}
+                  {pg.paged.length === 0 && (
+                    <tr>
+                      <td colSpan={5} className="py-8 text-center text-sm text-muted-foreground">No rows on this page</td>
+                    </tr>
+                  )}
+                </tbody>
+              </table>
+            </div>
+            <Pagination currentPage={pg.page} totalPages={pg.totalPages} onPageChange={pg.setPage} />
+          </div>
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/apps/edr-passenger-web/backoffice/src/app/reports/overall/page.tsx b/apps/edr-passenger-web/backoffice/src/app/reports/overall/page.tsx
index 6ab811622..9e88bdd5f 100644
--- a/apps/edr-passenger-web/backoffice/src/app/reports/overall/page.tsx
+++ b/apps/edr-passenger-web/backoffice/src/app/reports/overall/page.tsx
@@ -8,7 +8,6 @@ import {
   Tooltip, Legend, ResponsiveContainer, PieChart, Pie, Cell,
 } from 'recharts';
 import { bookingsApi } from '@/lib/api';
-import { dashboardApi } from '@/lib/api/dashboard';
 import { apiClient } from '@/lib/api-client';
 import { formatCurrency } from '@/lib/utils';
 import ActionButton from '@/components/ui/ActionButton';
@@ -24,6 +23,8 @@ export default function ReportsPage() {
   const [dateRange, setDateRange] = useState('30');
   const [startDate, setStartDate] = useState('');
   const [endDate, setEndDate] = useState('');
+  const [routeOrigin, setRouteOrigin] = useState('');
+  const [routeDestination, setRouteDestination] = useState('');
   const [exportModalOpen, setExportModalOpen] = useState(false);
   const [exportFormat, setExportFormat] = useState<'csv' | 'excel' | 'pdf'>('csv');
 
@@ -60,12 +61,6 @@ export default function ReportsPage() {
   const dates = getDateRange();
 
   // Confirmed-ticket revenue — same source as dashboard
-  const { data: stats, isLoading: statsLoading } = useQuery({
-    queryKey: ['backoffice-stats'],
-    queryFn: dashboardApi.getBackofficeStats,
-    staleTime: 60000,
-  });
-
   const { data: exchangeRates = [] } = useQuery<any[]>({
     queryKey: ['currencies'],
     queryFn: () => apiClient.get('/currencies'),
@@ -78,25 +73,25 @@ export default function ReportsPage() {
     return r ? 1 / r.rate : null;
   };
 
+  const getBookingTicketCount = (booking: any): number => {
+    if (Array.isArray(booking.tickets)) return booking.tickets.length;
+    if (typeof booking.ticketCount === 'number') return booking.ticketCount;
+    return 0;
+  };
+
   const calcGrand = (rows: { currency: string; totalMinor: number }[]) =>
     rows.reduce((sum, { currency, totalMinor }) => {
       const rate = toEtbRate(currency);
       return rate !== null ? sum + Math.round(totalMinor * rate) : sum;
     }, 0);
 
-  const normalRows = stats?.revenueByCurrency ?? [];
-  const packageRows = stats?.packageRevenueByCurrency ?? [];
-  const normalGrand = calcGrand(normalRows);
-  const packageGrand = calcGrand(packageRows);
-  const overallGrand = normalGrand + packageGrand;
-
   // Bookings for charts / status distribution
   const { data: bookingsData, isLoading: bookingsLoading } = useQuery({
-    queryKey: ['all-bookings'],
-    queryFn: () => bookingsApi.getAll({ pageSize: 1000 }),
+    queryKey: ['all-bookings', dates.startDate, dates.endDate],
+    queryFn: () => bookingsApi.getAll({ pageSize: 5000, dateFrom: dates.startDate, dateTo: dates.endDate }),
   });
 
-  const isLoading = statsLoading || bookingsLoading;
+  const isLoading = bookingsLoading;
 
   const allBookings: any[] = Array.isArray(bookingsData?.items) ? bookingsData.items : [];
 
@@ -105,7 +100,29 @@ export default function ReportsPage() {
     return d >= dates.startDate && d <= dates.endDate;
   });
 
-  const confirmedBookings = bookings.filter((b: any) => b.status !== 'CANCELLED' && b.status !== 'REFUNDED');
+  const confirmedBookings = bookings.filter((b: any) => b.status === 'CONFIRMED' || b.status === 'BOARDED');
+
+  const totalRevenueMinor = confirmedBookings.reduce((sum, b: any) => {
+    const rate = toEtbRate(b.currency);
+    return rate !== null ? sum + Math.round((b.totalMinor || 0) * rate) : sum;
+  }, 0);
+
+  const totalBookingsCount = confirmedBookings.length;
+  const totalTicketsCount = confirmedBookings.reduce((sum, b: any) => sum + getBookingTicketCount(b), 0);
+
+  const totalRegularTicketsCount = confirmedBookings
+    .filter((b: any) => {
+      const bookingType = String(b.bookingType || '').toUpperCase();
+      return bookingType !== 'PACKAGE' && !b.packageId;
+    })
+    .reduce((sum: number, b: any) => sum + getBookingTicketCount(b), 0);
+
+  const totalPackageTicketsCount = confirmedBookings
+    .filter((b: any) => {
+      const bookingType = String(b.bookingType || '').toUpperCase();
+      return bookingType === 'PACKAGE' || Boolean(b.packageId);
+    })
+    .reduce((sum: number, b: any) => sum + getBookingTicketCount(b), 0);
 
   const byDate = confirmedBookings.reduce((acc: Record<string, any>, b: any) => {
     const date = new Date(b.createdAt).toISOString().split('T')[0];
@@ -123,7 +140,78 @@ export default function ReportsPage() {
       bookings: d.count || 0,
     }));
 
-  const avgDailyRevenue = chartData.length > 0 ? Math.round(overallGrand / 100 / chartData.length) : 0;
+  const avgDailyRevenueMinor = chartData.length > 0 ? Math.round(totalRevenueMinor / chartData.length) : 0;
+
+  const totalRegularBookingsCount = confirmedBookings.filter((b: any) => {
+    const bookingType = String(b.bookingType || '').toUpperCase();
+    return bookingType !== 'PACKAGE' && !b.packageId;
+  }).length;
+
+  const totalPackageBookingsCount = confirmedBookings.filter((b: any) => {
+    const bookingType = String(b.bookingType || '').toUpperCase();
+    return bookingType === 'PACKAGE' || Boolean(b.packageId);
+  }).length;
+
+  const normalRows = confirmedBookings
+    .filter((b: any) => {
+      const bookingType = String(b.bookingType || '').toUpperCase();
+      return bookingType !== 'PACKAGE' && !b.packageId;
+    })
+    .reduce((acc: Record<string, number>, b: any) => {
+      const currency = b.currency || 'ETB';
+      acc[currency] = (acc[currency] || 0) + (b.totalMinor || 0);
+      return acc;
+    }, {} as Record<string, number>);
+
+  const packageRows = confirmedBookings
+    .filter((b: any) => {
+      const bookingType = String(b.bookingType || '').toUpperCase();
+      return bookingType === 'PACKAGE' || Boolean(b.packageId);
+    })
+    .reduce((acc: Record<string, number>, b: any) => {
+      const currency = b.currency || 'ETB';
+      acc[currency] = (acc[currency] || 0) + (b.totalMinor || 0);
+      return acc;
+    }, {} as Record<string, number>);
+
+  const normalRowData = Object.entries(normalRows).map(([currency, totalMinor]) => ({ currency, totalMinor }));
+  const packageRowData = Object.entries(packageRows).map(([currency, totalMinor]) => ({ currency, totalMinor }));
+  const normalGrand = calcGrand(normalRowData);
+  const packageGrand = calcGrand(packageRowData);
+  const overallGrand = normalGrand + packageGrand;
+
+  const filteredRouteBookings = confirmedBookings.filter((b: any) => {
+    const origin = b.schedule?.originStation?.name || b.originStationName || b.origin || 'Unknown';
+    const destination = b.schedule?.destinationStation?.name || b.destinationStationName || b.destination || 'Unknown';
+    if (routeOrigin && origin !== routeOrigin) return false;
+    if (routeDestination && destination !== routeDestination) return false;
+    return true;
+  });
+
+  const routeOriginOptions = [
+    ...new Set(confirmedBookings.map((b: any) => b.schedule?.originStation?.name || b.originStationName || b.origin || 'Unknown').filter(Boolean)),
+  ].sort() as string[];
+  const routeDestinationOptions = [
+    ...new Set(confirmedBookings.map((b: any) => b.schedule?.destinationStation?.name || b.destinationStationName || b.destination || 'Unknown').filter(Boolean)),
+  ].sort() as string[];
+
+  const routeRevenueData = Object.entries(
+    filteredRouteBookings.reduce((acc: Record<string, { totalEtbMinor: number; bookings: number }>, b: any) => {
+      const origin = b.schedule?.originStation?.name || b.originStationName || b.origin || 'Unknown';
+      const destination = b.schedule?.destinationStation?.name || b.destinationStationName || b.destination || 'Unknown';
+      const route = `${origin} → ${destination}`;
+      const rate = toEtbRate(b.currency);
+      const etbMinor = rate !== null ? Math.round((b.totalMinor || 0) * rate) : 0;
+      if (!acc[route]) acc[route] = { totalEtbMinor: 0, bookings: 0 };
+      acc[route].totalEtbMinor += etbMinor;
+      acc[route].bookings += 1;
+      return acc;
+    }, {}),
+  ).map(([route, value]) => ({
+    route,
+    totalEtbMinor: value.totalEtbMinor,
+    bookings: value.bookings,
+  })).sort((a, b) => b.totalEtbMinor - a.totalEtbMinor);
 
   const REPORT_COLS = ['Date', 'Revenue (ETB)', 'Confirmed Bookings'];
 
@@ -142,8 +230,8 @@ export default function ReportsPage() {
         `th,td{border:1px solid #ccc;padding:4px 8px}th{background:#10b981;color:#fff}</style></head><body>` +
         `<h2>Revenue Report — ${esc(dates.startDate)} to ${esc(dates.endDate)}</h2>` +
         `<p>Total Revenue: ${esc(formatCurrency(overallGrand, 'ETB'))} | ` +
-        `Bookings: ${esc(String(stats?.totalBookings ?? 0))} | ` +
-        `Tickets: ${esc(String(stats?.totalTickets ?? 0))}</p>` +
+        `Bookings: ${esc(String(totalBookingsCount))} | ` +
+        `Tickets: ${esc(String(totalTicketsCount))}</p>` +
         `<table><thead><tr>${thead}</tr></thead><tbody>${tbody}</tbody></table></body></html>`
       );
       w.document.close(); w.print();
@@ -161,6 +249,20 @@ export default function ReportsPage() {
     setExportModalOpen(false);
   };
 
+  const doExportRouteRevenue = () => {
+    if (!routeRevenueData.length) { alert('No route revenue to export'); return; }
+    const rows = routeRevenueData.map((row) => [row.route, String(row.bookings), formatCurrency(row.totalEtbMinor, 'ETB')]);
+    const headers = ['Route', 'Bookings', 'Revenue (ETB)'];
+    const csv = [headers.map((h) => `"${h}"`).join(','), ...rows.map((r) => r.map((v) => `"${v}"`).join(','))].join('\n');
+    const blob = new Blob([csv], { type: 'text/csv' });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = `route-revenue-${dates.startDate}-${dates.endDate}.csv`;
+    a.click();
+    URL.revokeObjectURL(url);
+  };
+
   const renderCurrencyRow = ({ currency, totalMinor }: { currency: string; totalMinor: number }) => {
     const rate = toEtbRate(currency);
     const etbMinor = rate !== null ? Math.round(totalMinor * rate) : null;
@@ -231,16 +333,16 @@ export default function ReportsPage() {
             </div>
           </div>
           <p className="text-2xl font-bold text-emerald-600 dark:text-emerald-400 tabular-nums mt-1">
-            {statsLoading ? '—' : formatCurrency(overallGrand, 'ETB')}
+            {isLoading ? '—' : formatCurrency(totalRevenueMinor, 'ETB')}
           </p>
           <div className="flex flex-col gap-1 border-t border-border pt-2 mt-1">
             <div className="flex justify-between text-xs">
               <span className="text-muted-foreground">Regular</span>
-              <span className="font-semibold tabular-nums">{statsLoading ? '—' : formatCurrency(normalGrand, 'ETB')}</span>
+              <span className="font-semibold tabular-nums">{isLoading ? '—' : formatCurrency(normalGrand, 'ETB')}</span>
             </div>
             <div className="flex justify-between text-xs">
               <span className="text-muted-foreground">Package</span>
-              <span className="font-semibold tabular-nums">{statsLoading ? '—' : formatCurrency(packageGrand, 'ETB')}</span>
+              <span className="font-semibold tabular-nums">{isLoading ? '—' : formatCurrency(packageGrand, 'ETB')}</span>
             </div>
           </div>
         </div>
@@ -254,16 +356,16 @@ export default function ReportsPage() {
             </div>
           </div>
           <p className="text-2xl font-bold tabular-nums mt-1">
-            {statsLoading ? '—' : (stats?.totalBookings ?? 0).toLocaleString()}
+            {isLoading ? '—' : totalBookingsCount.toLocaleString()}
           </p>
           <div className="flex flex-col gap-1 border-t border-border pt-2 mt-1">
             <div className="flex justify-between text-xs">
               <span className="text-muted-foreground">Regular</span>
-              <span className="font-semibold tabular-nums">{statsLoading ? '—' : (stats?.totalNormalBookings ?? 0).toLocaleString()}</span>
+              <span className="font-semibold tabular-nums">{isLoading ? '—' : totalRegularBookingsCount.toLocaleString()}</span>
             </div>
             <div className="flex justify-between text-xs">
               <span className="text-muted-foreground">Package</span>
-              <span className="font-semibold tabular-nums">{statsLoading ? '—' : (stats?.totalPackageBookings ?? 0).toLocaleString()}</span>
+              <span className="font-semibold tabular-nums">{isLoading ? '—' : totalPackageBookingsCount.toLocaleString()}</span>
             </div>
           </div>
         </div>
@@ -277,16 +379,16 @@ export default function ReportsPage() {
             </div>
           </div>
           <p className="text-2xl font-bold tabular-nums mt-1">
-            {statsLoading ? '—' : (stats?.totalTickets ?? 0).toLocaleString()}
+            {isLoading ? '—' : totalTicketsCount.toLocaleString()}
           </p>
           <div className="flex flex-col gap-1 border-t border-border pt-2 mt-1">
             <div className="flex justify-between text-xs">
               <span className="text-muted-foreground">Regular</span>
-              <span className="font-semibold tabular-nums">{statsLoading ? '—' : (stats?.totalNormalTickets ?? 0).toLocaleString()}</span>
+              <span className="font-semibold tabular-nums">{isLoading ? '—' : totalRegularBookingsCount.toLocaleString()}</span>
             </div>
             <div className="flex justify-between text-xs">
               <span className="text-muted-foreground">Package</span>
-              <span className="font-semibold tabular-nums">{statsLoading ? '—' : (stats?.totalPackageTickets ?? 0).toLocaleString()}</span>
+              <span className="font-semibold tabular-nums">{isLoading ? '—' : totalPackageBookingsCount.toLocaleString()}</span>
             </div>
           </div>
         </div>
@@ -300,7 +402,7 @@ export default function ReportsPage() {
             </div>
           </div>
           <p className="text-2xl font-bold tabular-nums mt-1">
-            {isLoading ? '—' : formatCurrency(avgDailyRevenue * 100, 'ETB')}
+            {isLoading ? '—' : formatCurrency(avgDailyRevenueMinor, 'ETB')}
           </p>
           <p className="text-xs text-muted-foreground mt-auto pt-2 border-t border-border">
             Over {chartData.length} active day{chartData.length !== 1 ? 's' : ''} in range
@@ -313,9 +415,9 @@ export default function ReportsPage() {
         <h2 className="text-sm font-semibold uppercase tracking-widest text-muted-foreground mb-4">
           Revenue Breakdown — Confirmed Tickets
         </h2>
-        {statsLoading ? (
+        {isLoading ? (
           <p className="text-sm text-muted-foreground">Loading…</p>
-        ) : !normalRows.length && !packageRows.length ? (
+        ) : !normalRowData.length && !packageRowData.length ? (
           <p className="text-sm text-muted-foreground">No revenue data yet.</p>
         ) : (
           <div className="grid grid-cols-1 sm:grid-cols-2 gap-6">
@@ -324,12 +426,12 @@ export default function ReportsPage() {
               <div className="flex items-center justify-between mb-1">
                 <span className="text-xs font-semibold uppercase tracking-wider text-muted-foreground">Regular</span>
                 <span className="text-xs text-muted-foreground tabular-nums">
-                  {(stats?.totalNormalBookings ?? 0).toLocaleString()} bookings · {(stats?.totalNormalTickets ?? 0).toLocaleString()} tickets
+                  {totalRegularBookingsCount.toLocaleString()} bookings · {totalRegularTicketsCount.toLocaleString()} tickets
                 </span>
               </div>
-              {normalRows.length === 0
+              {normalRowData.length === 0
                 ? <p className="text-xs text-muted-foreground py-1">No revenue yet</p>
-                : normalRows.map(renderCurrencyRow)}
+                : normalRowData.map(renderCurrencyRow)}
               {normalRows.length > 0 && (
                 <div className="flex items-center justify-between rounded-md bg-muted/40 px-3 py-2 mt-1">
                   <span className="text-xs font-semibold text-muted-foreground">Subtotal</span>
@@ -343,13 +445,13 @@ export default function ReportsPage() {
               <div className="flex items-center justify-between mb-1">
                 <span className="text-xs font-semibold uppercase tracking-wider text-muted-foreground">Package</span>
                 <span className="text-xs text-muted-foreground tabular-nums">
-                  {(stats?.totalPackageBookings ?? 0).toLocaleString()} bookings · {(stats?.totalPackageTickets ?? 0).toLocaleString()} tickets
+                  {totalPackageBookingsCount.toLocaleString()} bookings · {totalPackageTicketsCount.toLocaleString()} tickets
                 </span>
               </div>
-              {packageRows.length === 0
+              {packageRowData.length === 0
                 ? <p className="text-xs text-muted-foreground py-1">No revenue yet</p>
-                : packageRows.map(renderCurrencyRow)}
-              {packageRows.length > 0 && (
+                : packageRowData.map(renderCurrencyRow)}
+              {packageRowData.length > 0 && (
                 <div className="flex items-center justify-between rounded-md bg-muted/40 px-3 py-2 mt-1">
                   <span className="text-xs font-semibold text-muted-foreground">Subtotal</span>
                   <span className="text-sm font-bold tabular-nums">{formatCurrency(packageGrand, 'ETB')}</span>
@@ -358,7 +460,7 @@ export default function ReportsPage() {
             </div>
           </div>
         )}
-        {!statsLoading && (normalRows.length > 0 || packageRows.length > 0) && (
+        {(normalRowData.length > 0 || packageRowData.length > 0) && (
           <div className="flex items-center justify-between rounded-lg border border-border bg-muted/30 px-4 py-3 mt-4">
             <span className="text-sm font-semibold text-muted-foreground">Grand Total (ETB equivalent)</span>
             <span className="text-lg font-bold text-emerald-600 dark:text-emerald-400 tabular-nums">
@@ -368,6 +470,85 @@ export default function ReportsPage() {
         )}
       </div>
 
+      {/* Route Revenue Breakdown */}
+      <div className="card">
+        <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-2 mb-4">
+          <div>
+            <h2 className="text-sm font-semibold uppercase tracking-widest text-muted-foreground">
+              Revenue by Route
+            </h2>
+            <p className="text-xs text-muted-foreground">
+              Confirmed booking revenue for the selected date range, grouped by route.
+            </p>
+          </div>
+          <div className="flex flex-wrap items-center gap-2 text-xs text-muted-foreground">
+            <span>{routeRevenueData.length} route{routeRevenueData.length !== 1 ? 's' : ''}</span>
+            <button
+              type="button"
+              className="text-primary underline"
+              onClick={() => {
+                setRouteOrigin('');
+                setRouteDestination('');
+              }}
+            >
+              Clear filters
+            </button>
+          </div>
+        </div>
+
+        <div className="grid grid-cols-1 md:grid-cols-3 gap-3 mb-4">
+          <div>
+            <label className="label">Origin</label>
+            <select
+              className="input"
+              value={routeOrigin}
+              onChange={(e) => setRouteOrigin(e.target.value)}
+              disabled={isLoading}
+            >
+              <option value="">All origins</option>
+              {routeOriginOptions.map((origin) => (
+                <option key={origin} value={origin}>{origin}</option>
+              ))}
+            </select>
+          </div>
+          <div>
+            <label className="label">Destination</label>
+            <select
+              className="input"
+              value={routeDestination}
+              onChange={(e) => setRouteDestination(e.target.value)}
+              disabled={isLoading}
+            >
+              <option value="">All destinations</option>
+              {routeDestinationOptions.map((destination) => (
+                <option key={destination} value={destination}>{destination}</option>
+              ))}
+            </select>
+          </div>
+          <div className="flex items-end justify-end">
+            <ActionButton variant="secondary" onClick={doExportRouteRevenue} disabled={isLoading || routeRevenueData.length === 0}>
+              Export route revenue
+            </ActionButton>
+          </div>
+        </div>
+
+        {routeRevenueData.length === 0 ? (
+          <p className="text-sm text-muted-foreground">No route revenue data available for this range.</p>
+        ) : (
+          <div className="space-y-3">
+            {routeRevenueData.slice(0, 10).map((route) => (
+              <div key={route.route} className="grid grid-cols-1 md:grid-cols-[1.4fr_0.8fr_0.8fr] gap-3 items-center rounded-md bg-muted/20 p-3">
+                <div className="text-sm font-medium break-words">{route.route}</div>
+                <div className="text-sm text-muted-foreground">{route.bookings.toLocaleString()} booking{route.bookings !== 1 ? 's' : ''}</div>
+                <div className="text-right text-sm font-semibold tabular-nums">
+                  {formatCurrency(route.totalEtbMinor, 'ETB')}
+                </div>
+              </div>
+            ))}
+          </div>
+        )}
+      </div>
+
       {/* Charts */}
       <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
         {/* Revenue Trend */}
@@ -485,17 +666,17 @@ export default function ReportsPage() {
         <h3 className="text-base font-semibold mb-4">Summary</h3>
         <div className="grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-6 gap-3">
           {[
-            { label: 'Active Days', value: chartData.length, fromStats: false },
-            { label: 'Confirmed', value: bookings.filter((b: any) => b.status === 'CONFIRMED').length, fromStats: false },
-            { label: 'Boarded', value: bookings.filter((b: any) => b.status === 'BOARDED').length, fromStats: false },
-            { label: 'Cancelled', value: bookings.filter((b: any) => b.status === 'CANCELLED').length, fromStats: false },
-            { label: 'Regular Bookings', value: stats?.totalNormalBookings ?? 0, fromStats: true },
-            { label: 'Package Bookings', value: stats?.totalPackageBookings ?? 0, fromStats: true },
-          ].map(({ label, value, fromStats }) => (
+            { label: 'Active Days', value: chartData.length },
+            { label: 'Confirmed', value: bookings.filter((b: any) => b.status === 'CONFIRMED').length },
+            { label: 'Boarded', value: bookings.filter((b: any) => b.status === 'BOARDED').length },
+            { label: 'Cancelled', value: bookings.filter((b: any) => b.status === 'CANCELLED').length },
+            { label: 'Regular Bookings', value: totalRegularBookingsCount },
+            { label: 'Package Bookings', value: totalPackageBookingsCount },
+          ].map(({ label, value }) => (
             <div key={label} className="border border-border rounded-lg p-3 text-center">
               <p className="text-xs text-muted-foreground">{label}</p>
               <p className="text-xl font-bold mt-1 tabular-nums">
-                {fromStats && statsLoading ? '—' : value.toLocaleString()}
+                {value.toLocaleString()}
               </p>
             </div>
           ))}
diff --git a/apps/edr-passenger-web/backoffice/src/components/layout/Sidebar.tsx b/apps/edr-passenger-web/backoffice/src/components/layout/Sidebar.tsx
index 616488917..58a773b2f 100644
--- a/apps/edr-passenger-web/backoffice/src/components/layout/Sidebar.tsx
+++ b/apps/edr-passenger-web/backoffice/src/components/layout/Sidebar.tsx
@@ -123,6 +123,7 @@ const navigationSections: { title: string; items: NavItem[] }[] = [
     title: 'Analytics & Reports',
     items: [
       { name: 'Overall',              href: '/reports/overall',                icon: BarChart3,      permission: PERMS.reports.view },
+      { name: 'Finance',             href: '/reports/finance',                icon: DollarSign,     permission: PERMS.reports.view },
       { name: 'Seats',               href: '/reports/seats',                  icon: Armchair,       permission: PERMS.reports.view },
       { name: 'Blocked Seats',       href: '/reports/blocked-seats',          icon: Ban,            permission: PERMS.reports.view },
       { name: 'Passengers',          href: '/reports/passengers',             icon: Users,          permission: PERMS.reports.view },
diff --git a/apps/edr-passenger-web/backoffice/src/components/ui/Skeleton.tsx b/apps/edr-passenger-web/backoffice/src/components/ui/Skeleton.tsx
new file mode 100644
index 000000000..e6f24fb02
--- /dev/null
+++ b/apps/edr-passenger-web/backoffice/src/components/ui/Skeleton.tsx
@@ -0,0 +1,10 @@
+import { cn } from '@/lib/utils';
+
+interface SkeletonProps {
+  className?: string;
+}
+
+/** A shimmering placeholder block. Give it the size/shape of the content it stands in for. */
+export default function Skeleton({ className }: SkeletonProps) {
+  return <div className={cn('skeleton', className)} aria-hidden="true" />;
+}
diff --git a/apps/edr-passenger-web/backoffice/src/lib/api/finance.ts b/apps/edr-passenger-web/backoffice/src/lib/api/finance.ts
new file mode 100644
index 000000000..d99aaeae2
--- /dev/null
+++ b/apps/edr-passenger-web/backoffice/src/lib/api/finance.ts
@@ -0,0 +1,65 @@
+import { apiClient } from '@/lib/api-client';
+
+export type FinanceGranularity = 'daily' | 'weekly' | 'monthly';
+
+export interface FinanceSummaryFilters {
+  dateFrom: string;
+  dateTo: string;
+  granularity?: FinanceGranularity;
+  originStationId?: string;
+  destinationStationId?: string;
+  method?: string;
+}
+
+export interface FinanceBucketRow {
+  period: string;
+  originStationId: string;
+  destinationStationId: string;
+  segmentLabel: string;
+  method: string;
+  bookingCount: number;
+  revenueEtbMinor: number;
+}
+
+export interface FinanceRollupRow {
+  key: string;
+  label: string;
+  revenueEtbMinor: number;
+  bookingCount: number;
+}
+
+export interface FinanceTotals {
+  bookingCount: number;
+  revenueEtbMinor: number;
+}
+
+export interface FinanceSummaryReport {
+  granularity: FinanceGranularity;
+  dateFrom: string;
+  dateTo: string;
+  currency: string;
+  totals: FinanceTotals;
+  byPeriod: FinanceRollupRow[];
+  bySegment: FinanceRollupRow[];
+  byMethod: FinanceRollupRow[];
+  rows: FinanceBucketRow[];
+}
+
+/** Drops blanks so the API applies its own defaults (granularity=daily, no station/method filter). */
+function toParams(filters: FinanceSummaryFilters): Record<string, string> {
+  const params: Record<string, string> = { dateFrom: filters.dateFrom, dateTo: filters.dateTo };
+  if (filters.granularity) params.granularity = filters.granularity;
+  if (filters.originStationId) params.originStationId = filters.originStationId;
+  if (filters.destinationStationId) params.destinationStationId = filters.destinationStationId;
+  if (filters.method) params.method = filters.method;
+  return params;
+}
+
+export const financeApi = {
+  getSummary: (filters: FinanceSummaryFilters) =>
+    apiClient.get<FinanceSummaryReport>('/reports/finance', { params: toParams(filters) }),
+
+  /** CSV export. `getRaw` because the endpoint streams a bare CSV body, not the `{success,data}` envelope. */
+  exportCsv: (filters: FinanceSummaryFilters) =>
+    apiClient.getRaw<string>('/reports/finance/export', { params: toParams(filters) }),
+};
diff --git a/apps/edr-passenger-web/backoffice/src/lib/export/finance-workbook.ts b/apps/edr-passenger-web/backoffice/src/lib/export/finance-workbook.ts
new file mode 100644
index 000000000..da8f172be
--- /dev/null
+++ b/apps/edr-passenger-web/backoffice/src/lib/export/finance-workbook.ts
@@ -0,0 +1,245 @@
+import ExcelJS from 'exceljs';
+import type { FinanceGranularity, FinanceSummaryReport } from '@/lib/api/finance';
+
+// Brand palette — rgb(20,113,76), the same green used by ActionButton's primary variant,
+// so the exported file reads as the same product as the on-screen report.
+const BRAND = 'FF14714C';
+const BRAND_DARK = 'FF0E5A3D';
+const BRAND_TINT = 'FFEAF5EF';
+const INK = 'FF1F2937';
+const MUTED = 'FF6B7280';
+const ROW_ALT = 'FFF7F8F7';
+const BORDER = 'FFE2E5E1';
+const WHITE = 'FFFFFFFF';
+
+const CURRENCY_FMT = '"ETB" #,##0.00';
+const THIN_BORDER: Partial<ExcelJS.Borders> = {
+  top: { style: 'thin', color: { argb: BORDER } },
+  left: { style: 'thin', color: { argb: BORDER } },
+  bottom: { style: 'thin', color: { argb: BORDER } },
+  right: { style: 'thin', color: { argb: BORDER } },
+};
+
+export interface ChartImage {
+  dataUrl: string;
+  width: number;
+  height: number;
+}
+
+export interface FinanceWorkbookInput {
+  report: FinanceSummaryReport;
+  filters: { dateFrom: string; dateTo: string; granularity: FinanceGranularity; originLabel: string; destinationLabel: string; methodLabel: string };
+  methodLabel: (method: string) => string;
+  periodLabel: (period: string, granularity: FinanceGranularity) => string;
+  images: { trend?: ChartImage; segment?: ChartImage; method?: ChartImage };
+}
+
+function styleHeaderCell(cell: ExcelJS.Cell) {
+  cell.font = { bold: true, color: { argb: WHITE }, size: 11 };
+  cell.fill = { type: 'pattern', pattern: 'solid', fgColor: { argb: BRAND } };
+  cell.alignment = { vertical: 'middle', horizontal: 'left' };
+  cell.border = THIN_BORDER;
+}
+
+function addTableHeader(ws: ExcelJS.Worksheet, rowIndex: number, headers: string[], alignRight: Set<number> = new Set()) {
+  const row = ws.getRow(rowIndex);
+  headers.forEach((h, i) => {
+    const cell = row.getCell(i + 1);
+    cell.value = h;
+    styleHeaderCell(cell);
+    if (alignRight.has(i)) cell.alignment = { vertical: 'middle', horizontal: 'right' };
+  });
+  row.height = 20;
+  row.commit();
+}
+
+function bandRow(ws: ExcelJS.Worksheet, rowIndex: number, colCount: number, isAlt: boolean) {
+  const row = ws.getRow(rowIndex);
+  for (let c = 1; c <= colCount; c++) {
+    const cell = row.getCell(c);
+    cell.border = THIN_BORDER;
+    if (isAlt) cell.fill = { type: 'pattern', pattern: 'solid', fgColor: { argb: ROW_ALT } };
+  }
+}
+
+function titleBanner(ws: ExcelJS.Worksheet, title: string, subtitle: string, colSpan: number) {
+  ws.mergeCells(1, 1, 1, colSpan);
+  const titleCell = ws.getCell(1, 1);
+  titleCell.value = title;
+  titleCell.font = { bold: true, size: 18, color: { argb: WHITE } };
+  titleCell.fill = { type: 'pattern', pattern: 'solid', fgColor: { argb: BRAND } };
+  titleCell.alignment = { vertical: 'middle', horizontal: 'left', indent: 1 };
+  ws.getRow(1).height = 34;
+  for (let c = 1; c <= colSpan; c++) ws.getCell(1, c).fill = titleCell.fill;
+
+  ws.mergeCells(2, 1, 2, colSpan);
+  const subCell = ws.getCell(2, 1);
+  subCell.value = subtitle;
+  subCell.font = { italic: true, size: 10, color: { argb: MUTED } };
+  subCell.alignment = { vertical: 'middle', horizontal: 'left', indent: 1 };
+  ws.getRow(2).height = 18;
+}
+
+function kpiCard(ws: ExcelJS.Worksheet, startRow: number, startCol: number, span: number, label: string, value: string, accent: string) {
+  ws.mergeCells(startRow, startCol, startRow, startCol + span - 1);
+  ws.mergeCells(startRow + 1, startCol, startRow + 1, startCol + span - 1);
+
+  const labelCell = ws.getCell(startRow, startCol);
+  labelCell.value = label.toUpperCase();
+  labelCell.font = { bold: true, size: 9, color: { argb: MUTED } };
+  labelCell.alignment = { vertical: 'middle', horizontal: 'left', indent: 1 };
+
+  const valueCell = ws.getCell(startRow + 1, startCol);
+  valueCell.value = value;
+  valueCell.font = { bold: true, size: 16, color: { argb: accent } };
+  valueCell.alignment = { vertical: 'middle', horizontal: 'left', indent: 1 };
+
+  for (let r = startRow; r <= startRow + 1; r++) {
+    for (let c = startCol; c < startCol + span; c++) {
+      const cell = ws.getCell(r, c);
+      cell.fill = { type: 'pattern', pattern: 'solid', fgColor: { argb: BRAND_TINT } };
+      cell.border = {
+        top: r === startRow ? { style: 'thin', color: { argb: BORDER } } : undefined,
+        bottom: r === startRow + 1 ? { style: 'thin', color: { argb: BORDER } } : undefined,
+        left: c === startCol ? { style: 'thin', color: { argb: BORDER } } : undefined,
+        right: c === startCol + span - 1 ? { style: 'thin', color: { argb: BORDER } } : undefined,
+      };
+    }
+  }
+  ws.getRow(startRow).height = 16;
+  ws.getRow(startRow + 1).height = 26;
+}
+
+function addImage(wb: ExcelJS.Workbook, ws: ExcelJS.Worksheet, image: ChartImage | undefined, anchorRow: number, heading: string) {
+  const headingCell = ws.getCell(anchorRow, 1);
+  headingCell.value = heading;
+  headingCell.font = { bold: true, size: 12, color: { argb: INK } };
+  ws.getRow(anchorRow).height = 20;
+
+  if (!image) {
+    const emptyCell = ws.getCell(anchorRow + 1, 1);
+    emptyCell.value = 'No chart available for the current filters.';
+    emptyCell.font = { italic: true, size: 10, color: { argb: MUTED } };
+    return anchorRow + 3;
+  }
+
+  const maxWidth = 640;
+  const scale = image.width > maxWidth ? maxWidth / image.width : 1;
+  const width = Math.round(image.width * scale);
+  const height = Math.round(image.height * scale);
+
+  const imageId = wb.addImage({ base64: image.dataUrl, extension: 'png' });
+  ws.addImage(imageId, {
+    tl: { col: 0.15, row: anchorRow + 0.15 },
+    ext: { width, height },
+  });
+
+  // Advance past the image height (≈20px per row) plus a spacer row.
+  const rowsUsed = Math.ceil(height / 20) + 2;
+  return anchorRow + rowsUsed;
+}
+
+export async function buildFinanceWorkbook(input: FinanceWorkbookInput): Promise<Blob> {
+  const { report, filters, images } = input;
+  const methodLabel = input.methodLabel;
+  const periodLabel = input.periodLabel;
+
+  const wb = new ExcelJS.Workbook();
+  wb.creator = 'EDR Passenger Backoffice';
+  wb.created = new Date();
+
+  // ── Summary sheet ─────────────────────────────────────────────────────────
+  const summary = wb.addWorksheet('Summary', { views: [{ showGridLines: false }] });
+  summary.columns = [{ width: 16 }, { width: 16 }, { width: 16 }, { width: 16 }, { width: 16 }, { width: 16 }];
+
+  titleBanner(
+    summary,
+    'EDR Passenger — Finance Summary',
+    `${filters.dateFrom} to ${filters.dateTo} · ${filters.granularity} · Origin: ${filters.originLabel} · Destination: ${filters.destinationLabel} · Method: ${filters.methodLabel} · Generated ${new Date().toLocaleString('en-US')}`,
+    6,
+  );
+
+  const avgPerBooking = report.totals.bookingCount > 0 ? report.totals.revenueEtbMinor / report.totals.bookingCount : 0;
+  kpiCard(summary, 4, 1, 2, 'Total Revenue', `ETB ${(report.totals.revenueEtbMinor / 100).toLocaleString('en-US', { minimumFractionDigits: 2 })}`, BRAND_DARK);
+  kpiCard(summary, 4, 3, 2, 'Bookings', report.totals.bookingCount.toLocaleString('en-US'), INK);
+  kpiCard(summary, 4, 5, 2, 'Avg. per Booking', `ETB ${(avgPerBooking / 100).toLocaleString('en-US', { minimumFractionDigits: 2 })}`, INK);
+
+  let cursor = 7;
+  cursor = addImage(wb, summary, images.trend, cursor, 'Revenue Trend') + 1;
+  cursor = addImage(wb, summary, images.segment, cursor, 'Revenue by Segment') + 1;
+  addImage(wb, summary, images.method, cursor, 'Revenue by Payment Method');
+
+  // ── By Period sheet ──────────────────────────────────────────────────────
+  const byPeriod = wb.addWorksheet('By Period', { views: [{ state: 'frozen', ySplit: 1 }] });
+  byPeriod.columns = [{ width: 18 }, { width: 14 }, { width: 20 }];
+  addTableHeader(byPeriod, 1, ['Period', 'Bookings', 'Revenue (ETB)'], new Set([1, 2]));
+  const periodRows = [...report.byPeriod].sort((a, b) => a.key.localeCompare(b.key));
+  periodRows.forEach((p, i) => {
+    const r = byPeriod.getRow(i + 2);
+    r.getCell(1).value = periodLabel(p.key, report.granularity);
+    r.getCell(2).value = p.bookingCount;
+    r.getCell(2).alignment = { horizontal: 'right' };
+    r.getCell(3).value = p.revenueEtbMinor / 100;
+    r.getCell(3).numFmt = CURRENCY_FMT;
+    r.getCell(3).alignment = { horizontal: 'right' };
+    bandRow(byPeriod, i + 2, 3, i % 2 === 1);
+  });
+  byPeriod.autoFilter = { from: { row: 1, column: 1 }, to: { row: 1, column: 3 } };
+
+  // ── By Segment sheet ─────────────────────────────────────────────────────
+  const bySegment = wb.addWorksheet('By Segment', { views: [{ state: 'frozen', ySplit: 1 }] });
+  bySegment.columns = [{ width: 34 }, { width: 14 }, { width: 20 }];
+  addTableHeader(bySegment, 1, ['Origin → Destination', 'Bookings', 'Revenue (ETB)'], new Set([1, 2]));
+  report.bySegment.forEach((s, i) => {
+    const r = bySegment.getRow(i + 2);
+    r.getCell(1).value = s.label;
+    r.getCell(2).value = s.bookingCount;
+    r.getCell(2).alignment = { horizontal: 'right' };
+    r.getCell(3).value = s.revenueEtbMinor / 100;
+    r.getCell(3).numFmt = CURRENCY_FMT;
+    r.getCell(3).alignment = { horizontal: 'right' };
+    bandRow(bySegment, i + 2, 3, i % 2 === 1);
+  });
+  bySegment.autoFilter = { from: { row: 1, column: 1 }, to: { row: 1, column: 3 } };
+
+  // ── By Method sheet ──────────────────────────────────────────────────────
+  const byMethod = wb.addWorksheet('By Method', { views: [{ state: 'frozen', ySplit: 1 }] });
+  byMethod.columns = [{ width: 20 }, { width: 14 }, { width: 20 }, { width: 12 }];
+  addTableHeader(byMethod, 1, ['Payment Method', 'Bookings', 'Revenue (ETB)', 'Share'], new Set([1, 2, 3]));
+  const methodTotal = report.byMethod.reduce((sum, m) => sum + m.revenueEtbMinor, 0);
+  report.byMethod.forEach((m, i) => {
+    const r = byMethod.getRow(i + 2);
+    r.getCell(1).value = methodLabel(m.key);
+    r.getCell(2).value = m.bookingCount;
+    r.getCell(2).alignment = { horizontal: 'right' };
+    r.getCell(3).value = m.revenueEtbMinor / 100;
+    r.getCell(3).numFmt = CURRENCY_FMT;
+    r.getCell(3).alignment = { horizontal: 'right' };
+    r.getCell(4).value = methodTotal > 0 ? m.revenueEtbMinor / methodTotal : 0;
+    r.getCell(4).numFmt = '0.0%';
+    r.getCell(4).alignment = { horizontal: 'right' };
+    bandRow(byMethod, i + 2, 4, i % 2 === 1);
+  });
+  byMethod.autoFilter = { from: { row: 1, column: 1 }, to: { row: 1, column: 4 } };
+
+  // ── Detail sheet — every row, unpaginated ───────────────────────────────
+  const detail = wb.addWorksheet('Detail', { views: [{ state: 'frozen', ySplit: 1 }] });
+  detail.columns = [{ width: 18 }, { width: 34 }, { width: 18 }, { width: 14 }, { width: 20 }];
+  addTableHeader(detail, 1, ['Period', 'Origin → Destination', 'Payment Method', 'Bookings', 'Revenue (ETB)'], new Set([2, 3]));
+  report.rows.forEach((row, i) => {
+    const r = detail.getRow(i + 2);
+    r.getCell(1).value = periodLabel(row.period, report.granularity);
+    r.getCell(2).value = row.segmentLabel;
+    r.getCell(3).value = methodLabel(row.method);
+    r.getCell(4).value = row.bookingCount;
+    r.getCell(4).alignment = { horizontal: 'right' };
+    r.getCell(5).value = row.revenueEtbMinor / 100;
+    r.getCell(5).numFmt = CURRENCY_FMT;
+    r.getCell(5).alignment = { horizontal: 'right' };
+    bandRow(detail, i + 2, 5, i % 2 === 1);
+  });
+  detail.autoFilter = { from: { row: 1, column: 1 }, to: { row: 1, column: 5 } };
+
+  const buffer = await wb.xlsx.writeBuffer();
+  return new Blob([buffer], { type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' });
+}
diff --git a/apps/edr-passenger-web/backoffice/src/styles/globals.css b/apps/edr-passenger-web/backoffice/src/styles/globals.css
index e14e614af..4fd8c86dc 100644
--- a/apps/edr-passenger-web/backoffice/src/styles/globals.css
+++ b/apps/edr-passenger-web/backoffice/src/styles/globals.css
@@ -68,6 +68,24 @@
   .animate-fade-up {
     animation: fade-up 0.25s cubic-bezier(0.22, 1, 0.36, 1) both;
   }
+
+  @keyframes shimmer {
+    from { background-position: -300px 0; }
+    to   { background-position: 300px 0; }
+  }
+  .skeleton {
+    border-radius: 0.5rem;
+    background-color: hsl(var(--muted));
+    background-image: linear-gradient(
+      90deg,
+      hsl(var(--muted)) 0%,
+      hsl(var(--muted-foreground) / 0.18) 50%,
+      hsl(var(--muted)) 100%
+    );
+    background-size: 600px 100%;
+    background-repeat: no-repeat;
+    animation: shimmer 1.5s ease-in-out infinite;
+  }
 }
 
 @layer components {
diff --git a/packages/api-common/src/filters/http-exception.filter.ts b/packages/api-common/src/filters/http-exception.filter.ts
index 3dc301a0b..3015d239f 100644
--- a/packages/api-common/src/filters/http-exception.filter.ts
+++ b/packages/api-common/src/filters/http-exception.filter.ts
@@ -7,6 +7,8 @@ import {
   Logger,
 } from "@nestjs/common";
 
+import { logCtx } from "../logging/request-context";
+
 interface ErrorResponseBody {
   success: false;
   statusCode: number;
@@ -120,6 +122,18 @@ export class HttpExceptionFilter implements ExceptionFilter {
       path: request.url,
     };
 
+    // Land the failure on the request's canonical log line too — the middleware
+    // only sees a status code, not what threw. No-op outside a request.
+    logCtx(
+      {
+        name: exception instanceof Error ? exception.name : "Error",
+        message,
+        status,
+        stack: status >= 500 ? (exception as Error)?.stack : undefined,
+      },
+      { path: "error", mode: "set" },
+    );
+
     if (status >= 500) {
       this.logger.error(
         `${request.method} ${request.url} -> ${status}`,
diff --git a/packages/api-common/src/index.ts b/packages/api-common/src/index.ts
index 8561f3721..d71f026da 100644
--- a/packages/api-common/src/index.ts
+++ b/packages/api-common/src/index.ts
@@ -6,6 +6,10 @@ export * from "./decorators/public.decorator";
 // Filters
 export * from "./filters/http-exception.filter";
 
+// Logging
+export * from "./logging/request-context";
+export * from "./logging/request-log.middleware";
+
 // Interceptors
 export * from "./interceptors/response-transform.interceptor";
 
diff --git a/packages/api-common/src/logging/request-context.ts b/packages/api-common/src/logging/request-context.ts
new file mode 100644
index 000000000..0b41222ee
--- /dev/null
+++ b/packages/api-common/src/logging/request-context.ts
@@ -0,0 +1,109 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+/**
+ * Per-request bag of data points that end up on the canonical request log line
+ * (see request-log.middleware.ts). Anything written here is flattened into one
+ * JSON object at the end of the request, so keep it to values that are safe to
+ * ship to a log aggregator: ids, states, counts, outcomes — never secrets,
+ * tokens, or raw uploads.
+ */
+export type RequestLogContext = Record<string, unknown>;
+
+const storage = new AsyncLocalStorage<RequestLogContext>();
+
+export const getLogContext = (): RequestLogContext | undefined =>
+  storage.getStore();
+
+export const runWithLogContext = <T>(
+  seed: RequestLogContext,
+  fn: () => T,
+): T => storage.run(seed, fn);
+
+export interface LogCtxOptions {
+  /**
+   * Dot path to write under, e.g. "booking.transition". Namespacing is just a
+   * path with one segment ("payment"). Root object when omitted.
+   */
+  path?: string;
+  /**
+   * How the value lands:
+   * - `merge` (default) — shallow-merge objects into the target
+   * - `set` — overwrite the target
+   * - `push` — append to an array at the target
+   * - `count` — add the value (default 1) to a numeric counter at the target
+   */
+  mode?: "merge" | "set" | "push" | "count";
+}
+
+/** Escape hatch when the four modes don't fit: mutate the context yourself. */
+export type LogCtxMutator = (ctx: RequestLogContext, value: unknown) => void;
+
+// ponytail: fixed cap so a loop calling logCtx in `push` mode can't grow an
+// unbounded array in memory / a megabyte log line. Per-path caps if one ever
+// legitimately needs more.
+const MAX_PUSHED = 100;
+
+const isPlainObject = (v: unknown): v is Record<string, unknown> =>
+  typeof v === "object" && v !== null && !Array.isArray(v);
+
+/**
+ * Append a data point to the current request's canonical log line.
+ *
+ * No-op outside an HTTP request (bootstrap, cron, queue consumers) — callers
+ * never need to guard.
+ *
+ *   logCtx({ bookingId, status });                            // root merge
+ *   logCtx(intentId, { path: "payment.intentId", mode: "set" });
+ *   logCtx({ from, to }, { path: "booking.transition" });     // namespaced
+ *   logCtx({ wagonId }, { path: "wagons", mode: "push" });    // array
+ *   logCtx(1, { path: "smsSent", mode: "count" });            // counter
+ *   logCtx(err, (ctx, e) => { ctx.lastError = String(e); });  // custom
+ */
+export function logCtx(
+  value: unknown,
+  opts: LogCtxOptions | LogCtxMutator = {},
+): void {
+  const ctx = storage.getStore();
+  if (!ctx) return;
+
+  if (typeof opts === "function") {
+    opts(ctx, value);
+    return;
+  }
+
+  const { path, mode = "merge" } = opts;
+
+  if (!path) {
+    if (isPlainObject(value)) Object.assign(ctx, value);
+    return;
+  }
+
+  const keys = path.split(".");
+  const leaf = keys.pop() as string;
+  let node: Record<string, unknown> = ctx;
+  for (const key of keys) {
+    if (!isPlainObject(node[key])) node[key] = {};
+    node = node[key] as Record<string, unknown>;
+  }
+
+  switch (mode) {
+    case "set":
+      node[leaf] = value;
+      break;
+    case "push": {
+      const arr = Array.isArray(node[leaf]) ? (node[leaf] as unknown[]) : [];
+      if (arr.length < MAX_PUSHED) arr.push(value);
+      node[leaf] = arr;
+      break;
+    }
+    case "count":
+      node[leaf] =
+        ((node[leaf] as number) ?? 0) + (typeof value === "number" ? value : 1);
+      break;
+    default:
+      node[leaf] =
+        isPlainObject(node[leaf]) && isPlainObject(value)
+          ? Object.assign(node[leaf] as Record<string, unknown>, value)
+          : value;
+  }
+}
diff --git a/packages/api-common/src/logging/request-log.middleware.ts b/packages/api-common/src/logging/request-log.middleware.ts
new file mode 100644
index 000000000..5d9ead8b0
--- /dev/null
+++ b/packages/api-common/src/logging/request-log.middleware.ts
@@ -0,0 +1,143 @@
+import { randomUUID } from "node:crypto";
+import { Injectable, NestMiddleware } from "@nestjs/common";
+
+import {
+  RequestLogContext,
+  logCtx,
+  runWithLogContext,
+} from "./request-context";
+
+/**
+ * Structural request/response shapes — express types are not a dependency of
+ * this package (they arrive under @nestjs/platform-express in the apps).
+ */
+interface LoggedRequest {
+  method: string;
+  url: string;
+  originalUrl?: string;
+  baseUrl?: string;
+  route?: { path?: string };
+  headers: Record<string, string | string[] | undefined>;
+  ip?: string;
+  query?: Record<string, unknown>;
+  user?: Record<string, unknown> | null;
+}
+
+interface LoggedResponse {
+  statusCode: number;
+  writableEnded?: boolean;
+  setHeader(name: string, value: string): void;
+  on(event: string, listener: () => void): void;
+}
+
+const header = (req: LoggedRequest, name: string): string | undefined => {
+  const value = req.headers[name];
+  return Array.isArray(value) ? value[0] : value;
+};
+
+const userId = (req: LoggedRequest): string | undefined => {
+  const user = req.user;
+  if (!user) return undefined;
+  const id = user.id ?? user.sub ?? user.userId;
+  return typeof id === "string" || typeof id === "number"
+    ? String(id)
+    : undefined;
+};
+
+/**
+ * Opens an AsyncLocalStorage context for the request (so anything downstream
+ * can `logCtx(...)` into it) and emits ONE canonical JSON line per request when
+ * the response ends — request metadata plus every data point collected during
+ * the flow, on the same Nest logger transport as the rest of the app.
+ *
+ * Base fields win over collected context on key collisions, so a stray
+ * `logCtx({ status })` can never corrupt the fields dashboards filter on.
+ *
+ * Apply FIRST in `configure()`: middleware registered before this one runs
+ * outside the context and its `logCtx` calls are silently dropped.
+ */
+@Injectable()
+export class RequestLogMiddleware implements NestMiddleware {
+  use(req: LoggedRequest, res: LoggedResponse, next: () => void): void {
+    const start = Date.now();
+    const requestId = header(req, "x-request-id") ?? randomUUID();
+    res.setHeader("x-request-id", requestId);
+
+    // Held by reference, NOT read back through the ALS at emit time: response
+    // "finish"/"close" listeners are plain EventEmitter callbacks, which Node
+    // does not bind to the async context they were registered in — getStore()
+    // there returns whatever context happened to call res.end().
+    const ctx: RequestLogContext = {};
+
+    runWithLogContext(ctx, () => {
+      logCtx({ requestId });
+
+      let emitted = false;
+      // "finish" covers normal responses; "close" catches client aborts, where
+      // "finish" never fires and the request would vanish from the logs.
+      const emit = () => {
+        if (emitted) return;
+        emitted = true;
+
+        const url = req.originalUrl ?? req.url;
+        const status = res.statusCode;
+        const durationMs = Date.now() - start;
+
+        const line = {
+          ...ctx,
+          // Fields the Nest console prefix used to carry. They are IN the JSON
+          // now because this line is written raw (see below) — a log shipper
+          // needs level and time as parsable fields, not as console decoration.
+          time: new Date().toISOString(),
+          level: status >= 500 ? "error" : status >= 400 ? "warn" : "info",
+          logger: "request",
+          type: "http_request",
+          requestId,
+          method: req.method,
+          route: req.route?.path
+            ? `${req.baseUrl ?? ""}${req.route.path}`
+            : undefined,
+          url,
+          status,
+          durationMs,
+          userId: userId(req),
+          ip: req.ip,
+          userAgent: header(req, "user-agent"),
+          query:
+            req.query && Object.keys(req.query).length ? req.query : undefined,
+          aborted: res.writableEnded === false ? true : undefined,
+        };
+        // A circular value pushed into the context must not throw inside a
+        // response listener — that would take the process down, not the log.
+        let json: string;
+        try {
+          json = JSON.stringify(line);
+        } catch {
+          json = JSON.stringify({
+            time: line.time,
+            level: line.level,
+            logger: "request",
+            type: "http_request",
+            requestId,
+            method: req.method,
+            url,
+            status,
+            durationMs,
+            contextSerializationFailed: true,
+          });
+        }
+
+        // Written raw, NOT through Nest's Logger: the console logger wraps every
+        // message in "[Nest] pid - date LEVEL [ctx] …", which makes the line
+        // un-parsable as JSON. Same destination the Nest logger writes to
+        // (stdout, stderr for errors) — only the decoration is dropped.
+        (status >= 500 ? process.stderr : process.stdout).write(`${json}\n`);
+      };
+
+      res.on("finish", emit);
+      res.on("close", emit);
+
+      next();
+    });
+  }
+}
diff --git a/packages/api-common/src/repositories/base.repository.ts b/packages/api-common/src/repositories/base.repository.ts
index 6374d84a7..c0cc7073b 100644
--- a/packages/api-common/src/repositories/base.repository.ts
+++ b/packages/api-common/src/repositories/base.repository.ts
@@ -7,9 +7,16 @@ import {
   Repository,
 } from "typeorm";
 
+import { logCtx } from "../logging/request-context";
+
 export abstract class BaseRepository<T extends ObjectLiteral> {
   protected constructor(protected readonly repository: Repository<T>) {}
 
+  /** Table name, for the write trail on the canonical request log line. */
+  private get table(): string {
+    return this.repository.metadata.tableName;
+  }
+
   /** Find a single entity by its primary key. */
   async findById(
     id: string,
@@ -34,22 +41,43 @@ export abstract class BaseRepository<T extends ObjectLiteral> {
   /** Create and persist a new entity. */
   async create(data: DeepPartial<T>): Promise<T> {
     const entity = this.repository.create(data);
-    return this.repository.save(entity);
+    const saved = await this.repository.save(entity);
+    logCtx(1, { path: `db.created.${this.table}`, mode: "count" });
+    return saved;
   }
 
-  /** Patch an entity in place and return the reloaded row. */
+  /**
+   * Patch an entity in place and return the reloaded row.
+   *
+   * Every domain status machine in this app (booking, contract, wagon,
+   * warehouse, transfer request…) lands here, so this is the one place that can
+   * record "what state did this request actually move" without every service
+   * remembering to log it.
+   */
   async update(id: string, data: DeepPartial<T>): Promise<T | null> {
     await this.repository.update(id, data as never);
+    logCtx(1, { path: `db.updated.${this.table}`, mode: "count" });
+    if (data && typeof data === "object" && "status" in data) {
+      logCtx(
+        { entity: this.table, id, status: (data as { status: unknown }).status },
+        { path: "statusChanges", mode: "push" },
+      );
+    }
     return this.findById(id);
   }
 
   /** Soft-delete an entity by primary key (sets deleted_at). */
   async softDelete(id: string): Promise<void> {
     await this.repository.softDelete(id);
+    logCtx({ entity: this.table, id }, { path: "deleted", mode: "push" });
   }
 
   /** Permanently delete an entity. Avoid in domain code; prefer softDelete. */
   async hardDelete(id: string): Promise<void> {
     await this.repository.delete(id);
+    logCtx(
+      { entity: this.table, id, hard: true },
+      { path: "deleted", mode: "push" },
+    );
   }
 }
diff --git a/packages/types/src/freight/clearance-files.catalog.ts b/packages/types/src/freight/clearance-files.catalog.ts
index cb4f976eb..8fa50cba4 100644
--- a/packages/types/src/freight/clearance-files.catalog.ts
+++ b/packages/types/src/freight/clearance-files.catalog.ts
@@ -156,6 +156,48 @@ export function transitPermitFileLabel(code: string, index?: number): string {
   return code;
 }
 
+/** Legacy single Delivery Order code (pre multi-file uploads). */
+export const LEGACY_DELIVERY_ORDER_CODE = "delivery_order";
+
+/** Multi-file Delivery Order uploads use `delivery_order_0`, `delivery_order_1`, … */
+export const DELIVERY_ORDER_FILE_PREFIX = "delivery_order_";
+
+export function isDeliveryOrderFileCode(code: string | null | undefined): boolean {
+  if (!code) return false;
+  const lower = code.toLowerCase();
+  return lower === LEGACY_DELIVERY_ORDER_CODE || lower.startsWith(DELIVERY_ORDER_FILE_PREFIX);
+}
+
+export function deliveryOrderFileLabel(code: string, index?: number): string {
+  const lower = code.toLowerCase();
+  if (lower === LEGACY_DELIVERY_ORDER_CODE) return "Delivery Order";
+  if (lower.startsWith(DELIVERY_ORDER_FILE_PREFIX)) {
+    return index != null ? `Delivery Order ${index + 1}` : "Delivery Order";
+  }
+  return code;
+}
+
+/** Legacy single Release Order code (pre multi-file uploads). */
+export const LEGACY_RELEASE_ORDER_CODE = "release_order";
+
+/** Multi-file Release Order uploads use `release_order_0`, `release_order_1`, … */
+export const RELEASE_ORDER_FILE_PREFIX = "release_order_";
+
+export function isReleaseOrderFileCode(code: string | null | undefined): boolean {
+  if (!code) return false;
+  const lower = code.toLowerCase();
+  return lower === LEGACY_RELEASE_ORDER_CODE || lower.startsWith(RELEASE_ORDER_FILE_PREFIX);
+}
+
+export function releaseOrderFileLabel(code: string, index?: number): string {
+  const lower = code.toLowerCase();
+  if (lower === LEGACY_RELEASE_ORDER_CODE) return "Release Order";
+  if (lower.startsWith(RELEASE_ORDER_FILE_PREFIX)) {
+    return index != null ? `Release Order ${index + 1}` : "Release Order";
+  }
+  return code;
+}
+
 /** Legacy single T1 code (GL post-booking uploader). */
 export const LEGACY_T1_TRANSPORT_CODE = "t1_transport_document";
 
diff --git a/packages/types/src/freight/etrade.ts b/packages/types/src/freight/etrade.ts
index 6f33567e4..c23492413 100644
--- a/packages/types/src/freight/etrade.ts
+++ b/packages/types/src/freight/etrade.ts
@@ -55,7 +55,8 @@ export interface ETradeCompanyInfo {
     RenewedFrom: string;
     RenewedTo: string;
     BusinessLicensingGroupMain: string | null;
-    SubGroups: Array<{ Code: number; Description: string }> | null;
+    /** eTrade returns null entries in this array as well as a null array. */
+    SubGroups: Array<{ Code: number; Description: string | null } | null> | null;
   }>;
 }
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 68573264b..1538a044a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -99,9 +99,6 @@ importers:
       '@tria-plc/api-common':
         specifier: file:../../local-packages/tria-plc-api-common-1.6.0.tgz
         version: file:local-packages/tria-plc-api-common-1.6.0.tgz(ae9a56cc1c6d93629dd85f7605ccd5b6)
-      '@tria-plc/auditlog':
-        specifier: file:../../local-packages/tria-plc-auditlog-1.1.2.tgz
-        version: file:local-packages/tria-plc-auditlog-1.1.2.tgz(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(@nestjs/microservices@11.1.24)(@nestjs/swagger@11.4.4(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2))(@nestjs/typeorm@11.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3))))(rxjs@7.8.2)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3)))
       '@tria-plc/iamapi-common':
         specifier: file:../../local-packages/tria-plc-iamapi-common-1.0.0.tgz
         version: file:local-packages/tria-plc-iamapi-common-1.0.0.tgz(d0be280d95adfc1b38e59bdc80c5dec5)
@@ -240,16 +237,16 @@ importers:
         version: 18.0.1(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       '@hookform/resolvers':
         specifier: ^5.4.0
-        version: 5.4.0(react-hook-form@7.77.0(react@19.2.6))
+        version: 5.6.0(@sinclair/typebox@0.27.10)(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(class-transformer@0.5.1)(class-validator@0.14.4)(effect@3.21.0)(react-hook-form@7.77.0(react@19.2.6))(zod@3.25.76)
       '@mantine/core':
         specifier: ^9.3.0
-        version: 9.3.0(@mantine/hooks@9.3.0(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 9.3.2(@mantine/hooks@9.3.2(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       '@mantine/dates':
         specifier: ^9.3.0
-        version: 9.3.2(@mantine/core@9.3.0(@mantine/hooks@9.3.0(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@mantine/hooks@9.3.0(react@19.2.6))(dayjs@1.11.21)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 9.3.2(@mantine/core@9.3.2(@mantine/hooks@9.3.2(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@mantine/hooks@9.3.2(react@19.2.6))(dayjs@1.11.21)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       '@mantine/hooks':
         specifier: ^9.3.0
-        version: 9.3.0(react@19.2.6)
+        version: 9.3.2(react@19.2.6)
       '@mdxeditor/editor':
         specifier: ^4.2.0
         version: 4.2.0(@codemirror/language@6.12.4)(@lezer/highlight@1.2.3)(@types/react-dom@18.3.7(@types/react@18.3.31))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@5.9.3)(yjs@13.6.32)
@@ -357,7 +354,7 @@ importers:
         version: 6.3.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(tinymce@8.6.0)
       '@tria-plc/iamui':
         specifier: file:../../../local-packages/tria-plc-iamui-0.1.1.tgz
-        version: file:local-packages/tria-plc-iamui-0.1.1.tgz(0ce39b7e349029277dcd938d06eeb0f7)
+        version: file:local-packages/tria-plc-iamui-0.1.1.tgz(e4483b467c1e4b1b4b359f6670e164a6)
       '@types/three':
         specifier: ^0.185.3
         version: 0.185.3
@@ -589,13 +586,13 @@ importers:
         version: 5.6.0(@sinclair/typebox@0.27.10)(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(class-transformer@0.5.1)(class-validator@0.14.4)(effect@3.21.0)(react-hook-form@7.77.0(react@19.2.6))(zod@4.4.3)
       '@mantine/core':
         specifier: ^9.3.0
-        version: 9.3.0(@mantine/hooks@9.3.0(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 9.3.2(@mantine/hooks@9.3.2(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       '@mantine/dates':
         specifier: ^9.3.0
-        version: 9.3.2(@mantine/core@9.3.0(@mantine/hooks@9.3.0(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@mantine/hooks@9.3.0(react@19.2.6))(dayjs@1.11.21)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 9.3.2(@mantine/core@9.3.2(@mantine/hooks@9.3.2(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@mantine/hooks@9.3.2(react@19.2.6))(dayjs@1.11.21)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
       '@mantine/hooks':
         specifier: ^9.3.0
-        version: 9.3.0(react@19.2.6)
+        version: 9.3.2(react@19.2.6)
       '@posthog/react':
         specifier: ^1.10.3
         version: 1.10.3(@types/react@18.3.31)(posthog-js@1.400.1)(react@19.2.6)
@@ -604,7 +601,7 @@ importers:
         version: 5.101.0(react@19.2.6)
       '@tria-plc/iamui':
         specifier: file:../../../local-packages/tria-plc-iamui-0.1.1.tgz
-        version: file:local-packages/tria-plc-iamui-0.1.1.tgz(a5d0bdee55164ae56064fb273b530e00)
+        version: file:local-packages/tria-plc-iamui-0.1.1.tgz(ea394f4c73a62db876565d0b255299aa)
       '@vis.gl/react-google-maps':
         specifier: ^1.8.3
         version: 1.8.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
@@ -983,6 +980,12 @@ importers:
       date-fns:
         specifier: ^3.0.0
         version: 3.6.0
+      exceljs:
+        specifier: ^4.4.0
+        version: 4.4.0
+      html-to-image:
+        specifier: ^1.11.11
+        version: 1.11.13
       lucide-react:
         specifier: ^0.446.0
         version: 0.446.0(react@18.3.1)
@@ -1439,7 +1442,7 @@ importers:
         version: link:../types
       '@mantine/core':
         specifier: ^9.3.0
-        version: 9.3.0(@mantine/hooks@9.3.0(react@18.3.1))(@types/react@18.3.31)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        version: 9.3.2(@mantine/hooks@9.3.2(react@18.3.1))(@types/react@18.3.31)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       '@tanstack/react-table':
         specifier: ^8.21.3
         version: 8.21.3(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
@@ -2279,11 +2282,6 @@ packages:
     peerDependencies:
       react-hook-form: ^7.0.0
 
-  '@hookform/resolvers@5.4.0':
-    resolution: {integrity: sha512-EIsqr/t/qbinPIhGjMdtvutIN1Kk4uwbROE9/UQ93CAVGR7GkA7Y92+fX80OzXi/OB67jVFYwKGO1WzkxmkFZw==}
-    peerDependencies:
-      react-hook-form: ^7.55.0
-
   '@hookform/resolvers@5.6.0':
     resolution: {integrity: sha512-qtgE4NUK/WQFPq8aDe+GOhr0/UiUSKT0m9ta9SMnDS5ZE63yC850ShAGz1lxtwO+dBjhUKvUxmHwkp4eN7/kBQ==}
     peerDependencies:
@@ -2921,13 +2919,6 @@ packages:
       react: ^18.x || ^19.x
       react-dom: ^18.x || ^19.x
 
-  '@mantine/core@9.3.0':
-    resolution: {integrity: sha512-mHVCm61YVW9ipy9eHiKMqsRUm3TkOErbdw7zHs0HRw5g403nf7tSTqNGvaYE+aX1Py874qMkrUzeQfj4bjiiBA==}
-    peerDependencies:
-      '@mantine/hooks': 9.3.0
-      react: ^19.2.0
-      react-dom: ^19.2.0
-
   '@mantine/core@9.3.2':
     resolution: {integrity: sha512-Upy/Z9Sj2eW2dGrFgUy/2kISVsxMTBYTDfP2TFdsIA3PdPSBkdqfSOPX/ug3d3F3a4bnwQSqcO6+aPEpBIh8dg==}
     peerDependencies:
@@ -2958,11 +2949,6 @@ packages:
     peerDependencies:
       react: ^18.x || ^19.x
 
-  '@mantine/hooks@9.3.0':
-    resolution: {integrity: sha512-QoSr9WI4WsKWrM3qFYYizHUn3+n+CVcFMYe4sdlnmFPStvs6BacPODKJSbFlYl73Z20t82JIy0eKqt4noHQI2g==}
-    peerDependencies:
-      react: ^19.2.0
-
   '@mantine/hooks@9.3.2':
     resolution: {integrity: sha512-jOjpUe0x1A/k3XUiu2/aaSCasXRI5ZKZOucm3ypwsvm9F2u8C1xzwBvagrzlbNZwJRF5vNYIJtCaT7NunPyc0A==}
     peerDependencies:
@@ -5023,19 +5009,6 @@ packages:
       rxjs: ^7.8.0
       typeorm: ^0.3.0
 
-  '@tria-plc/auditlog@file:local-packages/tria-plc-auditlog-1.1.2.tgz':
-    resolution: {integrity: sha512-3kRaAtETvM9wVRSbwd2jyrts9DCcSV9yFUDoEpxJfVQDsIGY2d9K0c+h1LAjfNNaogZ8eeBcroyCrnWjwBmkYA==, tarball: file:local-packages/tria-plc-auditlog-1.1.2.tgz}
-    version: 1.1.2
-    engines: {node: '>=18'}
-    peerDependencies:
-      '@nestjs/common': ^10.0.0 || ^11.0.0
-      '@nestjs/core': ^10.0.0 || ^11.0.0
-      '@nestjs/microservices': ^10.0.0 || ^11.0.0
-      '@nestjs/swagger': ^10.0.0 || ^11.0.0
-      '@nestjs/typeorm': ^10.0.0 || ^11.0.0
-      rxjs: ^7.0.0
-      typeorm: ^0.3.0
-
   '@tria-plc/iamapi-common@file:local-packages/tria-plc-iamapi-common-1.0.0.tgz':
     resolution: {integrity: sha512-rfHSXOm/0VUMTj7HrvYysrEAqxItqfPs4Rd35qWJyaAk+snF1wTKFRVz6cRGPoQNj8fhplkVAefnvuKBuHT+xQ==, tarball: file:local-packages/tria-plc-iamapi-common-1.0.0.tgz}
     version: 1.0.0
@@ -5240,9 +5213,6 @@ packages:
   '@types/jquery@3.5.34':
     resolution: {integrity: sha512-3m3939S3erqmTLJANS/uy0B6V7BorKx7RorcGZVjZ62dF5PAGbKEDZK1CuLtKombJkFA2T1jl8LAIIs7IV6gBQ==}
 
-  '@types/jquery@4.0.1':
-    resolution: {integrity: sha512-9a59A/tycXgYuPABcp6/3spSShn0NT2UOM4EfHvMumjYi4lJWTsK5SZWjhx3yRm9IHGCeWXdV2YfNsrWrft/CA==}
-
   '@types/js-cookie@3.0.6':
     resolution: {integrity: sha512-wkw9yd1kEXOPnvEeEV1Go1MmxtBJL0RR79aOTAApecWFVu7w0NNXNqhcWgvw2YgZDYadliXkl14pa3WXw5jlCQ==}
 
@@ -8338,6 +8308,9 @@ packages:
     resolution: {integrity: sha512-XxzooSo6oBoxBEUazgjdXj7VwTn/iSTSZzTYKzYY6I916tkaYzypHxy+pbVU1h+0UQ9JlVf5XkNQyxOAiiQO1g==}
     engines: {node: '>=0.10.0'}
 
+  html-to-image@1.11.13:
+    resolution: {integrity: sha512-cuOPoI7WApyhBElTTb9oqsawRvZ0rHhaHwghRLlTuffoD1B2aDemlCruLeZrUIIdvG7gs9xeELEPm6PhuASqrg==}
+
   html-url-attributes@3.0.1:
     resolution: {integrity: sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==}
 
@@ -9084,10 +9057,6 @@ packages:
     resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
     hasBin: true
 
-  js-yaml@4.2.0:
-    resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
-    hasBin: true
-
   js-yaml@4.3.0:
     resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
     hasBin: true
@@ -13976,7 +13945,7 @@ snapshots:
       globals: 13.24.0
       ignore: 5.3.2
       import-fresh: 3.3.1
-      js-yaml: 4.2.0
+      js-yaml: 4.3.0
       minimatch: 3.1.5
       strip-json-comments: 3.1.1
     transitivePeerDependencies:
@@ -14109,10 +14078,19 @@ snapshots:
     dependencies:
       react-hook-form: 7.77.0(react@18.3.1)
 
-  '@hookform/resolvers@5.4.0(react-hook-form@7.77.0(react@19.2.6))':
+  '@hookform/resolvers@5.6.0(@sinclair/typebox@0.27.10)(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(class-transformer@0.5.1)(class-validator@0.14.4)(effect@3.21.0)(react-hook-form@7.77.0(react@19.2.6))(zod@3.25.76)':
     dependencies:
       '@standard-schema/utils': 0.3.0
       react-hook-form: 7.77.0(react@19.2.6)
+    optionalDependencies:
+      '@sinclair/typebox': 0.27.10
+      '@standard-schema/spec': 1.1.0
+      ajv: 8.20.0
+      ajv-formats: 2.1.1(ajv@8.20.0)
+      class-transformer: 0.5.1
+      class-validator: 0.14.4
+      effect: 3.21.0
+      zod: 3.25.76
 
   '@hookform/resolvers@5.6.0(@sinclair/typebox@0.27.10)(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(class-transformer@0.5.1)(class-validator@0.14.4)(effect@3.21.0)(react-hook-form@7.77.0(react@19.2.6))(zod@4.4.3)':
     dependencies:
@@ -14895,10 +14873,10 @@ snapshots:
     transitivePeerDependencies:
       - '@types/react'
 
-  '@mantine/core@9.3.0(@mantine/hooks@9.3.0(react@18.3.1))(@types/react@18.3.31)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+  '@mantine/core@9.3.2(@mantine/hooks@9.3.2(react@18.3.1))(@types/react@18.3.31)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
     dependencies:
       '@floating-ui/react': 0.27.19(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-      '@mantine/hooks': 9.3.0(react@18.3.1)
+      '@mantine/hooks': 9.3.2(react@18.3.1)
       clsx: 2.1.1
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
@@ -14908,19 +14886,6 @@ snapshots:
     transitivePeerDependencies:
       - '@types/react'
 
-  '@mantine/core@9.3.0(@mantine/hooks@9.3.0(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
-    dependencies:
-      '@floating-ui/react': 0.27.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@mantine/hooks': 9.3.0(react@19.2.6)
-      clsx: 2.1.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      react-number-format: 5.4.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react-remove-scroll: 2.7.2(@types/react@18.3.31)(react@19.2.6)
-      type-fest: 5.7.0
-    transitivePeerDependencies:
-      - '@types/react'
-
   '@mantine/core@9.3.2(@mantine/hooks@9.3.2(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
       '@floating-ui/react': 0.27.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
@@ -14943,15 +14908,6 @@ snapshots:
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
 
-  '@mantine/dates@9.3.2(@mantine/core@9.3.0(@mantine/hooks@9.3.0(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@mantine/hooks@9.3.0(react@19.2.6))(dayjs@1.11.21)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
-    dependencies:
-      '@mantine/core': 9.3.0(@mantine/hooks@9.3.0(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@mantine/hooks': 9.3.0(react@19.2.6)
-      clsx: 2.1.1
-      dayjs: 1.11.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-
   '@mantine/dates@9.3.2(@mantine/core@9.3.2(@mantine/hooks@9.3.2(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@mantine/hooks@9.3.2(react@19.2.6))(dayjs@1.11.21)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
     dependencies:
       '@mantine/core': 9.3.2(@mantine/hooks@9.3.2(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
@@ -14965,14 +14921,10 @@ snapshots:
     dependencies:
       react: 19.2.6
 
-  '@mantine/hooks@9.3.0(react@18.3.1)':
+  '@mantine/hooks@9.3.2(react@18.3.1)':
     dependencies:
       react: 18.3.1
 
-  '@mantine/hooks@9.3.0(react@19.2.6)':
-    dependencies:
-      react: 19.2.6
-
   '@mantine/hooks@9.3.2(react@19.2.6)':
     dependencies:
       react: 19.2.6
@@ -17899,18 +17851,6 @@ snapshots:
       - debug
       - supports-color
 
-  '@tria-plc/auditlog@file:local-packages/tria-plc-auditlog-1.1.2.tgz(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(@nestjs/microservices@11.1.24)(@nestjs/swagger@11.4.4(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2))(@nestjs/typeorm@11.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3))))(rxjs@7.8.2)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3)))':
-    dependencies:
-      '@nestjs/common': 11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2)
-      '@nestjs/core': 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/microservices@11.1.24)(@nestjs/platform-express@11.1.24)(@nestjs/websockets@11.1.27)(reflect-metadata@0.2.2)(rxjs@7.8.2)
-      '@nestjs/microservices': 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(@nestjs/websockets@11.1.27)(amqp-connection-manager@5.0.0(amqplib@2.0.1))(amqplib@2.0.1)(reflect-metadata@0.2.2)(rxjs@7.8.2)
-      '@nestjs/swagger': 11.4.4(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)
-      '@nestjs/typeorm': 11.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3)))
-      amqp-connection-manager: 5.0.0(amqplib@0.10.9)
-      amqplib: 0.10.9
-      rxjs: 7.8.2
-      typeorm: 0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3))
-
   '@tria-plc/iamapi-common@file:local-packages/tria-plc-iamapi-common-1.0.0.tgz(cc085a020c559b355f168432c579a024)':
     dependencies:
       '@nestjs/axios': 4.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(axios@1.17.0)(rxjs@7.8.2)
@@ -17979,11 +17919,11 @@ snapshots:
       - '@faker-js/faker'
       - supports-color
 
-  '@tria-plc/iamui@file:local-packages/tria-plc-iamui-0.1.1.tgz(0ce39b7e349029277dcd938d06eeb0f7)':
+  '@tria-plc/iamui@file:local-packages/tria-plc-iamui-0.1.1.tgz(e4483b467c1e4b1b4b359f6670e164a6)':
     dependencies:
       '@emotion/react': 11.14.0(@types/react@18.3.31)(react@19.2.6)
       '@emotion/styled': 11.14.1(@emotion/react@11.14.0(@types/react@18.3.31)(react@19.2.6))(@types/react@18.3.31)(react@19.2.6)
-      '@hookform/resolvers': 5.4.0(react-hook-form@7.77.0(react@19.2.6))
+      '@hookform/resolvers': 5.6.0(@sinclair/typebox@0.27.10)(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(class-transformer@0.5.1)(class-validator@0.14.4)(effect@3.21.0)(react-hook-form@7.77.0(react@19.2.6))(zod@3.25.76)
       '@lottiefiles/react-lottie-player': 3.6.0(react@19.2.6)
       '@mantine/charts': 7.17.8(@mantine/core@7.17.8(@mantine/hooks@7.17.8(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@mantine/hooks@7.17.8(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(recharts@3.8.1(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react-is@19.2.7)(react@19.2.6)(redux@5.0.1))
       '@mantine/core': 7.17.8(@mantine/hooks@7.17.8(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
@@ -18086,11 +18026,29 @@ snapshots:
       - '@mui/icons-material'
       - '@mui/material'
       - '@mui/x-date-pickers'
+      - '@sinclair/typebox'
+      - '@standard-schema/spec'
       - '@types/prop-types'
       - '@types/react'
       - '@types/react-dom'
+      - '@typeschema/main'
+      - '@vinejs/vine'
+      - ajv
+      - ajv-errors
+      - ajv-formats
+      - arktype
+      - ata-validator
       - bufferutil
+      - class-transformer
+      - class-validator
+      - computed-types
       - debug
+      - effect
+      - fluentvalidation-ts
+      - fp-ts
+      - io-ts
+      - joi
+      - nope-validator
       - pdfjs-dist
       - prop-types
       - react-is
@@ -18098,16 +18056,21 @@ snapshots:
       - redux
       - rolldown
       - rollup
+      - superstruct
       - supports-color
+      - typanion
       - typescript
       - utf-8-validate
+      - valibot
+      - vest
       - vite
+      - yup
 
-  '@tria-plc/iamui@file:local-packages/tria-plc-iamui-0.1.1.tgz(a5d0bdee55164ae56064fb273b530e00)':
+  '@tria-plc/iamui@file:local-packages/tria-plc-iamui-0.1.1.tgz(ea394f4c73a62db876565d0b255299aa)':
     dependencies:
       '@emotion/react': 11.14.0(@types/react@18.3.31)(react@19.2.6)
       '@emotion/styled': 11.14.1(@emotion/react@11.14.0(@types/react@18.3.31)(react@19.2.6))(@types/react@18.3.31)(react@19.2.6)
-      '@hookform/resolvers': 5.4.0(react-hook-form@7.77.0(react@19.2.6))
+      '@hookform/resolvers': 5.6.0(@sinclair/typebox@0.27.10)(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(class-transformer@0.5.1)(class-validator@0.14.4)(effect@3.21.0)(react-hook-form@7.77.0(react@19.2.6))(zod@3.25.76)
       '@lottiefiles/react-lottie-player': 3.6.0(react@19.2.6)
       '@mantine/charts': 7.17.8(@mantine/core@7.17.8(@mantine/hooks@7.17.8(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@mantine/hooks@7.17.8(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(recharts@3.8.1(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react-is@19.2.7)(react@19.2.6)(redux@5.0.1))
       '@mantine/core': 7.17.8(@mantine/hooks@7.17.8(react@19.2.6))(@types/react@18.3.31)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
@@ -18210,11 +18173,29 @@ snapshots:
       - '@mui/icons-material'
       - '@mui/material'
       - '@mui/x-date-pickers'
+      - '@sinclair/typebox'
+      - '@standard-schema/spec'
       - '@types/prop-types'
       - '@types/react'
       - '@types/react-dom'
+      - '@typeschema/main'
+      - '@vinejs/vine'
+      - ajv
+      - ajv-errors
+      - ajv-formats
+      - arktype
+      - ata-validator
       - bufferutil
+      - class-transformer
+      - class-validator
+      - computed-types
       - debug
+      - effect
+      - fluentvalidation-ts
+      - fp-ts
+      - io-ts
+      - joi
+      - nope-validator
       - pdfjs-dist
       - prop-types
       - react-is
@@ -18222,10 +18203,15 @@ snapshots:
       - redux
       - rolldown
       - rollup
+      - superstruct
       - supports-color
+      - typanion
       - typescript
       - utf-8-validate
+      - valibot
+      - vest
       - vite
+      - yup
 
   '@ts-morph/common@0.27.0':
     dependencies:
@@ -18425,8 +18411,6 @@ snapshots:
     dependencies:
       '@types/sizzle': 2.3.10
 
-  '@types/jquery@4.0.1': {}
-
   '@types/js-cookie@3.0.6': {}
 
   '@types/json-schema@7.0.15': {}
@@ -18565,7 +18549,7 @@ snapshots:
 
   '@types/tinymce@4.6.9':
     dependencies:
-      '@types/jquery': 4.0.1
+      '@types/jquery': 3.5.34
 
   '@types/tmp@0.2.6': {}
 
@@ -19010,11 +18994,6 @@ snapshots:
       amqplib: 0.10.9
       promise-breaker: 6.0.0
 
-  amqp-connection-manager@5.0.0(amqplib@0.10.9):
-    dependencies:
-      amqplib: 0.10.9
-      promise-breaker: 6.0.0
-
   amqp-connection-manager@5.0.0(amqplib@2.0.1):
     dependencies:
       amqplib: 2.0.1
@@ -20176,7 +20155,7 @@ snapshots:
   cosmiconfig@8.3.6(typescript@5.9.3):
     dependencies:
       import-fresh: 3.3.1
-      js-yaml: 4.2.0
+      js-yaml: 4.3.0
       parse-json: 5.2.0
       path-type: 4.0.0
     optionalDependencies:
@@ -20186,7 +20165,7 @@ snapshots:
     dependencies:
       env-paths: 2.2.1
       import-fresh: 3.3.1
-      js-yaml: 4.2.0
+      js-yaml: 4.3.0
       parse-json: 5.2.0
     optionalDependencies:
       typescript: 5.9.3
@@ -20909,7 +20888,7 @@ snapshots:
       '@typescript-eslint/parser': 8.60.1(eslint@8.57.1)(typescript@5.9.3)
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.1(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1)
+      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1)
       eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.1(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
       eslint-plugin-jsx-a11y: 6.10.2(eslint@8.57.1)
       eslint-plugin-react: 7.37.5(eslint@8.57.1)
@@ -20933,7 +20912,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.1(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1):
+  eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1):
     dependencies:
       '@nolyfill/is-core-module': 1.0.39
       debug: 4.4.3(supports-color@8.1.1)
@@ -20948,14 +20927,14 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.13.0(@typescript-eslint/parser@8.60.1(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.1(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1))(eslint@8.57.1):
+  eslint-module-utils@2.13.0(@typescript-eslint/parser@8.60.1(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1):
     dependencies:
       debug: 3.2.7(supports-color@8.1.1)
     optionalDependencies:
       '@typescript-eslint/parser': 8.60.1(eslint@8.57.1)(typescript@5.9.3)
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.1(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1)
+      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1)
     transitivePeerDependencies:
       - supports-color
 
@@ -20970,7 +20949,7 @@ snapshots:
       doctrine: 2.1.0
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.10
-      eslint-module-utils: 2.13.0(@typescript-eslint/parser@8.60.1(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.1(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1))(eslint@8.57.1)
+      eslint-module-utils: 2.13.0(@typescript-eslint/parser@8.60.1(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
       hasown: 2.0.4
       is-core-module: 2.16.2
       is-glob: 4.0.3
@@ -21082,7 +21061,7 @@ snapshots:
       imurmurhash: 0.1.4
       is-glob: 4.0.3
       is-path-inside: 3.0.3
-      js-yaml: 4.2.0
+      js-yaml: 4.3.0
       json-stable-stringify-without-jsonify: 1.0.1
       levn: 0.4.1
       lodash.merge: 4.6.2
@@ -22046,6 +22025,8 @@ snapshots:
       is-self-closing: 1.0.1
       kind-of: 6.0.3
 
+  html-to-image@1.11.13: {}
+
   html-url-attributes@3.0.1: {}
 
   html2canvas@1.4.1:
@@ -22915,10 +22896,6 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
-  js-yaml@4.2.0:
-    dependencies:
-      argparse: 2.0.1
-
   js-yaml@4.3.0:
     dependencies:
       argparse: 2.0.1