price adjustment and stock adjustments

serial numbers
ui bug fixers
2026-10-12 15:02:59 +05:30 · 2026-10-12 14:57:15 +05:30 · 2026-10-12 14:56:12 +05:30 · 2026-10-12 14:36:01 +05:30 · 2026-10-07 08:19:03 +00:00 · 2026-10-07 13:17:52 +05:30
726 changed files with 159235 additions and 169374 deletions
@@ -0,0 +1,106 @@
+name: CI/CD - ERP Core Monorepo
+
+on:
+  pull_request:
+    branches:
+      - production
+    types:
+      - closed
+
+jobs:
+  build-and-deploy-backend:
+    name: Build & Deploy Backend
+    runs-on: linux
+    if: github.event.pull_request.merged == true
+    steps:
+      - name: Checkout code
+        run: |
+          git clone \
+            --depth 1 \
+            --branch production \
+            https://oauth2:${{ secrets.ERPCORE }}@gitea.hexdive.com/New_REP_SYSTEM/ERP-core.git \
+            .
+      - name: Restore
+        run: dotnet restore Backend/ERPCore.sln
+      - name: Publish
+        run: |
+          rm -rf /tmp/erpcore-deploy
+          mkdir -p /tmp/erpcore-deploy
+          dotnet publish Backend/ERPCore/ERPCore.csproj \
+            -c Release \
+            -r linux-x64 \
+            --self-contained true \
+            -o /tmp/erpcore-deploy
+      - name: Stop service
+        run: systemctl stop erpcore.service
+      - name: Copy to deploy folder
+        run: |
+          mkdir -p /home/erp/core/publish
+          rm -rf /home/erp/core/publish/*
+          cp -r /tmp/erpcore-deploy/* /home/erp/core/publish/
+      - name: Fix ownership and permissions
+        run: |
+          chown -R erpuser:erpuser /home/erp/core/publish
+          find /home/erp/core/publish -type d -exec chmod 755 {} +
+          find /home/erp/core/publish -type f -exec chmod 644 {} +
+          chmod +x /home/erp/core/publish/ERPCore
+      - name: Restart service
+        # ConnectionStrings__DefaultConnection is supplied by the systemd unit on the host
+        # (Environment= or EnvironmentFile=), deliberately not committed: appsettings.json ships
+        # the key empty and appsettings.Production.json carries no ConnectionStrings section at
+        # all. If the unit does not set it, startup throws before serving and the Verify step
+        # below fails the job.
+        run: systemctl restart erpcore.service
+      - name: Verify
+        run: |
+          # `is-active ... || echo` always exited 0, so a crashed service still reported success.
+          # Wait a few seconds first: a startup failure (bad or missing connection string) happens
+          # during MigrateAsync, after systemctl restart has already returned.
+          sleep 5
+          if ! systemctl is-active --quiet erpcore.service; then
+            echo "❌ erpcore.service is not running:"
+            journalctl -u erpcore.service -n 50 --no-pager
+            exit 1
+          fi
+          echo "✅ Service running"
+
+  build-and-deploy-frontend:
+    name: Build & Deploy Frontend
+    runs-on: linux
+    if: github.event.pull_request.merged == true
+    steps:
+      - name: Checkout code
+        run: |
+          git clone \
+            --depth 1 \
+            --branch production \
+            https://oauth2:${{ secrets.ERPCORE }}@gitea.hexdive.com/New_REP_SYSTEM/ERP-core.git \
+            .
+      - name: Build Docker image
+        run: |
+          docker build --progress=plain --no-cache \
+            -t erpcore-frontend:latest \
+            ./Frontend/erp-system
+      - name: Stop & remove existing container
+        run: |
+          docker stop erpcore-frontend 2>/dev/null || true
+          docker rm erpcore-frontend 2>/dev/null || true
+      - name: Start container
+        run: |
+          docker run -d \
+            --name erpcore-frontend \
+            -p 6702:6702 \
+            --add-host=host.docker.internal:host-gateway \
+            -e BACKEND_ORIGIN=http://host.docker.internal:6701 \
+            --restart unless-stopped \
+            --memory="512m" \
+            --cpus="1.0" \
+            --cap-drop ALL \
+            --security-opt no-new-privileges \
+            erpcore-frontend:latest
+      - name: Remove old images
+        run: docker image prune -f
+      - name: Verify
+        run: |
+          docker ps --filter name=erpcore-frontend --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}" \
+            | grep erpcore-frontend && echo "✅ Container running" || echo "❌ Container failed"
@@ -0,0 +1,211 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Accounts;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using Microsoft.EntityFrameworkCore;
+using static ERPCore.Tests.TestSupport.BankDepositTestSupport;
+
+namespace ERPCore.Tests;
+
+/// <summary>Recording and cancelling bank deposits (docs/BANK_DEPOSIT_MODULE_PLAN.md §7.2, §11).</summary>
+public class BankDepositServiceTests
+{
+    private static readonly DateOnly Today = Clock.Today;
+    private static readonly DateOnly Start = Today.AddDays(-10);
+    private static readonly DateOnly Day = Today.AddDays(-2);
+
+    [Fact]
+    public async Task Create_PostsBankDebitCashCredit_AndLowersCashInHand()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000));
+        await db.SaveChangesAsync();
+        var gl = new FakeGeneralLedger();
+
+        var dto = await DepositService(db, Start, gl).CreateAsync(Request(600, depositDate: Day.AddDays(1)));
+
+        Assert.Equal(BankDepositStatus.Posted, dto.Status);
+        Assert.Equal(("BOC Current", "Bank of Ceylon", "0001234567"), (dto.ToBankAccountName, dto.ToBankName, dto.ToAccountNumber));
+        Assert.Equal("JE-1", dto.GlJournalNo);
+
+        var entry = Assert.Single(gl.Posted);
+        Assert.Equal(Day.AddDays(1), entry.EntryDate);
+        Assert.Equal("BANK_DEPOSIT", entry.SourceModule);
+        Assert.Collection(entry.Lines,
+            l => Assert.Equal(("1010-01", 600m, 0m), (l.AccountCode, l.DebitAmount, l.CreditAmount)),
+            l => Assert.Equal(("1000-01", 0m, 600m), (l.AccountCode, l.DebitAmount, l.CreditAmount)));
+
+        var position = await CashService(db, Start).GetPositionAsync(Day, Branch1);
+        Assert.Equal((600m, 400m), (position.Position.Deposited, position.Position.Closing));
+    }
+
+    [Fact]
+    public async Task Create_MoreThanCashInHand_IsRejected()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000, card: 5000));
+        await db.SaveChangesAsync();
+        var gl = new FakeGeneralLedger();
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => DepositService(db, Start, gl).CreateAsync(Request(1000.01m)));
+
+        Assert.Equal(ErrorCodes.BankDepositExceedsCashInHand, ex.Code);
+        Assert.Empty(gl.Posted);
+    }
+
+    [Fact]
+    public async Task Create_BackDatedDepositThatOverdrawsALaterDay_IsRejected()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000));
+        db.BankDeposits.Add(Deposit(Day.AddDays(1), 900));     // the next day already banked most of it
+        await db.SaveChangesAsync();
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            DepositService(db, Start, new FakeGeneralLedger()).CreateAsync(Request(500)));
+
+        Assert.Equal(ErrorCodes.BankDepositExceedsCashInHand, ex.Code);
+        Assert.Contains("100.00", ex.Message);
+    }
+
+    [Fact]
+    public async Task Cancel_ReversesGl_AndPutsTheCashBack()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000));
+        await db.SaveChangesAsync();
+        var gl = new FakeGeneralLedger();
+        var service = DepositService(db, Start, gl);
+        var created = await service.CreateAsync(Request(1000));
+
+        var cancelled = await service.CancelAsync(created.BankDepositId, new CancelBankDepositRequest { Reason = " wrong bank " });
+
+        Assert.Equal(BankDepositStatus.Cancelled, cancelled.Status);
+        Assert.Equal("wrong bank", cancelled.CancelReason);
+        Assert.Equal("JE-2", cancelled.GlReversalJournalNo);
+        Assert.Collection(gl.Posted[1].Lines,
+            l => Assert.Equal(("1000-01", 1000m, 0m), (l.AccountCode, l.DebitAmount, l.CreditAmount)),
+            l => Assert.Equal(("1010-01", 0m, 1000m), (l.AccountCode, l.DebitAmount, l.CreditAmount)));
+        Assert.Equal(1000m, (await CashService(db, Start).GetPositionAsync(Day, Branch1)).Position.Closing);
+
+        var again = await Assert.ThrowsAsync<DomainException>(() =>
+            service.CancelAsync(created.BankDepositId, new CancelBankDepositRequest { Reason = "again" }));
+        Assert.Equal(ErrorCodes.BankDepositNotCancellable, again.Code);
+    }
+
+    [Theory]
+    [InlineData(FakeGeneralLedger.BankAccountId, FakeGeneralLedger.BankAccountId, ErrorCodes.BankDepositCashAccountInvalid)]
+    [InlineData(FakeGeneralLedger.CashAccountId, FakeGeneralLedger.CashAccountId, ErrorCodes.BankDepositBankAccountInvalid)]
+    [InlineData(99L, FakeGeneralLedger.BankAccountId, ErrorCodes.BankDepositCashAccountInvalid)]
+    public async Task Create_WrongAccountTypes_AreRejected(long from, long to, string code)
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000));
+        await db.SaveChangesAsync();
+
+        var request = Request(100);
+        request.FromGlCashAccountId = from;
+        request.ToGlBankAccountId = to;
+        var ex = await Assert.ThrowsAsync<DomainException>(() => DepositService(db, Start, new FakeGeneralLedger()).CreateAsync(request));
+
+        Assert.Equal(code, ex.Code);
+    }
+
+    [Fact]
+    public async Task Create_CashAndBankAccountsSharingAnId_AreToldApartByType()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000));
+        await db.SaveChangesAsync();
+        // GL numbers cash and bank accounts in separate tables, so both can be account 1.
+        var gl = new FakeGeneralLedger
+        {
+            Accounts =
+            [
+                new("Cash", 1, "main", null, "Cash in Transit", "CASH-000001", 22, "1400-01-01", "LKR"),
+                new("Bank", 1, "Main - 01", "Commercial Bank", null, "2032434543", 2, "1000-01", "LKR")
+            ]
+        };
+        var request = Request(400);
+        request.FromGlCashAccountId = 1;
+        request.ToGlBankAccountId = 1;
+
+        var dto = await DepositService(db, Start, gl).CreateAsync(request);
+
+        Assert.Equal(("main", "Main - 01"), (dto.FromCashAccountName, dto.ToBankAccountName));
+        Assert.Collection(Assert.Single(gl.Posted).Lines,
+            l => Assert.Equal(("1000-01", 400m), (l.AccountCode, l.DebitAmount)),
+            l => Assert.Equal(("1400-01-01", 400m), (l.AccountCode, l.CreditAmount)));
+    }
+
+    [Fact]
+    public async Task Create_CannotUseAnotherBranchsCash()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000, warehouseId: Warehouse2));
+        await db.SaveChangesAsync();
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            DepositService(db, Start, new FakeGeneralLedger()).CreateAsync(Request(100, branchId: Branch1)));
+
+        Assert.Equal(ErrorCodes.BankDepositExceedsCashInHand, ex.Code);
+    }
+
+    [Theory]
+    [InlineData(-11, null)]   // before tracking starts
+    [InlineData(1, null)]     // business date in the future
+    [InlineData(-2, -3)]      // deposited before the business day
+    [InlineData(-2, 2)]       // deposit date beyond tomorrow
+    public async Task Create_InvalidDates_AreRejected(int businessOffset, int? depositOffset)
+    {
+        await using var db = CreateContext();
+        var request = Request(100);
+        request.BusinessDate = Today.AddDays(businessOffset);
+        request.DepositDate = depositOffset is { } d ? Today.AddDays(d) : null;
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => DepositService(db, Start, new FakeGeneralLedger()).CreateAsync(request));
+
+        Assert.Equal(ErrorCodes.BankDepositDateInvalid, ex.Code);
+    }
+
+    [Fact]
+    public async Task Create_GlRejection_LeavesNoDeposit()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000));
+        await db.SaveChangesAsync();
+
+        await Assert.ThrowsAsync<DomainException>(() =>
+            DepositService(db, Start, new FakeGeneralLedger { Reject = true }).CreateAsync(Request(500)));
+
+        Assert.Equal(0, await db.BankDeposits.CountAsync());
+    }
+
+    [Fact]
+    public async Task List_FiltersAndTotalsEveryMatchingRow()
+    {
+        await using var db = CreateContext();
+        db.BankDeposits.AddRange(
+            Deposit(Day, 100), Deposit(Day, 200), Deposit(Day.AddDays(-1), 400),
+            Deposit(Day, 800, branchId: Branch2), Deposit(Day, 1600, status: BankDepositStatus.Cancelled));
+        await db.SaveChangesAsync();
+
+        var result = await DepositService(db, Start, new FakeGeneralLedger()).ListAsync(
+            new() { PageSize = 1 }, new BankDepositListFilter(Day, Day, Branch1, null, BankDepositStatus.Posted));
+
+        Assert.Single(result.Items);
+        Assert.Equal(2, result.Pagination.TotalItems);
+        Assert.Equal(300m, result.TotalAmount);
+    }
+
+    private static CreateBankDepositRequest Request(decimal amount, int branchId = Branch1, DateOnly? depositDate = null) => new()
+    {
+        BranchId = branchId,
+        BusinessDate = Day,
+        DepositDate = depositDate,
+        Amount = amount,
+        FromGlCashAccountId = FakeGeneralLedger.CashAccountId,
+        ToGlBankAccountId = FakeGeneralLedger.BankAccountId,
+        DepositSlipNo = "SLIP-1"
+    };
+}
@@ -0,0 +1,134 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using static ERPCore.Tests.TestSupport.BankDepositTestSupport;
+
+namespace ERPCore.Tests;
+
+/// <summary>Till cash in hand (docs/BANK_DEPOSIT_MODULE_PLAN.md §2, §11).</summary>
+public class CashInHandServiceTests
+{
+    private static readonly DateOnly Today = Clock.Today;
+    private static readonly DateOnly Start = Today.AddDays(-10);
+
+    [Fact]
+    public async Task OnlyCashIsCounted()
+    {
+        await using var db = CreateContext();
+        var day = Today.AddDays(-2);
+        db.SalesSlips.AddRange(
+            CashSlip(day, cash: 300, card: 200),   // only the 300 is till cash
+            CashSlip(day, cash: 0, card: 900));
+        db.SalesInvoices.Add(new SalesInvoice
+        {
+            SalesInvoiceId = 1, InvoiceNo = "INV-1", InvoiceDate = At(day.AddDays(-5)), Status = SalesInvoiceStatus.Posted, BranchId = Branch1
+        });
+        db.SalesInvoicePayments.AddRange(
+            new SalesInvoicePayment { SalesInvoicePaymentId = 1, SalesInvoiceId = 1, PaymentDate = At(day), PaymentMethod = SalesPaymentMethod.Cash, Amount = 150 },
+            new SalesInvoicePayment { SalesInvoicePaymentId = 2, SalesInvoiceId = 1, PaymentDate = At(day), PaymentMethod = SalesPaymentMethod.Card, Amount = 500 },
+            new SalesInvoicePayment { SalesInvoicePaymentId = 3, SalesInvoiceId = 1, PaymentDate = At(day), PaymentMethod = SalesPaymentMethod.Cheque, Amount = 70 });
+        db.Expenses.Add(new Expense { ExpenseId = 1, DocNo = "EXP-1", BranchId = Branch1, ExpenseDate = day, Amount = 100, Status = ExpenseStatus.Posted });
+        db.ExpensePayments.AddRange(
+            new ExpensePayment { ExpensePaymentId = 1, ExpenseId = 1, PaymentDate = At(day), PaymentMethod = ExpensePaymentMethod.Cash, Amount = 40 },
+            new ExpensePayment { ExpensePaymentId = 2, ExpenseId = 1, PaymentDate = At(day), PaymentMethod = ExpensePaymentMethod.BankTransfer, Amount = 60 });
+        await db.SaveChangesAsync();
+
+        var p = (await CashService(db, Start).GetPositionAsync(day, Branch1)).Position;
+
+        Assert.Equal(450m, p.CashIn);
+        Assert.Equal(40m, p.CashOut);
+        Assert.Equal(410m, p.NetCash);
+        Assert.Equal(410m, p.Closing);
+    }
+
+    [Fact]
+    public async Task UndepositedCash_CarriesToTheNextDay_AndDepositsReduceIt()
+    {
+        await using var db = CreateContext();
+        var d1 = Today.AddDays(-3);
+        var d2 = Today.AddDays(-2);
+        db.SalesSlips.AddRange(CashSlip(d1, 1000), CashSlip(d2, 500));
+        db.BankDeposits.AddRange(
+            Deposit(d1, 600),
+            Deposit(d1, 999, status: BankDepositStatus.Cancelled));   // ignored
+        await db.SaveChangesAsync();
+
+        var days = (await CashService(db, Start).GetDailyAsync(d1, d2, Branch1)).Days;
+
+        Assert.Equal((0m, 1000m, 600m, 400m), (days[0].Opening, days[0].NetCash, days[0].Deposited, days[0].Closing));
+        Assert.Equal((400m, 500m, 0m, 900m), (days[1].Opening, days[1].NetCash, days[1].Deposited, days[1].Closing));
+    }
+
+    [Fact]
+    public async Task Opening_IsCarriedInFromBeforeTheWindow()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.AddRange(CashSlip(Today.AddDays(-6), 700), CashSlip(Today.AddDays(-5), 300));
+        db.BankDeposits.Add(Deposit(Today.AddDays(-5), 200));
+        await db.SaveChangesAsync();
+
+        var day = (await CashService(db, Start).GetPositionAsync(Today.AddDays(-1), Branch1)).Position;
+
+        Assert.Equal(800m, day.Opening);
+        Assert.Equal(800m, day.Closing);
+    }
+
+    [Fact]
+    public async Task CashBeforeTheTrackingStart_IsNotCarried()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.AddRange(CashSlip(Start.AddDays(-1), 5000), CashSlip(Start, 100));
+        await db.SaveChangesAsync();
+
+        var days = (await CashService(db, Start).GetDailyAsync(Start.AddDays(-1), Start, Branch1)).Days;
+
+        Assert.Equal(5000m, days[0].NetCash);      // still reported for the day itself
+        Assert.Equal(0m, days[1].Opening);         // but not carried into tracking
+        Assert.Equal(100m, days[1].Closing);
+    }
+
+    [Fact]
+    public async Task Available_IsTheLowestClosingFromThatDayToToday()
+    {
+        await using var db = CreateContext();
+        var d1 = Today.AddDays(-2);
+        db.SalesSlips.Add(CashSlip(d1, 1000));
+        db.BankDeposits.Add(Deposit(Today.AddDays(-1), 800));      // already took most of it the next day
+        await db.SaveChangesAsync();
+
+        var position = await CashService(db, Start).GetPositionAsync(d1, Branch1);
+
+        Assert.Equal(1000m, position.Position.Closing);
+        Assert.Equal(200m, position.AvailableToDeposit);
+    }
+
+    [Fact]
+    public async Task Branches_AreKeptApart()
+    {
+        await using var db = CreateContext();
+        var day = Today.AddDays(-1);
+        db.SalesSlips.AddRange(CashSlip(day, 100, warehouseId: Warehouse1), CashSlip(day, 900, warehouseId: Warehouse2));
+        await db.SaveChangesAsync();
+
+        var service = CashService(db, Start);
+
+        Assert.Equal(100m, (await service.GetPositionAsync(day, Branch1)).Position.Closing);
+        Assert.Equal(900m, (await service.GetPositionAsync(day, Branch2)).Position.Closing);
+        Assert.Equal(1000m, (await service.GetPositionAsync(day, null)).Position.Closing);
+    }
+
+    [Fact]
+    public async Task LateEveningSale_CountsOnTheLocalDay()
+    {
+        await using var db = CreateContext();
+        var day = Today.AddDays(-1);
+        var slip = CashSlip(day, 250);
+        slip.SlipDate = Clock.ToUtc(day.AddDays(1)).AddMinutes(-30);    // 23:30 local
+        db.SalesSlips.Add(slip);
+        await db.SaveChangesAsync();
+
+        var days = (await CashService(db, Start).GetDailyAsync(day, day.AddDays(1), Branch1)).Days;
+
+        Assert.Equal(250m, days[0].CashIn);
+        Assert.Equal(0m, days[1].CashIn);
+    }
+}
@@ -0,0 +1,257 @@
+using ERPCore.Domain;
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Infra.Auth;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Storage;
+using Microsoft.Extensions.Configuration;
+
+namespace ERPCore.Tests;
+
+/// <summary>Aggregates of the Day-End Sales Report (docs/DAY_END_SALES_REPORT_PLAN.md §7).</summary>
+public class DayEndReportServiceTests
+{
+    private static readonly InMemoryDatabaseRoot Root = new();
+
+    // Asia/Colombo is UTC+05:30 all year (no DST), so local midnight is 18:30 UTC the day before.
+    private static readonly DateOnly Day = new(2026, 10, 8);
+    private static DateTime UtcAt(int hour, int minute = 0) => new(2026, 10, 8, hour, minute, 0, DateTimeKind.Utc);
+
+    [Fact]
+    public async Task Day_MixOfSlipsBundlesAndInvoices_TotalsAndSplitsByMethod()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.AddRange(
+            Slip(1, UtcAt(5), total: 1000, paid: 600, cash: 400, card: 200),   // partial, mixed
+            Slip(2, UtcAt(6), total: 200, paid: 200, cash: 200, card: 0),      // all cash
+            Slip(3, UtcAt(7), total: 999, paid: 999, cash: 999, card: 0, status: SalesSlipStatus.Draft));
+        db.BundleSales.Add(new BundleSale { BundleSaleId = 1, BundleDate = UtcAt(8), Status = BundleSaleStatus.Posted, GrandTotal = 500, CashAmount = 0, CardAmount = 500 });
+        db.SalesInvoices.Add(Invoice(1, UtcAt(9), netPayable: 2000, paid: 1500));
+        db.SalesInvoicePayments.AddRange(
+            Payment(1, invoiceId: 1, UtcAt(9), SalesPaymentMethod.Cash, 500),
+            Payment(2, invoiceId: 1, UtcAt(10), SalesPaymentMethod.Card, 1000));
+        SeedExpenseSetup(db);
+        db.Expenses.AddRange(
+            Expense(1, Day, 300, ExpenseStatus.Posted),
+            Expense(2, Day, 700, ExpenseStatus.Cancelled),
+            Expense(3, Day.AddDays(1), 50, ExpenseStatus.Posted));
+        await db.SaveChangesAsync();
+
+        var report = await CreateService(db).GetDayAsync(Day, null);
+        var s = report.Summary;
+
+        Assert.Equal(3700m, s.TotalSales);
+        Assert.Equal(2800m, s.PaidAmount);
+        Assert.Equal(900m, s.DueAmount);
+        Assert.Equal(1100m, s.PaidByCash);
+        Assert.Equal(1700m, s.PaidByCard);
+        Assert.Equal(0m, s.PaidByOther);
+        Assert.Equal(4, s.SalesCount);
+        Assert.Equal(1, s.CashSalesCount);
+        Assert.Equal(1, s.CardSalesCount);
+        Assert.Equal(2, s.MixedSalesCount);
+        Assert.Equal(0, s.UnpaidSalesCount);
+        Assert.Equal(300m, s.ExpenseTotal);
+        Assert.Equal(3400m, s.Income);
+        Assert.Single(report.Expenses);
+        Assert.Equal("Electricity", report.Expenses[0].TitleName);
+    }
+
+    [Fact]
+    public async Task Day_SaleLateInTheLocalEvening_CountsOnTheLocalDay()
+    {
+        await using var db = CreateContext();
+        // 19:00 UTC on Oct 7 is 00:30 on Oct 8 in Colombo; 18:00 UTC on Oct 8 is 23:30 on Oct 8.
+        db.SalesSlips.AddRange(
+            Slip(1, new DateTime(2026, 10, 7, 19, 0, 0, DateTimeKind.Utc), total: 100, paid: 100, cash: 100, card: 0),
+            Slip(2, new DateTime(2026, 10, 8, 18, 0, 0, DateTimeKind.Utc), total: 40, paid: 40, cash: 40, card: 0),
+            Slip(3, new DateTime(2026, 10, 8, 19, 0, 0, DateTimeKind.Utc), total: 7, paid: 7, cash: 7, card: 0));
+        await db.SaveChangesAsync();
+
+        var report = await CreateService(db).GetDailyAsync(Day.AddDays(-1), Day.AddDays(1), null);
+
+        Assert.Equal([0m, 140m, 7m], report.Days.Select(d => d.TotalSales));
+        Assert.Equal(147m, report.Totals.TotalSales);
+    }
+
+    [Fact]
+    public async Task Day_PaymentOnAnEarlierInvoice_IsACollectionAndCountsInNetCash()
+    {
+        await using var db = CreateContext();
+        db.SalesInvoices.Add(Invoice(1, UtcAt(5).AddDays(-3), netPayable: 800, paid: 250));
+        db.SalesInvoicePayments.Add(Payment(1, invoiceId: 1, UtcAt(6), SalesPaymentMethod.Cash, 250));
+        db.SalesSlips.Add(Slip(1, UtcAt(7), total: 60, paid: 60, cash: 60, card: 0));
+        SeedExpenseSetup(db);
+        db.Expenses.Add(Expense(1, Day, 30, ExpenseStatus.Posted));
+        db.ExpensePayments.Add(new ExpensePayment { ExpensePaymentId = 1, ExpenseId = 1, Amount = 30, PaymentDate = UtcAt(8), PaymentMethod = ExpensePaymentMethod.Cash });
+        await db.SaveChangesAsync();
+
+        var s = (await CreateService(db).GetDayAsync(Day, null)).Summary;
+
+        Assert.Equal(60m, s.TotalSales);
+        Assert.Equal(60m, s.PaidAmount);
+        Assert.Equal(250m, s.EarlierInvoiceCollections);
+        Assert.Equal(60m + 250m - 30m, s.NetCash);
+    }
+
+    [Fact]
+    public async Task Day_ShowsBankDepositsAndTheCashLeftInHand()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.AddRange(
+            Slip(1, UtcAt(5).AddDays(-1), total: 300, paid: 300, cash: 300, card: 0),   // yesterday, never banked
+            Slip(2, UtcAt(6), total: 1000, paid: 1000, cash: 1000, card: 0));
+        db.BankDeposits.AddRange(
+            BankDeposit(1, Day, 800, BankDepositStatus.Posted),
+            BankDeposit(2, Day, 5000, BankDepositStatus.Cancelled));
+        await db.SaveChangesAsync();
+
+        var report = await CreateService(db).GetDayAsync(Day, null);
+        var s = report.Summary;
+
+        Assert.Equal((300m, 1000m, 800m, 500m), (s.OpeningCashInHand, s.NetCash, s.CashDeposited, s.ClosingCashInHand));
+        var deposit = Assert.Single(report.Deposits);
+        Assert.Equal(("BD-1", "BOC Current", 800m), (deposit.DocNo, deposit.BankAccountName, deposit.Amount));
+
+        var range = await CreateService(db).GetDailyAsync(Day.AddDays(-1), Day, null);
+        Assert.Equal((0m, 800m, 500m), (range.Totals.OpeningCashInHand, range.Totals.CashDeposited, range.Totals.ClosingCashInHand));
+    }
+
+    [Fact]
+    public async Task Day_Profit_IsSalesLessStockCostLessExpenses_AndCanBeALoss()
+    {
+        await using var db = CreateContext();
+        db.SalesInvoices.Add(Invoice(1, UtcAt(5), netPayable: 1000, paid: 1000));
+        db.SalesInvoicePayments.Add(Payment(1, invoiceId: 1, UtcAt(5), SalesPaymentMethod.Card, 1000));
+        db.SalesSlips.Add(Slip(1, UtcAt(6), total: 200, paid: 0, cash: 0, card: 0));
+        db.StockLedger.AddRange(
+            Ledger(1, DocumentTypes.SalesInvoice, 1, Direction.Out, 600),
+            Ledger(2, DocumentTypes.SalesInvoice, 1, Direction.Out, 100),
+            Ledger(3, DocumentTypes.SalesSlip, 1, Direction.Out, 150),
+            Ledger(4, DocumentTypes.SalesInvoice, 1, Direction.In, 999));   // not a sale's cost
+        SeedExpenseSetup(db);
+        db.Expenses.Add(Expense(1, Day, 900, ExpenseStatus.Posted));
+        await db.SaveChangesAsync();
+
+        var report = await CreateService(db).GetDayAsync(Day, null);
+        var s = report.Summary;
+
+        Assert.Equal(850m, s.CostOfGoodsSold);
+        Assert.Equal(350m, s.GrossProfit);
+        Assert.Equal(-550m, s.NetProfit);
+        Assert.Equal(2, report.Sales.Count);
+        var invoice = report.Sales.Single(x => x.DocType == "Invoice");
+        Assert.Equal(("Card", 700m, 300m), (invoice.PaidBy, invoice.Cost, invoice.GrossProfit));
+        Assert.Equal("Unpaid", report.Sales.Single(x => x.DocType == "Slip").PaidBy);
+    }
+
+    [Fact]
+    public async Task Day_UnpaidInvoice_CountsAsUnpaidAndDue()
+    {
+        await using var db = CreateContext();
+        db.SalesInvoices.Add(Invoice(1, UtcAt(5), netPayable: 450, paid: 0));
+        await db.SaveChangesAsync();
+
+        var s = (await CreateService(db).GetDayAsync(Day, null)).Summary;
+
+        Assert.Equal(1, s.UnpaidSalesCount);
+        Assert.Equal(450m, s.DueAmount);
+    }
+
+    [Fact]
+    public async Task Daily_FillsQuietDaysWithZeros()
+    {
+        await using var db = CreateContext();
+        var report = await CreateService(db).GetDailyAsync(Day, Day.AddDays(4), null);
+
+        Assert.Equal(5, report.Days.Count);
+        Assert.All(report.Days, d => Assert.Equal(0m, d.Income));
+        Assert.Equal(Day.AddDays(4), report.Days[^1].Date);
+    }
+
+    [Theory]
+    [InlineData(1, 0)]   // to before from
+    [InlineData(0, 92)]  // 93 days
+    public async Task Daily_InvalidRange_IsRejected(int fromOffset, int toOffset)
+    {
+        await using var db = CreateContext();
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            CreateService(db).GetDailyAsync(Day.AddDays(fromOffset), Day.AddDays(toOffset), null));
+
+        Assert.Equal(ErrorCodes.DayEndReportRangeInvalid, ex.Code);
+    }
+
+    // --- helpers ------------------------------------------------------------------------------
+
+    private static SalesSlip Slip(int id, DateTime at, decimal total, decimal paid, decimal cash, decimal card,
+        SalesSlipStatus status = SalesSlipStatus.Posted) => new()
+    {
+        SalesSlipId = id, SlipNo = $"SL-{id}", SlipDate = at, Status = status,
+        GrandTotal = total, PaidAmount = paid, BalanceAmount = total - paid, CashAmount = cash, CardAmount = card
+    };
+
+    private static SalesInvoice Invoice(int id, DateTime at, decimal netPayable, decimal paid) => new()
+    {
+        SalesInvoiceId = id, InvoiceNo = $"INV-{id}", InvoiceDate = at, Status = SalesInvoiceStatus.Posted,
+        GrandTotal = netPayable, NetPayable = netPayable, PaidAmount = paid, BalanceAmount = netPayable - paid
+    };
+
+    private static SalesInvoicePayment Payment(int id, int invoiceId, DateTime at, SalesPaymentMethod method, decimal amount) => new()
+    {
+        SalesInvoicePaymentId = id, SalesInvoiceId = invoiceId, PaymentDate = at, PaymentMethod = method, Amount = amount
+    };
+
+    private static StockLedger Ledger(int id, string docType, int docId, Direction direction, decimal value) => new()
+    {
+        LedgerId = id, SourceDocType = docType, SourceDocId = docId, Direction = direction, Value = value, QtyBase = 1, ItemId = 1, WarehouseId = 1
+    };
+
+    private static Expense Expense(int id, DateOnly date, decimal amount, ExpenseStatus status) => new()
+    {
+        ExpenseId = id, DocNo = $"EXP-{id}", ExpenseDate = date, Amount = amount, Status = status,
+        ExpenseCategoryId = 1, ExpenseTitleId = 1
+    };
+
+    private static BankDeposit BankDeposit(int id, DateOnly businessDate, decimal amount, BankDepositStatus status) => new()
+    {
+        BankDepositId = id, DocNo = $"BD-{id}", BranchId = 1, BusinessDate = businessDate, DepositDate = businessDate, Amount = amount,
+        Status = status, FromCashAccountCode = "1000-01", FromCashAccountName = "Main Till",
+        ToBankAccountCode = "1010-01", ToBankAccountName = "BOC Current"
+    };
+
+    private static void SeedExpenseSetup(ErpDbContext db)
+    {
+        db.ExpenseCategories.Add(new ExpenseCategory { ExpenseCategoryId = 1, Code = "UTILITY", Name = "Utility" });
+        db.ExpenseTitles.Add(new ExpenseTitle { ExpenseTitleId = 1, ExpenseCategoryId = 1, Name = "Electricity", GlExpenseAccountCode = "5200-01" });
+    }
+
+    private static DayEndReportService CreateService(ErpDbContext db)
+    {
+        var config = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?> { ["DayEndReport:TimeZone"] = "Asia/Colombo" })
+            .Build();
+        var clock = new BusinessDayClock(config);
+        var branch = new CurrentBranchContext(new TestCurrentUser());
+        var cash = new CashInHandService(
+            new Repository<SalesSlip>(db), new Repository<BundleSale>(db), new Repository<SalesInvoicePayment>(db),
+            new Repository<ExpensePayment>(db), new Repository<BankDeposit>(db), branch, clock, config);
+        return new DayEndReportService(
+            new Repository<SalesSlip>(db), new Repository<BundleSale>(db), new Repository<SalesInvoice>(db),
+            new Repository<SalesInvoicePayment>(db), new Repository<StockLedger>(db),
+            new Repository<Expense>(db), new Repository<BankDeposit>(db), cash, branch, clock);
+    }
+
+    private static ErpDbContext CreateContext()
+    {
+        var options = new DbContextOptionsBuilder<ErpDbContext>()
+            .UseInMemoryDatabase(Guid.NewGuid().ToString("N"), Root)
+            .Options;
+        var currentUser = new TestCurrentUser();
+        return new ErpDbContext(options, currentUser, new CurrentBranchContext(currentUser));
+    }
+}
@@ -0,0 +1,388 @@
+using ERPCore.Domain;
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Approvals;
+using ERPCore.Dtos.Notifications;
+using ERPCore.Dtos.Products;
+using ERPCore.Dtos.Stock;
+using ERPCore.Infra.Auth;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.Services.Interfaces;
+using ERPCore.Services.Stock;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Storage;
+using Microsoft.Extensions.Configuration;
+
+namespace ERPCore.Tests;
+
+/// <summary>Dual approval of stock and price adjustments (docs/DUAL_APPROVAL_PLAN.md §13).</summary>
+public class DualApprovalTests
+{
+    private static readonly InMemoryDatabaseRoot Root = new();
+
+    // Requester, two approvers, and a clerk who can approve but isn't a manager.
+    private const int Requester = 10, ApproverA = 11, ApproverB = 12, Clerk = 13;
+    private const int ApproverRoleId = 2, ClerkRoleId = 3;
+    private const int ItemId = 1, WarehouseId = 1, ReasonId = 1;
+
+    // --- Stock adjustments ------------------------------------------------------------------
+
+    [Fact]
+    public async Task StockAdjustment_IsARequest_NothingMovesUntilApproved()
+    {
+        var h = await Harness.CreateAsync();
+
+        var dto = await h.Stock.CreateAsync(Request(-3));
+
+        Assert.Equal(AdjustmentStatus.PendingApproval, dto.Status);
+        Assert.Equal(2, dto.RequiredApprovals);
+        Assert.Equal(1, dto.PendingLevel);
+        Assert.Empty(h.Mutator.Calls);
+        Assert.Empty(h.Gl.Posted);
+        var pending = Assert.Single(h.Notifications.Targeted, n => n.ModuleKey == "approval.pending");
+        Assert.Equal([ApproverA, ApproverB, Clerk], pending.UserIds.Order());   // never the requester
+    }
+
+    [Fact]
+    public async Task StockAdjustment_TwoDifferentApprovers_ThenItPosts()
+    {
+        var h = await Harness.CreateAsync();
+        var id = (await h.Stock.CreateAsync(Request(-3))).AdjustmentId;
+
+        h.User.Be(Requester);
+        var own = await Assert.ThrowsAsync<DomainException>(() => h.Stock.ApproveAsync(id, null));
+        Assert.Equal(ErrorCodes.ApprovalForbidden, own.Code);
+
+        h.User.Be(ApproverA);
+        var first = await h.Stock.ApproveAsync(id, "counted twice");
+        Assert.Equal(AdjustmentStatus.PendingSecondApproval, first.Status);
+        Assert.Empty(h.Mutator.Calls);
+
+        var twice = await Assert.ThrowsAsync<DomainException>(() => h.Stock.ApproveAsync(id, null));
+        Assert.Equal(ErrorCodes.ApprovalSamePerson, twice.Code);
+
+        h.User.Be(ApproverB);
+        var posted = await h.Stock.ApproveAsync(id, null);
+
+        Assert.Equal(AdjustmentStatus.Posted, posted.Status);
+        Assert.Equal((ApproverA, ApproverB), (posted.ApprovedLevel1By, posted.ApprovedLevel2By));
+        var call = Assert.Single(h.Mutator.Calls);
+        Assert.Equal(-3m, Assert.Single(call).QtyDelta);
+        Assert.Single(h.Gl.Posted);
+        Assert.NotNull(posted.PostedAt);
+        Assert.Equal([1, 2], posted.ApprovalHistory!.Select(s => s.Level));
+        Assert.Contains(h.Notifications.Targeted, n => n.ModuleKey == "approval.approved" && n.UserIds.SequenceEqual([Requester]));
+    }
+
+    [Fact]
+    public async Task StockAdjustment_Rejected_NeedsAReason_AndNeverPosts()
+    {
+        var h = await Harness.CreateAsync();
+        var id = (await h.Stock.CreateAsync(Request(5))).AdjustmentId;
+        h.User.Be(ApproverA);
+
+        var noReason = await Assert.ThrowsAsync<DomainException>(() => h.Stock.RejectAsync(id, " "));
+        Assert.Equal(ErrorCodes.ApprovalReasonRequired, noReason.Code);
+
+        var rejected = await h.Stock.RejectAsync(id, "wrong warehouse");
+        Assert.Equal((AdjustmentStatus.Rejected, "wrong warehouse"), (rejected.Status, rejected.RejectReason));
+
+        h.User.Be(ApproverB);
+        var late = await Assert.ThrowsAsync<DomainException>(() => h.Stock.ApproveAsync(id, null));
+        Assert.Equal(ErrorCodes.ApprovalNotPending, late.Code);
+        Assert.Empty(h.Mutator.Calls);
+        Assert.Contains(h.Notifications.Targeted, n => n.ModuleKey == "approval.rejected");
+    }
+
+    [Fact]
+    public async Task StockAdjustment_ApprovalsOff_PostsOnCreate()
+    {
+        var h = await Harness.CreateAsync(stockLevels: 0);
+
+        var dto = await h.Stock.CreateAsync(Request(2));
+
+        Assert.Equal((AdjustmentStatus.Posted, 0), (dto.Status, dto.RequiredApprovals));
+        Assert.Single(h.Mutator.Calls);
+    }
+
+    [Fact]
+    public async Task StockAdjustment_BelowTheValueThreshold_NeedsOneApproval()
+    {
+        // 3 units at 10.00 each = 30.00, below the 1,000 threshold.
+        var h = await Harness.CreateAsync(stockThreshold: 1000);
+        var id = (await h.Stock.CreateAsync(Request(-3))).AdjustmentId;
+
+        h.User.Be(ApproverA);
+        var posted = await h.Stock.ApproveAsync(id, null);
+
+        Assert.Equal((AdjustmentStatus.Posted, 1), (posted.Status, posted.RequiredApprovals));
+        Assert.Single(h.Mutator.Calls);
+    }
+
+    [Fact]
+    public async Task StockAdjustment_OnlyTheRequesterCanWithdraw()
+    {
+        var h = await Harness.CreateAsync();
+        var id = (await h.Stock.CreateAsync(Request(-1))).AdjustmentId;
+
+        h.User.Be(ApproverA);
+        var other = await Assert.ThrowsAsync<DomainException>(() => h.Stock.CancelAsync(id));
+        Assert.Equal(ErrorCodes.ApprovalForbidden, other.Code);
+
+        h.User.Be(Requester);
+        Assert.Equal(AdjustmentStatus.Cancelled, (await h.Stock.CancelAsync(id)).Status);
+    }
+
+    [Fact]
+    public async Task SecondApproval_CanBeLimitedToRoles()
+    {
+        var h = await Harness.CreateAsync(level2Roles: "Approver");
+        var id = (await h.Stock.CreateAsync(Request(-1))).AdjustmentId;
+        h.User.Be(ApproverA);
+        await h.Stock.ApproveAsync(id, null);
+
+        h.User.Be(Clerk);
+        var clerk = await Assert.ThrowsAsync<DomainException>(() => h.Stock.ApproveAsync(id, null));
+        Assert.Equal(ErrorCodes.ApprovalRoleRequired, clerk.Code);
+
+        h.User.Be(ApproverB);
+        Assert.Equal(AdjustmentStatus.Posted, (await h.Stock.ApproveAsync(id, null)).Status);
+    }
+
+    // --- Price adjustments ------------------------------------------------------------------
+
+    [Fact]
+    public async Task PriceAdjustment_AppliesOnlyAfterTheSecondApproval_AndKeepsHistory()
+    {
+        var h = await Harness.CreateAsync();
+        var dto = await h.Prices.CreateAsync(PriceRequest(flat: 120m));
+        Assert.Equal(PriceAdjustmentStatus.PendingApproval, dto.Status);
+        Assert.Equal(100m, (await h.Db.Items.AsNoTracking().FirstAsync()).SellingFlatPrice);
+
+        h.User.Be(ApproverA);
+        await h.Prices.ApproveAsync(dto.PriceAdjustmentId, null);
+        Assert.Equal(100m, (await h.Db.Items.AsNoTracking().FirstAsync()).SellingFlatPrice);
+
+        h.User.Be(ApproverB);
+        var applied = await h.Prices.ApproveAsync(dto.PriceAdjustmentId, null);
+
+        Assert.Equal(PriceAdjustmentStatus.Approved, applied.Status);
+        Assert.Equal(120m, (await h.Db.Items.AsNoTracking().FirstAsync()).SellingFlatPrice);
+        var history = Assert.Single(await h.Prices.ItemHistoryAsync(ItemId));
+        Assert.Equal((100m, 120m, ApproverA, ApproverB, dto.DocNo), (history.OldFlatPrice, history.NewFlatPrice, history.ApprovedLevel1By, history.ApprovedLevel2By, history.DocNo));
+    }
+
+    [Fact]
+    public async Task PriceAdjustment_ItemRepricedSinceTheRequest_IsRefusedAsStale()
+    {
+        var h = await Harness.CreateAsync();
+        var id = (await h.Prices.CreateAsync(PriceRequest(flat: 120m))).PriceAdjustmentId;
+        h.User.Be(ApproverA);
+        await h.Prices.ApproveAsync(id, null);
+
+        var item = await h.Db.Items.FirstAsync();
+        item.SellingFlatPrice = 105m;            // someone changed it in between
+        await h.Db.SaveChangesAsync();
+
+        h.User.Be(ApproverB);
+        var stale = await Assert.ThrowsAsync<DomainException>(() => h.Prices.ApproveAsync(id, null));
+        Assert.Equal(ErrorCodes.PriceAdjustmentStale, stale.Code);
+        Assert.Empty(await h.Prices.ItemHistoryAsync(ItemId));
+    }
+
+    [Fact]
+    public async Task PriceAdjustment_OnePendingRequestPerItem()
+    {
+        var h = await Harness.CreateAsync();
+        await h.Prices.CreateAsync(PriceRequest(flat: 120m));
+
+        var second = await Assert.ThrowsAsync<DomainException>(() => h.Prices.CreateAsync(PriceRequest(flat: 130m)));
+        Assert.Equal(ErrorCodes.PriceAdjustmentItemPending, second.Code);
+    }
+
+    [Theory]
+    [InlineData(100, 120, 20)]
+    [InlineData(100, 80, 20)]
+    [InlineData(-1, 50, 100)]     // setting a price where there was none (-1 = no price)
+    [InlineData(50, -1, 100)]     // clearing one
+    [InlineData(40, 40, 0)]
+    public void ChangePercent_MeasuresTheSizeOfAPriceChange(int oldPrice, int newPrice, int expected)
+    {
+        decimal? Price(int v) => v < 0 ? null : v;
+        Assert.Equal(expected, PriceAdjustmentService.ChangePercent(Price(oldPrice), Price(newPrice)));
+    }
+
+    [Theory]
+    [InlineData(2, 0, 5000, 2)]     // no threshold: always two
+    [InlineData(2, 1000, 50, 1)]    // below threshold: one
+    [InlineData(2, 1000, 1000, 2)]  // at threshold: two
+    [InlineData(1, 1000, 5000, 1)]
+    [InlineData(0, 0, 5000, 0)]
+    public void RequiredLevels_FollowTheSettings(int configured, double threshold, double measure, int expected)
+        => Assert.Equal(expected, ApprovalService.Levels(configured, (decimal)threshold, (decimal)measure));
+
+    // --- helpers ------------------------------------------------------------------------------
+
+    private static CreateAdjustmentRequest Request(decimal qty) => new()
+    {
+        WarehouseId = WarehouseId, BranchId = 1, ReasonCodeId = ReasonId,
+        Lines = [new CreateAdjustmentLineInput { ItemId = ItemId, QtyDelta = qty }]
+    };
+
+    private static CreatePriceAdjustmentRequest PriceRequest(decimal flat) => new()
+    {
+        Reason = "Supplier price rise",
+        Lines = [new PriceAdjustmentLineInput { ItemId = ItemId, NewMinPrice = 90m, NewMaxPrice = 150m, NewFlatPrice = flat }]
+    };
+
+    private sealed class Harness
+    {
+        public required ErpDbContext Db { get; init; }
+        public required SwitchableUser User { get; init; }
+        public required RecordingMutator Mutator { get; init; }
+        public required FakeGeneralLedger Gl { get; init; }
+        public required RecordingNotifications Notifications { get; init; }
+        public required AdjustmentService Stock { get; init; }
+        public required PriceAdjustmentService Prices { get; init; }
+
+        public static async Task<Harness> CreateAsync(int stockLevels = 2, decimal stockThreshold = 0, string? level2Roles = null)
+        {
+            var db = new ErpDbContext(
+                new DbContextOptionsBuilder<ErpDbContext>().UseInMemoryDatabase(Guid.NewGuid().ToString("N"), Root).Options,
+                new TestCurrentUser(), new CurrentBranchContext(new TestCurrentUser()));
+
+            db.Roles.AddRange(
+                new Role { RoleId = 1, Code = "Requester", Name = "Requester" },
+                new Role { RoleId = ApproverRoleId, Code = "Approver", Name = "Approver" },
+                new Role { RoleId = ClerkRoleId, Code = "Clerk", Name = "Clerk" });
+            db.Users.AddRange(
+                new User { UserId = ERPCore.Domain.Entities.User.SystemUserId, Username = "system", DisplayName = "System" },
+                new User { UserId = Requester, Username = "req", DisplayName = "Requester", RoleId = 1 },
+                new User { UserId = ApproverA, Username = "a", DisplayName = "Approver A", RoleId = ApproverRoleId },
+                new User { UserId = ApproverB, Username = "b", DisplayName = "Approver B", RoleId = ApproverRoleId },
+                new User { UserId = Clerk, Username = "c", DisplayName = "Clerk", RoleId = ClerkRoleId });
+            db.Permissions.AddRange(
+                new Permission { PermissionId = 45, Code = "NAV:stock.adjustments" },
+                new Permission { PermissionId = 58, Code = "NAV:products.price-adjustments" });
+            foreach (var roleId in new[] { ApproverRoleId, ClerkRoleId })
+            foreach (var permissionId in new[] { 45, 58 })
+                db.RolePermissions.Add(new RolePermission { RoleId = roleId, PermissionId = permissionId, Actions = RolePermissionAction.All });
+            db.RolePermissions.Add(new RolePermission { RoleId = 1, PermissionId = 45, Actions = RolePermissionAction.View | RolePermissionAction.Create });
+
+            db.Branches.Add(new Branch { BranchId = 1, Code = "BR-001", Name = "Main" });
+            db.Warehouses.Add(new Warehouse { WarehouseId = WarehouseId, Code = "WH-1", Name = "Main Store", BranchId = 1 });
+            db.Uoms.Add(new Uom { UomId = 1, Name = "pcs" });
+            db.Items.Add(new Item { ItemId = ItemId, Sku = "SKU-1", Name = "Cola", BaseUomId = 1, CategoryId = 1,
+                SellingMinPrice = 90m, SellingMaxPrice = 150m, SellingFlatPrice = 100m });
+            db.ReasonCodes.Add(new ReasonCode { ReasonCodeId = ReasonId, Code = "DMG", Description = "Damage", Context = ReasonContext.Adjustment });
+            db.ApprovalConfig.Add(new ApprovalConfig
+            {
+                ApprovalConfigId = ApprovalConfig.SingletonId, StockAdjustmentLevels = stockLevels,
+                StockAdjustmentLevel2ThresholdValue = stockThreshold, PriceAdjustmentLevels = 2, Level2RoleCodes = level2Roles
+            });
+            await db.SaveChangesAsync();
+
+            var user = new SwitchableUser(Requester, "Requester");
+            var uow = new PassThroughUnitOfWork(db);
+            var notifications = new RecordingNotifications();
+            var approvals = new ApprovalService(
+                new Repository<ApprovalConfig>(db), new Repository<DocumentApproval>(db), new Repository<User>(db),
+                new Repository<RolePermission>(db), user, notifications, uow);
+            var gl = new FakeGeneralLedger();
+            var mutator = new RecordingMutator();
+            var numbers = new FakeNumberSequence();
+
+            var stock = new AdjustmentService(
+                new Repository<StockAdjustment>(db), new Repository<Warehouse>(db), new Repository<Item>(db),
+                new Repository<ReasonCode>(db), new Repository<StockLedger>(db), mutator, new FixedValuation(),
+                numbers, user, new FakeBranchConfig(), notifications, approvals, uow, db, gl,
+                new ConfigurationBuilder().Build(),
+                new SerialTrackingService(new Repository<Serial>(db), new Repository<SerialMovement>(db), new Repository<StockLayer>(db),
+                    new Repository<ProductConfig>(db), user));
+            var prices = new PriceAdjustmentService(
+                new Repository<PriceAdjustment>(db), new Repository<Item>(db), new Repository<ItemPriceHistory>(db),
+                new Repository<User>(db), new Repository<ApprovalConfig>(db), approvals, notifications, numbers, user, uow);
+
+            return new Harness { Db = db, User = user, Mutator = mutator, Gl = gl, Notifications = notifications, Stock = stock, Prices = prices };
+        }
+    }
+
+    /// <summary>A signed-in user whose identity the test switches between steps.</summary>
+    private sealed class SwitchableUser(int userId, string roleCode) : ICurrentUser
+    {
+        private static readonly Dictionary<int, string> Roles = new()
+        {
+            [Requester] = "Requester", [ApproverA] = "Approver", [ApproverB] = "Approver", [Clerk] = "Clerk"
+        };
+
+        public int AuditUserId { get; private set; } = userId;
+        public string? RoleCode { get; private set; } = roleCode;
+        public string UserId => AuditUserId.ToString();
+        public bool IsAuthenticated => true;
+        public bool IsAdmin => false;
+        public int? BranchId => null;
+
+        public void Be(int userId)
+        {
+            AuditUserId = userId;
+            RoleCode = Roles[userId];
+        }
+    }
+
+    /// <summary>Records what would be posted to stock; every unit is worth 10.00.</summary>
+    private sealed class RecordingMutator : IStockMutator
+    {
+        public List<IReadOnlyList<StockDelta>> Calls { get; } = new();
+
+        public Task<IReadOnlyList<StockLedger>> ApplyAsync(int warehouseId, string sourceDocType, int sourceDocId, DateTime now,
+            IReadOnlyList<StockDelta> deltas, CancellationToken ct = default)
+        {
+            Calls.Add(deltas);
+            IReadOnlyList<StockLedger> refs = deltas.Select(d => new StockLedger
+            {
+                ItemId = d.ItemId, WarehouseId = warehouseId, QtyBase = Math.Abs(d.QtyDelta), UnitCost = 10m, Value = Math.Abs(d.QtyDelta) * 10m,
+                Direction = d.QtyDelta < 0 ? Direction.Out : Direction.In, SourceDocType = sourceDocType, SourceDocId = sourceDocId, CreatedAt = now
+            }).ToList();
+            return Task.FromResult(refs);
+        }
+    }
+
+    /// <summary>10 units on hand worth 100.00 — 10.00 each, which prices requests for the threshold.</summary>
+    private sealed class FixedValuation : IFifoCostingService
+    {
+        public Task<StockValuationDto> GetValuationAsync(int itemId, int warehouseId, CancellationToken ct = default)
+            => Task.FromResult(new StockValuationDto(itemId, warehouseId, [], 10m, 100m, "LKR", "FIFO"));
+        public Task<StockLayer> CreateInboundLayerAsync(int itemId, int warehouseId, int? batchId, int? serialId, int? grnLineId,
+            decimal qtyBase, decimal unitCost, DateTime receiptDate, CancellationToken ct = default) => throw new NotSupportedException();
+        public Task<IReadOnlyList<ConsumedSegment>> ConsumeAsync(int itemId, int warehouseId, int? batchId, decimal qtyBase, CancellationToken ct = default,
+            bool allowShortfall = false, IReadOnlyCollection<int>? serialIds = null) => throw new NotSupportedException();
+        public Task<IReadOnlyList<BatchAllocation>> SuggestBatchesAsync(int itemId, int warehouseId, decimal qtyBase, CancellationToken ct = default)
+            => throw new NotSupportedException();
+        public Task<StockLedger> PostLedgerAsync(int itemId, int warehouseId, int? binId, int? batchId, int? serialId, int userId,
+            Direction direction, decimal qtyBase, decimal unitCost, decimal runningBalance, string sourceDocType, int sourceDocId,
+            DateTime createdAt, CancellationToken ct = default, decimal? valueOverride = null) => throw new NotSupportedException();
+        public Task<decimal> GetOnHandAsync(int itemId, int warehouseId, CancellationToken ct = default) => Task.FromResult(10m);
+    }
+
+    private sealed class RecordingNotifications : INotificationService
+    {
+        public List<(IReadOnlyList<int> UserIds, string ModuleKey, string Message)> Targeted { get; } = new();
+
+        public Task RaiseAsync(string moduleKey, string title, string message, string? relatedEntityType = null, int? relatedEntityId = null,
+            CancellationToken ct = default) => Task.CompletedTask;
+
+        public Task NotifyUsersAsync(IEnumerable<int> userIds, string moduleKey, string title, string message,
+            string? relatedEntityType = null, int? relatedEntityId = null, CancellationToken ct = default)
+        {
+            Targeted.Add((userIds.ToList(), moduleKey, message));
+            return Task.CompletedTask;
+        }
+
+        public Task<NotificationFeedDto> GetFeedAsync(int userId, int take = 20, CancellationToken ct = default) => throw new NotSupportedException();
+        public Task MarkAllReadAsync(int userId, CancellationToken ct = default) => throw new NotSupportedException();
+    }
+}
@@ -8,7 +8,7 @@
  </PropertyGroup>

  <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.9" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="9.0.20" />
    <PackageReference Include="coverlet.collector" Version="6.0.4" />
    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
    <PackageReference Include="xunit" Version="2.9.3" />
@@ -0,0 +1,151 @@
+using ERPCore.Infra.Gl;
+using ERPCore.Services.Gl;
+using ERPCore.Services.Interfaces;
+using ERPCore.System.Time;
+using ERPCore.Tests.TestSupport;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+
+namespace ERPCore.Tests;
+
+/// <summary>
+/// The validator is advisory: enforcement lives in <see cref="ERPCore.Services.GlAccountConfigService"/>,
+/// which refuses to store a bad mapping in the first place. So the behaviour that matters here is that
+/// it <b>cannot abort startup</b>. An earlier revision threw on a missing code and core-dumped
+/// erpcore.service on deploy (2026-10-07), turning a long-standing data mismatch into an outage.
+/// </summary>
+public class GlAccountCodeValidatorTests
+{
+    [Fact]
+    public async Task StartAsync_Succeeds_WhenEveryMappedCodeExistsInGl()
+    {
+        var validator = CreateValidator(
+            new(),
+            new StubGeneralLedgerService([
+                StubGeneralLedgerService.Postable("1100"),
+                StubGeneralLedgerService.Postable("2000")
+            ]),
+            (GlAccountRole.Inventory, "1100"), (GlAccountRole.Clearing, "2000"));
+
+        await validator.StartAsync(CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task StartAsync_DoesNotThrow_WhenMappedCodesAreMissingFromGl()
+    {
+        var validator = CreateValidator(
+            new(),
+            new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1000-01")]),
+            (GlAccountRole.Inventory, "1100"), (GlAccountRole.Cash, "1000-01"));
+
+        await validator.StartAsync(CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task StartAsync_Throws_AndNamesEveryMissingCode_WhenConfiguredToFail()
+    {
+        var validator = CreateValidator(
+            new() { ["GeneralLedgerService:FailOnMissingAccountCodes"] = "true" },
+            new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1100")]),
+            (GlAccountRole.Inventory, "1100"),
+            (GlAccountRole.Cash, "1000-01"),
+            (GlAccountRole.InventoryLoss, "5100"));
+
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => validator.StartAsync(CancellationToken.None));
+
+        Assert.Contains("1000-01", ex.Message);
+        Assert.Contains("5100", ex.Message);
+        Assert.Contains("2 of 3", ex.Message);
+    }
+
+    /// <summary>
+    /// If GL's /accounts shape ever changes, the reader yields nothing. Treating that as
+    /// "everything is missing" would refuse to start on a contract change.
+    /// </summary>
+    [Fact]
+    public async Task StartAsync_DoesNotThrow_WhenGlReturnsNoAccountsAtAll()
+    {
+        var validator = CreateValidator(
+            new() { ["GeneralLedgerService:FailOnMissingAccountCodes"] = "true" },
+            new StubGeneralLedgerService([]),
+            (GlAccountRole.Inventory, "1100"));
+
+        await validator.StartAsync(CancellationToken.None);
+    }
+
+    /// <summary>
+    /// The catch filter once matched only DomainException/OperationCanceledException, so anything
+    /// else — a parse failure, a null-items NRE in the reader, a database hiccup reading the
+    /// mapping — escaped a hosted service and aborted the host.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(UnexpectedFailures))]
+    public async Task StartAsync_DoesNotThrow_OnAnyUnexpectedFailure(Exception failure)
+    {
+        var validator = CreateValidator(
+            new() { ["GeneralLedgerService:FailOnMissingAccountCodes"] = "true" },
+            new StubGeneralLedgerService(failure),
+            (GlAccountRole.Inventory, "1100"));
+
+        await validator.StartAsync(CancellationToken.None);
+    }
+
+    public static TheoryData<Exception> UnexpectedFailures() =>
+    [
+        StubGeneralLedgerService.Unreachable(),
+        new NullReferenceException("items was null"),
+        new global::System.Text.Json.JsonException("unexpected shape"),
+        new InvalidOperationException("something else entirely"),
+        new HttpRequestException("connection reset"),
+        new OperationCanceledException(),
+    ];
+
+    [Fact]
+    public async Task StartAsync_SkipsTheGlCall_WhenNothingIsMapped()
+    {
+        var gl = new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1100")]);
+
+        var validator = CreateValidator(new(), gl);
+        await validator.StartAsync(CancellationToken.None);
+
+        Assert.Equal(0, gl.Calls);
+    }
+
+    /// <summary>Duplicate codes across roles are one account to verify, not several.</summary>
+    [Fact]
+    public async Task StartAsync_DeduplicatesCodesSharedBySeveralRoles()
+    {
+        var gl = new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1100")]);
+
+        var validator = CreateValidator(
+            new() { ["GeneralLedgerService:FailOnMissingAccountCodes"] = "true" },
+            gl,
+            (GlAccountRole.Inventory, "1100"), (GlAccountRole.InventoryGain, "1100"));
+
+        await validator.StartAsync(CancellationToken.None);
+        Assert.Equal(1, gl.Calls);
+    }
+
+    /// <summary>Asia/Colombo is UTC+05:30, so 20:00 UTC on the 31st is already the 1st locally.</summary>
+    [Fact]
+    public void BusinessClock_MapsAUtcInstantToTheLocalBusinessDay()
+    {
+        Assert.Equal(new DateOnly(2026, 11, 1), BusinessClock.ToBusinessDate(new DateTime(2026, 10, 31, 20, 0, 0, DateTimeKind.Utc)));
+        Assert.Equal(new DateOnly(2026, 10, 31), BusinessClock.ToBusinessDate(new DateTime(2026, 10, 31, 18, 0, 0, DateTimeKind.Utc)));
+        Assert.Equal(new DateOnly(2026, 10, 31), BusinessClock.ToBusinessDate(new DateTime(2026, 10, 31, 18, 29, 59, DateTimeKind.Utc)));
+        Assert.Equal(new DateOnly(2026, 11, 1), BusinessClock.ToBusinessDate(new DateTime(2026, 10, 31, 18, 30, 0, DateTimeKind.Utc)));
+    }
+
+    private static GlAccountCodeValidator CreateValidator(
+        Dictionary<string, string?> settings, StubGeneralLedgerService gl, params (GlAccountRole, string?)[] mapping)
+    {
+        var configuration = new ConfigurationBuilder().AddInMemoryCollection(settings).Build();
+        var services = new ServiceCollection()
+            .AddScoped<IGeneralLedgerService>(_ => gl)
+            .AddScoped<IGlAccountConfigService>(_ => new StubGlAccountConfigService(mapping))
+            .BuildServiceProvider();
+        return new GlAccountCodeValidator(services, configuration, NullLogger<GlAccountCodeValidator>.Instance);
+    }
+}
@@ -0,0 +1,234 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Dtos.Config;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.Services.Gl;
+using ERPCore.Services.Interfaces;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+
+namespace ERPCore.Tests;
+
+/// <summary>
+/// The point of this service is that a mapping GL cannot post to never reaches the database.
+/// Validation at the point of entry is what the old appsettings approach could not do: those codes
+/// were only ever checked at boot, and on 2026-10-07 eleven of twelve turned out never to have
+/// existed in GL at all.
+/// </summary>
+public class GlAccountConfigServiceTests
+{
+    [Fact]
+    public async Task UpdateAsync_PersistsAMappingGlCanPostTo()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var gl = new StubGeneralLedgerService([
+            StubGeneralLedgerService.Postable("1100", "Inventory"),
+            StubGeneralLedgerService.Postable("2000", "GRNI")
+        ]);
+        var service = CreateService(db, gl);
+        var before = (await service.GetAsync()).RowVersion;
+
+        var result = await service.UpdateAsync(
+            new UpdateGlAccountConfigRequest { InventoryAccountCode = "1100", ClearingAccountCode = "2000" }, before);
+
+        Assert.True(result.RowVersion > before);
+        var codes = await CreateService(db, gl).GetCodesAsync();
+        Assert.Equal("1100", codes[GlAccountRole.Inventory]);
+        Assert.Equal("2000", codes[GlAccountRole.Clearing]);
+    }
+
+    [Fact]
+    public async Task UpdateAsync_RejectsACodeGlDoesNotHave_AndNamesIt()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1100")]));
+        var rowVersion = (await service.GetAsync()).RowVersion;
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(
+            new UpdateGlAccountConfigRequest { InventoryAccountCode = "1100", ClearingAccountCode = "9999" }, rowVersion));
+
+        Assert.Equal(ErrorCodes.GlAccountInvalid, ex.Code);
+        Assert.Equal(422, ex.StatusCode);
+        Assert.Contains("9999", ex.Message);
+        Assert.Contains("Clearing", ex.Message);
+        await AssertNothingStoredAsync(db);
+    }
+
+    /// <summary>
+    /// GL rejects a journal line against a non-postable account, so storing one only defers the
+    /// failure to posting time. The auto-created <c>1000</c> Bank/Cash header is exactly this trap.
+    /// </summary>
+    [Fact]
+    public async Task UpdateAsync_RejectsANonPostableAccount()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([
+            StubGeneralLedgerService.NotPostable("1000", "Bank and Cash")
+        ]));
+        var rowVersion = (await service.GetAsync()).RowVersion;
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(
+            new UpdateGlAccountConfigRequest { CashAccountCode = "1000" }, rowVersion));
+
+        Assert.Equal(ErrorCodes.GlAccountInvalid, ex.Code);
+        Assert.Contains("not postable", ex.Message);
+        await AssertNothingStoredAsync(db);
+    }
+
+    /// <summary>Fails closed, deliberately opposite to the startup validator: an unverified mapping is not a valid one.</summary>
+    [Fact]
+    public async Task UpdateAsync_RefusesToSaveWhenGlIsUnreachable()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService(StubGeneralLedgerService.Unreachable()));
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(
+            new UpdateGlAccountConfigRequest { InventoryAccountCode = "1100" }, 1));
+
+        Assert.Equal(ErrorCodes.GlServiceUnavailable, ex.Code);
+        await AssertNothingStoredAsync(db);
+    }
+
+    [Fact]
+    public async Task UpdateAsync_RefusesToSaveAgainstAnEmptyChartOfAccounts()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([]));
+        var rowVersion = (await service.GetAsync()).RowVersion;
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(
+            new UpdateGlAccountConfigRequest { InventoryAccountCode = "1100" }, rowVersion));
+
+        Assert.Equal(ErrorCodes.GlAccountInvalid, ex.Code);
+        Assert.Equal(503, ex.StatusCode);
+    }
+
+    [Fact]
+    public async Task UpdateAsync_RejectsAStaleIfMatch()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1100")]));
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(
+            new UpdateGlAccountConfigRequest { InventoryAccountCode = "1100" }, expectedRowVersion: 9999));
+
+        Assert.Equal(ErrorCodes.ConcurrencyConflict, ex.Code);
+        Assert.Equal(412, ex.StatusCode);
+    }
+
+    /// <summary>An empty string clears a role rather than storing "" and posting it to GL.</summary>
+    [Fact]
+    public async Task UpdateAsync_TreatsBlankAsCleared()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var gl = new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1100")]);
+        var service = CreateService(db, gl);
+        var rowVersion = (await service.GetAsync()).RowVersion;
+
+        await service.UpdateAsync(new UpdateGlAccountConfigRequest { InventoryAccountCode = "   " }, rowVersion);
+
+        var codes = await CreateService(db, gl).GetCodesAsync();
+        Assert.Null(codes.GetOrNull(GlAccountRole.Inventory));
+    }
+
+    /// <summary>Reading an unmapped role names the role, instead of posting "" and letting GL 404.</summary>
+    [Fact]
+    public async Task GetCodesAsync_ThrowsNamingTheRole_WhenUnmapped()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([]));
+
+        var codes = await service.GetCodesAsync();
+        var ex = Assert.Throws<DomainException>(() => codes[GlAccountRole.Cogs]);
+
+        Assert.Equal(ErrorCodes.GlAccountNotConfigured, ex.Code);
+        Assert.Contains("Cogs", ex.Message);
+    }
+
+    /// <summary>One request can post through several services; they should not each re-read the row.</summary>
+    [Fact]
+    public async Task GetCodesAsync_ReadsOncePerScope()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([]));
+
+        var first = await service.GetCodesAsync();
+        var second = await service.GetCodesAsync();
+
+        Assert.Same(first, second);
+    }
+
+    /// <summary>GL being down must not stop the saved mapping from rendering on the settings screen.</summary>
+    [Fact]
+    public async Task GetAsync_StillReturnsTheMapping_WhenGlIsUnreachable()
+    {
+        await using var db = await CreateSeededContextAsync(c => c.InventoryAccountCode = "1100");
+        var service = CreateService(db, new StubGeneralLedgerService(StubGeneralLedgerService.Unreachable()));
+
+        var result = await service.GetAsync();
+
+        Assert.True(result.Value.GlUnavailable);
+        Assert.Empty(result.Value.Options);
+        var inventory = result.Value.Mappings.Single(m => m.Role == nameof(GlAccountRole.Inventory));
+        Assert.Equal("1100", inventory.AccountCode);
+    }
+
+    /// <summary>The 2026-10-07 state: a stored code GL does not have is shown flagged, not blank.</summary>
+    [Fact]
+    public async Task GetAsync_FlagsAStoredCodeThatGlDoesNotHave()
+    {
+        await using var db = await CreateSeededContextAsync(c =>
+        {
+            c.InventoryAccountCode = "1100";
+            c.CashAccountCode = "1000-01";
+        });
+        var service = CreateService(db, new StubGeneralLedgerService([
+            StubGeneralLedgerService.Postable("1000-01", "Cash in Hand")
+        ]));
+
+        var result = await service.GetAsync();
+
+        Assert.False(result.Value.Mappings.Single(m => m.Role == nameof(GlAccountRole.Inventory)).ExistsInGl);
+        Assert.True(result.Value.Mappings.Single(m => m.Role == nameof(GlAccountRole.Cash)).ExistsInGl);
+    }
+
+    /// <summary>The picker must only offer what validation will accept.</summary>
+    [Fact]
+    public async Task GetAsync_OffersOnlyPostableActiveAccounts()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([
+            StubGeneralLedgerService.Postable("1100", "Inventory"),
+            StubGeneralLedgerService.NotPostable("1000", "Bank and Cash"),
+            new GlAccount("1200", "Retired", 1, true, false)
+        ]));
+
+        var options = (await service.GetAsync()).Value.Options;
+
+        Assert.Equal(["1100"], options.Select(o => o.AccountCode));
+    }
+
+    private static async Task AssertNothingStoredAsync(ErpDbContext db)
+    {
+        var row = await new Repository<GlAccountConfig>(db).GetByIdAsync(GlAccountConfig.SingletonId);
+        Assert.Null(row!.InventoryAccountCode);
+        Assert.Null(row.ClearingAccountCode);
+        Assert.Null(row.CashAccountCode);
+    }
+
+    private static async Task<ErpDbContext> CreateSeededContextAsync(Action<GlAccountConfig>? configure = null)
+    {
+        var db = NotificationConfigTestSupport.CreateContext(Guid.NewGuid().ToString("N"));
+        db.Users.Add(new User { UserId = User.SystemUserId, Username = "system", DisplayName = "System" });
+
+        var config = new GlAccountConfig { ConfigId = GlAccountConfig.SingletonId };
+        configure?.Invoke(config);
+        db.GlAccountConfig.Add(config);
+        await db.SaveChangesAsync();
+        return db;
+    }
+
+    private static GlAccountConfigService CreateService(ErpDbContext db, IGeneralLedgerService gl) =>
+        new(new Repository<GlAccountConfig>(db), gl, new TestCurrentUser(), new ERPCore.Infra.UoW.UnitOfWork(db));
+}
@@ -0,0 +1,366 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Infra.Auth;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.Services.Stock;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Storage;
+
+namespace ERPCore.Tests;
+
+/// <summary>
+/// Serial/batch rules from docs/ITEM_TRACKING_PLAN.md that live outside the MariaDB-only FIFO
+/// SQL: the sales-line check (<see cref="SalesDomainService.ValidateLineTrackingAsync"/>) and the
+/// shared stock-document rules (<see cref="SerialTrackingService"/>).
+/// </summary>
+public class ItemTrackingTests
+{
+    private static readonly InMemoryDatabaseRoot Root = new();
+
+    private const int Wh1 = 1;
+    private const int Wh2 = 2;
+    private const int SerialItemId = 10;
+    private const int BatchItemId = 20;
+    private const int PlainItemId = 30;
+
+    // --- sales line validation --------------------------------------------------------------
+
+    [Fact]
+    public async Task SalesLine_SerialItem_RequiresOneSerialPerUnit()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 2, null, new[] { 1 }, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.TrackingRequired, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_SerialItem_WithoutSerials_IsRejected_WhenNoPreTrackingStockIsLeft()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 1, null, null, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.TrackingRequired, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_SerialItem_WithoutSerials_IsAllowed_FromPreTrackingStock()
+    {
+        await using var db = await SeedAsync();
+        // D6: stock received before serial capture — a layer with no serial.
+        db.StockLayers.Add(new StockLayer { ItemId = SerialItemId, WarehouseId = Wh1, QtyReceived = 3, QtyRemaining = 3, UnitCost = 10, ReceiptDate = DateTime.UtcNow });
+        await db.SaveChangesAsync();
+        var sales = CreateSalesDomain(db);
+
+        var serials = await sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 2, null, null, new HashSet<int>());
+
+        Assert.Empty(serials);
+    }
+
+    [Fact]
+    public async Task SalesLine_Serial_AtAnotherWarehouse_IsNotAvailable()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        // Serial 3 is in stock at warehouse 2.
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 1, null, new[] { 3 }, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.SerialNotAvailable, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_SoldSerial_IsNotAvailable()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 1, null, new[] { 4 }, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.SerialNotAvailable, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_SameSerialOnTwoLines_IsADuplicate()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+        var documentSerials = new HashSet<int>();
+
+        await sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 1, null, new[] { 1 }, documentSerials);
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 1, null, new[] { 1 }, documentSerials));
+
+        Assert.Equal(ErrorCodes.SerialDuplicate, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_ValidSerials_AreReturned()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var serials = await sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 2, null, new[] { 1, 2 }, new HashSet<int>());
+
+        Assert.Equal(new[] { 1, 2 }, serials.Select(s => s.SerialId).OrderBy(i => i));
+    }
+
+    [Fact]
+    public async Task SalesLine_UntrackedItem_RejectsSerials()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(PlainItemId, Wh1, 1, null, new[] { 1 }, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.Validation, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_ExpiredBatch_IsBlocked()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(BatchItemId, Wh1, 1, 101, null, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.ExpiredBatchBlocked, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_BatchOfAnotherItem_IsRejected()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(PlainItemId, Wh1, 1, 100, null, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.Validation, ex.Code);
+    }
+
+    // --- stock documents (transfers / adjustments / purchase returns) ------------------------
+
+    [Fact]
+    public async Task Outbound_DamagedSerial_OnlyWhenAllowed()
+    {
+        await using var db = await SeedAsync();
+        var tracking = CreateSerialTracking(db);
+        var item = await db.Items.FirstAsync(i => i.ItemId == SerialItemId);
+
+        // Serial 5 is Damaged at warehouse 1: a transfer (InStock only) refuses it...
+        var ex = await Assert.ThrowsAsync<DomainException>(() => tracking.ResolveOutboundAsync(
+            item, Wh1, 1, new[] { 5 }, new HashSet<int>(), new[] { SerialStatus.InStock }));
+        Assert.Equal(ErrorCodes.SerialNotAvailable, ex.Code);
+
+        // ...a write-off or purchase return (InStock or Damaged) takes it.
+        var serials = await tracking.ResolveOutboundAsync(
+            item, Wh1, 1, new[] { 5 }, new HashSet<int>(), new[] { SerialStatus.InStock, SerialStatus.Damaged });
+        Assert.Single(serials);
+    }
+
+    [Fact]
+    public async Task Inbound_SerialAlreadyInStock_IsADuplicate()
+    {
+        await using var db = await SeedAsync();
+        var tracking = CreateSerialTracking(db);
+        var item = await db.Items.FirstAsync(i => i.ItemId == SerialItemId);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => tracking.ResolveInboundAsync(
+            item, Wh1, 1, new[] { "SN-1" }, new HashSet<string>()));
+
+        Assert.Equal(ErrorCodes.SerialDuplicate, ex.Code);
+    }
+
+    [Fact]
+    public async Task Inbound_FractionalQty_IsRejected_ForSerialItems()
+    {
+        await using var db = await SeedAsync();
+        var tracking = CreateSerialTracking(db);
+        var item = await db.Items.FirstAsync(i => i.ItemId == SerialItemId);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => tracking.ResolveInboundAsync(
+            item, Wh1, 1.5m, new[] { "SN-NEW" }, new HashSet<string>()));
+
+        Assert.Equal(ErrorCodes.Validation, ex.Code);
+    }
+
+    [Fact]
+    public async Task Inbound_NewAndSoldSerials_AreCreatedOrBroughtBack()
+    {
+        await using var db = await SeedAsync();
+        var tracking = CreateSerialTracking(db);
+        var item = await db.Items.FirstAsync(i => i.ItemId == SerialItemId);
+
+        // SN-4 is Sold (out of stock) — it comes back; SN-NEW does not exist — it is created.
+        var serials = await tracking.ResolveInboundAsync(item, Wh1, 2, new[] { "SN-4", "SN-NEW" }, new HashSet<string>());
+        await tracking.MoveAsync(serials, SerialStatus.InStock, Wh1, null, "ADJ", 1, DateTime.UtcNow);
+        await db.SaveChangesAsync();
+
+        var all = await db.Serials.Where(s => s.ItemId == SerialItemId && (s.SerialNo == "SN-4" || s.SerialNo == "SN-NEW")).ToListAsync();
+        Assert.All(all, s => Assert.Equal(SerialStatus.InStock, s.Status));
+        Assert.All(all, s => Assert.Equal(Wh1, s.WarehouseId));
+        Assert.Equal(2, await db.SerialMovements.CountAsync(m => m.SourceDocType == "ADJ"));
+    }
+
+    [Fact]
+    public async Task Move_RecordsHistory_WithPreviousWarehouse()
+    {
+        await using var db = await SeedAsync();
+        var tracking = CreateSerialTracking(db);
+        var serial = await db.Serials.FirstAsync(s => s.SerialId == 1);
+
+        await tracking.MoveAsync(new[] { serial }, SerialStatus.InTransit, null, null, "TRF", 7, DateTime.UtcNow);
+        await db.SaveChangesAsync();
+
+        var movement = await db.SerialMovements.SingleAsync(m => m.SerialId == 1);
+        Assert.Equal(SerialStatus.InTransit, movement.Status);
+        Assert.Equal(Wh1, movement.FromWarehouseId);
+        Assert.Null(movement.WarehouseId);
+        Assert.Null(serial.WarehouseId);
+    }
+
+    // --- auto-generated serial numbers -------------------------------------------------------
+
+    [Fact]
+    public async Task NextNumbers_ContinueAfterHighestUsed_AndSkipDraftGrnNumbers()
+    {
+        await using var db = await SeedAsync();
+        db.Serials.Add(new Serial { SerialId = 50, ItemId = SerialItemId, SerialNo = "PH-0041", Status = SerialStatus.Sold });
+        // A draft GRN line already holds PH-0042 (not yet a Serial).
+        db.GrnLines.Add(new GrnLine { GrnLineId = 900, GrnId = 1, ItemId = SerialItemId, Qty = 1,
+            Serials = { new GrnLineSerial { SerialNo = "PH-0042" } } });
+        await db.SaveChangesAsync();
+        var tracking = new ItemTrackingService(db, null!);
+
+        var next = await tracking.NextSerialNumbersAsync(SerialItemId, "PH-", 3);
+
+        Assert.Equal(new[] { "PH-0043", "PH-0044", "PH-0045" }, next);
+    }
+
+    [Fact]
+    public async Task NextNumbers_StartAtOne_ForANewPrefix_AndIgnoreOtherItems()
+    {
+        await using var db = await SeedAsync();
+        db.Serials.Add(new Serial { SerialId = 51, ItemId = PlainItemId, SerialNo = "NEW-0099", Status = SerialStatus.InStock });
+        await db.SaveChangesAsync();
+        var tracking = new ItemTrackingService(db, null!);
+
+        var next = await tracking.NextSerialNumbersAsync(SerialItemId, "NEW-", 2);
+
+        Assert.Equal(new[] { "NEW-0001", "NEW-0002" }, next);
+    }
+
+    [Fact]
+    public async Task NextNumbers_RejectsTooMany()
+    {
+        await using var db = await SeedAsync();
+        var tracking = new ItemTrackingService(db, null!);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => tracking.NextSerialNumbersAsync(SerialItemId, "X-", 5000));
+
+        Assert.Equal(ErrorCodes.Validation, ex.Code);
+    }
+
+    // --- fixtures ---------------------------------------------------------------------------
+
+    private static async Task<ErpDbContext> SeedAsync()
+    {
+        var db = CreateContext();
+        db.Items.AddRange(
+            new Item { ItemId = SerialItemId, Sku = "SER-1", Name = "Phone", CategoryId = 1, BaseUomId = 1, StockNature = StockNature.Stocked, TrackingMode = TrackingMode.Serial },
+            new Item { ItemId = BatchItemId, Sku = "BAT-1", Name = "Milk", CategoryId = 1, BaseUomId = 1, StockNature = StockNature.Stocked, TrackingMode = TrackingMode.Batch },
+            new Item { ItemId = PlainItemId, Sku = "PLN-1", Name = "Bolt", CategoryId = 1, BaseUomId = 1, StockNature = StockNature.Stocked, TrackingMode = TrackingMode.None });
+        db.Batches.AddRange(
+            new Batch { BatchId = 100, ItemId = BatchItemId, BatchNo = "B-OK", ExpiryDate = DateOnly.FromDateTime(DateTime.UtcNow).AddDays(30) },
+            new Batch { BatchId = 101, ItemId = BatchItemId, BatchNo = "B-EXP", ExpiryDate = DateOnly.FromDateTime(DateTime.UtcNow).AddDays(-1) });
+        db.Serials.AddRange(
+            new Serial { SerialId = 1, ItemId = SerialItemId, SerialNo = "SN-1", Status = SerialStatus.InStock, WarehouseId = Wh1 },
+            new Serial { SerialId = 2, ItemId = SerialItemId, SerialNo = "SN-2", Status = SerialStatus.InStock, WarehouseId = Wh1 },
+            new Serial { SerialId = 3, ItemId = SerialItemId, SerialNo = "SN-3", Status = SerialStatus.InStock, WarehouseId = Wh2 },
+            new Serial { SerialId = 4, ItemId = SerialItemId, SerialNo = "SN-4", Status = SerialStatus.Sold, WarehouseId = null },
+            new Serial { SerialId = 5, ItemId = SerialItemId, SerialNo = "SN-5", Status = SerialStatus.Damaged, WarehouseId = Wh1 });
+        await db.SaveChangesAsync();
+        return db;
+    }
+
+    private static ErpDbContext CreateContext()
+    {
+        var options = new DbContextOptionsBuilder<ErpDbContext>()
+            .UseInMemoryDatabase(Guid.NewGuid().ToString("N"), Root)
+            .Options;
+        var currentUser = new TestCurrentUser();
+        return new ErpDbContext(options, currentUser, new CurrentBranchContext(currentUser));
+    }
+
+    // Pricing is never touched by the tracking check, so it is not wired.
+    private static SalesDomainService CreateSalesDomain(ErpDbContext db) => new(
+        new Repository<Customer>(db), new Repository<Warehouse>(db), new Repository<User>(db),
+        new Repository<Item>(db), new Repository<TaxRate>(db), null!, new Repository<SalesConfig>(db),
+        new Repository<Batch>(db), new Repository<Serial>(db), new Repository<StockLayer>(db),
+        CreateSerialTracking(db));
+
+    private static SerialTrackingService CreateSerialTracking(ErpDbContext db) => new(
+        new Repository<Serial>(db), new Repository<SerialMovement>(db), new Repository<StockLayer>(db),
+        new Repository<ProductConfig>(db), new TestCurrentUser());
+
+    private static async Task SwitchSerialNumbersAsync(ErpDbContext db, bool enabled)
+    {
+        db.ProductConfig.Add(new ProductConfig { ConfigId = ProductConfig.SingletonId, SerialNumbersEnabled = enabled });
+        await db.SaveChangesAsync();
+    }
+
+    // --- Product Configuration "Serial numbers" switch ---------------------------------------
+
+    [Fact]
+    public async Task SwitchOff_SerialItemSells_WithoutSerials()
+    {
+        await using var db = await SeedAsync();
+        await SwitchSerialNumbersAsync(db, enabled: false);
+        var sales = CreateSalesDomain(db);
+
+        // No pre-tracking stock exists, yet nothing is asked: the item is plain stock now.
+        var serials = await sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 5, null, null, new HashSet<int>());
+
+        Assert.Empty(serials);
+    }
+
+    [Fact]
+    public async Task SwitchOff_SerialsSent_AreRefused()
+    {
+        await using var db = await SeedAsync();
+        await SwitchSerialNumbersAsync(db, enabled: false);
+        var sales = CreateSalesDomain(db);
+        var tracking = CreateSerialTracking(db);
+        var item = await db.Items.FirstAsync(i => i.ItemId == SerialItemId);
+
+        var sale = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 1, null, new[] { 1 }, new HashSet<int>()));
+        var adjustment = await Assert.ThrowsAsync<DomainException>(() =>
+            tracking.ResolveInboundAsync(item, Wh1, 1, new[] { "SN-X" }, new HashSet<string>()));
+
+        Assert.Equal(ErrorCodes.ConfigDisabled, sale.Code);
+        Assert.Equal(ErrorCodes.ConfigDisabled, adjustment.Code);
+    }
+
+    [Fact]
+    public async Task SwitchOn_IsTheDefault_WhenConfigRowIsMissing()
+    {
+        await using var db = await SeedAsync();
+        Assert.True(await CreateSerialTracking(db).IsEnabledAsync());
+    }
+}
@@ -0,0 +1,116 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Notifications;
+using ERPCore.Dtos.Stock;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services.Interfaces;
+using ERPCore.Services.Stock;
+using ERPCore.Tests.TestSupport;
+
+namespace ERPCore.Tests;
+
+/// <summary>Low-stock / reorder alerts raised after stock issues.</summary>
+public class LowStockAlertServiceTests
+{
+    private const int ItemId = 1, WarehouseId = 1;
+
+    [Theory]
+    [InlineData(12, 4, 8, true)]    // 12 → 8 crosses the alert level of 10
+    [InlineData(12, 2, 10, true)]   // landing exactly on the level counts
+    [InlineData(20, 5, 15, false)]  // still above the level
+    [InlineData(9, 3, 6, false)]    // was already low — no repeat alert on every sale
+    public async Task Alerts_OnlyWhenAnIssueCrossesTheReorderPoint(decimal before, decimal issued, decimal after, bool alerts)
+    {
+        Assert.Equal(before - issued, after);
+        await using var db = Seed();
+        var tracker = new LowStockTracker();
+        tracker.Track(ItemId, WarehouseId, issued);
+        var notifications = new RecordingNotifications();
+
+        await Service(db, tracker, after, notifications).CheckAsync();
+
+        if (!alerts)
+        {
+            Assert.Empty(notifications.Raised);
+            return;
+        }
+        var raised = Assert.Single(notifications.Raised);
+        Assert.Equal(LowStockAlertService.ModuleKey, raised.ModuleKey);
+        Assert.Contains("SKU-1", raised.Message);
+        Assert.Contains($"down to {after:0.####} pcs at WH-1", raised.Message);
+        Assert.Contains("Suggested reorder: 50 pcs", raised.Message);
+    }
+
+    [Fact]
+    public async Task ItemsWithoutARule_OrUntouched_AreIgnored()
+    {
+        await using var db = Seed();
+        var tracker = new LowStockTracker();
+        tracker.Track(itemId: 99, WarehouseId, 100);     // no rule for this item
+        var notifications = new RecordingNotifications();
+
+        await Service(db, tracker, available: 0, notifications).CheckAsync();
+        await Service(db, new LowStockTracker(), available: 0, notifications).CheckAsync();  // nothing issued
+
+        Assert.Empty(notifications.Raised);
+    }
+
+    [Fact]
+    public async Task Tracker_SumsIssuesWithinARequest_AndEmptiesWhenDrained()
+    {
+        var tracker = new LowStockTracker();
+        tracker.Track(ItemId, WarehouseId, 3);
+        tracker.Track(ItemId, WarehouseId, 4);
+        tracker.Track(ItemId, WarehouseId, 0);
+
+        Assert.Equal(7m, tracker.Drain()[(ItemId, WarehouseId)]);
+        Assert.Empty(tracker.Drain());
+    }
+
+    private static LowStockAlertService Service(ErpDbContext db, LowStockTracker tracker, decimal available, INotificationService notifications)
+        => new(tracker, new Repository<ItemReorder>(db), new FixedStock(available), notifications);
+
+    private static ErpDbContext Seed()
+    {
+        var db = BankDepositTestSupport.CreateContext();   // users, branches, warehouses WH-1 / WH-2
+        db.Uoms.Add(new Uom { UomId = 1, Name = "pcs" });
+        db.Items.Add(new Item { ItemId = ItemId, Sku = "SKU-1", Name = "Cola 500ml", BaseUomId = 1, CategoryId = 1 });
+        db.ItemReorders.Add(new ItemReorder { ReorderId = 1, ItemId = ItemId, WarehouseId = WarehouseId, ReorderPoint = 10, ReorderQty = 50 });
+        db.SaveChanges();
+        return db;
+    }
+
+    private sealed class FixedStock(decimal available) : IStockService
+    {
+        public Task<StockOnHandDto> GetOnHandAsync(int itemId, int warehouseId, CancellationToken ct = default)
+            => Task.FromResult(new StockOnHandDto(itemId, warehouseId, available, available, 0, 0, 0, DateTime.UtcNow));
+        public Task<PagedResponse<StockOnHandDto>> GetOnHandListAsync(int? itemId, int? warehouseId, int? branchId, PageQuery query, CancellationToken ct = default)
+            => throw new NotSupportedException();
+        public Task<IReadOnlyDictionary<int, decimal>> GetAvailableByItemAsync(int warehouseId, CancellationToken ct = default)
+            => throw new NotSupportedException();
+        public Task<PagedResponse<StockLedgerRowDto>> GetLedgerAsync(int? itemId, int? warehouseId, int? branchId, DateOnly? from, DateOnly? to,
+            string? sourceDocType, int? sourceDocId, PageQuery query, CancellationToken ct = default) => throw new NotSupportedException();
+        public Task<StockValuationDto> GetValuationAsync(int itemId, int warehouseId, CancellationToken ct = default)
+            => throw new NotSupportedException();
+    }
+
+    private sealed class RecordingNotifications : INotificationService
+    {
+        public List<(string ModuleKey, string Title, string Message)> Raised { get; } = new();
+
+        public Task RaiseAsync(string moduleKey, string title, string message, string? relatedEntityType = null,
+            int? relatedEntityId = null, CancellationToken ct = default)
+        {
+            Raised.Add((moduleKey, title, message));
+            return Task.CompletedTask;
+        }
+
+        public Task NotifyUsersAsync(IEnumerable<int> userIds, string moduleKey, string title, string message,
+            string? relatedEntityType = null, int? relatedEntityId = null, CancellationToken ct = default) => throw new NotSupportedException();
+
+        public Task<NotificationFeedDto> GetFeedAsync(int userId, int take = 20, CancellationToken ct = default) => throw new NotSupportedException();
+        public Task MarkAllReadAsync(int userId, CancellationToken ct = default) => throw new NotSupportedException();
+    }
+}
@@ -30,7 +30,7 @@ public class NotificationConfigServiceTests

        var result = await service.GetAsync();

-        Assert.Equal(7u, result.RowVersion);
+        Assert.Equal(1u, result.RowVersion);
        Assert.Contains(result.Value.Modules, m => m.ModuleKey == "sale.create" && m.EmailEnabled && !m.SmsEnabled && m.InAppEnabled);
        Assert.Contains(result.Value.Modules, m => m.ModuleKey == "grn.confirmed" && !m.EmailEnabled && !m.SmsEnabled && !m.InAppEnabled);
    }
@@ -55,9 +55,9 @@ public class NotificationConfigServiceTests
            }).ToList()
        };

-        var updated = await service.UpdateAsync(request, 7);
+        var updated = await service.UpdateAsync(request, 1);

-        Assert.Equal(7u, updated.RowVersion);
+        Assert.Equal(2u, updated.RowVersion);
        Assert.Contains(updated.Value.Modules, m => m.ModuleKey == catalog.GetAll()[0].Key && m.EmailEnabled && !m.SmsEnabled && !m.InAppEnabled);
        Assert.Contains(updated.Value.Modules, m => m.ModuleKey == catalog.GetAll()[1].Key && !m.EmailEnabled && m.SmsEnabled && m.InAppEnabled);

@@ -133,7 +133,7 @@ public class NotificationConfigServiceTests
            }).ToList()
        };

-        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(request, 7));
+        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(request, 1));
        Assert.Equal(ErrorCodes.ConcurrencyConflict, ex.Code);
        Assert.Equal(412, ex.StatusCode);
    }
@@ -0,0 +1,124 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Production;
+using ERPCore.Infra.Auth;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services.Production;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Storage;
+
+namespace ERPCore.Tests;
+
+/// <summary>
+/// Covers the 412 translation on the two production services, which save through
+/// <c>ExecuteInTransactionAsync</c> rather than a bare <c>SaveChangesAsync</c> and so guard
+/// concurrency differently from the inline pattern the other services use.
+/// </summary>
+public class ProductionConcurrencyTests
+{
+    private static readonly InMemoryDatabaseRoot Root = new();
+
+    [Fact]
+    public async Task TemplateUpdateAsync_MapsConcurrencyFailuresToDomainException()
+    {
+        await using var db = CreateContext();
+
+        // Validation runs before the transaction opens, so the referenced item has to exist.
+        db.Items.Add(new Item
+        {
+            ItemId = 1,
+            Sku = "FG-1",
+            Name = "Finished good",
+            CategoryId = 1,
+            BaseUomId = 1,
+            Status = EntityStatus.Active
+        });
+        await db.SaveChangesAsync();
+
+        var service = CreateTemplateService(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(
+            () => service.UpdateAsync(1, SingleStageTemplate(), expectedRowVersion: 1));
+
+        Assert.Equal(ErrorCodes.ConcurrencyConflict, ex.Code);
+        Assert.Equal(412, ex.StatusCode);
+    }
+
+    [Fact]
+    public async Task RunUpdateStageQuantitiesAsync_MapsConcurrencyFailuresToDomainException()
+    {
+        await using var db = CreateContext();
+        var service = CreateRunService(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(
+            () => service.UpdateStageQuantitiesAsync(1, 1, new UpdateStageQuantitiesRequest()));
+
+        Assert.Equal(ErrorCodes.ConcurrencyConflict, ex.Code);
+        Assert.Equal(412, ex.StatusCode);
+    }
+
+    /// <summary>
+    /// The smallest graph the validator accepts: one stage (both entry and terminal) with a
+    /// stock input and a single item-bearing output, and no edges.
+    /// </summary>
+    private static SaveTemplateRequest SingleStageTemplate() => new()
+    {
+        Code = "TPL-1",
+        Name = "Template 1",
+        Stages =
+        [
+            new SaveStageRequest
+            {
+                Key = "tmp-1",
+                Name = "Mix",
+                Inputs =
+                [
+                    new SaveInputRequest
+                    {
+                        Source = StageInputSource.Stock,
+                        ItemId = 1,
+                        QtyUnit = StageQtyUnit.Pack,
+                        QtyPerBatch = 1m
+                    }
+                ],
+                Outputs =
+                [
+                    new SaveOutputRequest { Key = "tmp-o1", Name = "Output", ItemId = 1, QtyPerBatch = 1m }
+                ]
+            }
+        ]
+    };
+
+    private static ErpDbContext CreateContext()
+    {
+        var options = new DbContextOptionsBuilder<ErpDbContext>()
+            .UseInMemoryDatabase(Guid.NewGuid().ToString("N"), Root)
+            .Options;
+
+        // The real CurrentBranchContext over an unauthenticated user yields IsActive=false,
+        // which leaves the branch query filters off: what a unit test wants.
+        var currentUser = new TestCurrentUser();
+        return new ErpDbContext(options, currentUser, new CurrentBranchContext(currentUser));
+    }
+
+    private static ProductionTemplateService CreateTemplateService(ErpDbContext db)
+        => new(
+            new Repository<ProductionTemplate>(db), new Repository<TemplateStage>(db),
+            new Repository<StageInput>(db), new Repository<StageOutput>(db),
+            new Repository<StageEdge>(db), new Repository<Item>(db),
+            new Repository<Uom>(db), new Repository<ProductionRun>(db),
+            new ThrowingTransactionUnitOfWork(), new TestCurrentUser());
+
+    // The costing, measurement and numbering collaborators are only ever touched inside the
+    // transaction lambda, which ThrowingTransactionUnitOfWork never invokes.
+    private static ProductionRunService CreateRunService(ErpDbContext db)
+        => new(
+            new Repository<ProductionRun>(db), new Repository<ProductionTemplate>(db),
+            new Repository<Warehouse>(db), new Repository<Bin>(db),
+            new Repository<Item>(db), new Repository<ReasonCode>(db),
+            fifo: null!, measure: null!, numbers: null!,
+            new ThrowingTransactionUnitOfWork(), new TestCurrentUser());
+}
@@ -0,0 +1,168 @@
+using ERPCore.Common.Http;
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Config;
+using ERPCore.Infra.Auth;
+using ERPCore.Infra.Gl;
+using ERPCore.Infra.Persistence;
+using ERPCore.Infra.UoW;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.Services.Gl;
+using ERPCore.Services.Interfaces;
+using ERPCore.System.Errors;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Storage;
+using Microsoft.Extensions.Configuration;
+
+namespace ERPCore.Tests.TestSupport;
+
+/// <summary>Records every journal it is asked to post; can be told to reject them instead.</summary>
+internal sealed class FakeGeneralLedger : IGeneralLedgerService
+{
+    public const long CashAccountId = 1, BankAccountId = 2, OtherBankAccountId = 3;
+
+    public List<GlJournalEntryRequest> Posted { get; } = new();
+    public bool Reject { get; set; }
+
+    public IReadOnlyList<GlBankAccount> Accounts { get; init; } =
+    [
+        new("Cash", CashAccountId, "Main Till", null, "Petty", null, 101, "1000-01", "LKR"),
+        new("Bank", BankAccountId, "BOC Current", "Bank of Ceylon", null, "0001234567", 102, "1010-01", "LKR"),
+        new("Bank", OtherBankAccountId, "HNB Savings", "Hatton National Bank", null, "9876543210", 103, "1010-02", "LKR")
+    ];
+
+    public Task<GeneralLedgerResponse> ForwardAsync(HttpMethod method, string path, string? queryString, string? contentType, Stream? body, CancellationToken ct)
+        => throw new NotSupportedException();
+
+    public Task<GlJournalEntryResult> PostJournalEntryAsync(GlJournalEntryRequest request, CancellationToken ct)
+    {
+        if (Reject) throw new DomainException(ErrorCodes.Validation, "GL rejected the entry.", 502);
+        Posted.Add(request);
+        return Task.FromResult(new GlJournalEntryResult($"JE-{Posted.Count}", true));
+    }
+
+    public Task<GlPeriod> GetPeriodByDateAsync(DateOnly date, CancellationToken ct) => Task.FromResult(new GlPeriod(1, 1));
+
+    public Task<IReadOnlyList<GlBankAccount>> ListBankAccountsAsync(CancellationToken ct) => Task.FromResult(Accounts);
+}
+
+/// <summary>The in-memory provider has no transactions: run the work, then save — what the real one commits.</summary>
+internal sealed class PassThroughUnitOfWork(ErpDbContext db) : IUnitOfWork
+{
+    public Task<int> SaveChangesAsync(CancellationToken ct = default) => db.SaveChangesAsync(ct);
+
+    public async Task ExecuteInTransactionAsync(Func<CancellationToken, Task> action, CancellationToken ct = default)
+    {
+        await action(ct);
+        await db.SaveChangesAsync(ct);
+    }
+
+    public async Task<T> ExecuteInTransactionAsync<T>(Func<CancellationToken, Task<T>> action, CancellationToken ct = default)
+    {
+        var result = await action(ct);
+        await db.SaveChangesAsync(ct);
+        return result;
+    }
+}
+
+internal sealed class FakeNumberSequence : INumberSequenceService
+{
+    private int _next;
+    public Task<string> NextAsync(string docType, int branchId, CancellationToken ct = default) => Task.FromResult($"{docType}-{++_next:00000}");
+    public Task<string> NextAsync(string docType, CancellationToken ct = default) => Task.FromResult($"{docType}-{++_next:00000}");
+}
+
+/// <summary>Branching on: the requested branch is used as-is.</summary>
+internal sealed class FakeBranchConfig : IBranchConfigService
+{
+    public Task<ETagged<BranchConfigDto>> GetAsync(CancellationToken ct = default) => throw new NotSupportedException();
+    public Task<ETagged<BranchConfigDto>> UpdateAsync(UpdateBranchConfigRequest request, uint expectedRowVersion, CancellationToken ct = default)
+        => throw new NotSupportedException();
+    public Task<bool> IsBranchingEnabledAsync(CancellationToken ct = default) => Task.FromResult(true);
+    public Task<int> ResolveBranchIdAsync(int requestedBranchId, CancellationToken ct = default)
+        => requestedBranchId > 0 ? Task.FromResult(requestedBranchId) : throw new DomainException(ErrorCodes.Validation, "Branch is required.", 422);
+    public Task<bool> IsWarehouseBranchingEnabledAsync(CancellationToken ct = default) => Task.FromResult(true);
+    public Task<int> ResolveWarehouseBranchIdAsync(int requestedBranchId, CancellationToken ct = default) => Task.FromResult(requestedBranchId);
+    public Task<int> ResolveDefaultBranchIdAsync(CancellationToken ct = default) => Task.FromResult(1);
+}
+
+/// <summary>Seeds and services for the cash-in-hand / bank-deposit tests. Two branches, one warehouse each.</summary>
+internal static class BankDepositTestSupport
+{
+    private static readonly InMemoryDatabaseRoot Root = new();
+
+    public const int Branch1 = 1, Branch2 = 2;
+    public const int Warehouse1 = 1, Warehouse2 = 2;
+
+    public static BusinessDayClock Clock { get; } = new(Config());
+
+    public static IConfiguration Config(DateOnly? trackingStart = null) => new ConfigurationBuilder()
+        .AddInMemoryCollection(new Dictionary<string, string?>
+        {
+            ["DayEndReport:TimeZone"] = "Asia/Colombo",
+            ["BankDeposit:DefaultCashAccountCode"] = "1000-01",
+            ["BankDeposit:CashTrackingStartDate"] = trackingStart?.ToString("yyyy-MM-dd")
+        })
+        .Build();
+
+    /// <summary>Midday on a local business day, as the UTC instant documents are stamped with.</summary>
+    public static DateTime At(DateOnly day) => Clock.ToUtc(day).AddHours(6);
+
+    public static ErpDbContext CreateContext()
+    {
+        var options = new DbContextOptionsBuilder<ErpDbContext>()
+            .UseInMemoryDatabase(Guid.NewGuid().ToString("N"), Root)
+            .Options;
+        var currentUser = new TestCurrentUser();
+        var db = new ErpDbContext(options, currentUser, new CurrentBranchContext(currentUser));
+
+        db.Users.Add(new User { UserId = User.SystemUserId, Username = "system", DisplayName = "System" });
+        db.Branches.AddRange(
+            new Branch { BranchId = Branch1, Code = "BR-001", Name = "Colombo" },
+            new Branch { BranchId = Branch2, Code = "BR-002", Name = "Kandy" });
+        db.Warehouses.AddRange(
+            new Warehouse { WarehouseId = Warehouse1, Code = "WH-1", Name = "Colombo Store", BranchId = Branch1 },
+            new Warehouse { WarehouseId = Warehouse2, Code = "WH-2", Name = "Kandy Store", BranchId = Branch2 });
+        db.SaveChanges();
+        return db;
+    }
+
+    private static int _id;
+
+    public static SalesSlip CashSlip(DateOnly day, decimal cash, decimal card = 0m, int warehouseId = Warehouse1)
+    {
+        var id = Interlocked.Increment(ref _id);
+        return new SalesSlip
+        {
+            SalesSlipId = id, SlipNo = $"SL-{id}", SlipDate = At(day), Status = SalesSlipStatus.Posted, WarehouseId = warehouseId,
+            GrandTotal = cash + card, PaidAmount = cash + card, CashAmount = cash, CardAmount = card
+        };
+    }
+
+    public static CashInHandService CashService(ErpDbContext db, DateOnly? trackingStart)
+        => new(new Repository<SalesSlip>(db), new Repository<BundleSale>(db), new Repository<SalesInvoicePayment>(db),
+            new Repository<ExpensePayment>(db), new Repository<BankDeposit>(db),
+            new CurrentBranchContext(new TestCurrentUser()), Clock, Config(trackingStart));
+
+    public static BankDepositService DepositService(ErpDbContext db, DateOnly? trackingStart, FakeGeneralLedger gl)
+    {
+        var currentUser = new TestCurrentUser();
+        return new BankDepositService(
+            new Repository<BankDeposit>(db), new Repository<Branch>(db), CashService(db, trackingStart), gl,
+            currentUser, new CurrentBranchContext(currentUser), new FakeNumberSequence(), new FakeBranchConfig(),
+            new PassThroughUnitOfWork(db), db, Clock);
+    }
+
+    public static BankDeposit Deposit(DateOnly businessDate, decimal amount, int branchId = Branch1,
+        BankDepositStatus status = BankDepositStatus.Posted)
+    {
+        var id = Interlocked.Increment(ref _id);
+        return new BankDeposit
+        {
+            BankDepositId = id, DocNo = $"BD-{id}", BranchId = branchId, BusinessDate = businessDate, DepositDate = businessDate,
+            Amount = amount, Status = status, FromCashAccountCode = "1000-01", FromCashAccountName = "Main Till",
+            ToBankAccountCode = "1010-01", ToBankAccountName = "BOC Current", CreatedBy = User.SystemUserId
+        };
+    }
+}
@@ -0,0 +1,66 @@
+using ERPCore.Infra.Gl;
+using ERPCore.Services.Gl;
+using ERPCore.Services.Interfaces;
+using ERPCore.System.Errors;
+
+namespace ERPCore.Tests.TestSupport;
+
+/// <summary>
+/// Stands in for the external GL service. Only <see cref="ListAccountsAsync"/> is implemented —
+/// nothing under test here posts a journal, and leaving the rest throwing means a test that starts
+/// doing so fails loudly rather than against a silently empty fake.
+/// </summary>
+internal sealed class StubGeneralLedgerService : IGeneralLedgerService
+{
+    private readonly IReadOnlyList<GlAccount> _accounts;
+    private readonly Exception? _throws;
+
+    public StubGeneralLedgerService(IReadOnlyList<GlAccount> accounts) => _accounts = accounts;
+    public StubGeneralLedgerService(Exception throws) { _accounts = []; _throws = throws; }
+
+    public int Calls { get; private set; }
+
+    /// <summary>A postable, active account — the ordinary case.</summary>
+    public static GlAccount Postable(string code, string name = "Account", short type = 1) => new(code, name, type, true, true);
+
+    /// <summary>A header/control account. GL rejects journal lines against these.</summary>
+    public static GlAccount NotPostable(string code, string name = "Header", short type = 1) => new(code, name, type, false, true);
+
+    public Task<IReadOnlyList<GlAccount>> ListAccountsAsync(CancellationToken ct)
+    {
+        Calls++;
+        return _throws is not null
+            ? Task.FromException<IReadOnlyList<GlAccount>>(_throws)
+            : Task.FromResult(_accounts);
+    }
+
+    public Task<GeneralLedgerResponse> ForwardAsync(
+        HttpMethod method, string path, string? queryString, string? contentType, Stream? body, CancellationToken ct)
+        => throw new NotSupportedException();
+
+    public Task<GlJournalEntryResult> PostJournalEntryAsync(GlJournalEntryRequest request, CancellationToken ct)
+        => throw new NotSupportedException();
+
+    public Task<GlPeriod> GetPeriodByDateAsync(DateOnly date, CancellationToken ct)
+        => throw new NotSupportedException();
+
+    public Task<IReadOnlyList<GlBankAccount>> ListBankAccountsAsync(CancellationToken ct)
+        => throw new NotSupportedException();
+
+    public static DomainException Unreachable() =>
+        new(ErrorCodes.GlServiceUnavailable, "The General Ledger service is unreachable.", 503);
+}
+
+/// <summary>Returns a fixed mapping, for exercising the startup validator without a database.</summary>
+internal sealed class StubGlAccountConfigService(params (GlAccountRole Role, string? Code)[] mappings) : IGlAccountConfigService
+{
+    public Task<GlAccountCodes> GetCodesAsync(CancellationToken ct = default) =>
+        Task.FromResult(new GlAccountCodes(mappings.ToDictionary(m => m.Role, m => m.Code)));
+
+    public Task<ERPCore.Common.Http.ETagged<ERPCore.Dtos.Config.GlAccountConfigDto>> GetAsync(CancellationToken ct = default)
+        => throw new NotSupportedException();
+
+    public Task<ERPCore.Common.Http.ETagged<ERPCore.Dtos.Config.GlAccountConfigDto>> UpdateAsync(
+        ERPCore.Dtos.Config.UpdateGlAccountConfigRequest request, uint expectedRowVersion, CancellationToken ct = default)
+        => throw new NotSupportedException();
+}
@@ -11,6 +11,12 @@ internal sealed class TestCurrentUser : ICurrentUser
    public string UserId => "system";
    public int AuditUserId => User.SystemUserId;
    public bool IsAuthenticated => false;
+
+    // Unauthenticated, so no role claim and no branch scoping: the three members the
+    // AuthHex integration added to ICurrentUser.
+    public string? RoleCode => null;
+    public bool IsAdmin => false;
+    public int? BranchId => null;
 }

 internal sealed class ThrowingUnitOfWork : ERPCore.Infra.UoW.IUnitOfWork
@@ -25,6 +31,25 @@ internal sealed class ThrowingUnitOfWork : ERPCore.Infra.UoW.IUnitOfWork
        => throw new NotSupportedException();
 }

+/// <summary>
+/// Fails the transactional path the way a lost optimistic-concurrency race does, so the
+/// services that save through <c>ExecuteInTransactionAsync</c> can be covered too. The
+/// lambda is never invoked, which is the point: the real <c>UnitOfWork</c> issues its own
+/// <c>SaveChangesAsync</c> after the lambda returns, so the catch under test has to sit
+/// outside it.
+/// </summary>
+internal sealed class ThrowingTransactionUnitOfWork : ERPCore.Infra.UoW.IUnitOfWork
+{
+    public Task<int> SaveChangesAsync(CancellationToken ct = default)
+        => throw new DbUpdateConcurrencyException("Test concurrency conflict.");
+
+    public Task ExecuteInTransactionAsync(Func<CancellationToken, Task> action, CancellationToken ct = default)
+        => throw new DbUpdateConcurrencyException("Test concurrency conflict.");
+
+    public Task<T> ExecuteInTransactionAsync<T>(Func<CancellationToken, Task<T>> action, CancellationToken ct = default)
+        => throw new DbUpdateConcurrencyException("Test concurrency conflict.");
+}
+
 internal static class NotificationConfigTestSupport
 {
    private static readonly InMemoryDatabaseRoot Root = new();
@@ -35,7 +60,10 @@ internal static class NotificationConfigTestSupport
            .UseInMemoryDatabase(name, Root)
            .Options;

-        return new ErpDbContext(options, new TestCurrentUser());
+        // The real CurrentBranchContext over an unauthenticated user yields IsActive=false,
+        // which leaves the branch query filters off: what a unit test wants.
+        var currentUser = new TestCurrentUser();
+        return new ErpDbContext(options, currentUser, new CurrentBranchContext(currentUser));
    }

    public static async Task SeedAsync(ErpDbContext db, IEnumerable<NotificationConfigModule>? modules = null)
@@ -52,7 +80,8 @@ internal static class NotificationConfigTestSupport
            NotificationConfigId = NotificationConfig.SingletonId,
            UpdatedBy = User.SystemUserId,
            UpdatedAt = DateTime.UtcNow,
-            RowVersion = 7,
+            // No RowVersion here on purpose: ErpDbContext.BumpRowVersions stamps every
+            // inserted row with 1, so any seeded value is overwritten on save.
        };

        if (modules is not null)
@@ -0,0 +1,43 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Dtos.Approvals;
+using ERPCore.Infra.Auth;
+using ERPCore.Services;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Approvals inbox and settings (docs/DUAL_APPROVAL_PLAN.md §7, §10). The inbox is open to every
+/// signed-in user — it only lists what they may approve and their own requests. Reading the
+/// settings is open too (screens need to know whether prices are locked); changing them needs
+/// <c>settings.approvals</c>.
+/// </summary>
+[Route("api/v1/approvals")]
+public sealed class ApprovalsController : ApiControllerBase
+{
+    private readonly ApprovalInboxService _inbox;
+    private readonly IApprovalService _approvals;
+
+    public ApprovalsController(ApprovalInboxService inbox, IApprovalService approvals)
+    {
+        _inbox = inbox;
+        _approvals = approvals;
+    }
+
+    [HttpGet("pending")]
+    [ProducesResponseType(typeof(PendingApprovalsDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PendingApprovalsDto>> Pending(CancellationToken ct)
+        => Ok(await _inbox.PendingAsync(ct));
+
+    [HttpGet("config")]
+    [ProducesResponseType(typeof(ApprovalConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<ApprovalConfigDto>> GetConfig(CancellationToken ct)
+        => Ok(await _approvals.GetConfigAsync(ct));
+
+    [HttpPut("config")]
+    [Authorize(Policy = NavPolicies.Prefix + "settings.approvals")]
+    [ProducesResponseType(typeof(ApprovalConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<ApprovalConfigDto>> UpdateConfig([FromBody] UpdateApprovalConfigRequest request, CancellationToken ct)
+        => Ok(await _approvals.UpdateConfigAsync(request, ct));
+}
@@ -0,0 +1,78 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Accounts;
+using ERPCore.Dtos.Common;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Till cash deposited to the bank, and the cash in hand behind it (docs/BANK_DEPOSIT_MODULE_PLAN.md §7.3).
+/// Recording needs the Create action on <c>accounts.bank-deposits</c>; cancelling needs Delete.
+/// </summary>
+[Route("api/v1/bank-deposits")]
+[Authorize(Policy = NavPolicies.Prefix + "accounts.bank-deposits")]
+public sealed class BankDepositsController : ApiControllerBase
+{
+    private readonly IBankDepositService _deposits;
+    private readonly ICashInHandService _cash;
+
+    public BankDepositsController(IBankDepositService deposits, ICashInHandService cash)
+    {
+        _deposits = deposits;
+        _cash = cash;
+    }
+
+    /// <summary>Deposits filtered by business date range, branch, bank account and status, plus their total.</summary>
+    [HttpGet]
+    [ProducesResponseType(typeof(BankDepositListDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<BankDepositListDto>> List(
+        [FromQuery] PageQuery query, [FromQuery] DateOnly? from, [FromQuery] DateOnly? to, [FromQuery] int? branchId,
+        [FromQuery] long? bankAccountId, [FromQuery] BankDepositStatus? status, CancellationToken ct)
+        => Ok(await _deposits.ListAsync(query, new BankDepositListFilter(from, to, branchId, bankAccountId, status), ct));
+
+    [HttpGet("{bankDepositId:int}")]
+    [ProducesResponseType(typeof(BankDepositDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<BankDepositDto>> GetById(int bankDepositId, CancellationToken ct)
+    {
+        var result = await _deposits.GetAsync(bankDepositId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    /// <summary>One business day's cash position (defaults to today) and how much of it can still be deposited.</summary>
+    [HttpGet("cash-in-hand")]
+    [ProducesResponseType(typeof(CashInHandDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<CashInHandDto>> CashInHand([FromQuery] DateOnly? date, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _cash.GetPositionAsync(date, branchId, ct));
+
+    /// <summary>Day-wise cash position for <c>from</c>..<c>to</c> inclusive (at most 92 days).</summary>
+    [HttpGet("cash-in-hand/daily")]
+    [ProducesResponseType(typeof(CashInHandDailyDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    public async Task<ActionResult<CashInHandDailyDto>> CashInHandDaily(
+        [FromQuery] DateOnly from, [FromQuery] DateOnly to, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _cash.GetDailyAsync(from, to, branchId, ct));
+
+    /// <summary>Record a deposit; posts GL (Debit bank / Credit cash). Rejected above the cash in hand.</summary>
+    [HttpPost]
+    [Authorize(Policy = NavPolicies.Prefix + "accounts.bank-deposits" + NavPolicies.ActionSeparator + NavPolicies.CreateAction)]
+    [ProducesResponseType(typeof(BankDepositDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    public async Task<ActionResult<BankDepositDto>> Create([FromBody] CreateBankDepositRequest request, CancellationToken ct)
+    {
+        var result = await _deposits.CreateAsync(request, ct);
+        return Created($"/api/v1/bank-deposits/{result.BankDepositId}", result);
+    }
+
+    /// <summary>Cancel a Posted deposit; posts the reversing GL entry and puts the cash back in hand.</summary>
+    [HttpPost("{bankDepositId:int}/cancel")]
+    [Authorize(Policy = NavPolicies.Prefix + "accounts.bank-deposits" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
+    [ProducesResponseType(typeof(BankDepositDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<BankDepositDto>> Cancel(int bankDepositId, [FromBody] CancelBankDepositRequest request, CancellationToken ct)
+        => Ok(await _deposits.CancelAsync(bankDepositId, request, ct));
+}
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Config;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -14,6 +16,7 @@ namespace ERPCore.Controllers;
 /// </para>
 /// </summary>
 [Route("api/v1/branch-config")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
 public sealed class BranchConfigController : ApiControllerBase
 {
    private readonly IBranchConfigService _config;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Brands;
 using ERPCore.Dtos.Common;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>Brand master endpoints (docs/11-BACKEND-PHASE1.md §2.6).</summary>
 [Route("api/v1/brands")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class BrandsController : ApiControllerBase
 {
    private readonly IBrandService _brands;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
@@ -7,6 +9,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;

 [Route("api/v1/bundle-sales")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class BundleSalesController : ApiControllerBase
 {
    private readonly IBundleSaleService _bundles;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Categories;
 using ERPCore.Dtos.Common;
@@ -12,6 +14,7 @@ namespace ERPCore.Controllers;
 /// <c>?tree=true</c> parameter is gone along with the self-nesting model.
 /// </summary>
 [Route("api/v1/categories")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class CategoriesController : ApiControllerBase
 {
    private readonly ICategoryService _categories;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Customers;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>Customer master endpoints for Phase 1 sales.</summary>
 [Route("api/v1/customers")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class CustomersController : ApiControllerBase
 {
    private readonly ICustomerService _customers;
@@ -20,8 +23,10 @@ public sealed class CustomersController : ApiControllerBase
        [FromQuery] PageQuery query,
        [FromQuery] EntityStatus? status,
        [FromQuery] CustomerType? customerType,
-        CancellationToken ct)
-        => Ok(await _customers.ListAsync(query, status, customerType, ct));
+        CancellationToken ct,
+        [FromQuery] bool includeCashCustomer = false,
+        [FromQuery] int? branchId = null)
+        => Ok(await _customers.ListAsync(query, status, customerType, includeCashCustomer, branchId, ct));

    [HttpGet("{customerId:int}")]
    [ProducesResponseType(typeof(CustomerDto), StatusCodes.Status200OK)]
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Dashboard;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -6,6 +8,7 @@ namespace ERPCore.Controllers;

 /// <summary>Dashboard overview stats — cross-domain counts, not a stored entity.</summary>
 [Route("api/v1/dashboard")]
+[Authorize(Policy = NavPolicies.Prefix + "dashboard")]
 public sealed class DashboardController : ApiControllerBase
 {
    private readonly IDashboardService _dashboard;
@@ -0,0 +1,31 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Dtos.Reports;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Day-End Sales Report — a day's sales, payments by method, expenses and income, and the
+/// same day-wise over a range for the income chart/PDF (docs/DAY_END_SALES_REPORT_PLAN.md §4).</summary>
+[Route("api/v1/day-end-report")]
+[Authorize(Policy = NavPolicies.Prefix + "sales.day-end-report")]
+public sealed class DayEndReportController : ApiControllerBase
+{
+    private readonly IDayEndReportService _reports;
+
+    public DayEndReportController(IDayEndReportService reports) => _reports = reports;
+
+    /// <summary>One business day (defaults to today in the report's time zone).</summary>
+    [HttpGet]
+    [ProducesResponseType(typeof(DayEndReportDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<DayEndReportDto>> GetDay([FromQuery] DateOnly? date, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _reports.GetDayAsync(date, branchId, ct));
+
+    /// <summary>Day-wise figures for <c>from</c>..<c>to</c> inclusive (at most 92 days).</summary>
+    [HttpGet("daily")]
+    [ProducesResponseType(typeof(DayEndDailyReportDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    public async Task<ActionResult<DayEndDailyReportDto>> GetDaily([FromQuery] DateOnly from, [FromQuery] DateOnly to, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _reports.GetDailyAsync(from, to, branchId, ct));
+}
@@ -0,0 +1,57 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Dtos.Expenses;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Expense categories and titles (docs/EXPENSE_MODULE_PLAN.md §6 "Setup"). Reading is open to
+/// anyone with Accounts access (the expense form needs the lists); changes need the
+/// Expense Setup permission. Categories are the fixed seeded four — there is no create
+/// endpoint; only their active flag can change. Titles can be added under them.
+/// </summary>
+[Route("api/v1")]
+[Authorize(Policy = NavPolicies.Prefix + "accounts")]
+public sealed class ExpenseSetupController : ApiControllerBase
+{
+    private const string SetupPolicy = NavPolicies.Prefix + "accounts.expense-setup";
+
+    private readonly IExpenseSetupService _setup;
+
+    public ExpenseSetupController(IExpenseSetupService setup) => _setup = setup;
+
+    /// <summary>Categories, each with its titles, in display order.</summary>
+    [HttpGet("expense-categories")]
+    [ProducesResponseType(typeof(IReadOnlyList<ExpenseCategoryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<ExpenseCategoryDto>>> List([FromQuery] bool includeInactive, CancellationToken ct)
+        => Ok(await _setup.ListAsync(includeInactive, ct));
+
+    [HttpPut("expense-categories/{expenseCategoryId:int}")]
+    [Authorize(Policy = SetupPolicy)]
+    [ProducesResponseType(typeof(ExpenseCategoryDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ExpenseCategoryDto>> UpdateCategory(int expenseCategoryId, [FromBody] UpdateExpenseCategoryRequest request, CancellationToken ct)
+        => Ok(await _setup.UpdateCategoryAsync(expenseCategoryId, request, ct));
+
+    [HttpPost("expense-categories/{expenseCategoryId:int}/titles")]
+    [Authorize(Policy = SetupPolicy)]
+    [ProducesResponseType(typeof(ExpenseTitleDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ExpenseTitleDto>> CreateTitle(int expenseCategoryId, [FromBody] CreateExpenseTitleRequest request, CancellationToken ct)
+    {
+        var dto = await _setup.CreateTitleAsync(expenseCategoryId, request, ct);
+        return Created($"/api/v1/expense-titles/{dto.ExpenseTitleId}", dto);
+    }
+
+    [HttpPut("expense-titles/{expenseTitleId:int}")]
+    [Authorize(Policy = SetupPolicy)]
+    [ProducesResponseType(typeof(ExpenseTitleDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ExpenseTitleDto>> UpdateTitle(int expenseTitleId, [FromBody] UpdateExpenseTitleRequest request, CancellationToken ct)
+        => Ok(await _setup.UpdateTitleAsync(expenseTitleId, request, ct));
+}
@@ -0,0 +1,127 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Expenses;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Business expense bills — draft, post (GL accrual), pay, cancel (docs/EXPENSE_MODULE_PLAN.md §6).</summary>
+[Route("api/v1/expenses")]
+[Authorize(Policy = NavPolicies.Prefix + "accounts.expenses")]
+public sealed class ExpensesController : ApiControllerBase
+{
+    private readonly IExpenseService _expenses;
+    private readonly IExpensePaymentService _payments;
+
+    public ExpensesController(IExpenseService expenses, IExpensePaymentService payments)
+    {
+        _expenses = expenses;
+        _payments = payments;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<ExpenseSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<ExpenseSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] ExpenseStatus? status, [FromQuery] ExpensePaymentStatus? paymentStatus,
+        [FromQuery] int? categoryId, [FromQuery] int? titleId, [FromQuery] DateOnly? from, [FromQuery] DateOnly? to,
+        [FromQuery] bool overdueOnly, CancellationToken ct)
+        => Ok(await _expenses.ListAsync(query, new ExpenseListFilter(status, paymentStatus, categoryId, titleId, from, to, overdueOnly), ct));
+
+    /// <summary>Totals by category → title for Posted expenses dated in [from, to] (default: this month), plus unpaid/overdue position.</summary>
+    [HttpGet("summary")]
+    [ProducesResponseType(typeof(ExpenseSummaryReportDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<ExpenseSummaryReportDto>> Summary([FromQuery] DateOnly? from, [FromQuery] DateOnly? to, CancellationToken ct)
+        => Ok(await _expenses.GetSummaryAsync(from, to, ct));
+
+    [HttpGet("{expenseId:int}")]
+    [ProducesResponseType(typeof(ExpenseDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ExpenseDto>> GetById(int expenseId, CancellationToken ct)
+    {
+        var result = await _expenses.GetAsync(expenseId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(ExpenseDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<ExpenseDto>> Create([FromBody] CreateExpenseRequest request, CancellationToken ct)
+    {
+        var result = await _expenses.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/expenses/{result.Value.ExpenseId}", result.Value);
+    }
+
+    [HttpPut("{expenseId:int}")]
+    [ProducesResponseType(typeof(ExpenseDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<ExpenseDto>> Update(int expenseId, [FromBody] UpdateExpenseRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _expenses.UpdateAsync(expenseId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>Draft only.</summary>
+    [HttpDelete("{expenseId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int expenseId, CancellationToken ct)
+    {
+        await _expenses.DeleteAsync(expenseId, ct);
+        return NoContent();
+    }
+
+    /// <summary>Accrue the expense to GL (Debit expense account / Credit Accrued Expenses).</summary>
+    [HttpPost("{expenseId:int}/post")]
+    [ProducesResponseType(typeof(ExpenseDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ExpenseDto>> Post(int expenseId, CancellationToken ct)
+        => Ok(await _expenses.PostAsync(expenseId, ct));
+
+    /// <summary>Post a Draft and pay it, in full or partially, in one transaction; any remainder stays as the balance.</summary>
+    [HttpPost("{expenseId:int}/post-and-pay")]
+    [ProducesResponseType(typeof(ExpenseDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ExpenseDto>> PostAndPay(int expenseId, [FromBody] CreateExpensePaymentRequest request, CancellationToken ct)
+        => Ok(await _payments.PostAndPayAsync(expenseId, request, ct));
+
+    /// <summary>Draft, or Posted with no payments (posts the reversing GL entry).</summary>
+    [HttpPost("{expenseId:int}/cancel")]
+    [ProducesResponseType(typeof(ExpenseDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ExpenseDto>> Cancel(int expenseId, [FromBody] CancelExpenseRequest request, CancellationToken ct)
+        => Ok(await _expenses.CancelAsync(expenseId, request, ct));
+
+    /// <summary>Pay against the balance, in full or in installments; one GL entry per submission.</summary>
+    [HttpPost("{expenseId:int}/payments")]
+    [ProducesResponseType(typeof(IReadOnlyList<ExpensePaymentDto>), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<IReadOnlyList<ExpensePaymentDto>>> Pay(int expenseId, [FromBody] CreateExpensePaymentRequest request, CancellationToken ct)
+    {
+        var rows = await _payments.PayAsync(expenseId, request, ct);
+        return Created($"/api/v1/expenses/{expenseId}/payments", rows);
+    }
+
+    /// <summary>Payment history, newest first.</summary>
+    [HttpGet("{expenseId:int}/payments")]
+    [ProducesResponseType(typeof(IReadOnlyList<ExpensePaymentDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<IReadOnlyList<ExpensePaymentDto>>> ListPayments(int expenseId, CancellationToken ct)
+        => Ok(await _payments.ListAsync(expenseId, ct));
+}
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
@@ -12,6 +14,7 @@ namespace ERPCore.Controllers;
 /// the existing sales-slip CRUD surface under a more business-friendly route.
 /// </summary>
 [Route("api/v1/free-issues")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class FreeIssuesController : ApiControllerBase
 {
    private readonly ISalesSlipService _slips;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;

@@ -14,6 +16,7 @@ namespace ERPCore.Controllers;
 /// only and is never exposed to the frontend.
 /// </summary>
 [Route("api/v1/gl")]
+[Authorize(Policy = NavPolicies.Prefix + "ledgers")]
 public sealed class GeneralLedgerController : ApiControllerBase
 {
    private readonly IGeneralLedgerService _gl;
@@ -0,0 +1,53 @@
+using ERPCore.Dtos.Config;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Role → GL account mapping endpoints.
+/// <para>
+/// <b>Authorization:</b> the <c>settings</c> nav policy, like <see cref="BranchConfigController"/>.
+/// Note this endpoint also serves the selectable accounts, rather than the screen calling the GL
+/// proxy directly: <see cref="GeneralLedgerController"/> is gated on <c>ledgers</c>, so a
+/// settings-only user would get a 403 from it — and serving both from here guarantees the picker
+/// and the server-side validation work from the same list.
+/// </para>
+/// </summary>
+[Route("api/v1/gl-account-config")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
+public sealed class GlAccountConfigController : ApiControllerBase
+{
+    private readonly IGlAccountConfigService _config;
+
+    public GlAccountConfigController(IGlAccountConfigService config) => _config = config;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(GlAccountConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<GlAccountConfigDto>> Get(CancellationToken ct)
+    {
+        var result = await _config.GetAsync(ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>
+    /// Replaces the mapping. 422 when a code is unknown to GL or not postable; 503 when GL could
+    /// not be reached, since a mapping that could not be verified is not stored.
+    /// </summary>
+    [HttpPut]
+    [ProducesResponseType(typeof(GlAccountConfigDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status503ServiceUnavailable)]
+    public async Task<ActionResult<GlAccountConfigDto>> Update(
+        [FromBody] UpdateGlAccountConfigRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _config.UpdateAsync(request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+}
@@ -0,0 +1,45 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
+using ERPCore.Dtos.Config;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// GRN configuration endpoints — warehouse selection and the default receiving warehouse.
+/// <para>
+/// <b>Authorization:</b> gated on the Receiving nav policy (the New GRN form has to read it), same
+/// Phase-1 posture as <see cref="SalesConfigController"/>.
+/// </para>
+/// </summary>
+[Route("api/v1/grn-config")]
+[Authorize(Policy = NavPolicies.Prefix + "receiving")]
+public sealed class GrnConfigController : ApiControllerBase
+{
+    private readonly IGrnConfigService _config;
+
+    public GrnConfigController(IGrnConfigService config) => _config = config;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(GrnConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<GrnConfigDto>> Get(CancellationToken ct)
+    {
+        var result = await _config.GetAsync(ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPut]
+    [ProducesResponseType(typeof(GrnConfigDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<GrnConfigDto>> Update(
+        [FromBody] UpdateGrnConfigRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _config.UpdateAsync(request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+}
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Grn;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>Goods-receipt endpoints (docs/11 §4).</summary>
 [Route("api/v1/grns")]
+[Authorize(Policy = NavPolicies.Prefix + "receiving")]
 public sealed class GrnsController : ApiControllerBase
 {
    private readonly IGrnService _grns;
@@ -94,13 +94,13 @@ public sealed class EmployeesController : ApiControllerBase

    /// <summary>Permanently deletes the employee and all dependent HR records. Blocked (409) if payroll history exists.</summary>
    [HttpDelete("{employeeId:int}")]
-    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(typeof(EmployeeDeleteResultDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
-    public async Task<IActionResult> Delete(int employeeId, CancellationToken ct)
+    public async Task<ActionResult<EmployeeDeleteResultDto>> Delete(int employeeId, [FromQuery] bool deleteUserAccount, CancellationToken ct)
    {
-        await _employees.DeleteAsync(employeeId, ct);
-        return NoContent();
+        var result = await _employees.DeleteAsync(employeeId, deleteUserAccount, ct);
+        return Ok(result);
    }

    [HttpPost("{employeeId:int}/link-user")]
@@ -0,0 +1,64 @@
+using ERPCore.Dtos.Items;
+using ERPCore.Infra.Auth;
+using ERPCore.Services;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Item photos. Same access as the item master itself.</summary>
+[Route("api/v1/items/{itemId:int}/images")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
+public sealed class ItemImagesController : ApiControllerBase
+{
+    private readonly IItemImageService _images;
+    private readonly ICurrentUser _currentUser;
+
+    public ItemImagesController(IItemImageService images, ICurrentUser currentUser)
+    {
+        _images = images;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(List<ItemImageDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<List<ItemImageDto>>> List(int itemId, CancellationToken ct)
+        => Ok(await _images.ListAsync(itemId, ct));
+
+    /// <summary>Upload one image (multipart <c>file</c>). 422 CONFIG_DISABLED while item images are off.</summary>
+    [HttpPost]
+    [RequestSizeLimit(ItemImageService.MaxSizeBytes + 64 * 1024)]
+    [ProducesResponseType(typeof(ItemImageDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status413PayloadTooLarge)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<ItemImageDto>> Upload(int itemId, IFormFile file, CancellationToken ct)
+    {
+        await using var stream = file.OpenReadStream();
+        var result = await _images.UploadAsync(itemId, stream, file.FileName, file.ContentType, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/items/{itemId}/images/{result.ItemImageId}", result);
+    }
+
+    /// <summary>The image bytes, served inline so an &lt;img&gt; can point straight at it.</summary>
+    [HttpGet("{itemImageId:int}/content")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Content(int itemId, int itemImageId, CancellationToken ct)
+    {
+        var (content, contentType) = await _images.OpenAsync(itemId, itemImageId, ct);
+        // Stored files are immutable (new upload ⇒ new id), so the browser may cache them.
+        Response.Headers.CacheControl = "private, max-age=86400";
+        return File(content, contentType);
+    }
+
+    [HttpDelete("{itemImageId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Delete(int itemId, int itemImageId, CancellationToken ct)
+    {
+        await _images.DeleteAsync(itemId, itemImageId, ct);
+        return NoContent();
+    }
+}
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.ItemTypes;
@@ -13,6 +15,7 @@ namespace ERPCore.Controllers;
 /// into the client-generated SKU (docs/10 Part C.9).
 /// </summary>
 [Route("api/v1/item-types")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class ItemTypesController : ApiControllerBase
 {
    private readonly IItemTypeService _itemTypes;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Items;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>Item master endpoints (docs/11-BACKEND-PHASE1.md §2.1–2.2).</summary>
 [Route("api/v1/items")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class ItemsController : ApiControllerBase
 {
    private readonly IItemService _items;
@@ -27,6 +30,40 @@ public sealed class ItemsController : ApiControllerBase
        CancellationToken ct)
        => Ok(await _items.ListAsync(query, status, categoryId, subCategoryId, brandId, trackingMode, ct));

+    /// <summary>Items list enriched with stock value, low-stock, last-purchase and
+    /// trailing-30-day sales aggregates, for the Items overview table.</summary>
+    [HttpGet("overview")]
+    [ProducesResponseType(typeof(PagedResponse<ItemOverviewDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<ItemOverviewDto>>> Overview(
+        [FromQuery] PageQuery query,
+        [FromQuery] EntityStatus? status,
+        [FromQuery] int? categoryId,
+        [FromQuery] int? subCategoryId,
+        [FromQuery] int? brandId,
+        [FromQuery] TrackingMode? trackingMode,
+        [FromQuery] StockNature? stockNature,
+        [FromQuery] ItemStockFilter? stock,
+        CancellationToken ct)
+        => Ok(await _items.GetOverviewAsync(query, status, categoryId, subCategoryId, brandId, trackingMode, stockNature, stock, ct));
+
+    /// <summary>Barcode/RFID lookup — matches an item's barcode/SKU, or a batch/serial
+    /// barcode/no (optionally scoped to <paramref name="itemId"/> first).</summary>
+    [HttpGet("scan")]
+    [ProducesResponseType(typeof(ItemScanResultDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ItemScanResultDto>> Scan([FromQuery] string code, [FromQuery] int? itemId, CancellationToken ct)
+    {
+        var result = await _items.ScanAsync(code, itemId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    /// <summary>The item's latest posted GRN receipts (default 5, newest first): unit cost, discount, net cost, vendor.</summary>
+    [HttpGet("{itemId:int}/purchase-prices")]
+    [ProducesResponseType(typeof(IReadOnlyList<ItemPurchasePriceDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<IReadOnlyList<ItemPurchasePriceDto>>> PurchasePrices(int itemId, [FromQuery] int take, CancellationToken ct)
+        => Ok(await _items.GetPurchasePricesAsync(itemId, take <= 0 ? 5 : take, ct));
+
    /// <summary>Get a single item; returns an <c>ETag</c> for optimistic concurrency.</summary>
    [HttpGet("{itemId:int}")]
    [ProducesResponseType(typeof(ItemDetailDto), StatusCodes.Status200OK)]
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Audit;
 using ERPCore.Dtos.Common;
 using ERPCore.Services.Interfaces;
@@ -10,6 +12,7 @@ namespace ERPCore.Controllers;
 /// Data only — no posting in Phase 1.
 /// </summary>
 [Route("api/v1/journal-entries")]
+[Authorize(Policy = NavPolicies.Prefix + "ledgers")]
 public sealed class JournalEntriesController : ApiControllerBase
 {
    private readonly IAuditService _audit;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Notifications;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -5,6 +7,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;

 [Route("api/v1/notification-config")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
 public sealed class NotificationConfigController : ApiControllerBase
 {
    private readonly INotificationConfigService _config;
@@ -0,0 +1,32 @@
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+[Route("api/v1/notifications")]
+public sealed class NotificationsController : ApiControllerBase
+{
+    private readonly INotificationService _notifications;
+    private readonly ICurrentUser _currentUser;
+
+    public NotificationsController(INotificationService notifications, ICurrentUser currentUser)
+    {
+        _notifications = notifications;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet]
+    public async Task<ActionResult> Get([FromQuery] int take = 20, CancellationToken ct = default)
+    {
+        var feed = await _notifications.GetFeedAsync(_currentUser.AuditUserId, take, ct);
+        return Ok(feed);
+    }
+
+    [HttpPost("mark-all-read")]
+    public async Task<ActionResult> MarkAllRead(CancellationToken ct)
+    {
+        await _notifications.MarkAllReadAsync(_currentUser.AuditUserId, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,89 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Approvals;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Products;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Selling-price change requests (docs/DUAL_APPROVAL_PLAN.md §6.4). Requesting needs Create on
+/// <c>products.price-adjustments</c>, deciding needs Approve; an item's applied price history is
+/// readable by anyone who can see Products.
+/// </summary>
+[Route("api/v1/price-adjustments")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
+public sealed class PriceAdjustmentsController : ApiControllerBase
+{
+    private const string Screen = NavPolicies.Prefix + "products.price-adjustments";
+    private const string CreatePolicy = Screen + NavPolicies.ActionSeparator + NavPolicies.CreateAction;
+    private const string ApprovePolicy = Screen + NavPolicies.ActionSeparator + NavPolicies.ApproveAction;
+
+    private readonly IPriceAdjustmentService _prices;
+
+    public PriceAdjustmentsController(IPriceAdjustmentService prices) => _prices = prices;
+
+    [HttpGet]
+    [Authorize(Policy = Screen)]
+    [ProducesResponseType(typeof(PagedResponse<PriceAdjustmentSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<PriceAdjustmentSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] PriceAdjustmentStatus? status, [FromQuery] int? itemId, CancellationToken ct)
+        => Ok(await _prices.ListAsync(query, status, itemId, ct));
+
+    [HttpGet("{priceAdjustmentId:int}")]
+    [Authorize(Policy = Screen)]
+    [ProducesResponseType(typeof(PriceAdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<PriceAdjustmentDto>> GetById(int priceAdjustmentId, CancellationToken ct)
+    {
+        var dto = await _prices.GetAsync(priceAdjustmentId, ct);
+        return dto is null ? NotFound() : Ok(dto);
+    }
+
+    /// <summary>Request new selling prices for one or more items.</summary>
+    [HttpPost]
+    [Authorize(Policy = CreatePolicy)]
+    [ProducesResponseType(typeof(PriceAdjustmentDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PriceAdjustmentDto>> Create([FromBody] CreatePriceAdjustmentRequest request, CancellationToken ct)
+    {
+        var dto = await _prices.CreateAsync(request, ct);
+        return Created($"/api/v1/price-adjustments/{dto.PriceAdjustmentId}", dto);
+    }
+
+    /// <summary>Give the next approval; the final one applies the prices.</summary>
+    [HttpPost("{priceAdjustmentId:int}/approve")]
+    [Authorize(Policy = ApprovePolicy)]
+    [ProducesResponseType(typeof(PriceAdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PriceAdjustmentDto>> Approve(int priceAdjustmentId, [FromBody] ApproveRequest? request, CancellationToken ct)
+        => Ok(await _prices.ApproveAsync(priceAdjustmentId, request?.Comment, ct));
+
+    [HttpPost("{priceAdjustmentId:int}/reject")]
+    [Authorize(Policy = ApprovePolicy)]
+    [ProducesResponseType(typeof(PriceAdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PriceAdjustmentDto>> Reject(int priceAdjustmentId, [FromBody] RejectRequest request, CancellationToken ct)
+        => Ok(await _prices.RejectAsync(priceAdjustmentId, request.Reason, ct));
+
+    /// <summary>The requester withdraws a pending request.</summary>
+    [HttpPost("{priceAdjustmentId:int}/cancel")]
+    [Authorize(Policy = Screen)]
+    [ProducesResponseType(typeof(PriceAdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PriceAdjustmentDto>> Cancel(int priceAdjustmentId, CancellationToken ct)
+        => Ok(await _prices.CancelAsync(priceAdjustmentId, ct));
+
+    /// <summary>Every applied price change for an item, newest first, with who approved it.</summary>
+    [HttpGet("/api/v1/items/{itemId:int}/price-history")]
+    [ProducesResponseType(typeof(IReadOnlyList<ItemPriceHistoryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<ItemPriceHistoryDto>>> ItemHistory(int itemId, CancellationToken ct)
+        => Ok(await _prices.ItemHistoryAsync(itemId, ct));
+}
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Config;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -16,6 +18,7 @@ namespace ERPCore.Controllers;
 /// </para>
 /// </summary>
 [Route("api/v1/product-config")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class ProductConfigController : ApiControllerBase
 {
    private readonly IProductConfigService _config;
@@ -42,5 +45,4 @@ public sealed class ProductConfigController : ApiControllerBase
        var result = await _config.UpdateAsync(request, expected, ct);
        SetETag(result.RowVersion);
        return Ok(result.Value);
-    }
-}
+    }}
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Production;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>Production run endpoints (docs/30-BACKEND-PHASE2.md §D.2–D.3).</summary>
 [Route("api/v1/production-runs")]
+[Authorize(Policy = NavPolicies.Prefix + "production")]
 public sealed class ProductionRunsController : ApiControllerBase
 {
    private readonly IProductionRunService _runs;
@@ -53,6 +56,7 @@ public sealed class ProductionRunsController : ApiControllerBase
    [ProducesResponseType(typeof(RunGraphDto), StatusCodes.Status201Created)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
    public async Task<ActionResult<RunGraphDto>> Create([FromBody] CreateRunRequest request, CancellationToken ct)
    {
        var result = await _runs.CreateAsync(request, ct);
@@ -66,6 +70,7 @@ public sealed class ProductionRunsController : ApiControllerBase
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
    public async Task<ActionResult<RunStageDto>> UpdateQuantities(
        int runId, int runStageId, [FromBody] UpdateStageQuantitiesRequest request, CancellationToken ct)
        => Ok(await _runs.UpdateStageQuantitiesAsync(runId, runStageId, request, ct));
@@ -83,6 +88,7 @@ public sealed class ProductionRunsController : ApiControllerBase
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
    public async Task<ActionResult<StartStageResultDto>> Start(
        int runId, int runStageId,
        [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -95,6 +101,7 @@ public sealed class ProductionRunsController : ApiControllerBase
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
    public async Task<ActionResult<RunStageDto>> Complete(
        int runId, int runStageId, [FromBody] CompleteStageRequest request,
        [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -106,6 +113,7 @@ public sealed class ProductionRunsController : ApiControllerBase
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
    public async Task<ActionResult<ApproveStageResultDto>> Approve(
        int runId, int runStageId, [FromBody] ApproveStageRequest? request,
        [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -117,6 +125,7 @@ public sealed class ProductionRunsController : ApiControllerBase
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
    public async Task<ActionResult<TransferResultDto>> Transfer(
        int runId, int runStageId, [FromBody] TransferRemainderRequest request,
        [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -129,6 +138,7 @@ public sealed class ProductionRunsController : ApiControllerBase
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
    public async Task<ActionResult<ReturnLeftoverResultDto>> ReturnLeftover(
        int runId, int runInputId, [FromBody] ReturnLeftoverRequest request,
        [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -139,6 +149,7 @@ public sealed class ProductionRunsController : ApiControllerBase
    [ProducesResponseType(typeof(RejectIntakeResultDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
    public async Task<ActionResult<RejectIntakeResultDto>> RejectIntake(
        int runId, int runStageId, [FromBody] RejectRequest? request,
        [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -150,6 +161,7 @@ public sealed class ProductionRunsController : ApiControllerBase
    [ProducesResponseType(typeof(TerminalRejectResultDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
    public async Task<ActionResult<TerminalRejectResultDto>> Reject(
        int runId, int runStageId, [FromBody] RejectRequest? request,
        [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -162,6 +174,7 @@ public sealed class ProductionRunsController : ApiControllerBase
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
    public async Task<ActionResult<CancelRunResultDto>> Cancel(
        int runId, [FromBody] CancelRunRequest request,
        [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Production;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>Production template endpoints (docs/30-BACKEND-PHASE2.md §D.1).</summary>
 [Route("api/v1/production-templates")]
+[Authorize(Policy = NavPolicies.Prefix + "production")]
 public sealed class ProductionTemplatesController : ApiControllerBase
 {
    private readonly IProductionTemplateService _templates;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Grn;
@@ -9,6 +11,7 @@ namespace ERPCore.Controllers;

 /// <summary>Purchase invoice endpoints — vendor invoices consolidating Confirmed GRNs.</summary>
 [Route("api/v1/purchase-invoices")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class PurchaseInvoicesController : ApiControllerBase
 {
    private readonly IPurchaseInvoiceService _invoices;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>Purchase-order endpoints (docs/11 §3.3).</summary>
 [Route("api/v1/purchase-orders")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class PurchaseOrdersController : ApiControllerBase
 {
    private readonly IPurchaseOrderService _pos;
@@ -32,7 +35,7 @@ public sealed class PurchaseOrdersController : ApiControllerBase
        return Ok(result.Value);
    }

-    /// <summary>Create a PO — auto-approved on creation in Phase 1 (FR-PROC-04). Totals computed server-side.</summary>
+    /// <summary>Create a PO — non-draft is issued straight into PendingApproval (FR-PROC-04). Totals computed server-side.</summary>
    [HttpPost]
    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status201Created)]
    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
@@ -57,7 +60,7 @@ public sealed class PurchaseOrdersController : ApiControllerBase
        return Ok(result.Value);
    }

-    /// <summary>Submit a Draft PO (Draft → Approved). 409 PO_NOT_EDITABLE if not Draft.</summary>
+    /// <summary>Submit a Draft PO (Draft → PendingApproval). 409 PO_NOT_EDITABLE if not Draft.</summary>
    [HttpPost("{poId:int}/submit")]
    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -67,6 +70,7 @@ public sealed class PurchaseOrdersController : ApiControllerBase

    /// <summary>Delete a PO — permitted only while Draft (409 PO_NOT_EDITABLE otherwise).</summary>
    [HttpDelete("{poId:int}")]
+    [Authorize(Policy = NavPolicies.Prefix + "procurement" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
    [ProducesResponseType(StatusCodes.Status204NoContent)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -76,13 +80,28 @@ public sealed class PurchaseOrdersController : ApiControllerBase
        return NoContent();
    }

-    /// <summary>Approve — no-op in Phase 1 (POs auto-approve); transitions PendingApproval→Approved when enabled.</summary>
+    /// <summary>Approve — PendingApproval → Approved. 403 PO_APPROVAL_FORBIDDEN if the caller
+    /// isn't an Admin or is the PO's own creator; 409 PO_NOT_PENDING_APPROVAL otherwise.</summary>
    [HttpPost("{poId:int}/approve")]
+    [Authorize(Policy = NavPolicies.Prefix + "procurement" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction)]
    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
    public async Task<ActionResult<PurchaseOrderDto>> Approve(int poId, CancellationToken ct)
        => Ok(await _pos.ApproveAsync(poId, ct));

+    /// <summary>Reject — PendingApproval → Draft, so the requester can revise and resubmit.
+    /// Same caller restrictions as <see cref="Approve"/>.</summary>
+    [HttpPost("{poId:int}/reject")]
+    [Authorize(Policy = NavPolicies.Prefix + "procurement" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction)]
+    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PurchaseOrderDto>> Reject(int poId, [FromBody] RejectPurchaseOrderRequest request, CancellationToken ct)
+        => Ok(await _pos.RejectAsync(poId, request.Reason, ct));
+
    /// <summary>Cancel — 409 if any goods have been received against the PO.</summary>
    [HttpPost("{poId:int}/cancel")]
    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
 using ERPCore.Services.Interfaces;
@@ -7,6 +9,7 @@ namespace ERPCore.Controllers;

 /// <summary>Purchase-return endpoints (docs/11 §3.4).</summary>
 [Route("api/v1/purchase-returns")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class PurchaseReturnsController : ApiControllerBase
 {
    private readonly IPurchaseReturnService _returns;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>Purchase-requisition endpoints (docs/11 §3.1).</summary>
 [Route("api/v1/requisitions")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class RequisitionsController : ApiControllerBase
 {
    private readonly IRequisitionService _requisitions;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>RFQ &amp; quotation endpoints (docs/11 §3.2).</summary>
 [Route("api/v1/rfqs")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class RfqsController : ApiControllerBase
 {
    private readonly IRfqService _rfqs;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Rbac;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>Role CRUD + permission assignment (mirrors AuthHex's Role; see docs/10 C.9).</summary>
 [Route("api/v1/roles")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
 public sealed class RolesController : ApiControllerBase
 {
    private readonly IRoleService _roles;
@@ -64,6 +67,7 @@ public sealed class RolesController : ApiControllerBase
    }

    [HttpDelete("{roleId:int}")]
+    [Authorize(Policy = NavPolicies.Prefix + "settings" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
    [ProducesResponseType(StatusCodes.Status204NoContent)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -0,0 +1,46 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
+using ERPCore.Dtos.Config;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Sales configuration endpoints — the singleton "allow cash customer" toggle.
+/// <para>
+/// <b>Authorization:</b> gated on the Sales nav policy (the New Sale form has to read it), same
+/// Phase-1 posture as <see cref="BranchConfigController"/> — any Sales user can flip the flag
+/// until per-endpoint RBAC lands.
+/// </para>
+/// </summary>
+[Route("api/v1/sales-config")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
+public sealed class SalesConfigController : ApiControllerBase
+{
+    private readonly ISalesConfigService _config;
+
+    public SalesConfigController(ISalesConfigService config) => _config = config;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(SalesConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<SalesConfigDto>> Get(CancellationToken ct)
+    {
+        var result = await _config.GetAsync(ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPut]
+    [ProducesResponseType(typeof(SalesConfigDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<SalesConfigDto>> Update(
+        [FromBody] UpdateSalesConfigRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _config.UpdateAsync(request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+}
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
 using ERPCore.Services.Interfaces;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 /// <summary>Cashier day-end close-out — locks a cashier's Posted sales slips for a business
 /// date and posts one consolidated GL journal entry for the day (docs/14 Sales API).</summary>
 [Route("api/v1/sales-day-end")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesDayEndController : ApiControllerBase
 {
    private readonly ISalesDayEndService _dayEnds;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
@@ -7,15 +9,75 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;

 [Route("api/v1/sales-invoices")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesInvoicesController : ApiControllerBase
 {
    private readonly ISalesInvoiceService _invoices;
    private readonly ISalesInvoicePaymentService _payments;
+    private readonly ISalesPricingService _pricing;
+    private readonly ISalesDomainService _sales;
+    private readonly IStockService _stock;

-    public SalesInvoicesController(ISalesInvoiceService invoices, ISalesInvoicePaymentService payments)
+    public SalesInvoicesController(
+        ISalesInvoiceService invoices, ISalesInvoicePaymentService payments, ISalesPricingService pricing,
+        ISalesDomainService sales, IStockService stock)
    {
        _invoices = invoices;
        _payments = payments;
+        _pricing = pricing;
+        _sales = sales;
+        _stock = stock;
+    }
+
+    // Lets the New Sale form warn, per line, when qty exceeds the stock a sale can issue — under
+    // the "sales" policy, since sales users may not hold the "stock" nav permission. Non-stocked
+    // items (services) are never short, so they report IsStocked = false and no limit.
+    [HttpGet("stock-availability")]
+    [ProducesResponseType(typeof(SalesStockAvailabilityDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<SalesStockAvailabilityDto>> StockAvailability(
+        [FromQuery] int itemId, [FromQuery] int warehouseId, CancellationToken ct)
+    {
+        bool isStocked;
+        try
+        {
+            isStocked = await _sales.IsStockedItemAsync(itemId, ct);
+        }
+        catch (InvalidOperationException)
+        {
+            return NotFound();
+        }
+        var available = isStocked ? (await _stock.GetOnHandAsync(itemId, warehouseId, ct)).Available : 0m;
+        return Ok(new SalesStockAvailabilityDto(itemId, warehouseId, isStocked, available));
+    }
+
+    // Feeds New Sale's "Add item" dropdown with each item's issuable stock at the sale's warehouse.
+    // Under "sales" for the same reason as above; items absent from the list have no stock there.
+    [HttpGet("stock-summary")]
+    [ProducesResponseType(typeof(IReadOnlyList<SalesItemStockDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<SalesItemStockDto>>> StockSummary([FromQuery] int warehouseId, CancellationToken ct)
+    {
+        var available = await _stock.GetAvailableByItemAsync(warehouseId, ct);
+        return Ok(available.Select(kv => new SalesItemStockDto(kv.Key, kv.Value)).ToList());
+    }
+
+    // Lets the New Sale form pre-fill Unit price for items with no flat selling price, using the
+    // same resolution the server applies on save.
+    [HttpGet("suggested-price")]
+    [ProducesResponseType(typeof(SalesSuggestedPriceDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<SalesSuggestedPriceDto>> SuggestedPrice(
+        [FromQuery] int itemId, [FromQuery] int warehouseId, CancellationToken ct)
+    {
+        try
+        {
+            var price = await _pricing.ResolveAsync(itemId, warehouseId, null, false, ct);
+            return Ok(new SalesSuggestedPriceDto(itemId, warehouseId, price.UnitPrice, price.PriceSource));
+        }
+        catch (InvalidOperationException)
+        {
+            return NotFound();
+        }
    }

    [HttpGet]
@@ -26,8 +88,12 @@ public sealed class SalesInvoicesController : ApiControllerBase
        [FromQuery] int? customerId,
        [FromQuery] int? warehouseId,
        [FromQuery] int? branchId,
+        [FromQuery] DateOnly? from,
+        [FromQuery] DateOnly? to,
+        [FromQuery] int? createdBy,
+        [FromQuery] bool? paid,
        CancellationToken ct)
-        => Ok(await _invoices.ListAsync(query, status, customerId, warehouseId, branchId, ct));
+        => Ok(await _invoices.ListAsync(query, status, customerId, warehouseId, branchId, from, to, createdBy, paid, ct));

    [HttpGet("{salesInvoiceId:int}")]
    [ProducesResponseType(typeof(SalesInvoiceDto), StatusCodes.Status200OK)]
@@ -89,6 +155,18 @@ public sealed class SalesInvoicesController : ApiControllerBase
        return Created($"/api/v1/sales-invoices/{salesInvoiceId}/payments/{dto.SalesInvoicePaymentId}", dto);
    }

+    /// <summary>
+    /// Pay several Posted invoices of one (non-cash) customer at once, split across payment lines;
+    /// applied oldest invoice first under a single GL journal entry. Returns one payment per split.
+    /// </summary>
+    [HttpPost("payments/bulk")]
+    [ProducesResponseType(typeof(IReadOnlyList<SalesInvoicePaymentDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<IReadOnlyList<SalesInvoicePaymentDto>>> PayBulk([FromBody] CreateBulkSalesInvoicePaymentRequest request, CancellationToken ct)
+        => Ok(await _payments.PayBulkAsync(request, ct));
+
    /// <summary>Payment history for this invoice, newest first.</summary>
    [HttpGet("{salesInvoiceId:int}/payments")]
    [ProducesResponseType(typeof(IReadOnlyList<SalesInvoicePaymentDto>), StatusCodes.Status200OK)]
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Sales;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -5,6 +7,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;

 [Route("api/v1/reports/sales")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesReportsController : ApiControllerBase
 {
    private readonly ISalesReportService _reports;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
 using ERPCore.Services.Interfaces;
@@ -7,6 +9,7 @@ namespace ERPCore.Controllers;

 /// <summary>Sales-return endpoints — customer returns of previously sold goods.</summary>
 [Route("api/v1/sales-returns")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesReturnsController : ApiControllerBase
 {
    private readonly ISalesReturnService _returns;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Sales;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -5,6 +7,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;

 [Route("api/v1/sales-slips/{salesSlipId:int}/free-issue-suggestions")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesSlipPromotionsController : ApiControllerBase
 {
    private readonly ISalesPromotionSuggestionService _suggestions;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
@@ -7,6 +9,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;

 [Route("api/v1/sales-slips")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesSlipsController : ApiControllerBase
 {
    private readonly ISalesSlipService _slips;
@@ -0,0 +1,20 @@
+using ERPCore.Dtos.Search;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+[Route("api/v1/search")]
+public sealed class SearchController : ApiControllerBase
+{
+    private readonly IGlobalSearchService _search;
+
+    public SearchController(IGlobalSearchService search) => _search = search;
+
+    [HttpGet]
+    public async Task<ActionResult<IReadOnlyList<GlobalSearchResultDto>>> Get([FromQuery] string q, CancellationToken ct)
+    {
+        var results = await _search.SearchAsync(q, 6, ct);
+        return Ok(results);
+    }
+}
@@ -0,0 +1,41 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Stock;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Serial register and per-serial history (docs/ITEM_TRACKING_PLAN.md Phase 9).</summary>
+[Route("api/v1/serials")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
+public sealed class SerialsController : ApiControllerBase
+{
+    private readonly IItemTrackingService _tracking;
+
+    public SerialsController(IItemTrackingService tracking) => _tracking = tracking;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<SerialSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<SerialSummaryDto>>> List(
+        [FromQuery] int? itemId, [FromQuery] int? warehouseId, [FromQuery] SerialStatus? status,
+        [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _tracking.ListSerialsAsync(query, itemId, warehouseId, status, ct));
+
+    /// <summary>Exact lookup by serial number or barcode, across items.</summary>
+    [HttpGet("lookup")]
+    [ProducesResponseType(typeof(IReadOnlyList<SerialDetailDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<SerialDetailDto>>> Lookup([FromQuery] string serialNo, CancellationToken ct)
+        => Ok(await _tracking.FindSerialAsync(serialNo, ct));
+
+    [HttpGet("{serialId:int}")]
+    [ProducesResponseType(typeof(SerialDetailDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<SerialDetailDto>> Get(int serialId, CancellationToken ct)
+    {
+        var dto = await _tracking.GetSerialAsync(serialId, ct);
+        return dto is null ? NotFound() : Ok(dto);
+    }
+}
@@ -1,3 +1,7 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Domain.Enums;
+using ERPCore.Infra.Auth;
+using ERPCore.Dtos.Approvals;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Stock;
 using ERPCore.Services.Interfaces;
@@ -5,22 +9,30 @@ using Microsoft.AspNetCore.Mvc;

 namespace ERPCore.Controllers;

-/// <summary>Stock-adjustment endpoints (docs/11 §5.5).</summary>
+/// <summary>
+/// Stock-adjustment endpoints (docs/11 §5.5). Creating submits a request; it moves stock once
+/// approved (docs/DUAL_APPROVAL_PLAN.md §5.4). Approving or rejecting needs the Approve action on
+/// <c>stock.adjustments</c>; the two-person rules are enforced by the service.
+/// </summary>
 [Route("api/v1/stock-adjustments")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
 public sealed class StockAdjustmentsController : ApiControllerBase
 {
+    private const string ApprovePolicy = NavPolicies.Prefix + "stock.adjustments" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction;
+
    private readonly IAdjustmentService _adjustments;

    public StockAdjustmentsController(IAdjustmentService adjustments) => _adjustments = adjustments;

-    /// <summary>List posted adjustments, newest first.</summary>
+    /// <summary>List adjustments (posted and requests), newest first.</summary>
    [HttpGet]
    [ProducesResponseType(typeof(PagedResponse<AdjustmentSummaryDto>), StatusCodes.Status200OK)]
    public async Task<ActionResult<PagedResponse<AdjustmentSummaryDto>>> List(
-        [FromQuery] PageQuery query, [FromQuery] int? warehouseId, [FromQuery] int? branchId, [FromQuery] int? reasonCodeId, CancellationToken ct)
-        => Ok(await _adjustments.ListAsync(query, warehouseId, branchId, reasonCodeId, ct));
+        [FromQuery] PageQuery query, [FromQuery] int? warehouseId, [FromQuery] int? branchId, [FromQuery] int? reasonCodeId,
+        [FromQuery] AdjustmentStatus? status, CancellationToken ct)
+        => Ok(await _adjustments.ListAsync(query, warehouseId, branchId, reasonCodeId, status, ct));

-    /// <summary>Get one adjustment with its lines and the ledger entries it posted.</summary>
+    /// <summary>Get one adjustment with its lines, approval trail and the ledger entries it posted.</summary>
    [HttpGet("{adjustmentId:int}")]
    [ProducesResponseType(typeof(AdjustmentDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -30,7 +42,7 @@ public sealed class StockAdjustmentsController : ApiControllerBase
        return dto is null ? NotFound() : Ok(dto);
    }

-    /// <summary>Create + auto-post an adjustment (mandatory reason code; decrease FIFO-consumes).</summary>
+    /// <summary>Submit an adjustment (mandatory reason code). Posts at once only when approvals are off.</summary>
    [HttpPost]
    [ProducesResponseType(typeof(AdjustmentDto), StatusCodes.Status201Created)]
    [ProducesResponseType(StatusCodes.Status400BadRequest)]
@@ -41,4 +53,29 @@ public sealed class StockAdjustmentsController : ApiControllerBase
        var dto = await _adjustments.CreateAsync(request, ct);
        return Created($"/api/v1/stock-adjustments/{dto.AdjustmentId}", dto);
    }
+
+    /// <summary>Give the next approval. The final one posts the stock movement and GL.</summary>
+    [HttpPost("{adjustmentId:int}/approve")]
+    [Authorize(Policy = ApprovePolicy)]
+    [ProducesResponseType(typeof(AdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<AdjustmentDto>> Approve(int adjustmentId, [FromBody] ApproveRequest? request, CancellationToken ct)
+        => Ok(await _adjustments.ApproveAsync(adjustmentId, request?.Comment, ct));
+
+    [HttpPost("{adjustmentId:int}/reject")]
+    [Authorize(Policy = ApprovePolicy)]
+    [ProducesResponseType(typeof(AdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<AdjustmentDto>> Reject(int adjustmentId, [FromBody] RejectRequest request, CancellationToken ct)
+        => Ok(await _adjustments.RejectAsync(adjustmentId, request.Reason, ct));
+
+    /// <summary>The requester withdraws a pending request.</summary>
+    [HttpPost("{adjustmentId:int}/cancel")]
+    [ProducesResponseType(typeof(AdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<AdjustmentDto>> Cancel(int adjustmentId, CancellationToken ct)
+        => Ok(await _adjustments.CancelAsync(adjustmentId, ct));
 }
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
 using ERPCore.Dtos.Stock;
@@ -8,17 +10,31 @@ namespace ERPCore.Controllers;

 /// <summary>Stock enquiry, ledger, valuation and reorder-alert endpoints (docs/11 §5.1–5.3, §5.7).</summary>
 [Route("api/v1/stock")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
 public sealed class StockController : ApiControllerBase
 {
    private readonly IStockService _stock;
    private readonly IReorderService _reorder;
+    private readonly IItemTrackingService _tracking;

-    public StockController(IStockService stock, IReorderService reorder)
+    public StockController(IStockService stock, IReorderService reorder, IItemTrackingService tracking)
    {
        _stock = stock;
        _reorder = reorder;
+        _tracking = tracking;
    }

+    /// <summary>
+    /// Stock on hand per batch with expiry (docs/ITEM_TRACKING_PLAN.md Phase 9), soonest expiry
+    /// first. <c>expiringWithinDays</c> keeps batches expiring within that window, expired included.
+    /// </summary>
+    [HttpGet("batches")]
+    [ProducesResponseType(typeof(PagedResponse<BatchStockDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<BatchStockDto>>> Batches(
+        [FromQuery] int? itemId, [FromQuery] int? warehouseId, [FromQuery] int? expiringWithinDays,
+        [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _tracking.ListBatchStockAsync(query, itemId, warehouseId, expiringWithinDays, ct));
+
    [HttpGet("on-hand")]
    [ProducesResponseType(typeof(StockOnHandDto), StatusCodes.Status200OK)]
    public async Task<ActionResult<StockOnHandDto>> OnHand([FromQuery] int itemId, [FromQuery] int warehouseId, CancellationToken ct)
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Stock;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>Stock-count endpoints (docs/11 §5.6).</summary>
 [Route("api/v1/stock-counts")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
 public sealed class StockCountsController : ApiControllerBase
 {
    private readonly ICountService _counts;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Stock;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>Stock-transfer endpoints (docs/11 §5.4).</summary>
 [Route("api/v1/stock-transfers")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
 public sealed class StockTransfersController : ApiControllerBase
 {
    private readonly ITransferService _transfers;
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Categories;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -10,6 +12,7 @@ namespace ERPCore.Controllers;
 /// since a subcategory only exists in the context of one.
 /// </summary>
 [Route("api/v1/subcategories")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class SubCategoriesController : ApiControllerBase
 {
    private readonly ICategoryService _categories;
@@ -0,0 +1,70 @@
+using ERPCore.Dtos.Support;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+[Route("api/v1/support-tickets")]
+public sealed class SupportTicketsController : ApiControllerBase
+{
+    private readonly ISupportTicketService _tickets;
+    private readonly ICurrentUser _currentUser;
+
+    public SupportTicketsController(ISupportTicketService tickets, ICurrentUser currentUser)
+    {
+        _tickets = tickets;
+        _currentUser = currentUser;
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(SupportTicketDto), StatusCodes.Status201Created)]
+    public async Task<ActionResult<SupportTicketDto>> Create([FromBody] CreateSupportTicketRequest request, CancellationToken ct)
+    {
+        var result = await _tickets.CreateAsync(_currentUser.AuditUserId, request, ct);
+        SetETag(result.RowVersion);
+        return CreatedAtAction(nameof(GetById), new { id = result.Value.TicketId }, result.Value);
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(IReadOnlyList<SupportTicketSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<SupportTicketSummaryDto>>> GetList(CancellationToken ct)
+    {
+        var list = await _tickets.GetListAsync(_currentUser.AuditUserId, _currentUser.IsAdmin, ct);
+        return Ok(list);
+    }
+
+    [HttpGet("{id:int}")]
+    [ProducesResponseType(typeof(SupportTicketDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<SupportTicketDto>> GetById(int id, CancellationToken ct)
+    {
+        var result = await _tickets.GetByIdAsync(id, _currentUser.AuditUserId, _currentUser.IsAdmin, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost("{id:int}/messages")]
+    [ProducesResponseType(typeof(SupportTicketDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<SupportTicketDto>> AddMessage(int id, [FromBody] AddSupportTicketMessageRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _tickets.AddMessageAsync(id, _currentUser.AuditUserId, _currentUser.IsAdmin, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPut("{id:int}/status")]
+    [ProducesResponseType(typeof(SupportTicketDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<SupportTicketDto>> UpdateStatus(int id, [FromBody] UpdateSupportTicketStatusRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _tickets.UpdateStatusAsync(id, _currentUser.AuditUserId, _currentUser.IsAdmin, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+}
@@ -0,0 +1,70 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.TaxRates;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Tax rate master endpoints — see <see cref="Domain.Entities.TaxRate"/>.</summary>
+[Route("api/v1/tax-rates")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
+public sealed class TaxRatesController : ApiControllerBase
+{
+    private readonly ITaxRateService _taxRates;
+
+    public TaxRatesController(ITaxRateService taxRates) => _taxRates = taxRates;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<TaxRateDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<TaxRateDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _taxRates.ListAsync(query, status, ct));
+
+    [HttpGet("{taxRateId:int}")]
+    [ProducesResponseType(typeof(TaxRateDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<TaxRateDto>> GetById(int taxRateId, CancellationToken ct)
+    {
+        var result = await _taxRates.GetAsync(taxRateId, ct);
+        if (result is null) return NotFound();
+
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(TaxRateDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<TaxRateDto>> Create([FromBody] CreateTaxRateRequest request, CancellationToken ct)
+    {
+        var result = await _taxRates.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/tax-rates/{result.Value.TaxRateId}", result.Value);
+    }
+
+    [HttpPut("{taxRateId:int}")]
+    [ProducesResponseType(typeof(TaxRateDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<TaxRateDto>> Update(int taxRateId, [FromBody] UpdateTaxRateRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _taxRates.UpdateAsync(taxRateId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>Deactivate/reactivate. Masters are never hard-deleted (FR-MD-08).</summary>
+    [HttpPatch("{taxRateId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int taxRateId, [FromBody] UpdateTaxRateStatusRequest request, CancellationToken ct)
+    {
+        await _taxRates.SetStatusAsync(taxRateId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,64 @@
+using ERPCore.Dtos.Stock;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Serial/batch pickers used across GRN, sales, returns and stock screens
+/// (docs/ITEM_TRACKING_PLAN.md Phase 8). Read-only lookups like the item scan, so they need
+/// only ERP access — not one module's nav permission — as every one of those screens calls them.
+/// </summary>
+[Route("api/v1/tracking")]
+public sealed class TrackingController : ApiControllerBase
+{
+    private readonly IItemTrackingService _tracking;
+    private readonly ISerialTrackingService _serialTracking;
+
+    public TrackingController(IItemTrackingService tracking, ISerialTrackingService serialTracking)
+    {
+        _tracking = tracking;
+        _serialTracking = serialTracking;
+    }
+
+    /// <summary>
+    /// Which tracking features are switched on (Product Configuration) — readable by every
+    /// screen, unlike <c>/product-config</c> which needs the Products permission.
+    /// </summary>
+    [HttpGet("settings")]
+    [ProducesResponseType(typeof(TrackingSettingsDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<TrackingSettingsDto>> Settings(CancellationToken ct)
+        => Ok(new TrackingSettingsDto(await _serialTracking.IsEnabledAsync(ct)));
+
+    /// <summary>
+    /// Auto-generate: the next <c>count</c> free serial numbers for an item under <c>prefix</c>
+    /// (continues the highest number already used). Nothing is reserved — the GRN still checks
+    /// uniqueness when it is saved and confirmed.
+    /// </summary>
+    [HttpGet("serials/next-numbers")]
+    [ProducesResponseType(typeof(IReadOnlyList<string>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<string>>> NextSerialNumbers(
+        [FromQuery] int itemId, [FromQuery] string? prefix, [FromQuery] int count = 1, CancellationToken ct = default)
+        => Ok(await _tracking.NextSerialNumbersAsync(itemId, prefix ?? string.Empty, count, ct));
+
+    /// <summary>Issuable serials of an item at a warehouse (search by number/barcode with <c>q</c>).</summary>
+    [HttpGet("serials/available")]
+    [ProducesResponseType(typeof(IReadOnlyList<AvailableSerialDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<AvailableSerialDto>>> AvailableSerials(
+        [FromQuery] int itemId, [FromQuery] int warehouseId, [FromQuery] string? q, [FromQuery] int take = 200, CancellationToken ct = default)
+        => Ok(await _tracking.GetAvailableSerialsAsync(itemId, warehouseId, q, take, ct));
+
+    /// <summary>Issuable stock per batch with expiry, soonest expiry first.</summary>
+    [HttpGet("batches/available")]
+    [ProducesResponseType(typeof(IReadOnlyList<AvailableBatchDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<AvailableBatchDto>>> AvailableBatches(
+        [FromQuery] int itemId, [FromQuery] int warehouseId, CancellationToken ct)
+        => Ok(await _tracking.GetAvailableBatchesAsync(itemId, warehouseId, ct));
+
+    /// <summary>The FEFO pick posting would make for <c>qty</c> when no batch is chosen.</summary>
+    [HttpGet("batches/suggest")]
+    [ProducesResponseType(typeof(IReadOnlyList<BatchSuggestionDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<BatchSuggestionDto>>> SuggestBatches(
+        [FromQuery] int itemId, [FromQuery] int warehouseId, [FromQuery] decimal qty, CancellationToken ct)
+        => Ok(await _tracking.SuggestBatchesAsync(itemId, warehouseId, qty, ct));
+}
@@ -1,3 +1,6 @@
+using ERPCore.Domain.Enums;
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Uoms;
 using ERPCore.Services.Interfaces;
@@ -7,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>Unit-of-measure endpoints (docs/11-BACKEND-PHASE1.md §2.2).</summary>
 [Route("api/v1/uoms")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class UomsController : ApiControllerBase
 {
    private readonly IUomService _uoms;
@@ -15,8 +19,9 @@ public sealed class UomsController : ApiControllerBase

    [HttpGet]
    [ProducesResponseType(typeof(PagedResponse<UomDto>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<PagedResponse<UomDto>>> List([FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _uoms.ListAsync(query, ct));
+    public async Task<ActionResult<PagedResponse<UomDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _uoms.ListAsync(query, status, ct));

    [HttpPost]
    [ProducesResponseType(typeof(UomDto), StatusCodes.Status201Created)]
@@ -26,4 +31,14 @@ public sealed class UomsController : ApiControllerBase
        var dto = await _uoms.CreateAsync(request, ct);
        return Created($"/api/v1/uoms/{dto.UomId}", dto);
    }
+
+    /// <summary>Deactivate/reactivate. Masters are never hard-deleted (FR-MD-08).</summary>
+    [HttpPatch("{uomId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int uomId, [FromBody] UpdateUomStatusRequest request, CancellationToken ct)
+    {
+        await _uoms.SetStatusAsync(uomId, request.Status, ct);
+        return NoContent();
+    }
 }
@@ -1,10 +1,13 @@
+using Microsoft.AspNetCore.Authorization;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Audit;
+using ERPCore.Dtos.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
 using ERPCore.Dtos.Users;
 using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using ERPCore.System.Errors;
 using Microsoft.AspNetCore.Mvc;

 namespace ERPCore.Controllers;
@@ -14,6 +17,7 @@ namespace ERPCore.Controllers;
 /// account creation orchestrated against AuthHex (see <see cref="IUserManagementService.CreateAsync"/>).
 /// </summary>
 [Route("api/v1/users")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
 public sealed class UsersController : ApiControllerBase
 {
    private readonly IUserManagementService _users;
@@ -83,4 +87,20 @@ public sealed class UsersController : ApiControllerBase
    [ProducesResponseType(typeof(PagedResponse<LoginActivityDto>), StatusCodes.Status200OK)]
    public async Task<ActionResult<PagedResponse<LoginActivityDto>>> ListLoginDevices(int userId, [FromQuery] PageQuery query, CancellationToken ct)
        => Ok(await _audit.ListLoginDevicesAsync(userId, query, ct));
+
+    /// <summary>
+    /// Admin-only escape hatch: permanently deletes a stale AuthHex identity (by email/mobile/NIC/
+    /// username) that is blocking new registrations. Does not touch ERPCore's own `users` table.
+    /// See <see cref="IUserManagementService.PurgeAuthHexIdentityAsync"/>.
+    /// </summary>
+    [HttpPost("purge-authhex-identity")]
+    [ProducesResponseType(typeof(DeleteAuthHexUserResult), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    public async Task<ActionResult<DeleteAuthHexUserResult>> PurgeAuthHexIdentity([FromBody] PurgeAuthHexIdentityRequest request, CancellationToken ct)
+    {
+        if (!_currentUser.IsAdmin)
+            throw new DomainException("FORBIDDEN", "Only an administrator can purge an AuthHex identity.", 403);
+
+        return Ok(await _users.PurgeAuthHexIdentityAsync(request, ct));
+    }
 }
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Vendors;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;

 /// <summary>Vendor master endpoints (docs/11-BACKEND-PHASE1.md §2.4).</summary>
 [Route("api/v1/vendors")]
+[Authorize(Policy = NavPolicies.Prefix + "vendors")]
 public sealed class VendorsController : ApiControllerBase
 {
    private readonly IVendorService _vendors;
@@ -62,4 +65,15 @@ public sealed class VendorsController : ApiControllerBase
        await _vendors.SetStatusAsync(vendorId, request.Status, ct);
        return NoContent();
    }
+
+    [HttpDelete("{vendorId:int}")]
+    [Authorize(Policy = NavPolicies.Prefix + "vendors" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int vendorId, CancellationToken ct)
+    {
+        await _vendors.DeleteAsync(vendorId, ct);
+        return NoContent();
+    }
 }
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Warehouses;
 using ERPCore.Services.Interfaces;
@@ -7,6 +9,7 @@ namespace ERPCore.Controllers;

 /// <summary>Warehouse &amp; bin endpoints (docs/11-BACKEND-PHASE1.md §2.5).</summary>
 [Route("api/v1/warehouses")]
+[Authorize(Policy = NavPolicies.Prefix + "warehouses")]
 public sealed class WarehousesController : ApiControllerBase
 {
    private readonly IWarehouseService _warehouses;
@@ -37,6 +40,24 @@ public sealed class WarehousesController : ApiControllerBase
        return Created($"/api/v1/warehouses/{dto.WarehouseId}", dto);
    }

+    [HttpPut("{warehouseId:int}")]
+    [ProducesResponseType(typeof(WarehouseDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<WarehouseDto>> Update(int warehouseId, [FromBody] UpdateWarehouseRequest request, CancellationToken ct)
+        => Ok(await _warehouses.UpdateAsync(warehouseId, request, ct));
+
+    [HttpDelete("{warehouseId:int}")]
+    [Authorize(Policy = NavPolicies.Prefix + "warehouses" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int warehouseId, CancellationToken ct)
+    {
+        await _warehouses.DeleteAsync(warehouseId, ct);
+        return NoContent();
+    }
+
    [HttpGet("{warehouseId:int}/bins")]
    [ProducesResponseType(typeof(IReadOnlyList<BinDto>), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -0,0 +1,30 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Stock;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Customer warranty register (docs/ITEM_TRACKING_PLAN.md Phase 5). Warranties are created by
+/// posting a sale, never directly — this controller only reads.
+/// </summary>
+[Route("api/v1/warranties")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
+public sealed class WarrantiesController : ApiControllerBase
+{
+    private readonly IItemTrackingService _tracking;
+
+    public WarrantiesController(IItemTrackingService tracking) => _tracking = tracking;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<WarrantyRegistrationDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<WarrantyRegistrationDto>>> List(
+        [FromQuery] int? customerId, [FromQuery] int? itemId, [FromQuery] string? serialNo,
+        [FromQuery] WarrantyStatus? status, [FromQuery] int? expiringWithinDays, [FromQuery] bool? expired,
+        [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _tracking.ListWarrantiesAsync(query, customerId, itemId, serialNo, status, expiringWithinDays, expired, ct));
+}
@@ -0,0 +1,44 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Items;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Custom warranty period master — managed under Products like Item Variants.</summary>
+[Route("api/v1/warranty-periods")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
+public sealed class WarrantyPeriodsController : ApiControllerBase
+{
+    private readonly IWarrantyPeriodService _periods;
+
+    public WarrantyPeriodsController(IWarrantyPeriodService periods) => _periods = periods;
+
+    /// <summary>Custom periods only (defaults are fixed); filter <c>status=Active</c> for selectable rows.</summary>
+    [HttpGet]
+    [ProducesResponseType(typeof(List<WarrantyPeriodDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<WarrantyPeriodDto>>> List([FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _periods.ListAsync(status, ct));
+
+    [HttpPost]
+    [ProducesResponseType(typeof(WarrantyPeriodDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<WarrantyPeriodDto>> Create([FromBody] CreateWarrantyPeriodRequest request, CancellationToken ct)
+    {
+        var result = await _periods.CreateAsync(request.Months!.Value, ct);
+        return Created($"/api/v1/warranty-periods/{result.WarrantyPeriodId}", result);
+    }
+
+    /// <summary>Deactivate/reactivate. Never hard-deleted (FR-MD-08).</summary>
+    [HttpPatch("{warrantyPeriodId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int warrantyPeriodId, [FromBody] UpdateWarrantyPeriodStatusRequest request, CancellationToken ct)
+    {
+        await _periods.SetStatusAsync(warrantyPeriodId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -26,4 +26,13 @@ public static class DocumentTypes

    /// <summary>Cashier day-end close-out (Sales) — <c>DEND-2026-00001</c>.</summary>
    public const string SalesDayEnd = "DEND";
+
+    /// <summary>Business expense bill (Accounts) — <c>EXP-BR-001-2026-00001</c>.</summary>
+    public const string Expense = "EXP";
+
+    /// <summary>Till cash deposited to a bank account (Accounts) — <c>BD-BR-001-2026-00001</c>.</summary>
+    public const string BankDeposit = "BD";
+
+    /// <summary>Selling-price change request (Products) — <c>PADJ-2026-00001</c>.</summary>
+    public const string PriceAdjustment = "PADJ";
 }
@@ -0,0 +1,55 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Till cash taken to the bank (docs/BANK_DEPOSIT_MODULE_PLAN.md §4). Saving it posts a GL entry
+/// (Debit the bank account / Credit the cash account) and lowers the branch's cash in hand for
+/// <see cref="BusinessDate"/>. There is no draft: a wrong deposit is cancelled (the entry is
+/// reversed) and entered again. GL accounts have no local FK, so the account details are snapshots.
+/// </summary>
+public class BankDeposit
+{
+    public int BankDepositId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
+    /// <summary>The day whose cash is deposited — cash in hand and the day-end report group by this.</summary>
+    public DateOnly BusinessDate { get; set; }
+    /// <summary>The day the bank received it; the GL entry date.</summary>
+    public DateOnly DepositDate { get; set; }
+
+    public decimal Amount { get; set; }
+
+    public long FromGlCashAccountId { get; set; }
+    public string FromCashAccountCode { get; set; } = string.Empty;
+    public string FromCashAccountName { get; set; } = string.Empty;
+
+    public long ToGlBankAccountId { get; set; }
+    public string ToBankAccountCode { get; set; } = string.Empty;
+    public string ToBankAccountName { get; set; } = string.Empty;
+    public string? ToBankName { get; set; }
+    public string? ToAccountNumber { get; set; }
+
+    public string? DepositSlipNo { get; set; }
+    public string? DepositedBy { get; set; }
+    public string? Remarks { get; set; }
+
+    public BankDepositStatus Status { get; set; } = BankDepositStatus.Posted;
+
+    public string? GlJournalNo { get; set; }
+    public DateTime? GlPostedAt { get; set; }
+
+    public string? GlReversalJournalNo { get; set; }
+    public string? CancelReason { get; set; }
+    public int? CancelledBy { get; set; }
+    public DateTime? CancelledAt { get; set; }
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+    public DateTime CreatedAt { get; set; }
+
+    public uint RowVersion { get; set; }
+}
@@ -13,4 +13,7 @@ public class Batch

    public string BatchNo { get; set; } = string.Empty;
    public DateOnly? ExpiryDate { get; set; }
+
+    /// <summary>Optional scan code for barcode/RFID lookup (unique when set).</summary>
+    public string? Barcode { get; set; }
 }
@@ -9,6 +9,18 @@ namespace ERPCore.Domain.Entities;
 /// </summary>
 public class Branch
 {
+    /// <summary>
+    /// Code of the deployment's default branch. Every branch-scoped entity has a
+    /// non-nullable <c>BranchId</c> with a Restrict FK, so this row must exist before any
+    /// of them can be written — see <c>DataSeeder.EnsureDefaultBranchAsync</c>, which
+    /// creates it at startup, and <c>BranchConfigService.ResolveDefaultBranchIdAsync</c>,
+    /// which is the lazy runtime fallback.
+    /// </summary>
+    public const string DefaultCode = "BR-000";
+
+    /// <summary>Display name paired with <see cref="DefaultCode"/>.</summary>
+    public const string DefaultName = "Main Branch";
+
    public int BranchId { get; set; }

    /// <summary>Server-generated on create ("BR-001", "BR-002", ...) — never accepted from the client.</summary>
@@ -17,6 +17,12 @@ public class BranchConfig

    public bool BranchingEnabled { get; set; } = true;

+    /// <summary>Independent sub-toggle: when the global <see cref="BranchingEnabled"/> is on
+    /// but this is off, Warehouses stop asking for/showing a branch while Employees etc.
+    /// still do. Meaningless when <see cref="BranchingEnabled"/> is off (everything is
+    /// single-branch already).</summary>
+    public bool WarehouseBranchingEnabled { get; set; } = true;
+
    public DateTime? UpdatedAt { get; set; }

    public int? UpdatedBy { get; set; }
@@ -25,9 +25,14 @@ public class BundleSale
    public decimal DiscountTotal { get; set; }
    public decimal TaxTotal { get; set; }
    public decimal GrandTotal { get; set; }
+
+    /// <summary>How the (always fully paid) <see cref="GrandTotal"/> was tendered:
+    /// <c>CashAmount + CardAmount == GrandTotal</c>. Backfilled as all cash.</summary>
+    public decimal CashAmount { get; set; }
+    public decimal CardAmount { get; set; }
    public DateTime CreatedAt { get; set; }
    public DateTime? UpdatedAt { get; set; }
-    public int ConcurrencyStamp { get; set; }
+    public uint RowVersion { get; set; }

    /// <summary>Set once this bundle's business date is closed by <see cref="SalesDayEnd"/> — a
    /// closed bundle sale is frozen (no further edits). Same role as <see cref="SalesSlip.DayEndId"/>;
@@ -11,7 +11,7 @@ public class BundleSaleTemplate
    public EntityStatus Status { get; set; } = EntityStatus.Active;
    public DateTime CreatedAt { get; set; }
    public DateTime? UpdatedAt { get; set; }
-    public int ConcurrencyStamp { get; set; }
+    public uint RowVersion { get; set; }

    public ICollection<BundleSaleTemplateLine> Lines { get; set; } = new List<BundleSaleTemplateLine>();
 }
@@ -29,6 +29,9 @@ public class Customer
    public int? DefaultWarehouseId { get; set; }
    public Warehouse? DefaultWarehouse { get; set; }

+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
    public EntityStatus Status { get; set; } = EntityStatus.Active;
    public DateTime CreatedAt { get; set; }
    public DateTime? UpdatedAt { get; set; }
@@ -0,0 +1,48 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// One approval decision on a document (docs/DUAL_APPROVAL_PLAN.md §4.1) — a row per decision, so
+/// the full trail survives. Polymorphic like the stock ledger: <see cref="DocType"/> +
+/// <see cref="DocId"/>, no FK. Doc types: <c>ADJ</c> (stock adjustment), <c>PADJ</c> (price adjustment).
+/// </summary>
+public class DocumentApproval
+{
+    public int DocumentApprovalId { get; set; }
+    public string DocType { get; set; } = string.Empty;
+    public int DocId { get; set; }
+    /// <summary>1 or 2.</summary>
+    public int Level { get; set; }
+    public ApprovalDecision Decision { get; set; }
+    public int DecidedBy { get; set; }
+    public User? Decider { get; set; }
+    public DateTime DecidedAt { get; set; }
+    public string? Comment { get; set; }
+}
+
+/// <summary>
+/// Approval rules (docs/DUAL_APPROVAL_PLAN.md §7). Singleton row, edited under Settings → Approvals.
+/// Levels: 0 = no approval (applies on create), 1 = one approver, 2 = two different approvers.
+/// </summary>
+public class ApprovalConfig
+{
+    public const int SingletonId = 1;
+
+    public int ApprovalConfigId { get; set; }
+
+    public int StockAdjustmentLevels { get; set; } = 2;
+    /// <summary>With 2 levels: an adjustment whose stock value is below this needs only one approval. 0 = always two.</summary>
+    public decimal StockAdjustmentLevel2ThresholdValue { get; set; }
+
+    public int PriceAdjustmentLevels { get; set; } = 2;
+    /// <summary>With 2 levels: a change smaller than this percent (largest across its lines) needs only one approval. 0 = always two.</summary>
+    public decimal PriceAdjustmentLevel2ThresholdPercent { get; set; }
+
+    /// <summary>Comma-separated role codes allowed to give the second approval; empty = anyone with the Approve action.</summary>
+    public string? Level2RoleCodes { get; set; }
+
+    public DateTime? UpdatedAt { get; set; }
+    public int? UpdatedBy { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,92 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// One business expense bill (electricity, rent, …) outside procurement. Draft is editable;
+/// Post accrues it to GL (Debit the title's expense account / Credit Accrued Expenses);
+/// payments then settle the accrual in one or more installments (see
+/// ExpensePaymentService). Model: docs/EXPENSE_MODULE_PLAN.md §3.3.
+/// </summary>
+public class Expense
+{
+    public int ExpenseId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
+    public DateOnly ExpenseDate { get; set; }
+    public DateOnly? DueDate { get; set; }
+
+    public int ExpenseCategoryId { get; set; }
+    public ExpenseCategory? Category { get; set; }
+
+    public int ExpenseTitleId { get; set; }
+    public ExpenseTitle? Title { get; set; }
+
+    public string? Payee { get; set; }
+    public int? VendorId { get; set; }
+    public Vendor? Vendor { get; set; }
+
+    public string? BillReference { get; set; }
+    public string? Description { get; set; }
+    /// <summary>Optional month the bill covers, as <c>yyyy-MM</c> (e.g. September's electricity).</summary>
+    public string? PeriodMonth { get; set; }
+
+    public decimal Amount { get; set; }
+    public decimal PaidAmount { get; set; }
+    public decimal BalanceAmount { get; set; }
+
+    public ExpenseStatus Status { get; set; } = ExpenseStatus.Draft;
+    public ExpensePaymentStatus PaymentStatus { get; set; } = ExpensePaymentStatus.Unpaid;
+
+    /// <summary>Snapshot of the title's GL expense account at post time.</summary>
+    public string? GlExpenseAccountCode { get; set; }
+    /// <summary>Journal number of the accrual entry posted on Post.</summary>
+    public string? GlJournalNo { get; set; }
+    public DateTime? GlPostedAt { get; set; }
+    /// <summary>Journal number of the reversing entry posted on Cancel (Posted expenses only).</summary>
+    public string? GlReversalJournalNo { get; set; }
+    public string? CancelReason { get; set; }
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    public uint RowVersion { get; set; }
+
+    public ICollection<ExpensePayment> Payments { get; set; } = new List<ExpensePayment>();
+}
+
+/// <summary>
+/// A payment against a Posted expense's balance (installments allowed). Every line of one
+/// payment submission shares the single GL journal entry that submission posted (Debit
+/// Accrued Expenses / Credit each selected cash-or-bank account). Mirrors
+/// <see cref="PurchaseInvoicePayment"/>.
+/// </summary>
+public class ExpensePayment
+{
+    public int ExpensePaymentId { get; set; }
+
+    public int ExpenseId { get; set; }
+    public Expense? Expense { get; set; }
+
+    public decimal Amount { get; set; }
+    public DateTime PaymentDate { get; set; }
+    public ExpensePaymentMethod PaymentMethod { get; set; }
+
+    /// <summary>GL's numeric id for the bank/cash account the payment was made from.</summary>
+    public long GlBankAccountId { get; set; }
+    /// <summary>Snapshot of the account's display name at payment time (GL account lists have no local FK).</summary>
+    public string BankAccountName { get; set; } = string.Empty;
+
+    public string? ChequeNo { get; set; }
+    public string? Reference { get; set; }
+    public string? GlJournalNo { get; set; }
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+    public DateTime CreatedAt { get; set; }
+}
@@ -0,0 +1,48 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Top-level expense grouping (Utility, Rental, Salaries, Other). The four seeded rows are
+/// <see cref="IsSystem"/> — they can be deactivated but not renamed; admins can add more.
+/// Each category owns its <see cref="ExpenseTitle"/>s. Model: docs/EXPENSE_MODULE_PLAN.md §3.1.
+/// </summary>
+public class ExpenseCategory
+{
+    public int ExpenseCategoryId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public bool IsSystem { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+    public int SortOrder { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+
+    public ICollection<ExpenseTitle> Titles { get; set; } = new List<ExpenseTitle>();
+}
+
+/// <summary>
+/// A specific expense under a category (Utility → Electricity, Water, …). Carries the GL
+/// expense account debited when an expense with this title is posted — snapshotted onto the
+/// expense at post time, so changing it later does not touch already-posted expenses.
+/// Model: docs/EXPENSE_MODULE_PLAN.md §3.2.
+/// </summary>
+public class ExpenseTitle
+{
+    public int ExpenseTitleId { get; set; }
+
+    public int ExpenseCategoryId { get; set; }
+    public ExpenseCategory? Category { get; set; }
+
+    public string Name { get; set; } = string.Empty;
+    public string GlExpenseAccountCode { get; set; } = string.Empty;
+    public bool IsSystem { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+    public int SortOrder { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,71 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Role → GL account code mapping — a singleton row, same shape as <see cref="GrnConfig"/>.
+/// <para>
+/// This is master data, not deployment config. It used to live in <c>appsettings.json</c> as
+/// per-module <c>Gl*Code</c> keys, which meant (a) only a redeploy could correct a mapping, and
+/// (b) nothing checked the codes existed in GL until something tried to post. Held here it is
+/// validated against GL's live chart of accounts on every save, so an unknown or non-postable
+/// account cannot be stored in the first place — see <c>GlAccountConfigService.UpdateAsync</c>.
+/// </para>
+/// <para>
+/// Codes are nullable: a fresh install has nothing mapped, and a posting flow that needs an
+/// unmapped role fails with <c>GL_ACCOUNT_NOT_CONFIGURED</c> naming that role. Width matches
+/// GL's own <c>accounts.account_code varchar(20)</c>.
+/// </para>
+/// </summary>
+public class GlAccountConfig
+{
+    /// <summary>Always 1 - the singleton row's id.</summary>
+    public const int SingletonId = 1;
+
+    /// <summary>Matches GL's <c>accounts.account_code</c> column width.</summary>
+    public const int CodeMaxLength = 20;
+
+    public int ConfigId { get; set; }
+
+    /// <summary>Stock on hand (was <c>Grn|Adjustment|SalesDayEnd|Fifo:GlInventoryAccountCode</c>).</summary>
+    public string? InventoryAccountCode { get; set; }
+
+    /// <summary>Recoverable input VAT (was <c>Grn:GlVatRecoverableAccountCode</c>).</summary>
+    public string? VatRecoverableAccountCode { get; set; }
+
+    /// <summary>Trade debtors (was <c>SalesDayEnd|SalesInvoice:GlAccountsReceivableCode</c>).</summary>
+    public string? AccountsReceivableCode { get; set; }
+
+    /// <summary>Goods received not invoiced (was <c>Grn|PurchaseInvoice|Fifo:GlClearingAccountCode</c>).</summary>
+    public string? ClearingAccountCode { get; set; }
+
+    /// <summary>Output tax payable (was <c>SalesDayEnd:GlTaxPayableAccountCode</c>).</summary>
+    public string? TaxPayableAccountCode { get; set; }
+
+    /// <summary>Trade creditors (was <c>PurchaseInvoice:GlAccountsPayableCode</c>).</summary>
+    public string? AccountsPayableCode { get; set; }
+
+    /// <summary>Sales revenue (was <c>SalesDayEnd:GlSalesRevenueAccountCode</c>).</summary>
+    public string? SalesRevenueAccountCode { get; set; }
+
+    /// <summary>Sales discount given (was <c>SalesDayEnd:GlSalesDiscountAccountCode</c>).</summary>
+    public string? SalesDiscountAccountCode { get; set; }
+
+    /// <summary>Inventory gain on adjustment/count (was <c>Adjustment:GlGainAccountCode</c>).</summary>
+    public string? InventoryGainAccountCode { get; set; }
+
+    /// <summary>Cost of goods sold (was <c>SalesDayEnd:GlCogsAccountCode</c>).</summary>
+    public string? CogsAccountCode { get; set; }
+
+    /// <summary>Inventory loss on adjustment/count (was <c>Adjustment:GlLossAccountCode</c>).</summary>
+    public string? InventoryLossAccountCode { get; set; }
+
+    /// <summary>Cash takings at day-end (was <c>SalesDayEnd:GlCashAccountCode</c>).</summary>
+    public string? CashAccountCode { get; set; }
+
+    public DateTime? UpdatedAt { get; set; }
+
+    public int? UpdatedBy { get; set; }
+    public User? UpdatedByUser { get; set; }
+
+    /// <summary>Optimistic concurrency token (ETag source); bumped by ErpDbContext.BumpRowVersions.</summary>
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,41 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// GRN (goods receipt) configuration — a singleton row, same shape as <see cref="SalesConfig"/>.
+/// Controls which warehouse goods are received into.
+/// </summary>
+public class GrnConfig
+{
+    /// <summary>Always 1 - the singleton row's id.</summary>
+    public const int SingletonId = 1;
+
+    public int ConfigId { get; set; }
+
+    /// <summary>When on (default) and no <see cref="DefaultWarehouseId"/> is saved, New GRN shows
+    /// a Warehouse picker. When off, a default must be saved.</summary>
+    public bool AllowWarehouseSelection { get; set; } = true;
+
+    /// <summary>Default receiving warehouse. Whenever set, New GRN shows only this warehouse (locked)
+    /// and every GRN is forced onto it server-side (see GrnConfigService.GetForcedWarehouseIdAsync).
+    /// Required while <see cref="AllowWarehouseSelection"/> is off; clearing it brings the picker back.</summary>
+    public int? DefaultWarehouseId { get; set; }
+    public Warehouse? DefaultWarehouse { get; set; }
+
+    /// <summary>When on (default), GRN lines may carry a discount % (the New GRN "Disc %" column and
+    /// header rate); when off, they are hidden and a discount above zero is rejected server-side
+    /// (see GrnService.CreateAsync).</summary>
+    public bool AllowDiscounts { get; set; } = true;
+
+    /// <summary>When on (default), GRN lines carry VAT (entered, or the item's tax rate when left
+    /// empty); when off, the VAT columns are hidden, every line is received at 0% VAT, and a VAT
+    /// above zero is rejected server-side (see GrnService.CreateAsync).</summary>
+    public bool AllowVat { get; set; } = true;
+
+    public DateTime? UpdatedAt { get; set; }
+
+    public int? UpdatedBy { get; set; }
+    public User? UpdatedByUser { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}
@@ -65,4 +65,12 @@ public class GrnLine
    /// Empty for a non-warranty item.
    /// </summary>
    public ICollection<GrnLineWarrantyNumber> WarrantyNumbers { get; set; } = new List<GrnLineWarrantyNumber>();
+
+    /// <summary>
+    /// One row per received unit when <see cref="Item.TrackingMode"/> is
+    /// <see cref="TrackingMode.Serial"/> — count must equal <see cref="Qty"/>. For a serial item
+    /// under warranty the serial is the warranty identity, so it carries no
+    /// <see cref="WarrantyNumbers"/>. Empty otherwise.
+    /// </summary>
+    public ICollection<GrnLineSerial> Serials { get; set; } = new List<GrnLineSerial>();
 }
@@ -0,0 +1,22 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A serial number captured on a Draft GRN line for a serial-tracked item
+/// (<see cref="Item.TrackingMode"/> = <see cref="Enums.TrackingMode.Serial"/>). The line must
+/// carry exactly <see cref="GrnLine.Qty"/> of these. The draft holds the numbers only — the
+/// <see cref="Serial"/> rows (and their qty-1 FIFO layers) are created when the GRN is
+/// confirmed, so a draft that is never confirmed reserves nothing (docs/ITEM_TRACKING_PLAN.md Phase 2).
+/// </summary>
+public class GrnLineSerial
+{
+    public int GrnLineSerialId { get; set; }
+
+    public int GrnLineId { get; set; }
+    public GrnLine? GrnLine { get; set; }
+
+    public string SerialNo { get; set; } = string.Empty;
+
+    /// <summary>Set on confirm — the <see cref="Serial"/> created for this number.</summary>
+    public int? SerialId { get; set; }
+    public Serial? Serial { get; set; }
+}
@@ -14,6 +14,9 @@ public class Item
    public string Name { get; set; } = string.Empty;
    public string? Description { get; set; }

+    /// <summary>Optional scan code for barcode/RFID lookup (unique when set).</summary>
+    public string? Barcode { get; set; }
+
    public int CategoryId { get; set; }
    public Category? Category { get; set; }

@@ -41,7 +44,14 @@ public class Item
    public Warranty Warranty { get; set; } = Warranty.NonWarranty;
    /// <summary>Coverage length in months (see <see cref="Enums.WarrantyPeriods.AllowedMonths"/>) when <see cref="Warranty"/> is Warranty; null otherwise.</summary>
    public int? WarrantyPeriodMonths { get; set; }
-    public string? TaxClass { get; set; }
+
+    /// <summary>
+    /// The tax rate a sales/purchase line for this item defaults to (see
+    /// <see cref="TaxRate"/>) — replaces the old free-text "tax class" label that nothing
+    /// ever read. Null means no default; a line must be given an explicit tax percentage.
+    /// </summary>
+    public int? TaxRateId { get; set; }
+    public TaxRate? TaxRate { get; set; }

    /// <summary>
    /// Optional selling price range and flat price used by Sales only.
@@ -0,0 +1,27 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A product photo attached to an item. Like <see cref="EmployeeDocument"/>, the file lives
+/// behind <see cref="Infra.Storage.IFileStorageService"/> under a server-generated name and is
+/// only reachable through the authenticated items API — never a static path. Only uploadable
+/// while <see cref="ProductConfig.ItemImagesEnabled"/> is on; existing images stay readable
+/// after the flag is switched off (reads are never gated).
+/// </summary>
+public class ItemImage
+{
+    public int ItemImageId { get; set; }
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+
+    public string OriginalFileName { get; set; } = string.Empty;
+    public string StoredFileName { get; set; } = string.Empty;
+    public string RelativePath { get; set; } = string.Empty;
+    public string ContentType { get; set; } = string.Empty;
+    public long SizeBytes { get; set; }
+
+    /// <summary>Display order; the lowest is the item's main image.</summary>
+    public int SortOrder { get; set; }
+
+    public int UploadedBy { get; set; }
+    public DateTime UploadedAt { get; set; }
+}
@@ -0,0 +1,22 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A single raised notification event (e.g. "GRN Confirmed"). Broadcast to
+/// active users via <see cref="NotificationRecipient"/> rows, gated by
+/// whether the module's InApp channel is enabled in <see cref="NotificationConfig"/>.
+/// </summary>
+public class Notification
+{
+    public int NotificationId { get; set; }
+
+    public string ModuleKey { get; set; } = string.Empty;
+    public string Title { get; set; } = string.Empty;
+    public string Message { get; set; } = string.Empty;
+
+    public string? RelatedEntityType { get; set; }
+    public int? RelatedEntityId { get; set; }
+
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+
+    public ICollection<NotificationRecipient> Recipients { get; set; } = new List<NotificationRecipient>();
+}
@@ -0,0 +1,18 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Per-user read state for a broadcast <see cref="Notification"/>.
+/// </summary>
+public class NotificationRecipient
+{
+    public int NotificationRecipientId { get; set; }
+
+    public int NotificationId { get; set; }
+    public Notification? Notification { get; set; }
+
+    public int UserId { get; set; }
+    public User? User { get; set; }
+
+    public bool IsRead { get; set; }
+    public DateTime? ReadAt { get; set; }
+}
@@ -10,6 +10,10 @@ public class NumberSequence
 {
    public int SequenceId { get; set; }
    public string DocType { get; set; } = string.Empty;
+    /// <summary>Per-branch counter key (docs/BRANCH_ISOLATION_PLAN.md §5) — backfilled to the
+    /// deployment's default branch for rows that predate per-branch numbering.</summary>
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
    public int Year { get; set; }
    public int LastNumber { get; set; }
 }
@@ -0,0 +1,78 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A request to change items' selling prices (docs/DUAL_APPROVAL_PLAN.md §6). Nothing changes on the
+/// items until it is fully approved; then each line's new prices are written to its item and an
+/// <see cref="ItemPriceHistory"/> row is kept. <see cref="CreatedBy"/> is the requester.
+/// </summary>
+public class PriceAdjustment
+{
+    public int PriceAdjustmentId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+    public string Reason { get; set; } = string.Empty;
+
+    public PriceAdjustmentStatus Status { get; set; } = PriceAdjustmentStatus.PendingApproval;
+    public int RequiredApprovals { get; set; }
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+    public DateTime CreatedAt { get; set; }
+
+    public int? ApprovedLevel1By { get; set; }
+    public DateTime? ApprovedLevel1At { get; set; }
+    public int? ApprovedLevel2By { get; set; }
+    public DateTime? ApprovedLevel2At { get; set; }
+    public int? RejectedBy { get; set; }
+    public DateTime? RejectedAt { get; set; }
+    public string? RejectReason { get; set; }
+    public DateTime? CancelledAt { get; set; }
+    /// <summary>When the new prices were written to the items.</summary>
+    public DateTime? AppliedAt { get; set; }
+
+    public uint RowVersion { get; set; }
+
+    public ICollection<PriceAdjustmentLine> Lines { get; set; } = new List<PriceAdjustmentLine>();
+}
+
+/// <summary>One item's change. The Old* values are the item's prices when the request was made —
+/// approval fails if the item has been repriced since (stale request).</summary>
+public class PriceAdjustmentLine
+{
+    public int PriceAdjustmentLineId { get; set; }
+    public int PriceAdjustmentId { get; set; }
+    public PriceAdjustment? PriceAdjustment { get; set; }
+
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+
+    public decimal? OldMinPrice { get; set; }
+    public decimal? OldMaxPrice { get; set; }
+    public decimal? OldFlatPrice { get; set; }
+    public decimal? NewMinPrice { get; set; }
+    public decimal? NewMaxPrice { get; set; }
+    public decimal? NewFlatPrice { get; set; }
+}
+
+/// <summary>An applied selling-price change: what it was, what it became, and who approved it.</summary>
+public class ItemPriceHistory
+{
+    public int ItemPriceHistoryId { get; set; }
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+    public int? PriceAdjustmentId { get; set; }
+    public PriceAdjustment? PriceAdjustment { get; set; }
+
+    public decimal? OldMinPrice { get; set; }
+    public decimal? OldMaxPrice { get; set; }
+    public decimal? OldFlatPrice { get; set; }
+    public decimal? NewMinPrice { get; set; }
+    public decimal? NewMaxPrice { get; set; }
+    public decimal? NewFlatPrice { get; set; }
+
+    public int RequestedBy { get; set; }
+    public int? ApprovedLevel1By { get; set; }
+    public int? ApprovedLevel2By { get; set; }
+    public DateTime AppliedAt { get; set; }
+}
@@ -31,6 +31,26 @@ public class ProductConfig
    public bool BatchListsEnabled { get; set; } = true;
    public bool WarrantyPeriodsEnabled { get; set; } = true;

+    /// <summary>
+    /// Lets the item create screen add a new item variant (item type) on the spot, instead
+    /// of only picking from the Item Variants master. Advisory like <see cref="ItemTypesEnabled"/>
+    /// - it gates a UI shortcut; the Item Variants master itself stays available either way.
+    /// </summary>
+    public bool CustomVariantsEnabled { get; set; }
+
+    /// <summary>
+    /// Allows photos to be uploaded to items (<see cref="ItemImage"/>). Enforced on upload
+    /// (<c>CONFIG_DISABLED</c>); images added earlier stay viewable when switched off.
+    /// </summary>
+    public bool ItemImagesEnabled { get; set; }
+
+    /// <summary>
+    /// Lets items use the active <see cref="WarrantyPeriod"/> master rows alongside the default
+    /// <see cref="Enums.WarrantyPeriods.AllowedMonths"/>. Enforced on item writes. The periods
+    /// themselves are managed under Products, not here.
+    /// </summary>
+    public bool CustomWarrantyPeriodsEnabled { get; set; }
+
    public DateTime? UpdatedAt { get; set; }

    public int? UpdatedBy { get; set; }
@@ -20,6 +20,9 @@ public class PurchaseInvoice
    public int VendorId { get; set; }
    public Vendor? Vendor { get; set; }

+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
    public string VendorSnapshotName { get; set; } = string.Empty;
    public string? VendorSnapshotTaxNo { get; set; }

@@ -5,9 +5,10 @@ namespace ERPCore.Domain.Entities;
 /// <summary>
 /// Purchase order header (FR-PROC-03..06). Mutable aggregate with a
 /// <see cref="RowVersion"/> ETag token; editable while open (FR-PROC-05).
-/// Phase 1 auto-approves on creation; <see cref="ApprovalRequired"/> is retained
-/// for the future approval workflow. Totals are computed server-side from lines
-/// (not stored). Model: docs/10 Part C.2.
+/// A submitted/issued PO goes to <see cref="PurchaseOrderStatus.PendingApproval"/> and
+/// needs a separate Approve action (an Admin who isn't <see cref="CreatedBy"/>) before it
+/// reaches <see cref="PurchaseOrderStatus.Approved"/>. Totals are computed server-side
+/// from lines (not stored). Model: docs/10 Part C.2.
 /// </summary>
 public class PurchaseOrder
 {
@@ -17,15 +18,25 @@ public class PurchaseOrder
    public int VendorId { get; set; }
    public Vendor? Vendor { get; set; }

+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
    public int? RequisitionId { get; set; }
    public Requisition? Requisition { get; set; }

    public PurchaseOrderStatus Status { get; set; } = PurchaseOrderStatus.Draft;
+    /// <summary>True once the PO has been (or needs to be) routed through approval —
+    /// i.e. it is not a still-editable Draft.</summary>
    public bool ApprovalRequired { get; set; }

    public int CreatedBy { get; set; }
    public User? Creator { get; set; }

+    /// <summary>Who approved this PO — set only when <see cref="Status"/> reaches Approved.</summary>
+    public int? ApprovedBy { get; set; }
+    public User? Approver { get; set; }
+    public DateTime? ApprovedAt { get; set; }
+
    public DateTime CreatedAt { get; set; }
    public DateTime? UpdatedAt { get; set; }

@@ -14,6 +14,9 @@ public class Requisition
    public int RequestedBy { get; set; }
    public User? Requester { get; set; }

+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
    public RequisitionStatus Status { get; set; } = RequisitionStatus.Draft;
    public DateTime CreatedAt { get; set; }

@@ -14,6 +14,9 @@ public class Rfq
    public int RequisitionId { get; set; }
    public Requisition? Requisition { get; set; }

+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
    public RfqStatus Status { get; set; } = RfqStatus.Open;
    public DateTime CreatedAt { get; set; }

@@ -1,3 +1,5 @@
+using ERPCore.Domain.Enums;
+
 namespace ERPCore.Domain.Entities;

 /// <summary>Join row granting a <see cref="Role"/> visibility of a <see cref="Permission"/> (nav node).</summary>
@@ -6,6 +8,13 @@ public class RolePermission
    public int RoleId { get; set; }
    public int PermissionId { get; set; }

+    /// <summary>
+    /// Which mutating actions the role may perform within this permission's module
+    /// (see <see cref="RolePermissionAction"/>); defaults to <see cref="RolePermissionAction.All"/>
+    /// so existing grants keep today's behavior until an admin narrows them.
+    /// </summary>
+    public RolePermissionAction Actions { get; set; } = RolePermissionAction.All;
+
    public Role? Role { get; set; }
    public Permission? Permission { get; set; }
 }
@@ -0,0 +1,61 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Sales configuration — a singleton row (single-tenant, docs/00-CORE §1), same shape as
+/// <see cref="BranchConfig"/>. When <see cref="AllowCashCustomer"/> is on, sales documents may
+/// be raised against the generic "Cash Customer" (<see cref="CashCustomerId"/>) and the New Sale
+/// form defaults to it; when off, a real customer must be picked and the cash customer is
+/// rejected server-side (see SalesDomainService.ValidateSalesHeaderAsync).
+/// </summary>
+public class SalesConfig
+{
+    /// <summary>Always 1 - the singleton row's id.</summary>
+    public const int SingletonId = 1;
+
+    public int ConfigId { get; set; }
+
+    public bool AllowCashCustomer { get; set; }
+
+    /// <summary>The Customer row used for cash (walk-in, unnamed) sales. Created on first
+    /// enabling <see cref="AllowCashCustomer"/> and kept afterwards, so switching the option
+    /// off and on again reuses the same customer (and its sales history).</summary>
+    public int? CashCustomerId { get; set; }
+    public Customer? CashCustomer { get; set; }
+
+    /// <summary>When on, sales invoice lines may carry a free quantity (the New Sale "Free"
+    /// column); when off, the column is hidden and a free qty above zero is rejected server-side
+    /// (see SalesInvoiceService.BuildLinesAsync). Defaults on, matching the behaviour before
+    /// this option existed.</summary>
+    public bool AllowFreeItems { get; set; } = true;
+
+    /// <summary>When on, sales invoice lines may carry a line discount (the New Sale "Disc %"
+    /// column); when off, the column is hidden and a discount above zero is rejected server-side
+    /// (see SalesInvoiceService.BuildLinesAsync). Defaults on, matching the behaviour before
+    /// this option existed.</summary>
+    public bool AllowDiscounts { get; set; } = true;
+
+    /// <summary>When on, posting a sale (invoice, slip, bundle) may issue more than the stock on
+    /// hand — the shortfall drives on-hand negative (see FifoCostingService.ConsumeAsync) and the
+    /// pre-post check reports it as a warning only. When off (default), posting is blocked with
+    /// STOCK_NEGATIVE_BLOCKED until stock covers every line.</summary>
+    public bool AllowOverStockSale { get; set; }
+
+    /// <summary>When on (default) and no <see cref="DefaultWarehouseId"/> is saved, New Sale shows
+    /// a Warehouse picker. When off, a default must be saved.</summary>
+    public bool AllowWarehouseSelection { get; set; } = true;
+
+    /// <summary>Default sales warehouse. Whenever set, New Sale shows only this warehouse (locked)
+    /// and every sales invoice (header and lines) is forced onto it server-side (see
+    /// SalesDomainService.GetForcedSalesWarehouseIdAsync). Required while
+    /// <see cref="AllowWarehouseSelection"/> is off; clearing it brings the picker back.</summary>
+    public int? DefaultWarehouseId { get; set; }
+    public Warehouse? DefaultWarehouse { get; set; }
+
+    public DateTime? UpdatedAt { get; set; }
+
+    public int? UpdatedBy { get; set; }
+    public User? UpdatedByUser { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}
--- a/Show More
+++ b/Show More