From 5891d0bd53f29fe4d20b1f86de55f1db0378ec9c Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 12:37:47 +0800
Subject: [PATCH 01/87] fix(tracking): throttle the public order lookup and
 return a minimal resource

The public Track Order page's GET int/v1/fleet-ops/lookup had no session,
no rate limit, and answered with the full OrderResource: notes, meta,
internal ids, files (possible POD photos and signatures), purchase rate,
and live driver location, to anyone holding a tracking number.

- Rate limit it per address on its own limiter (throttle:30,1,tracking-lookup),
  as the public inspection routes do.
- Answer with PublicOrderTracking, which carries only what
  order-tracking-lookup renders: tracking number, status, timeline, ETA and
  progress, stop coordinates for the route map, and the item list. Records
  are keyed by public id, so no internal uuid reaches the page. The driver
  position is included only while the order is started and unfinished. It
  extends JsonResource so registered resource transformers cannot add fields.
- Missing, malformed and unknown tracking numbers get one identical error,
  and malformed input never reaches the query.
---
 .../Internal/v1/OrderController.php           |  49 ++--
 .../Http/Resources/v1/PublicOrderTracking.php | 153 ++++++++++++
 server/src/routes.php                         |   5 +-
 .../Internal/OrderControllerContractsTest.php |  30 ++-
 .../tests/PublicOrderTrackingResourceTest.php | 221 ++++++++++++++++++
 .../tests/RouteRegistrationExecutionTest.php  |   6 +
 6 files changed, 439 insertions(+), 25 deletions(-)
 create mode 100644 server/src/Http/Resources/v1/PublicOrderTracking.php
 create mode 100644 server/tests/PublicOrderTrackingResourceTest.php

diff --git a/server/src/Http/Controllers/Internal/v1/OrderController.php b/server/src/Http/Controllers/Internal/v1/OrderController.php
index 4ad6b05d3..1375bc8d3 100644
--- a/server/src/Http/Controllers/Internal/v1/OrderController.php
+++ b/server/src/Http/Controllers/Internal/v1/OrderController.php
@@ -19,6 +19,7 @@
 use Fleetbase\FleetOps\Http\Resources\v1\Index\Order as OrderIndexResource;
 use Fleetbase\FleetOps\Http\Resources\v1\Order as OrderResource;
 use Fleetbase\FleetOps\Http\Resources\v1\Proof as ProofResource;
+use Fleetbase\FleetOps\Http\Resources\v1\PublicOrderTracking;
 use Fleetbase\FleetOps\Imports\OrdersImport;
 use Fleetbase\FleetOps\Jobs\FinalizeInternalOrderCreation;
 use Fleetbase\FleetOps\Jobs\NotifyBulkAssignedDriver;
@@ -54,6 +55,12 @@
 class OrderController extends FleetOpsController
 {
     use ResolvesOrderServiceStops;
+
+    /**
+     * The one answer the public tracking lookup gives for any number it cannot resolve.
+     */
+    public const TRACKING_LOOKUP_ERROR = 'No order found using tracking number provided.';
+
     /**
      * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
      *
@@ -1905,27 +1912,43 @@ public function getDefaultOrderConfig()
         return response()->json(OrderConfig::default());
     }
 
+    /**
+     * Look up an order for the public Track Order page.
+     *
+     * Answers with `PublicOrderTracking`, never the full order resource: the
+     * tracking number is the only credential here. A missing, malformed or
+     * unknown tracking number all get the same error, so a caller cannot tell
+     * which one they hit.
+     */
     public function lookup(Request $request)
     {
-        $trackingNumber = $request->input('tracking');
-        if (!$trackingNumber) {
-            return response()->error('No tracking number provided for lookup.');
-        }
-
-        $order = $this->findOrderByTrackingNumber($trackingNumber);
+        $trackingNumber = $this->normalizeTrackingLookup($request->input('tracking'));
+        $order          = $trackingNumber ? $this->findOrderByTrackingNumber($trackingNumber) : null;
 
         if (!$order) {
-            return response()->error('No order found using tracking number provided.');
+            return response()->error(static::TRACKING_LOOKUP_ERROR);
         }
 
-        // load required relations
-        $order->loadMissing(['trackingNumber', 'payload', 'trackingStatuses']);
-
-        // load tracker data
+        $order->loadMissing(['trackingNumber', 'trackingStatuses', 'payload.pickup', 'payload.dropoff', 'payload.waypoints', 'payload.entities']);
         $order->tracker_data = $order->tracker()->toArray();
-        $order->eta          = $order->tracker()->eta();
 
-        return new OrderResource($order);
+        return new PublicOrderTracking($order);
+    }
+
+    /**
+     * The tracking number to look up, or null when the input cannot be one:
+     * not a string, blank, too long, or outside the characters tracking
+     * numbers use.
+     */
+    protected function normalizeTrackingLookup($input): ?string
+    {
+        if (!is_string($input)) {
+            return null;
+        }
+
+        $input = trim($input);
+
+        return preg_match('/^[A-Za-z0-9][A-Za-z0-9._\-]{0,99}$/', $input) === 1 ? $input : null;
     }
 
     /**
diff --git a/server/src/Http/Resources/v1/PublicOrderTracking.php b/server/src/Http/Resources/v1/PublicOrderTracking.php
new file mode 100644
index 000000000..250013661
--- /dev/null
+++ b/server/src/Http/Resources/v1/PublicOrderTracking.php
@@ -0,0 +1,153 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Resources\v1;
+
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Support\Utils;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/**
+ * What the public Track Order page gets for a tracking number.
+ *
+ * The lookup has no session, so whoever holds the tracking number sees this.
+ * It carries only what `order-tracking-lookup` renders: status, the tracking
+ * timeline, ETA and progress, the stop coordinates the map routes between,
+ * and the item list. Notes, meta, internal ids, files, rates, and customer
+ * and facilitator details stay out. The driver's position is included only
+ * while the order is under way.
+ *
+ * It extends `JsonResource`, not `FleetbaseResource`, so transformers that
+ * other extensions register for resources cannot add fields to it. Records are
+ * keyed by public id, which Ember Data needs to build them, so the page never
+ * learns an internal uuid.
+ */
+class PublicOrderTracking extends JsonResource
+{
+    /**
+     * Never wrapped, whatever another resource set the shared wrapper to.
+     *
+     * @var string|null
+     */
+    public static $wrap;
+
+    /**
+     * Statuses after which the order is no longer under way.
+     */
+    public const FINISHED_STATUSES = ['completed', 'canceled', 'cancelled'];
+
+    /**
+     * Transform the resource into an array.
+     *
+     * @param \Illuminate\Http\Request $request
+     */
+    public function toArray($request): array
+    {
+        /** @var Order $order */
+        $order          = $this->resource;
+        $trackingNumber = $order->trackingNumber;
+        $tracker        = is_array($order->tracker_data) ? $order->tracker_data : [];
+
+        return [
+            'uuid'                => $order->public_id,
+            'tracking'            => data_get($trackingNumber, 'tracking_number'),
+            'status'              => $order->status,
+            'has_driver_assigned' => (bool) $order->has_driver_assigned,
+            'tracking_number'     => $trackingNumber ? [
+                'uuid'            => $trackingNumber->public_id,
+                'tracking_number' => $trackingNumber->tracking_number,
+            ] : null,
+            'tracking_statuses'   => collect($order->trackingStatuses)->map(fn ($status) => [
+                'uuid'       => $status->public_id,
+                'status'     => $status->status,
+                'details'    => $status->details,
+                'created_at' => $status->created_at,
+            ])->values()->all(),
+            'payload'             => $this->payload($order->payload),
+            'tracker_data'        => $this->trackerData($tracker, static::isInProgress($order)),
+            'created_at'          => $order->created_at,
+        ];
+    }
+
+    /**
+     * Whether the order is under way: started, and not yet completed or canceled.
+     */
+    public static function isInProgress(Order $order): bool
+    {
+        return (bool) $order->started && !in_array(strtolower((string) $order->status), static::FINISHED_STATUSES, true);
+    }
+
+    /**
+     * The stops the map routes between and the items the page lists.
+     */
+    protected function payload($payload): ?array
+    {
+        if (!$payload) {
+            return null;
+        }
+
+        return [
+            'uuid'      => $payload->public_id,
+            'pickup'    => $this->place($payload->pickup),
+            'dropoff'   => $this->place($payload->dropoff),
+            'waypoints' => collect($payload->waypoints)->map(fn ($place) => $this->place($place))->values()->all(),
+            'entities'  => collect($payload->entities)->map(fn ($entity) => [
+                'uuid'        => $entity->public_id,
+                'name'        => $entity->name,
+                'description' => $entity->description,
+                'tracking'    => data_get($entity, 'tracking'),
+                'price'       => $entity->price,
+                'currency'    => $entity->currency,
+                'photo_url'   => data_get($entity, 'photo_url'),
+            ])->values()->all(),
+        ];
+    }
+
+    /**
+     * A stop as the map needs it: its coordinates, with no address or contact.
+     */
+    protected function place($place): ?array
+    {
+        if (!$place) {
+            return null;
+        }
+
+        return [
+            'uuid'     => $place->public_id,
+            'location' => Utils::castPoint($place->location),
+        ];
+    }
+
+    /**
+     * The tracker fields the page reads; the driver's position only while under way.
+     */
+    protected function trackerData(array $tracker, bool $inProgress): array
+    {
+        return [
+            'driver'      => [
+                'location' => $inProgress ? data_get($tracker, 'driver.location') : null,
+            ],
+            'progress'    => [
+                'percentage'      => data_get($tracker, 'progress.percentage'),
+                'completed_stops' => data_get($tracker, 'progress.completed_stops'),
+            ],
+            'eta'         => [
+                'active_stop_seconds' => data_get($tracker, 'eta.active_stop_seconds'),
+                'completion_at'       => data_get($tracker, 'eta.completion_at'),
+            ],
+            'active_stop' => $this->stop(data_get($tracker, 'active_stop')),
+            'next_stop'   => $this->stop(data_get($tracker, 'next_stop')),
+        ];
+    }
+
+    /**
+     * A stop the page names under "Current/Next Destination".
+     */
+    protected function stop($stop): ?array
+    {
+        if (!is_array($stop)) {
+            return null;
+        }
+
+        return ['address' => data_get($stop, 'address')];
+    }
+}
diff --git a/server/src/routes.php b/server/src/routes.php
index dd757f07c..e2e3577c1 100644
--- a/server/src/routes.php
+++ b/server/src/routes.php
@@ -398,7 +398,10 @@ function ($router) {
                 $router->group(
                     ['prefix' => 'v1/fleet-ops', 'namespace' => 'v1'],
                     function ($router) {
-                        $router->get('lookup', 'OrderController@lookup');
+                        // The public Track Order page: no session, the tracking number is
+                        // the credential. Rate limited per address so numbers cannot be
+                        // enumerated, on a limiter of its own.
+                        $router->get('lookup', 'OrderController@lookup')->middleware('throttle:30,1,tracking-lookup');
                     }
                 );
 
diff --git a/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php b/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php
index 6c815da8a..a92601055 100644
--- a/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php
+++ b/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php
@@ -4,6 +4,7 @@
 use Fleetbase\FleetOps\Http\Controllers\Internal\v1\OrderController;
 use Fleetbase\FleetOps\Http\Requests\BulkDispatchRequest;
 use Fleetbase\FleetOps\Http\Requests\CancelOrderRequest;
+use Fleetbase\FleetOps\Http\Resources\v1\PublicOrderTracking;
 use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\FleetOps\Models\Entity;
 use Fleetbase\FleetOps\Models\Order;
@@ -68,6 +69,7 @@ class FleetOpsInternalOrderLifecycleControllerProbe extends OrderController
     public Collection $proofResults;
     public array $exportDownloads                                    = [];
     public ?FleetOpsInternalOrderLifecycleOrderFake $trackingOrder   = null;
+    public array $trackingLookups                                   = [];
     public ?FleetOpsInternalOrderLifecycleOrderFake $scheduleOrder   = null;
     public ?FleetOpsInternalOrderLifecycleDriverFake $scheduleDriver = null;
 
@@ -218,6 +220,7 @@ protected function downloadOrderExport(array $selections, string $fileName)
 
     protected function findOrderByTrackingNumber(string $trackingNumber): ?Order
     {
+        $this->trackingLookups[] = $trackingNumber;
         $this->trackingOrder?->setAttribute('tracking_lookup', $trackingNumber);
 
         return $this->trackingOrder;
@@ -1549,24 +1552,29 @@ function fleetopsSuppressStrNullDeprecations(): Closure
         ->and($export['selections'])->toBe(['order-one', 'order-two'])
         ->and($controller->exportDownloads[0][0])->toBe(['order-one', 'order-two']);
 
-    expect($controller->lookup(new Request())->getData(true))->toBe([
-        'error' => 'No tracking number provided for lookup.',
-    ])
-        ->and($controller->lookup(new Request(['tracking' => 'TN-404']))->getData(true))->toBe([
-            'error' => 'No order found using tracking number provided.',
-        ]);
+    // Missing, malformed and unknown tracking numbers all get the one answer,
+    // and malformed input never reaches the query.
+    $notFound = ['error' => OrderController::TRACKING_LOOKUP_ERROR];
+    foreach ([[], ['tracking' => ''], ['tracking' => '   '], ['tracking' => ['TN-1']], ['tracking' => '../etc/passwd'], ['tracking' => "TN-1' OR 1=1"], ['tracking' => str_repeat('A', 101)], ['tracking' => '-TN']] as $input) {
+        expect($controller->lookup(new Request($input))->getData(true))->toBe($notFound);
+    }
+    expect($controller->trackingLookups)->toBe([]);
+
+    expect($controller->lookup(new Request(['tracking' => 'TN-404']))->getData(true))->toBe($notFound)
+        ->and($controller->trackingLookups)->toBe(['TN-404']);
 
     $trackedOrder                 = fleetopsInternalOrderLifecycleOrder('tracked-order');
     $trackedOrder->trackerForTest = new FleetOpsInternalOrderLifecycleTrackerFake($trackedOrder);
     $controller->trackingOrder    = $trackedOrder;
 
-    $lookup = $controller->lookup(new Request(['tracking' => 'TN-100']));
+    $lookup = $controller->lookup(new Request(['tracking' => '  TN-100.a_b  ']));
 
-    expect($lookup->resource)->toBe($trackedOrder)
-        ->and($trackedOrder->tracking_lookup)->toBe('TN-100')
-        ->and($trackedOrder->loadedMissing)->toBe([['trackingNumber', 'payload', 'trackingStatuses']])
+    expect($lookup)->toBeInstanceOf(PublicOrderTracking::class)
+        ->and($lookup->resource)->toBe($trackedOrder)
+        ->and($trackedOrder->tracking_lookup)->toBe('TN-100.a_b')
+        ->and($trackedOrder->loadedMissing)->toBe([['trackingNumber', 'trackingStatuses', 'payload.pickup', 'payload.dropoff', 'payload.waypoints', 'payload.entities']])
         ->and($trackedOrder->tracker_data)->toBe(['tracker' => 'info', 'options' => []])
-        ->and($trackedOrder->eta)->toBe(['eta' => [['stop' => 'dropoff']], 'options' => []]);
+        ->and($trackedOrder->trackerForTest->etaOptions)->toBe([]);
 
     expect($controller->scheduleOrder(new Request(['order' => 'missing-order']))->getData(true))->toBe([
         'error' => 'No order found to schedule.',
diff --git a/server/tests/PublicOrderTrackingResourceTest.php b/server/tests/PublicOrderTrackingResourceTest.php
new file mode 100644
index 000000000..2f127d221
--- /dev/null
+++ b/server/tests/PublicOrderTrackingResourceTest.php
@@ -0,0 +1,221 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Resources\v1\PublicOrderTracking;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\LaravelMysqlSpatial\Types\Point;
+use Illuminate\Http\Request;
+use Illuminate\Support\Carbon;
+
+/**
+ * An order as the lookup loads it: tracking number, timeline, payload and
+ * tracker data, plus every field the public page must never see.
+ */
+function fleetopsPublicTrackingOrder(array $attributes = [], array $tracker = []): Order
+{
+    $order = new Order();
+    $order->setRawAttributes(array_merge([
+        'uuid'                 => 'order-internal-uuid',
+        'public_id'            => 'order_public',
+        'internal_id'          => 'INT-0042',
+        'company_uuid'         => 'company-uuid',
+        'customer_uuid'        => 'customer-uuid',
+        'facilitator_uuid'     => 'facilitator-uuid',
+        'driver_assigned_uuid' => 'driver-uuid',
+        'purchase_rate_uuid'   => 'rate-uuid',
+        'notes'                => 'Gate code 1234',
+        'meta'                 => '{"secret":"value"}',
+        'status'               => 'started',
+        'started'              => true,
+        'created_at'           => Carbon::parse('2026-10-01 09:00:00'),
+    ], $attributes), true);
+
+    $order->setRelation('trackingNumber', (object) [
+        'uuid'            => 'tracking-internal-uuid',
+        'public_id'       => 'track_public',
+        'tracking_number' => 'FLB1234567890SG',
+        'qr_code'         => 'qr-data',
+        'barcode'         => 'barcode-data',
+    ]);
+    $order->setRelation('trackingStatuses', collect([
+        (object) [
+            'uuid'       => 'status-internal-uuid',
+            'public_id'  => 'status_public',
+            'status'     => 'Order Created',
+            'details'    => 'New order created.',
+            'code'       => 'created',
+            'location'   => new Point(1.3, 103.8),
+            'created_at' => Carbon::parse('2026-10-01 09:00:00'),
+        ],
+    ]));
+    $order->setRelation('payload', (object) [
+        'uuid'      => 'payload-internal-uuid',
+        'public_id' => 'payload_public',
+        'meta'      => ['secret' => 'value'],
+        'cod_amount' => '100',
+        'pickup'    => (object) [
+            'uuid'      => 'pickup-internal-uuid',
+            'public_id' => 'place_pickup',
+            'name'      => 'Sender House',
+            'street1'   => '1 Sender Road',
+            'phone'     => '+6500000000',
+            'location'  => new Point(1.30, 103.80),
+        ],
+        'dropoff'   => (object) [
+            'uuid'      => 'dropoff-internal-uuid',
+            'public_id' => 'place_dropoff',
+            'name'      => 'Recipient House',
+            'street1'   => '2 Recipient Road',
+            'location'  => new Point(1.35, 103.85),
+        ],
+        'waypoints' => [],
+        'entities'  => collect([
+            (object) [
+                'uuid'          => 'entity-internal-uuid',
+                'public_id'     => 'entity_public',
+                'internal_id'   => 'ENT-INT',
+                'customer_uuid' => 'customer-uuid',
+                'name'          => 'Parcel',
+                'description'   => 'A box',
+                'tracking'      => 'FLB9999999999SG',
+                'price'         => '1500',
+                'currency'      => 'SGD',
+                'photo_url'     => 'https://example.test/parcel.png',
+                'meta'          => ['secret' => 'value'],
+            ],
+        ]),
+    ]);
+
+    $order->setAttribute('tracker_data', array_merge([
+        'provider'    => 'internal',
+        'driver'      => [
+            'location'             => ['type' => 'Point', 'coordinates' => [103.82, 1.32]],
+            'location_age_seconds' => 12,
+            'online'               => true,
+        ],
+        'progress'    => ['percentage' => 40, 'completed_stops' => 1, 'total_stops' => 2],
+        'stops'       => [['uuid' => 'stop-uuid', 'address' => '1 Sender Road']],
+        'active_stop' => ['uuid' => 'stop-uuid', 'address' => '2 Recipient Road', 'name' => 'Recipient House', 'latitude' => 1.35],
+        'next_stop'   => null,
+        'route'       => ['polyline' => 'abc'],
+        'eta'         => ['active_stop_seconds' => 600, 'completion_seconds' => 600, 'completion_at' => '2026-10-01T09:30:00.000Z'],
+        'insights'    => ['is_delayed' => false],
+    ], $tracker));
+
+    return $order;
+}
+
+test('public order tracking resource carries only what the track order page renders', function () {
+    $data = (new PublicOrderTracking(fleetopsPublicTrackingOrder()))->toArray(new Request());
+
+    expect(array_keys($data))->toBe([
+        'uuid', 'tracking', 'status', 'has_driver_assigned', 'tracking_number',
+        'tracking_statuses', 'payload', 'tracker_data', 'created_at',
+    ])
+        ->and($data['uuid'])->toBe('order_public')
+        ->and($data['tracking'])->toBe('FLB1234567890SG')
+        ->and($data['status'])->toBe('started')
+        ->and($data['has_driver_assigned'])->toBeTrue()
+        ->and($data['tracking_number'])->toBe(['uuid' => 'track_public', 'tracking_number' => 'FLB1234567890SG'])
+        ->and($data['created_at']->toDateTimeString())->toBe('2026-10-01 09:00:00');
+
+    expect($data['tracking_statuses'])->toHaveCount(1)
+        ->and(array_keys($data['tracking_statuses'][0]))->toBe(['uuid', 'status', 'details', 'created_at'])
+        ->and($data['tracking_statuses'][0]['uuid'])->toBe('status_public')
+        ->and($data['tracking_statuses'][0]['status'])->toBe('Order Created')
+        ->and($data['tracking_statuses'][0]['details'])->toBe('New order created.');
+
+    // Stops are coordinates only: the map routes between them, nothing names them.
+    $payload = $data['payload'];
+    expect(array_keys($payload))->toBe(['uuid', 'pickup', 'dropoff', 'waypoints', 'entities'])
+        ->and($payload['uuid'])->toBe('payload_public')
+        ->and(array_keys($payload['pickup']))->toBe(['uuid', 'location'])
+        ->and($payload['pickup']['uuid'])->toBe('place_pickup')
+        ->and($payload['pickup']['location']->getLat())->toBe(1.30)
+        ->and($payload['dropoff']['location']->getLng())->toBe(103.85)
+        ->and($payload['waypoints'])->toBe([])
+        ->and($payload['entities'])->toBe([[
+            'uuid'        => 'entity_public',
+            'name'        => 'Parcel',
+            'description' => 'A box',
+            'tracking'    => 'FLB9999999999SG',
+            'price'       => '1500',
+            'currency'    => 'SGD',
+            'photo_url'   => 'https://example.test/parcel.png',
+        ]]);
+
+    expect($data['tracker_data'])->toBe([
+        'driver'      => ['location' => ['type' => 'Point', 'coordinates' => [103.82, 1.32]]],
+        'progress'    => ['percentage' => 40, 'completed_stops' => 1],
+        'eta'         => ['active_stop_seconds' => 600, 'completion_at' => '2026-10-01T09:30:00.000Z'],
+        'active_stop' => ['address' => '2 Recipient Road'],
+        'next_stop'   => null,
+    ]);
+
+    // Nothing internal reaches the page, at any depth.
+    $json = json_encode($data);
+    foreach (['order-internal-uuid', 'INT-0042', 'company-uuid', 'customer-uuid', 'facilitator-uuid', 'driver-uuid', 'rate-uuid', 'Gate code', 'secret', 'qr-data', 'barcode-data', 'Sender House', '1 Sender Road', '+6500000000', 'ENT-INT', 'abc', 'internal'] as $leak) {
+        expect($json)->not->toContain($leak);
+    }
+});
+
+test('public order tracking resource drops the driver position unless the order is under way', function (array $attributes) {
+    $data = (new PublicOrderTracking(fleetopsPublicTrackingOrder($attributes)))->toArray(new Request());
+
+    expect($data['tracker_data']['driver'])->toBe(['location' => null])
+        ->and($data['tracker_data']['progress']['percentage'])->toBe(40);
+})->with([
+    'not started yet' => [['status' => 'dispatched', 'started' => false]],
+    'completed'       => [['status' => 'completed', 'started' => true]],
+    'canceled'        => [['status' => 'canceled', 'started' => true]],
+    'cancelled'       => [['status' => 'CANCELLED', 'started' => true]],
+]);
+
+test('public order tracking resource reports in progress only for started unfinished orders', function () {
+    expect(PublicOrderTracking::isInProgress(fleetopsPublicTrackingOrder()))->toBeTrue()
+        ->and(PublicOrderTracking::isInProgress(fleetopsPublicTrackingOrder(['started' => false])))->toBeFalse()
+        ->and(PublicOrderTracking::isInProgress(fleetopsPublicTrackingOrder(['status' => 'completed'])))->toBeFalse();
+});
+
+test('public order tracking resource tolerates missing relations and tracker data', function () {
+    $order = new Order();
+    $order->setRawAttributes(['public_id' => 'order_bare', 'status' => 'created'], true);
+    $order->setRelation('trackingNumber', null);
+    $order->setRelation('trackingStatuses', collect());
+    $order->setRelation('payload', null);
+
+    $data = (new PublicOrderTracking($order))->toArray(new Request());
+
+    expect($data['uuid'])->toBe('order_bare')
+        ->and($data['tracking'])->toBeNull()
+        ->and($data['has_driver_assigned'])->toBeFalse()
+        ->and($data['tracking_number'])->toBeNull()
+        ->and($data['tracking_statuses'])->toBe([])
+        ->and($data['payload'])->toBeNull()
+        ->and($data['tracker_data'])->toBe([
+            'driver'      => ['location' => null],
+            'progress'    => ['percentage' => null, 'completed_stops' => null],
+            'eta'         => ['active_stop_seconds' => null, 'completion_at' => null],
+            'active_stop' => null,
+            'next_stop'   => null,
+        ]);
+
+    // A payload with stops removed still serializes, leaving the gaps empty.
+    $order->setRelation('payload', (object) [
+        'public_id' => 'payload_bare',
+        'pickup'    => null,
+        'dropoff'   => null,
+        'waypoints' => collect([(object) ['public_id' => 'place_waypoint', 'location' => new Point(1.4, 103.9)]]),
+        'entities'  => [],
+    ]);
+    $payload = (new PublicOrderTracking($order))->toArray(new Request())['payload'];
+
+    expect($payload['pickup'])->toBeNull()
+        ->and($payload['dropoff'])->toBeNull()
+        ->and($payload['waypoints'][0]['uuid'])->toBe('place_waypoint')
+        ->and($payload['waypoints'][0]['location']->getLat())->toBe(1.4)
+        ->and($payload['entities'])->toBe([]);
+});
+
+test('public order tracking resource is never wrapped', function () {
+    expect(PublicOrderTracking::$wrap)->toBeNull();
+});
diff --git a/server/tests/RouteRegistrationExecutionTest.php b/server/tests/RouteRegistrationExecutionTest.php
index 803c50f7b..491558d9e 100644
--- a/server/tests/RouteRegistrationExecutionTest.php
+++ b/server/tests/RouteRegistrationExecutionTest.php
@@ -223,6 +223,12 @@ function fleetOpsRecordedRoutes(): FleetOpsRouteRecorder
     // Uploads through a link have a tighter limit of their own, on top of the group's.
     $upload = collect($recorder->routes)->firstWhere('uri', 'public/inspections/forms/{id}/files');
     expect($upload['middleware'] ?? [])->toBe(['throttle:20,1,inspection-upload']);
+
+    // The public tracking lookup has no session either, so it is rate limited
+    // per address, on a limiter of its own.
+    $lookup = collect($recorder->routes)->first(fn (array $route) => $route['action'] === 'OrderController@lookup');
+    expect($lookup)->not->toBeNull()
+        ->and($lookup['middleware'] ?? [])->toBe(['throttle:30,1,tracking-lookup']);
 });
 
 test('fleetops route file wires route groups with expected middleware and namespaces', function () {

From 413aa47d96cd060fcb01d62690cf793942caf307 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 13:06:04 +0800
Subject: [PATCH 02/87] fix(files): stop writing signatures with a public ACL;
 re-sign stored avatar URLs

- ProofController::storeSignature no longer passes 'public': the media bucket
  enforces bucket-owner ownership, rejects ACL'd PUTs, and put() silently
  returned false (no signature objects written since 2024-11-25).
- Vehicle/Driver/Place avatar_url accessors re-sign legacy absolute bucket URLs
  via core-api File::signStoredUrl when available.
---
 .../Http/Controllers/Internal/v1/ProofController.php | 12 ++++++++----
 server/src/Models/Driver.php                         |  3 ++-
 server/src/Models/Place.php                          |  3 ++-
 server/src/Models/Vehicle.php                        |  3 ++-
 server/src/Support/Utils.php                         | 11 +++++++++++
 .../Http/Internal/ProofControllerContractsTest.php   |  6 +++---
 .../Unit/Support/OsrmProofAndIssueFilterTest.php     |  7 ++++---
 server/tests/Unit/Support/UtilsAdditionalTest.php    |  9 +++++++++
 8 files changed, 41 insertions(+), 13 deletions(-)

diff --git a/server/src/Http/Controllers/Internal/v1/ProofController.php b/server/src/Http/Controllers/Internal/v1/ProofController.php
index eab7bd779..186d73495 100644
--- a/server/src/Http/Controllers/Internal/v1/ProofController.php
+++ b/server/src/Http/Controllers/Internal/v1/ProofController.php
@@ -83,8 +83,8 @@ public function captureSignature(string $publicId, Request $request)
         // set the signature storage path
         $path = $this->signatureStoragePath($proof);
 
-        // upload signature
-        $this->storeSignature($path, base64_decode($signature), 'public');
+        // upload signature (private object; File::url serves it through a signed URL)
+        $this->storeSignature($path, base64_decode($signature));
 
         // create file record for upload
         $file = $this->createSignatureFile($path, $signature, $proof);
@@ -121,9 +121,13 @@ protected function createProof(array $attributes): Proof
         return Proof::create($attributes);
     }
 
-    protected function storeSignature(string $path, string|false $contents, string $visibility): void
+    /**
+     * Writes without an ACL: the media bucket enforces bucket-owner object ownership, so a
+     * 'public' visibility (public-read ACL) makes S3 reject the PUT and put() return false.
+     */
+    protected function storeSignature(string $path, string|false $contents): void
     {
-        Storage::disk('s3')->put($path, $contents, $visibility);
+        Storage::disk('s3')->put($path, $contents);
     }
 
     /**
diff --git a/server/src/Models/Driver.php b/server/src/Models/Driver.php
index 7eef1ac1c..c796257fa 100644
--- a/server/src/Models/Driver.php
+++ b/server/src/Models/Driver.php
@@ -431,7 +431,8 @@ public function getAvatarUrlAttribute($value): ?string
             return static::getAvatar($value);
         }
 
-        return $value;
+        // legacy rows hold an absolute URL; re-sign it if it points into the private media bucket
+        return Utils::signStoredFileUrl($value);
     }
 
     /**
diff --git a/server/src/Models/Place.php b/server/src/Models/Place.php
index 4b3a94c97..898259e5f 100644
--- a/server/src/Models/Place.php
+++ b/server/src/Models/Place.php
@@ -187,7 +187,8 @@ public function getAvatarUrlAttribute($value)
             return static::getAvatar($value);
         }
 
-        return $value;
+        // legacy rows hold an absolute URL; re-sign it if it points into the private media bucket
+        return Utils::signStoredFileUrl($value);
     }
 
     /**
diff --git a/server/src/Models/Vehicle.php b/server/src/Models/Vehicle.php
index 0fb69577a..250b440d9 100644
--- a/server/src/Models/Vehicle.php
+++ b/server/src/Models/Vehicle.php
@@ -525,7 +525,8 @@ public function getAvatarUrlAttribute($value)
             return static::getAvatar($value);
         }
 
-        return $value;
+        // legacy rows hold an absolute URL; re-sign it if it points into the private media bucket
+        return Utils::signStoredFileUrl($value);
     }
 
     /**
diff --git a/server/src/Support/Utils.php b/server/src/Support/Utils.php
index 8671742e1..b7037d3ab 100644
--- a/server/src/Support/Utils.php
+++ b/server/src/Support/Utils.php
@@ -1603,4 +1603,15 @@ public static function fixPhone(?string $phone): ?string
 
         return $phone;
     }
+
+    /**
+     * Re-sign a URL stored as a string (e.g. a legacy `avatar_url` value) when it points into the
+     * private S3 media bucket, so it keeps working once the bucket stops allowing public reads.
+     * Other values pass through unchanged. Falls back to the raw value on core-api releases that
+     * predate File::signStoredUrl().
+     */
+    public static function signStoredFileUrl(?string $url): ?string
+    {
+        return method_exists(\Fleetbase\Models\File::class, 'signStoredUrl') ? \Fleetbase\Models\File::signStoredUrl($url) : $url;
+    }
 }
diff --git a/server/tests/Feature/Http/Internal/ProofControllerContractsTest.php b/server/tests/Feature/Http/Internal/ProofControllerContractsTest.php
index 5cdc1cf5d..dac559930 100644
--- a/server/tests/Feature/Http/Internal/ProofControllerContractsTest.php
+++ b/server/tests/Feature/Http/Internal/ProofControllerContractsTest.php
@@ -43,9 +43,9 @@ protected function createProof(array $attributes): Proof
         return $proof;
     }
 
-    protected function storeSignature(string $path, string|false $contents, string $visibility): void
+    protected function storeSignature(string $path, string|false $contents): void
     {
-        $this->storedSignatures[] = [$path, $contents, $visibility];
+        $this->storedSignatures[] = [$path, $contents];
     }
 
     protected function createSignatureFile(string $path, string $signature, Proof $proof): Fleetbase\Models\File
@@ -206,7 +206,7 @@ public function setKey($model, $type = null): Fleetbase\Models\File
             'raw_data'     => $signature,
         ])
         ->and($controller->storedSignatures)->toBe([
-            ['uploads/company-uuid/signatures/proof-public-1.png', 'signature-bytes', 'public'],
+            ['uploads/company-uuid/signatures/proof-public-1.png', 'signature-bytes'],
         ])
         ->and($controller->createdFiles)->toBe([
             ['uploads/company-uuid/signatures/proof-public-1.png', $signature, 'proof-public-1'],
diff --git a/server/tests/Unit/Support/OsrmProofAndIssueFilterTest.php b/server/tests/Unit/Support/OsrmProofAndIssueFilterTest.php
index 3c311fa00..20304b1f8 100644
--- a/server/tests/Unit/Support/OsrmProofAndIssueFilterTest.php
+++ b/server/tests/Unit/Support/OsrmProofAndIssueFilterTest.php
@@ -119,7 +119,7 @@ public function disk($disk = null)
 
         public function put($path, $contents, $options = [])
         {
-            $this->writes[] = [$path];
+            $this->writes[] = [$path, $options];
 
             return true;
         }
@@ -200,8 +200,9 @@ public function put($path, $contents, $options = [])
     expect($proof)->toBeInstanceOf(Proof::class)
         ->and($connection->table('proofs')->count())->toBe(1);
 
-    $probe->callHelper('storeSignature', 'signatures/proof.png', 'binary', 'public');
-    expect($GLOBALS['fleetopsProofStorageFake']->writes)->toHaveCount(1);
+    $probe->callHelper('storeSignature', 'signatures/proof.png', 'binary');
+    // Signatures are written without a visibility/ACL option; the media bucket rejects ACLs.
+    expect($GLOBALS['fleetopsProofStorageFake']->writes)->toBe([['signatures/proof.png', []]]);
 
     expect($probe->callHelper('jsonResponse', ['status' => 'ok'])->getData(true))->toBe(['status' => 'ok'])
         ->and($probe->callHelper('errorResponse', 'nope')->getData(true)['error'])->toBe('nope')
diff --git a/server/tests/Unit/Support/UtilsAdditionalTest.php b/server/tests/Unit/Support/UtilsAdditionalTest.php
index ca8931829..8f5e10f35 100644
--- a/server/tests/Unit/Support/UtilsAdditionalTest.php
+++ b/server/tests/Unit/Support/UtilsAdditionalTest.php
@@ -70,6 +70,15 @@ function fleetopsUtilsAdditionalPolygon(): Polygon
     ]);
 }
 
+test('stored file url signing passes through values that are not absolute urls', function () {
+    // Absolute URLs into the media bucket are re-signed by core-api File::signStoredUrl (covered there);
+    // everything else, including avatar option keys and empty values, must come back untouched.
+    expect(Utils::signStoredFileUrl(null))->toBeNull()
+        ->and(Utils::signStoredFileUrl(''))->toBe('')
+        ->and(Utils::signStoredFileUrl('mini_bus'))->toBe('mini_bus')
+        ->and(Utils::signStoredFileUrl('custom-avatars/vehicles/c/van.png'))->toBe('custom-avatars/vehicles/c/van.png');
+});
+
 test('company transaction currency prefers organization currency and falls back to usd', function () {
     $company = new Company();
     $company->setRawAttributes([

From 922b4ad7a840f304f58c7cd018edf925fa83a713 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 14:30:34 +0800
Subject: [PATCH 03/87] fix(mail): link customer credentials to
 /customer-access/{slug}

The customer portal resolves a company's access slug only under
/customer-access/{slug}; the credentials email linked /{slug}, which the
console does not route. Without a configured slug the link still points
at the portal's own /customer-portal sign-in.
---
 server/src/Mail/CustomerCredentialsMail.php       | 6 ++++--
 server/tests/NotificationAndMailContractsTest.php | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/server/src/Mail/CustomerCredentialsMail.php b/server/src/Mail/CustomerCredentialsMail.php
index af197524e..331fd564f 100644
--- a/server/src/Mail/CustomerCredentialsMail.php
+++ b/server/src/Mail/CustomerCredentialsMail.php
@@ -73,8 +73,10 @@ public function content(): Content
     private function getCustomerPortalAccessUrl(): string
     {
         $customerPortalConfig = Setting::lookupForCompany($this->customer->company_uuid, 'customer-portal-config');
-        $accessUrlSlug        = data_get($customerPortalConfig, 'accessUrlSlug', 'customer-portal');
+        $accessUrlSlug        = data_get($customerPortalConfig, 'accessUrlSlug');
 
-        return Utils::consoleUrl($accessUrlSlug ?: 'customer-portal');
+        // The portal resolves a company's access slug under /customer-access/{slug};
+        // without one, send the customer to the portal's own sign-in route.
+        return Utils::consoleUrl($accessUrlSlug ? 'customer-access/' . $accessUrlSlug : 'customer-portal');
     }
 }
diff --git a/server/tests/NotificationAndMailContractsTest.php b/server/tests/NotificationAndMailContractsTest.php
index 8539b5620..0e3e01016 100644
--- a/server/tests/NotificationAndMailContractsTest.php
+++ b/server/tests/NotificationAndMailContractsTest.php
@@ -704,5 +704,5 @@ public function track(Order $order, mixed $options): array
 
     $content = fleetOpsNotificationWithEnvironment(fn () => (new CustomerCredentialsMail('plain-secret', $customer))->content());
 
-    expect($content->with['customerPortalUrl'])->toBe('https://console.fleetbase.test/acme-portal');
+    expect($content->with['customerPortalUrl'])->toBe('https://console.fleetbase.test/customer-access/acme-portal');
 })->with([null, 'other-company']);

From 2f2de4ada66508e43b5e3bd1377724dbe7399afb Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 14:37:22 +0800
Subject: [PATCH 04/87] feat(tracking-page): organization settings for the
 customer tracking page

Add the settings backend for the customer tracking page refactor (PR 2):

- TrackingPageConfig: the company config's shape, defaults and sanitizing
  (pages, branding, access, what verified visitors see), instance defaults
  for the generic page, slug rules with a reserved list, and accent contrast
  helpers (ink colour and WCAG ratio).
- SettingController: get/save tracking-page-settings, a live slug check, and
  admin defaults. Saved slugs are indexed in fleet-ops.tracking-page-slugs.*
  so the public page resolves a company in one read; an enabled organization
  page refuses an invalid, reserved or taken slug. The read-back includes the
  slug status, the accent's ink and contrast, whether SMS is configured
  (Twilio counts only with credentials), and whether the customer portal is
  installed.
- Routes under settings/, and a tracking-page-settings permission resource.
---
 server/src/Auth/Schemas/FleetOps.php          |   5 +
 .../Internal/v1/SettingController.php         | 196 ++++++++++
 .../TrackingPage/TrackingPageConfig.php       | 259 +++++++++++++
 server/src/routes.php                         |   5 +
 server/tests/TrackingPageSettingsTest.php     | 343 ++++++++++++++++++
 5 files changed, 808 insertions(+)
 create mode 100644 server/src/Support/TrackingPage/TrackingPageConfig.php
 create mode 100644 server/tests/TrackingPageSettingsTest.php

diff --git a/server/src/Auth/Schemas/FleetOps.php b/server/src/Auth/Schemas/FleetOps.php
index 8a652e2f0..247e1da84 100644
--- a/server/src/Auth/Schemas/FleetOps.php
+++ b/server/src/Auth/Schemas/FleetOps.php
@@ -229,6 +229,11 @@ class FleetOps
             'actions'        => [],
             'remove_actions' => ['delete', 'export', 'create'],
         ],
+        [
+            'name'           => 'tracking-page-settings', // the customer tracking page: branding, access and what verified visitors see
+            'actions'        => [],
+            'remove_actions' => ['delete', 'export', 'create'],
+        ],
         [
             'name'           => 'telematics-settings', // organization device event and position history preferences
             'action'         => [],
diff --git a/server/src/Http/Controllers/Internal/v1/SettingController.php b/server/src/Http/Controllers/Internal/v1/SettingController.php
index 296363a07..3699c4bf7 100644
--- a/server/src/Http/Controllers/Internal/v1/SettingController.php
+++ b/server/src/Http/Controllers/Internal/v1/SettingController.php
@@ -5,10 +5,13 @@
 use Fleetbase\FleetOps\Jobs\DispatchTelematicsRetentionJobs;
 use Fleetbase\FleetOps\Support\Telematics\Retention\RetentionPolicy;
 use Fleetbase\FleetOps\Support\Telematics\Telemetry\Queue;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingPageConfig;
+use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\FleetOps\Tracking\TrackingProviderRegistry;
 use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Models\Setting;
+use Fleetbase\Services\SmsService;
 use Fleetbase\Support\Auth;
 use Fleetbase\Support\NotificationRegistry;
 use Illuminate\Database\MySqlConnection;
@@ -47,6 +50,11 @@ public function __construct()
             'saveTelematicsSettings'                  => 'update telematics-settings',
             'getTelematicsStorageUsage'               => 'admin',
             'runTelematicsRetention'                  => 'admin',
+            'getTrackingPageSettings'                 => 'view tracking-page-settings',
+            'saveTrackingPageSettings'                => 'update tracking-page-settings',
+            'validateTrackingPageSlug'                => 'update tracking-page-settings',
+            'getAdminTrackingPageSettings'            => 'admin',
+            'saveAdminTrackingPageSettings'           => 'admin',
         ]);
     }
 
@@ -1074,6 +1082,194 @@ protected function storageTableStatistics(array $tables): array
         return $statistics;
     }
 
+    /**
+     * The company's customer tracking page settings, with what the settings screen needs to
+     * explain them: whether the slug is usable, whether SMS can be sent, and whether the
+     * customer portal is there for sign-in.
+     *
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function getTrackingPageSettings()
+    {
+        return response()->json($this->trackingPageView($this->trackingPageConfig()));
+    }
+
+    /**
+     * Save the company's tracking page settings.
+     *
+     * The slug is indexed so the public page can find the company in one read. A slug that
+     * is invalid, reserved or taken can't be saved while the organization page is on; while
+     * it is off, the slug is kept but not indexed.
+     *
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function saveTrackingPageSettings(Request $request)
+    {
+        $previous   = $this->trackingPageConfig();
+        $config     = TrackingPageConfig::sanitize((array) $request->input('trackingPage', []), $this->trackingPageAdminConfig(), $this->trackingPageCompanyName());
+        $slug       = $config['org_page']['slug'];
+        $validation = $this->trackingPageSlugValidation($slug);
+
+        if ($config['org_page']['enabled'] && !$validation['valid']) {
+            return response()->error($validation['message'], 422);
+        }
+
+        if ($validation['valid']) {
+            $previousSlug = $previous['org_page']['slug'];
+            if ($previousSlug !== $slug && $this->trackingPageSlugOwner($previousSlug) === $this->trackingPageCompanyUuid()) {
+                $this->configureSetting(TrackingPageConfig::SLUG_INDEX_PREFIX . $previousSlug, null);
+            }
+
+            $this->configureSetting(TrackingPageConfig::SLUG_INDEX_PREFIX . $slug, $this->trackingPageCompanyUuid());
+        }
+
+        $this->configureCompanySetting(TrackingPageConfig::SETTING_KEY, $config);
+
+        return response()->json($this->trackingPageView($config));
+    }
+
+    /**
+     * Check a slug while it is typed.
+     *
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function validateTrackingPageSlug(Request $request)
+    {
+        $slug = strtolower(trim((string) $request->input('slug', '')));
+
+        return response()->json(array_merge(['slug' => $slug], $this->trackingPageSlugValidation($slug)));
+    }
+
+    /**
+     * Instance-wide defaults for the generic tracking page.
+     *
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function getAdminTrackingPageSettings()
+    {
+        return response()->json($this->trackingPageAdminConfig());
+    }
+
+    /**
+     * Save the instance-wide defaults for the generic tracking page.
+     *
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function saveAdminTrackingPageSettings(Request $request)
+    {
+        $config = TrackingPageConfig::sanitizeAdmin((array) $request->input('trackingPage', []));
+        $this->configureSetting(TrackingPageConfig::ADMIN_SETTING_KEY, $config);
+
+        return response()->json($config);
+    }
+
+    protected function trackingPageConfig(): array
+    {
+        return TrackingPageConfig::sanitize(
+            (array) $this->lookupCompanySetting(TrackingPageConfig::SETTING_KEY, []),
+            $this->trackingPageAdminConfig(),
+            $this->trackingPageCompanyName()
+        );
+    }
+
+    protected function trackingPageAdminConfig(): array
+    {
+        return TrackingPageConfig::sanitizeAdmin((array) $this->lookupSetting(TrackingPageConfig::ADMIN_SETTING_KEY, []));
+    }
+
+    /**
+     * The saved config plus the read-only facts the settings screen shows beside it.
+     */
+    protected function trackingPageView(array $config): array
+    {
+        $accent = $config['branding']['accent'];
+
+        return array_merge($config, [
+            'slug_validation'           => $this->trackingPageSlugValidation($config['org_page']['slug']),
+            'accent_ink'                => TrackingPageConfig::inkFor($accent),
+            'accent_contrast'           => TrackingPageConfig::contrastRatio($accent, TrackingPageConfig::inkFor($accent)),
+            'sms_available'             => $this->smsProviderConfigured(),
+            'customer_portal_installed' => $this->customerPortalInstalled(),
+            'admin'                     => $this->trackingPageAdminConfig(),
+        ]);
+    }
+
+    /**
+     * @return array{valid: bool, code: string, message: string}
+     */
+    protected function trackingPageSlugValidation(string $slug): array
+    {
+        $error = TrackingPageConfig::slugError($slug);
+        if ($error === 'invalid') {
+            return ['valid' => false, 'code' => 'invalid', 'message' => 'Use 3 to 40 lowercase letters, numbers and single hyphens, starting and ending with a letter or number.'];
+        }
+
+        if ($error === 'reserved') {
+            return ['valid' => false, 'code' => 'reserved', 'message' => 'This address is reserved. Please choose another.'];
+        }
+
+        $owner = $this->trackingPageSlugOwner($slug);
+        if ($owner !== null && $owner !== $this->trackingPageCompanyUuid()) {
+            return ['valid' => false, 'code' => 'taken', 'message' => 'Another organization already uses this address.'];
+        }
+
+        return ['valid' => true, 'code' => 'available', 'message' => 'This address is available.'];
+    }
+
+    protected function trackingPageSlugOwner(string $slug): ?string
+    {
+        $owner = $this->lookupSetting(TrackingPageConfig::SLUG_INDEX_PREFIX . $slug);
+
+        return is_string($owner) && $owner !== '' ? $owner : null;
+    }
+
+    protected function trackingPageCompanyUuid(): ?string
+    {
+        return data_get($this->currentCompany(), 'uuid');
+    }
+
+    protected function trackingPageCompanyName(): ?string
+    {
+        return data_get($this->currentCompany(), 'name');
+    }
+
+    /**
+     * Whether the instance can send SMS. Twilio is listed as always available, so it counts
+     * only with credentials; other providers report their own configuration.
+     */
+    protected function smsProviderConfigured(): bool
+    {
+        if (filled(config('services.twilio.sid')) && filled(config('services.twilio.token'))) {
+            return true;
+        }
+
+        return collect($this->smsProviders())
+            ->except(SmsService::PROVIDER_TWILIO)
+            ->contains(fn ($provider) => (bool) data_get($provider, 'available'));
+    }
+
+    protected function smsProviders(): array
+    {
+        // @codeCoverageIgnoreStart
+        // Reads the live SMS provider configuration; tests replace this seam.
+        return (new SmsService())->getAvailableProviders();
+        // @codeCoverageIgnoreEnd
+    }
+
+    protected function customerPortalInstalled(): bool
+    {
+        return collect($this->installedFleetbaseExtensions())
+            ->contains(fn ($package) => data_get($package, 'name') === 'fleetbase/customer-portal-api');
+    }
+
+    protected function installedFleetbaseExtensions(): array
+    {
+        // @codeCoverageIgnoreStart
+        // Reads the installed composer packages; tests replace this seam.
+        return Utils::getInstalledFleetbaseExtensions();
+        // @codeCoverageIgnoreEnd
+    }
+
     protected function dispatchTelematicsPrune(): void
     {
         Queue::dispatch(new DispatchTelematicsRetentionJobs());
diff --git a/server/src/Support/TrackingPage/TrackingPageConfig.php b/server/src/Support/TrackingPage/TrackingPageConfig.php
new file mode 100644
index 000000000..783965d07
--- /dev/null
+++ b/server/src/Support/TrackingPage/TrackingPageConfig.php
@@ -0,0 +1,259 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\TrackingPage;
+
+use Illuminate\Support\Str;
+
+/**
+ * The shape, defaults and sanitizing of a company's customer tracking page settings.
+ *
+ * A company keeps its config in the company setting `tracking-page`. Instance-wide
+ * defaults for the generic page live in the system setting `fleet-ops.tracking-page`.
+ * Everything here is pure, so the controller and the public tracking API read one shape.
+ *
+ * Privacy rules are not settings: the map and driver hide after delivery, and the driver
+ * shows only while en route to the viewer's stops, whatever is saved here.
+ */
+class TrackingPageConfig
+{
+    public const SETTING_KEY       = 'tracking-page';
+    public const ADMIN_SETTING_KEY = 'fleet-ops.tracking-page';
+    public const SLUG_INDEX_PREFIX = 'fleet-ops.tracking-page-slugs.';
+    public const DEFAULT_ACCENT    = '#1F5FA8';
+    public const DARK_INK          = '#14191A';
+    public const LIGHT_INK         = '#FFFFFF';
+
+    /**
+     * The FleetOps locales a tracking page can be shown in.
+     */
+    public const LOCALES = ['en-us', 'ar-ae', 'bg-bg', 'es-pa', 'fr-fr', 'mn-mn', 'pt-br', 'ru-ru', 'uk-ua', 'vi-vn'];
+
+    /**
+     * Slugs a company can't take: they would read as part of the page's own URLs.
+     */
+    public const RESERVED_SLUGS = [
+        'admin', 'api', 'auth', 'console', 'customer-access', 'customer-portal', 'fleetbase', 'help',
+        'int', 'login', 'new', 'portal', 'public', 'settings', 'support', 'track', 'tracking', 'www',
+    ];
+
+    /**
+     * Instance-wide defaults for the generic page, as an administrator saved them.
+     */
+    public static function sanitizeAdmin(array $input): array
+    {
+        return [
+            'generic_page' => [
+                'enabled' => static::bool(data_get($input, 'generic_page.enabled'), true),
+            ],
+            'branding'     => [
+                'display_name'  => static::text(data_get($input, 'branding.display_name'), 80),
+                'accent'        => static::color(data_get($input, 'branding.accent')) ?? static::DEFAULT_ACCENT,
+                'support_phone' => static::text(data_get($input, 'branding.support_phone'), 32),
+                'support_email' => static::email(data_get($input, 'branding.support_email')),
+                'website'       => static::url(data_get($input, 'branding.website')),
+                'powered_by'    => static::bool(data_get($input, 'branding.powered_by'), true),
+            ],
+        ];
+    }
+
+    /**
+     * A company's config, with every key present and every value valid.
+     *
+     * @param array       $admin       the sanitized instance defaults
+     * @param string|null $companyName used for the default slug
+     */
+    public static function sanitize(array $input, array $admin = [], ?string $companyName = null): array
+    {
+        $admin  = static::sanitizeAdmin($admin);
+        $locale = static::oneOf(data_get($input, 'branding.default_locale'), static::LOCALES, 'en-us');
+
+        return [
+            'org_page'     => [
+                'enabled' => static::bool(data_get($input, 'org_page.enabled'), false),
+                'slug'    => static::normalizeSlug(data_get($input, 'org_page.slug')) ?: static::slugify((string) $companyName),
+            ],
+            'generic_page' => [
+                'allowed' => static::bool(data_get($input, 'generic_page.allowed'), true),
+            ],
+            'links'        => [
+                'target' => static::oneOf(data_get($input, 'links.target'), ['auto', 'org', 'generic'], 'auto'),
+            ],
+            'branding'     => [
+                'display_name'  => static::text(data_get($input, 'branding.display_name'), 80),
+                'logo_uuid'     => static::text(data_get($input, 'branding.logo_uuid'), 64),
+                'accent'        => static::color(data_get($input, 'branding.accent')) ?? $admin['branding']['accent'],
+                'accent_dark'   => static::color(data_get($input, 'branding.accent_dark')),
+                'support_phone' => static::text(data_get($input, 'branding.support_phone'), 32),
+                'support_email' => static::email(data_get($input, 'branding.support_email')),
+                'website'       => static::url(data_get($input, 'branding.website')),
+                'powered_by'    => static::bool(data_get($input, 'branding.powered_by'), $admin['branding']['powered_by']),
+                'theme'         => static::oneOf(data_get($input, 'branding.theme'), ['system', 'light'], 'system'),
+                'default_locale' => $locale,
+                'locales'       => static::locales(data_get($input, 'branding.locales'), $locale),
+            ],
+            'access'       => [
+                'public_status'   => static::bool(data_get($input, 'access.public_status'), true),
+                'channels'        => [
+                    'sms'   => static::bool(data_get($input, 'access.channels.sms'), true),
+                    'email' => static::bool(data_get($input, 'access.channels.email'), true),
+                ],
+                'session_hours'   => static::clampInt(data_get($input, 'access.session_hours'), 1, 168, 24),
+                'account_sign_in' => static::bool(data_get($input, 'access.account_sign_in'), true),
+                'account_upsell'  => static::bool(data_get($input, 'access.account_upsell'), true),
+            ],
+            'visibility'   => [
+                'map'               => static::bool(data_get($input, 'visibility.map'), true),
+                'driver_name'       => static::bool(data_get($input, 'visibility.driver_name'), true),
+                'vehicle'           => static::bool(data_get($input, 'visibility.vehicle'), true),
+                'driver_contact'    => static::oneOf(data_get($input, 'visibility.driver_contact'), ['company', 'driver'], 'company'),
+                'items'             => static::bool(data_get($input, 'visibility.items'), true),
+                'item_prices'       => static::bool(data_get($input, 'visibility.item_prices'), false),
+                'pod_photo'         => static::bool(data_get($input, 'visibility.pod_photo'), true),
+                'pod_signature'     => static::bool(data_get($input, 'visibility.pod_signature'), true),
+                'instructions_edit' => static::bool(data_get($input, 'visibility.instructions_edit'), false),
+                'report_problem'    => static::bool(data_get($input, 'visibility.report_problem'), true),
+            ],
+        ];
+    }
+
+    /**
+     * Why a slug can't be used, or null when its shape is fine. Availability is the caller's check.
+     *
+     * @return string|null `invalid` or `reserved`
+     */
+    public static function slugError(?string $slug): ?string
+    {
+        if (!is_string($slug) || preg_match('/^[a-z0-9](?:[a-z0-9-]{1,38})[a-z0-9]$/', $slug) !== 1 || str_contains($slug, '--')) {
+            return 'invalid';
+        }
+
+        return in_array($slug, static::RESERVED_SLUGS, true) ? 'reserved' : null;
+    }
+
+    /**
+     * A slug made from a company name: lowercase, hyphenated, 3 to 40 characters.
+     */
+    public static function slugify(string $name): string
+    {
+        $slug = trim(Str::limit(Str::slug($name), 40, ''), '-');
+
+        if (strlen($slug) >= 3) {
+            return $slug;
+        }
+
+        return $slug === '' ? 'company-tracking' : $slug . '-tracking';
+    }
+
+    /**
+     * The text colour readable on an accent: white when it reaches 4.5:1, otherwise dark.
+     */
+    public static function inkFor(string $accent): string
+    {
+        return static::contrastRatio($accent, static::LIGHT_INK) >= 4.5 ? static::LIGHT_INK : static::DARK_INK;
+    }
+
+    /**
+     * The WCAG contrast ratio of two `#RRGGBB` colours.
+     */
+    public static function contrastRatio(string $a, string $b): float
+    {
+        $lighter = max(static::luminance($a), static::luminance($b));
+        $darker  = min(static::luminance($a), static::luminance($b));
+
+        return round(($lighter + 0.05) / ($darker + 0.05), 2);
+    }
+
+    protected static function luminance(string $hex): float
+    {
+        $channels = array_map(function (string $pair) {
+            $value = hexdec($pair) / 255;
+
+            return $value <= 0.03928 ? $value / 12.92 : (($value + 0.055) / 1.055) ** 2.4;
+        }, str_split(ltrim($hex, '#'), 2));
+
+        return 0.2126 * $channels[0] + 0.7152 * $channels[1] + 0.0722 * $channels[2];
+    }
+
+    protected static function normalizeSlug(mixed $value): string
+    {
+        return is_string($value) ? strtolower(trim($value)) : '';
+    }
+
+    protected static function bool(mixed $value, bool $default): bool
+    {
+        if (is_bool($value)) {
+            return $value;
+        }
+
+        return filter_var($value, FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE) ?? $default;
+    }
+
+    protected static function text(mixed $value, int $max): ?string
+    {
+        if (!is_string($value) && !is_numeric($value)) {
+            return null;
+        }
+
+        $value = trim((string) $value);
+
+        return $value === '' ? null : mb_substr($value, 0, $max);
+    }
+
+    protected static function email(mixed $value): ?string
+    {
+        $value = static::text($value, 191);
+
+        return $value !== null && filter_var($value, FILTER_VALIDATE_EMAIL) ? $value : null;
+    }
+
+    protected static function url(mixed $value): ?string
+    {
+        $value = static::text($value, 255);
+
+        return $value !== null && preg_match('#^https?://#i', $value) === 1 && filter_var($value, FILTER_VALIDATE_URL) ? $value : null;
+    }
+
+    /**
+     * `#RGB` or `#RRGGBB` as uppercase `#RRGGBB`, or null.
+     */
+    protected static function color(mixed $value): ?string
+    {
+        if (!is_string($value) || preg_match('/^#?([0-9a-f]{3}|[0-9a-f]{6})$/i', trim($value), $match) !== 1) {
+            return null;
+        }
+
+        $hex = $match[1];
+        if (strlen($hex) === 3) {
+            $hex = $hex[0] . $hex[0] . $hex[1] . $hex[1] . $hex[2] . $hex[2];
+        }
+
+        return '#' . strtoupper($hex);
+    }
+
+    protected static function oneOf(mixed $value, array $allowed, string $default): string
+    {
+        return is_string($value) && in_array($value, $allowed, true) ? $value : $default;
+    }
+
+    protected static function clampInt(mixed $value, int $min, int $max, int $default): int
+    {
+        if (!is_numeric($value)) {
+            return $default;
+        }
+
+        return max($min, min($max, (int) $value));
+    }
+
+    /**
+     * The enabled locales, always including the default one; every locale when none are valid.
+     */
+    protected static function locales(mixed $value, string $default): array
+    {
+        $locales = array_values(array_intersect(static::LOCALES, is_array($value) ? $value : []));
+        if ($locales === []) {
+            return static::LOCALES;
+        }
+
+        return in_array($default, $locales, true) ? $locales : array_merge([$default], $locales);
+    }
+}
diff --git a/server/src/routes.php b/server/src/routes.php
index dd757f07c..791078a04 100644
--- a/server/src/routes.php
+++ b/server/src/routes.php
@@ -806,6 +806,11 @@ function ($router) {
                                         $router->post('tracking-settings', 'SettingController@saveTrackingSettings');
                                         $router->get('admin-tracking-settings', 'SettingController@getAdminTrackingSettings');
                                         $router->post('admin-tracking-settings', 'SettingController@saveAdminTrackingSettings');
+                                        $router->get('tracking-page-settings', 'SettingController@getTrackingPageSettings');
+                                        $router->post('tracking-page-settings', 'SettingController@saveTrackingPageSettings');
+                                        $router->post('tracking-page-settings/validate-slug', 'SettingController@validateTrackingPageSlug');
+                                        $router->get('admin-tracking-page-settings', 'SettingController@getAdminTrackingPageSettings');
+                                        $router->post('admin-tracking-page-settings', 'SettingController@saveAdminTrackingPageSettings');
                                         $router->get('map', 'SettingController@getMapSettings');
                                         $router->post('map', 'SettingController@saveMapSettings');
                                         $router->get('admin-map', 'SettingController@getAdminMapSettings');
diff --git a/server/tests/TrackingPageSettingsTest.php b/server/tests/TrackingPageSettingsTest.php
new file mode 100644
index 000000000..9a027c73c
--- /dev/null
+++ b/server/tests/TrackingPageSettingsTest.php
@@ -0,0 +1,343 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\SettingController;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingPageConfig;
+use Illuminate\Http\Request;
+
+class FleetOpsTrackingPageSettingProbe extends SettingController
+{
+    public array $settings        = [];
+    public array $companySettings = [];
+    public array $configured      = [];
+    public mixed $company         = null;
+    public array $smsProviders    = [];
+    public array $extensions      = [];
+
+    public function __construct()
+    {
+    }
+
+    protected function configureSetting(string $key, mixed $value): mixed
+    {
+        $this->configured[]   = [$key, $value];
+        $this->settings[$key] = $value;
+
+        return null;
+    }
+
+    protected function configureCompanySetting(string $key, mixed $value): mixed
+    {
+        $this->companySettings[$key] = $value;
+
+        return null;
+    }
+
+    protected function lookupSetting(string $key, mixed $defaultValue = null): mixed
+    {
+        return $this->settings[$key] ?? $defaultValue;
+    }
+
+    protected function lookupCompanySetting(string $key, mixed $defaultValue = null): mixed
+    {
+        return $this->companySettings[$key] ?? $defaultValue;
+    }
+
+    protected function currentCompany(): mixed
+    {
+        return $this->company;
+    }
+
+    protected function smsProviders(): array
+    {
+        return $this->smsProviders;
+    }
+
+    protected function installedFleetbaseExtensions(): array
+    {
+        return $this->extensions;
+    }
+}
+
+function fleetopsTrackingPageProbe(): FleetOpsTrackingPageSettingProbe
+{
+    $probe          = new FleetOpsTrackingPageSettingProbe();
+    $probe->company = (object) ['uuid' => 'company-1', 'name' => 'Northwind Couriers'];
+
+    config(['services.twilio.sid' => null, 'services.twilio.token' => null]);
+
+    return $probe;
+}
+
+function fleetopsTrackingPageRequest(array $trackingPage): Request
+{
+    return new Request(['trackingPage' => $trackingPage]);
+}
+
+test('tracking page config fills every key with defaults for an empty company setting', function () {
+    $config = TrackingPageConfig::sanitize([], [], 'Northwind Couriers');
+
+    expect($config['org_page'])->toBe(['enabled' => false, 'slug' => 'northwind-couriers'])
+        ->and($config['generic_page'])->toBe(['allowed' => true])
+        ->and($config['links'])->toBe(['target' => 'auto'])
+        ->and($config['branding'])->toBe([
+            'display_name'   => null,
+            'logo_uuid'      => null,
+            'accent'         => '#1F5FA8',
+            'accent_dark'    => null,
+            'support_phone'  => null,
+            'support_email'  => null,
+            'website'        => null,
+            'powered_by'     => true,
+            'theme'          => 'system',
+            'default_locale' => 'en-us',
+            'locales'        => TrackingPageConfig::LOCALES,
+        ])
+        ->and($config['access'])->toBe([
+            'public_status'   => true,
+            'channels'        => ['sms' => true, 'email' => true],
+            'session_hours'   => 24,
+            'account_sign_in' => true,
+            'account_upsell'  => true,
+        ])
+        ->and($config['visibility'])->toBe([
+            'map'               => true,
+            'driver_name'       => true,
+            'vehicle'           => true,
+            'driver_contact'    => 'company',
+            'items'             => true,
+            'item_prices'       => false,
+            'pod_photo'         => true,
+            'pod_signature'     => true,
+            'instructions_edit' => false,
+            'report_problem'    => true,
+        ]);
+});
+
+test('tracking page config keeps valid values and replaces invalid ones', function () {
+    $config = TrackingPageConfig::sanitize([
+        'org_page'     => ['enabled' => 'true', 'slug' => '  Northwind  '],
+        'generic_page' => ['allowed' => '0'],
+        'links'        => ['target' => 'org'],
+        'branding'     => [
+            'display_name'   => '  Northwind  ',
+            'logo_uuid'      => 'file-uuid',
+            'accent'         => '0b6',
+            'accent_dark'    => '#5cc9be',
+            'support_phone'  => 5105550142,
+            'support_email'  => 'help@northwind.example',
+            'website'        => 'https://northwind.example',
+            'powered_by'     => false,
+            'theme'          => 'light',
+            'default_locale' => 'de-de',
+            'locales'        => ['fr-fr', 'xx-xx'],
+            'unknown'        => 'dropped',
+        ],
+        'access'       => ['public_status' => 'no', 'channels' => ['sms' => 'maybe', 'email' => false], 'session_hours' => 500],
+        'visibility'   => ['driver_contact' => 'driver', 'item_prices' => 1, 'map' => 'off'],
+        'extra'        => ['dropped' => true],
+    ], ['branding' => ['accent' => '#123456', 'powered_by' => false]], 'Ignored');
+
+    expect($config['org_page'])->toBe(['enabled' => true, 'slug' => 'northwind'])
+        ->and($config['generic_page']['allowed'])->toBeFalse()
+        ->and($config['links']['target'])->toBe('org')
+        ->and($config['branding']['display_name'])->toBe('Northwind')
+        ->and($config['branding']['logo_uuid'])->toBe('file-uuid')
+        ->and($config['branding']['accent'])->toBe('#00BB66')
+        ->and($config['branding']['accent_dark'])->toBe('#5CC9BE')
+        ->and($config['branding']['support_phone'])->toBe('5105550142')
+        ->and($config['branding']['support_email'])->toBe('help@northwind.example')
+        ->and($config['branding']['website'])->toBe('https://northwind.example')
+        ->and($config['branding']['powered_by'])->toBeFalse()
+        ->and($config['branding']['theme'])->toBe('light')
+        ->and($config['branding']['default_locale'])->toBe('en-us')
+        ->and($config['branding']['locales'])->toBe(['en-us', 'fr-fr'])
+        ->and($config['branding'])->not->toHaveKey('unknown')
+        ->and($config)->not->toHaveKey('extra')
+        ->and($config['access']['public_status'])->toBeFalse()
+        ->and($config['access']['channels'])->toBe(['sms' => true, 'email' => false])
+        ->and($config['access']['session_hours'])->toBe(168)
+        ->and($config['visibility']['driver_contact'])->toBe('driver')
+        ->and($config['visibility']['item_prices'])->toBeTrue()
+        ->and($config['visibility']['map'])->toBeFalse();
+
+    $fallback = TrackingPageConfig::sanitize([
+        'branding' => [
+            'accent'        => 'teal',
+            'accent_dark'   => ['#000000'],
+            'support_email' => 'not-an-email',
+            'website'       => 'ftp://northwind.example',
+            'display_name'  => '   ',
+            'locales'       => ['ar-ae', 'en-us'],
+        ],
+        'access'   => ['session_hours' => 'soon'],
+    ], ['branding' => ['accent' => '#123456', 'powered_by' => false]], 'N');
+
+    expect($fallback['org_page']['slug'])->toBe('n-tracking')
+        ->and($fallback['branding']['accent'])->toBe('#123456')
+        ->and($fallback['branding']['accent_dark'])->toBeNull()
+        ->and($fallback['branding']['support_email'])->toBeNull()
+        ->and($fallback['branding']['website'])->toBeNull()
+        ->and($fallback['branding']['display_name'])->toBeNull()
+        ->and($fallback['branding']['powered_by'])->toBeFalse()
+        ->and($fallback['branding']['locales'])->toBe(['en-us', 'ar-ae'])
+        ->and($fallback['access']['session_hours'])->toBe(24)
+        ->and(TrackingPageConfig::sanitize(['access' => ['session_hours' => 0]])['access']['session_hours'])->toBe(1)
+        ->and(TrackingPageConfig::sanitize([])['org_page']['slug'])->toBe('company-tracking');
+});
+
+test('tracking page admin defaults are sanitized on their own', function () {
+    expect(TrackingPageConfig::sanitizeAdmin([]))->toBe([
+        'generic_page' => ['enabled' => true],
+        'branding'     => [
+            'display_name'  => null,
+            'accent'        => '#1F5FA8',
+            'support_phone' => null,
+            'support_email' => null,
+            'website'       => null,
+            'powered_by'    => true,
+        ],
+    ])->and(TrackingPageConfig::sanitizeAdmin([
+        'generic_page' => ['enabled' => false],
+        'branding'     => ['display_name' => 'Fleetbase Cloud', 'accent' => '#abcdef', 'support_email' => 'ops@fleetbase.example'],
+    ]))->toBe([
+        'generic_page' => ['enabled' => false],
+        'branding'     => [
+            'display_name'  => 'Fleetbase Cloud',
+            'accent'        => '#ABCDEF',
+            'support_phone' => null,
+            'support_email' => 'ops@fleetbase.example',
+            'website'       => null,
+            'powered_by'    => true,
+        ],
+    ]);
+});
+
+test('tracking page slugs are checked for shape and reserved words', function () {
+    expect(TrackingPageConfig::slugError('northwind'))->toBeNull()
+        ->and(TrackingPageConfig::slugError('north-wind-2'))->toBeNull()
+        ->and(TrackingPageConfig::slugError('ab'))->toBe('invalid')
+        ->and(TrackingPageConfig::slugError(str_repeat('a', 41)))->toBe('invalid')
+        ->and(TrackingPageConfig::slugError('-northwind'))->toBe('invalid')
+        ->and(TrackingPageConfig::slugError('north--wind'))->toBe('invalid')
+        ->and(TrackingPageConfig::slugError('North'))->toBe('invalid')
+        ->and(TrackingPageConfig::slugError(null))->toBe('invalid')
+        ->and(TrackingPageConfig::slugError('track'))->toBe('reserved')
+        ->and(TrackingPageConfig::slugError('customer-portal'))->toBe('reserved')
+        ->and(TrackingPageConfig::slugify(str_repeat('Northwind ', 8)))->toHaveLength(39)
+        ->and(TrackingPageConfig::slugify('Northwind Couriers, Inc.'))->toBe('northwind-couriers-inc');
+});
+
+test('tracking page accents get a readable ink and a contrast ratio', function () {
+    expect(TrackingPageConfig::inkFor('#0B6E68'))->toBe('#FFFFFF')
+        ->and(TrackingPageConfig::inkFor('#5CC9BE'))->toBe('#14191A')
+        ->and(TrackingPageConfig::contrastRatio('#FFFFFF', '#000000'))->toBe(21.0)
+        ->and(TrackingPageConfig::contrastRatio('#1F5FA8', '#FFFFFF'))->toBeGreaterThan(4.5)
+        ->and(TrackingPageConfig::contrastRatio('#FFFFFF', '#FFFFFF'))->toBe(1.0);
+});
+
+test('tracking page settings read back with what the settings screen explains', function () {
+    $probe = fleetopsTrackingPageProbe();
+
+    $view = $probe->getTrackingPageSettings()->getData(true);
+
+    expect($view['org_page'])->toBe(['enabled' => false, 'slug' => 'northwind-couriers'])
+        ->and($view['slug_validation'])->toBe(['valid' => true, 'code' => 'available', 'message' => 'This address is available.'])
+        ->and($view['accent_ink'])->toBe('#FFFFFF')
+        ->and($view['accent_contrast'])->toBeGreaterThan(4.5)
+        ->and($view['sms_available'])->toBeFalse()
+        ->and($view['customer_portal_installed'])->toBeFalse()
+        ->and($view['admin']['generic_page'])->toBe(['enabled' => true]);
+
+    $probe->extensions   = [['name' => 'fleetbase/customer-portal-api']];
+    $probe->smsProviders = ['twilio' => ['available' => true], 'vonage' => ['available' => true]];
+
+    expect($probe->getTrackingPageSettings()->getData(true))
+        ->toMatchArray(['sms_available' => true, 'customer_portal_installed' => true]);
+
+    $probe->smsProviders = ['twilio' => ['available' => true]];
+    expect($probe->getTrackingPageSettings()->getData(true)['sms_available'])->toBeFalse();
+
+    config(['services.twilio.sid' => 'AC123', 'services.twilio.token' => 'secret']);
+    expect($probe->getTrackingPageSettings()->getData(true)['sms_available'])->toBeTrue();
+});
+
+test('saving tracking page settings indexes the slug and frees the old one', function () {
+    $probe = fleetopsTrackingPageProbe();
+
+    $saved = $probe->saveTrackingPageSettings(fleetopsTrackingPageRequest([
+        'org_page' => ['enabled' => true, 'slug' => 'northwind'],
+        'branding' => ['accent' => '#0B6E68'],
+    ]))->getData(true);
+
+    expect($saved['org_page'])->toBe(['enabled' => true, 'slug' => 'northwind'])
+        ->and($saved['branding']['accent'])->toBe('#0B6E68')
+        ->and($probe->companySettings[TrackingPageConfig::SETTING_KEY]['org_page']['slug'])->toBe('northwind')
+        ->and($probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind'])->toBe('company-1')
+        ->and($probe->configured)->toBe([[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind', 'company-1']]);
+
+    $probe->saveTrackingPageSettings(fleetopsTrackingPageRequest(['org_page' => ['enabled' => true, 'slug' => 'northwind-couriers']]));
+
+    expect($probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind'])->toBeNull()
+        ->and($probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind-couriers'])->toBe('company-1');
+
+    // A previous slug that another company now holds is left alone.
+    $probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind-couriers'] = 'company-2';
+    $probe->configured                                                            = [];
+    $probe->saveTrackingPageSettings(fleetopsTrackingPageRequest(['org_page' => ['enabled' => false, 'slug' => 'northwind-express']]));
+
+    expect($probe->configured)->toBe([[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind-express', 'company-1']])
+        ->and($probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind-couriers'])->toBe('company-2');
+});
+
+test('an enabled organization page refuses an unusable slug while a disabled one keeps it unindexed', function () {
+    $probe                                                                  = fleetopsTrackingPageProbe();
+    $probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'taken-slug'] = 'company-2';
+
+    expect($probe->saveTrackingPageSettings(fleetopsTrackingPageRequest(['org_page' => ['enabled' => true, 'slug' => 'taken-slug']]))->getData(true))
+        ->toBe(['error' => 'Another organization already uses this address.'])
+        ->and($probe->saveTrackingPageSettings(fleetopsTrackingPageRequest(['org_page' => ['enabled' => true, 'slug' => 'track']]))->getData(true))
+        ->toBe(['error' => 'This address is reserved. Please choose another.'])
+        ->and($probe->saveTrackingPageSettings(fleetopsTrackingPageRequest(['org_page' => ['enabled' => true, 'slug' => 'a b']]))->getData(true)['error'])
+        ->toStartWith('Use 3 to 40 lowercase letters')
+        ->and($probe->companySettings)->toBe([]);
+
+    $saved = $probe->saveTrackingPageSettings(fleetopsTrackingPageRequest(['org_page' => ['enabled' => false, 'slug' => 'taken-slug']]))->getData(true);
+
+    expect($saved['org_page'])->toBe(['enabled' => false, 'slug' => 'taken-slug'])
+        ->and($saved['slug_validation']['code'])->toBe('taken')
+        ->and($probe->configured)->toBe([])
+        ->and($probe->companySettings[TrackingPageConfig::SETTING_KEY]['org_page']['slug'])->toBe('taken-slug');
+});
+
+test('tracking page slugs can be checked while typed', function () {
+    $probe                                                                 = fleetopsTrackingPageProbe();
+    $probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind'] = 'company-1';
+    $probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'harbor']    = 'company-2';
+
+    expect($probe->validateTrackingPageSlug(new Request(['slug' => ' Northwind ']))->getData(true))
+        ->toBe(['slug' => 'northwind', 'valid' => true, 'code' => 'available', 'message' => 'This address is available.'])
+        ->and($probe->validateTrackingPageSlug(new Request(['slug' => 'harbor']))->getData(true)['code'])->toBe('taken')
+        ->and($probe->validateTrackingPageSlug(new Request(['slug' => 'admin']))->getData(true)['code'])->toBe('reserved')
+        ->and($probe->validateTrackingPageSlug(new Request())->getData(true)['code'])->toBe('invalid');
+
+    $probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'empty-owner'] = '';
+    expect($probe->validateTrackingPageSlug(new Request(['slug' => 'empty-owner']))->getData(true)['valid'])->toBeTrue();
+});
+
+test('admin tracking page defaults are read and saved sanitized', function () {
+    $probe = fleetopsTrackingPageProbe();
+
+    expect($probe->getAdminTrackingPageSettings()->getData(true)['generic_page'])->toBe(['enabled' => true]);
+
+    $saved = $probe->saveAdminTrackingPageSettings(fleetopsTrackingPageRequest([
+        'generic_page' => ['enabled' => false],
+        'branding'     => ['accent' => 'nope', 'website' => 'https://fleetbase.example'],
+    ]))->getData(true);
+
+    expect($saved['generic_page'])->toBe(['enabled' => false])
+        ->and($saved['branding']['accent'])->toBe('#1F5FA8')
+        ->and($saved['branding']['website'])->toBe('https://fleetbase.example')
+        ->and($probe->settings[TrackingPageConfig::ADMIN_SETTING_KEY])->toBe($saved)
+        ->and($probe->getAdminTrackingPageSettings()->getData(true))->toBe($saved)
+        ->and($probe->getTrackingPageSettings()->getData(true)['admin'])->toBe($saved);
+});

From e3d8bc33e56d4977c10c4d6e9552269577d838fa Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 14:38:26 +0800
Subject: [PATCH 05/87] feat(tracking): structured tracking-url QR codes and
 Code 128 barcodes

QR codes now carry a versioned tracking url naming the tracking number and
the owner's public id (https://<console>/track-order?order=<tn>&r=<public_id>&v=1)
instead of the owner's bare uuid, so a phone camera opens the tracking page
while scanners read the parameters. The barcode is now Code 128 with the bare
tracking number, matching the text printed beneath it.

capture-qr and tracking-numbers/from-qr resolve scans through one parser that
accepts the new url, a bare tracking number or public id, and the bare owner
uuid printed on labels already in circulation. from-qr is now scoped to the
session's company and resolves waypoint and place owners too.

qr_code_content is published in every environment: it no longer exposes a uuid.
Labels print the QR as a fixed square instead of cropping it with object-fit.
---
 server/resources/views/labels/default.php     |   4 +-
 .../resources/views/labels/entity-label.php   |   4 +-
 .../resources/views/labels/waypoint-label.php |   4 +-
 .../Controllers/Api/v1/OrderController.php    |   5 +-
 .../Api/v1/TrackingNumberController.php       |  38 +--
 .../src/Http/Resources/v1/TrackingNumber.php  |  42 +---
 server/src/Models/Entity.php                  |   9 +-
 server/src/Models/TrackingNumber.php          |  98 +++++++-
 server/src/Models/Waypoint.php                |   9 +-
 .../src/Observers/TrackingNumberObserver.php  |  24 +-
 server/src/Support/TrackingCode.php           | 218 ++++++++++++++++++
 11 files changed, 365 insertions(+), 90 deletions(-)
 create mode 100644 server/src/Support/TrackingCode.php

diff --git a/server/resources/views/labels/default.php b/server/resources/views/labels/default.php
index b79adaf1b..2214e277a 100755
--- a/server/resources/views/labels/default.php
+++ b/server/resources/views/labels/default.php
@@ -53,7 +53,7 @@
 	<div style="width: 420px; border: 2px #414141 solid; margin: auto;">
 		<div class="group" style="border-bottom: 1px #414141 solid; overflow: hidden;">
 			<div style="float: left; width: 130px; height: 120px; border-right: 1px #414141 solid; text-align: center; padding: 10px; box-sizing: border-box;">
-				<img src="data:image/png;base64,<?php echo Utils::notEmpty($trackingNumber) ? $trackingNumber->qr_code : $order->trackingNumber->qr_code; ?>" style="width: 100%; height: 100%; object-fit: cover;">
+				<img src="data:image/png;base64,<?php echo Utils::notEmpty($trackingNumber) ? $trackingNumber->qr_code : $order->trackingNumber->qr_code; ?>" style="width: 100px; height: 100px;">
 			</div>
 			<div style="margin-top: 10px; padding-left: 10px;">
 				<div style="font-size: 18px; font-weight: bold;"><?php echo e($company->name); ?></div>
@@ -185,7 +185,7 @@
 		<?php } ?>
 		<div class="group">
 			<div style="text-align: center; padding: 15px 0px; border-top: 1px #414141 solid;">
-				<img src="data:image/png;base64,<?php echo isset($trackingNumber) ? $trackingNumber->barcode : $order->trackingNumber->barcode; ?>" style="height: 90px; margin-top: 10px;">
+				<img src="data:image/png;base64,<?php echo isset($trackingNumber) ? $trackingNumber->barcode : $order->trackingNumber->barcode; ?>" style="max-width: 360px; max-height: 90px; margin-top: 10px;">
 				<div><?php echo e(strtoupper(isset($trackingNumber) ? $trackingNumber->tracking_number : $order->trackingNumber->tracking_number)); ?></div>
 			</div>
 		</div>
diff --git a/server/resources/views/labels/entity-label.php b/server/resources/views/labels/entity-label.php
index ac62da5f7..6f354d225 100644
--- a/server/resources/views/labels/entity-label.php
+++ b/server/resources/views/labels/entity-label.php
@@ -45,7 +45,7 @@
     <div style="width: 420px; border: 2px #414141 solid; margin: auto;">
         <div class="group" style="border-bottom: 1px #414141 solid; overflow: hidden;">
             <div style="float: left; width: 130px; height: 120px; border-right: 1px #414141 solid; text-align: center; padding: 10px; box-sizing: border-box;">
-                <img src="data:image/png;base64,<?= Utils::notEmpty($trackingNumber) ? $trackingNumber->qr_code : $entity->qr_code ?>" style="width: 100%; height: 100%; object-fit: cover;">
+                <img src="data:image/png;base64,<?= Utils::notEmpty($trackingNumber) ? $trackingNumber->qr_code : $entity->qr_code ?>" style="width: 100px; height: 100px;">
             </div>
             <div style="margin-top: 10px;">
                 <span style="padding-left: 10px; font-size: 18px; font-weight: bold;"><?= strtoupper($company->name) ?></span>
@@ -114,7 +114,7 @@
         <?php } ?>
         <div class="group">
             <div style="text-align: center; padding: 15px 0px; border-top: 1px #414141 solid;">
-                <img src="data:image/png;base64,<?= isset($trackingNumber) ? $trackingNumber->barcode : $entity->barcode ?>" style="height: 90px; margin-top: 10px;">
+                <img src="data:image/png;base64,<?= isset($trackingNumber) ? $trackingNumber->barcode : $entity->barcode ?>" style="max-width: 360px; max-height: 90px; margin-top: 10px;">
                 <div><?= strtoupper(isset($trackingNumber) ? $trackingNumber->tracking_number : $entity->public_id) ?></div>
             </div>
         </div>
diff --git a/server/resources/views/labels/waypoint-label.php b/server/resources/views/labels/waypoint-label.php
index 70f9a9585..fd043d703 100644
--- a/server/resources/views/labels/waypoint-label.php
+++ b/server/resources/views/labels/waypoint-label.php
@@ -52,7 +52,7 @@
     <div style="width: 420px; border: 2px #414141 solid; margin: auto;">
         <div class="group" style="border-bottom: 1px #414141 solid; overflow: hidden;">
             <div style="float: left; width: 130px; height: 120px; border-right: 1px #414141 solid; text-align: center; padding: 10px; box-sizing: border-box;">
-                <img src="data:image/png;base64,<?php echo Utils::notEmpty($trackingNumber) ? $trackingNumber->qr_code : $order->trackingNumber->qr_code; ?>" style="width: 100%; height: 100%; object-fit: cover;">
+                <img src="data:image/png;base64,<?php echo Utils::notEmpty($trackingNumber) ? $trackingNumber->qr_code : $order->trackingNumber->qr_code; ?>" style="width: 100px; height: 100px;">
             </div>
             <div style="margin-top: 10px;">
                 <span style="padding-left: 10px; font-size: 18px; font-weight: bold;"><?php echo e($company->name); ?></span>
@@ -123,7 +123,7 @@
         <?php } ?>
         <div class="group">
             <div style="text-align: center; padding: 15px 0px; border-top: 1px #414141 solid;">
-                <img src="data:image/png;base64,<?php echo isset($trackingNumber) ? $trackingNumber->barcode : $order->trackingNumber->barcode; ?>" style="height: 90px; margin-top: 10px;">
+                <img src="data:image/png;base64,<?php echo isset($trackingNumber) ? $trackingNumber->barcode : $order->trackingNumber->barcode; ?>" style="max-width: 360px; max-height: 90px; margin-top: 10px;">
                 <div><?php echo e(strtoupper(isset($trackingNumber) ? $trackingNumber->tracking_number : $order->trackingNumber->tracking_number)); ?></div>
             </div>
         </div>
diff --git a/server/src/Http/Controllers/Api/v1/OrderController.php b/server/src/Http/Controllers/Api/v1/OrderController.php
index bc4054d9a..bd99b72a2 100644
--- a/server/src/Http/Controllers/Api/v1/OrderController.php
+++ b/server/src/Http/Controllers/Api/v1/OrderController.php
@@ -25,6 +25,7 @@
 use Fleetbase\FleetOps\Models\ServiceQuote;
 use Fleetbase\FleetOps\Models\Waypoint;
 use Fleetbase\FleetOps\Support\ResolvesOrderServiceStops;
+use Fleetbase\FleetOps\Support\TrackingCode;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Http\Resources\Comment as CommentResource;
@@ -1444,8 +1445,8 @@ public function captureQrScan(Request $request, string $id, ?string $subjectId =
             return $this->apiError('Unable to capture QR code data.');
         }
 
-        // validate
-        if ($subject && $code === $subject->uuid) {
+        // validate: the scan must name this subject, in any code format still in circulation
+        if (TrackingCode::matches($code, $subject)) {
             // create verification proof
             $proof = $this->createProof([
                 'company_uuid' => session('company'),
diff --git a/server/src/Http/Controllers/Api/v1/TrackingNumberController.php b/server/src/Http/Controllers/Api/v1/TrackingNumberController.php
index d79658fcc..2c969163f 100644
--- a/server/src/Http/Controllers/Api/v1/TrackingNumberController.php
+++ b/server/src/Http/Controllers/Api/v1/TrackingNumberController.php
@@ -127,8 +127,10 @@ public function fromQR(DecodeTrackingNumberQR $request)
         // validate request inputs
         $code = $request->input('code');
 
-        // get the model of from the code
-        $model = $this->findQrModel(['entities', 'orders'], ['uuid' => $code]);
+        // the order, waypoint, entity or place the code points at, in any format still in
+        // circulation: a tracking url, a bare tracking number or public id, or the bare
+        // owner uuid printed on older labels
+        $model = $this->findQrModel($code);
 
         // if no model response with error
         if (!$model) {
@@ -179,37 +181,9 @@ protected function deletedTrackingNumberResource(TrackingNumber $trackingNumber)
         return new DeletedResource($trackingNumber);
     }
 
-    protected function findQrModel(array $tables, array $where)
+    protected function findQrModel(string $code)
     {
-        // Hydrate through the eloquent models so the resolved record can be
-        // wrapped in its typed resource — raw rows have no model class.
-        $modelMap = [
-            'entities' => \Fleetbase\FleetOps\Models\Entity::class,
-            'orders'   => \Fleetbase\FleetOps\Models\Order::class,
-        ];
-
-        foreach ($tables as $table) {
-            $modelClass = $modelMap[$table] ?? null;
-            if (!$modelClass) {
-                continue;
-            }
-
-            $model = $modelClass::where($where)->first();
-            if ($model) {
-                return $model;
-            }
-        }
-
-        // No raw-row fallback. Utils::findModel() was called with the ARRAY of table names
-        // and, when nothing matched, passed that array to DB::table() — which stringified
-        // it to the literal table name "Array" and threw SQLSTATE[42S02]. Every
-        // unresolvable code became a 500 instead of the 400 this method's caller already
-        // handles.
-        //
-        // The fallback could not have helped anyway: qrModelResource() serializes through
-        // a typed resource keyed on the model class, and a raw stdClass row has none. The
-        // mapped models above are the endpoint's whole contract.
-        return null;
+        return TrackingNumber::findOwnerByCode($code, session('company'));
     }
 
     protected function qrModelResource($model)
diff --git a/server/src/Http/Resources/v1/TrackingNumber.php b/server/src/Http/Resources/v1/TrackingNumber.php
index bed9b0d5d..2f5c62ef6 100644
--- a/server/src/Http/Resources/v1/TrackingNumber.php
+++ b/server/src/Http/Resources/v1/TrackingNumber.php
@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Resources\v1;
 
+use Fleetbase\FleetOps\Support\TrackingCode;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Resources\FleetbaseResource;
 use Fleetbase\Support\Http;
@@ -30,47 +31,20 @@ public function toArray($request)
             'status'          => $this->last_status,
             'status_code'     => $this->last_status_code,
             'qr_code'         => $this->qr_code,
-            // The raw text encoded inside qr_code, exposed ONLY in debug mode.
-            //
-            // qr_code is a base64 PNG generated from owner_uuid (TrackingNumber::newBarcode),
-            // and the endpoints that consume a scanned code match on that uuid. A client
-            // scans the image to obtain it; an automated contract run cannot, so debug
-            // builds publish the value beside the image rather than the API growing a
-            // decode endpoint or handing out uuids generally.
-            //
-            // `when()` omits the key entirely when false — it is absent, not null — so a
-            // production response is byte-identical to before.
-            'qr_code_content' => $this->when(static::exposesQrCodeContent(), fn () => $this->owner_uuid),
+            // A value that scans as this tracking number: the QR content current labels
+            // print (see TrackingCode). It names the tracking number and the subject's
+            // public id, both already in this resource, so it is safe to publish, and lets
+            // clients that print their own labels, or cannot decode a PNG, use the code.
+            // Labels printed before it encode the owner uuid; resolvers accept both.
+            'qr_code_content' => $this->when($this->tracking_number, fn () => TrackingCode::qrContent($this->tracking_number, Utils::get($this->owner, 'public_id'))),
             'barcode'         => $this->barcode,
-            'url'             => Utils::consoleUrl('track-order', ['order' => $this->tracking_number]),
+            'url'             => Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->tracking_number]),
             'type'            => Utils::getTypeFromClassName($this->owner_type),
             'updated_at'      => $this->updated_at,
             'created_at'      => $this->created_at,
         ];
     }
 
-    /**
-     * Whether the QR code's decoded content may be published.
-     *
-     * Debug mode only, and fails closed: any failure to determine the debug state — no
-     * container, an application without the accessor — answers false rather than
-     * defaulting to exposure.
-     */
-    protected static function exposesQrCodeContent(): bool
-    {
-        try {
-            $app = app();
-
-            if (!is_object($app) || !method_exists($app, 'hasDebugModeEnabled')) {
-                return false;
-            }
-
-            return (bool) $app->hasDebugModeEnabled();
-        } catch (\Throwable $e) {
-            return false;
-        }
-    }
-
     /**
      * Transform the resource into an webhook payload.
      *
diff --git a/server/src/Models/Entity.php b/server/src/Models/Entity.php
index 032e2950b..224d15ec0 100644
--- a/server/src/Models/Entity.php
+++ b/server/src/Models/Entity.php
@@ -471,10 +471,11 @@ public static function insertGetUuid($values = [], ?Payload $payload = null)
         if ($result && $payload) {
             // create tracking number for entity
             $trackingNumberId = TrackingNumber::insertGetUuid([
-                'owner_uuid' => $uuid,
-                'owner_type' => Utils::getModelClassName('entity'),
-                'region'     => $payload->getPickupRegion(),
-                'location'   => Utils::parsePointToWkt($payload->getPickupLocation()),
+                'owner_uuid'      => $uuid,
+                'owner_type'      => Utils::getModelClassName('entity'),
+                'owner_public_id' => $values['public_id'],
+                'region'          => $payload->getPickupRegion(),
+                'location'        => Utils::parsePointToWkt($payload->getPickupLocation()),
             ]);
 
             // set tracking number
diff --git a/server/src/Models/TrackingNumber.php b/server/src/Models/TrackingNumber.php
index e5b78defd..68ae9bd15 100644
--- a/server/src/Models/TrackingNumber.php
+++ b/server/src/Models/TrackingNumber.php
@@ -4,6 +4,7 @@
 
 use Fleetbase\Casts\PolymorphicType;
 use Fleetbase\FleetOps\Casts\Point;
+use Fleetbase\FleetOps\Support\TrackingCode;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\LaravelMysqlSpatial\Eloquent\SpatialTrait;
 use Fleetbase\Models\Model;
@@ -16,6 +17,7 @@
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\Str;
+use Milon\Barcode\Facades\DNS1DFacade as DNS1D;
 use Milon\Barcode\Facades\DNS2DFacade as DNS2D;
 
 class TrackingNumber extends Model
@@ -236,6 +238,74 @@ public static function findTrackingOrFail($id)
         throw (new \Illuminate\Database\Eloquent\ModelNotFoundException())->setModel(static::class, $id);
     }
 
+    /**
+     * The record a scanned code points at, within one company: the order, waypoint,
+     * entity or place that owns the tracking number.
+     *
+     * Accepts every format TrackingCode::parse() reads, including the bare owner uuid
+     * printed on labels before codes carried a url, and a bare tracking number or public
+     * id from a barcode or typed by hand. Without a company nothing resolves.
+     */
+    public static function findOwnerByCode(?string $code, ?string $companyUuid): ?\Illuminate\Database\Eloquent\Model
+    {
+        if (empty($companyUuid)) {
+            return null;
+        }
+
+        $parsed = TrackingCode::parse($code);
+
+        if ($parsed['uuid']) {
+            return static::ownerOf(static::firstForCode('owner_uuid', $parsed['uuid'], $companyUuid));
+        }
+
+        $number = $parsed['tracking_number'] ?? $parsed['reference'];
+        if ($number) {
+            $owner = static::ownerOf(static::firstForCode('tracking_number', $number, $companyUuid));
+
+            // A url names its tracking number deliberately, so an unknown one is a miss,
+            // not a cue to fall back to the owner it also names, which must agree.
+            if ($owner || $parsed['tracking_number']) {
+                return $owner && (!$parsed['public_id'] || data_get($owner, 'public_id') === $parsed['public_id']) ? $owner : null;
+            }
+        }
+
+        $publicId = $parsed['public_id'] ?? $parsed['reference'];
+
+        return $publicId ? static::ownerOf(static::firstForOwnerPublicId($publicId, $companyUuid)) : null;
+    }
+
+    protected static function firstForCode(string $column, string $value, string $companyUuid): ?self
+    {
+        return static::where('company_uuid', $companyUuid)->where($column, $value)->first();
+    }
+
+    protected static function firstForOwnerPublicId(string $publicId, string $companyUuid): ?self
+    {
+        // The public id's prefix names the owner's model, so only that table is searched.
+        $prefix     = Str::contains($publicId, '_') ? Str::before($publicId, '_') : null;
+        $ownerClass = [
+            'order'    => Order::class,
+            'waypoint' => Waypoint::class,
+            'entity'   => Entity::class,
+            'place'    => Place::class,
+        ][$prefix] ?? null;
+
+        if (!$ownerClass) {
+            return null;
+        }
+
+        return static::where('company_uuid', $companyUuid)
+            // Rows inserted raw (waypoints, entities) store the class with a leading slash.
+            ->whereIn('owner_type', [$ownerClass, '\\' . $ownerClass])
+            ->whereIn('owner_uuid', $ownerClass::withoutGlobalScopes()->select('uuid')->where('public_id', $publicId))
+            ->first();
+    }
+
+    protected static function ownerOf(?self $trackingNumber): ?\Illuminate\Database\Eloquent\Model
+    {
+        return $trackingNumber?->owner;
+    }
+
     public function updateOwnerStatus(?TrackingStatus $trackingStatus = null)
     {
         $trackingStatus = $trackingStatus ?? $this->load(['status'])->getRelationValue('status');
@@ -254,6 +324,10 @@ public function updateOwnerStatus(?TrackingStatus $trackingStatus = null)
 
     public static function insertGetUuid($values = [], ?Model $owner = null)
     {
+        // Read before the fillable filter below drops it. Callers that insert the owner
+        // with a raw query, and so have no model to pass, hand its public_id over here.
+        $ownerPublicId = $owner ? data_get($owner, 'public_id') : ($values['owner_public_id'] ?? null);
+
         $instance   = new static();
         $fillable   = $instance->getFillable();
         $insertKeys = array_keys($values);
@@ -276,8 +350,7 @@ public static function insertGetUuid($values = [], ?Model $owner = null)
         }
 
         $values['tracking_number'] = static::newTrackingNumber($values['region'] ?? 'SG');
-        $values['qr_code']         = static::newBarcode((string) ($values['owner_uuid'] ?? ''), 'QRCODE');
-        $values['barcode']         = static::newBarcode((string) ($values['owner_uuid'] ?? ''), 'PDF417');
+        $values                    = array_merge($values, static::codeImages($values['tracking_number'], $ownerPublicId));
 
         if (isset($values['meta']) && (is_object($values['meta']) || is_array($values['meta']))) {
             $values['meta'] = json_encode($values['meta']);
@@ -339,8 +412,29 @@ protected static function newTrackingNumber(string $region): string
         return static::generateNumber($region);
     }
 
+    /**
+     * The base64 PNGs printed on a label: a QR code carrying the tracking url (see
+     * TrackingCode) and a Code 128 barcode carrying the bare tracking number.
+     *
+     * @return array{qr_code: string, barcode: string}
+     */
+    public static function codeImages(string $trackingNumber, ?string $ownerPublicId = null): array
+    {
+        return [
+            // Medium error correction: labels get scuffed, and the url fits comfortably.
+            'qr_code' => static::newBarcode(TrackingCode::qrContent($trackingNumber, $ownerPublicId), 'QRCODE,M'),
+            'barcode' => static::newBarcode(TrackingCode::barcodeContent($trackingNumber), 'C128'),
+        ];
+    }
+
     protected static function newBarcode(string $value, string $type): string
     {
+        if ($type === 'C128') {
+            // 2px modules, 60px tall: a typical tracking number renders ~330px wide, inside
+            // the label's 360px cap, so it prints at its own resolution.
+            return DNS1D::getBarcodePNG($value, $type, 2, 60);
+        }
+
         return DNS2D::getBarcodePNG($value, $type);
     }
 
diff --git a/server/src/Models/Waypoint.php b/server/src/Models/Waypoint.php
index 35d611eb4..bfb895df3 100644
--- a/server/src/Models/Waypoint.php
+++ b/server/src/Models/Waypoint.php
@@ -221,10 +221,11 @@ public static function insertGetUuid($values = [], ?Payload $payload = null)
         if ($result && $payload) {
             // create tracking number for entity
             $trackingNumberId = static::createTrackingNumber([
-                'owner_uuid' => $uuid,
-                'owner_type' => Utils::getModelClassName('waypoint'),
-                'region'     => $payload->getPickupRegion(),
-                'location'   => static::pickupLocationWkt($payload),
+                'owner_uuid'      => $uuid,
+                'owner_type'      => Utils::getModelClassName('waypoint'),
+                'owner_public_id' => $values['public_id'],
+                'region'          => $payload->getPickupRegion(),
+                'location'        => static::pickupLocationWkt($payload),
             ]);
 
             // set tracking number
diff --git a/server/src/Observers/TrackingNumberObserver.php b/server/src/Observers/TrackingNumberObserver.php
index c90ec3088..2b249ebee 100644
--- a/server/src/Observers/TrackingNumberObserver.php
+++ b/server/src/Observers/TrackingNumberObserver.php
@@ -6,7 +6,6 @@
 use Fleetbase\FleetOps\Models\TrackingStatus;
 use Fleetbase\LaravelMysqlSpatial\Types\Point;
 use Illuminate\Support\Str;
-use Milon\Barcode\Facades\DNS2DFacade as DNS2D;
 
 class TrackingNumberObserver
 {
@@ -17,10 +16,9 @@ class TrackingNumberObserver
      */
     public function creating(TrackingNumber $trackingNumber)
     {
-        // generate a barcode annd qr code
+        // generate the tracking number, then the qr code and barcode printed from it
         $trackingNumber->tracking_number = $this->generateTrackingNumber($trackingNumber);
-        $trackingNumber->qr_code         = $this->generateBarcode($trackingNumber->owner_uuid, 'QRCODE');
-        $trackingNumber->barcode         = $this->generateBarcode($trackingNumber->owner_uuid, 'PDF417');
+        $trackingNumber->fill($this->generateCodeImages($trackingNumber->tracking_number, $this->ownerPublicId($trackingNumber)));
     }
 
     /**
@@ -47,9 +45,23 @@ protected function generateTrackingNumber(TrackingNumber $trackingNumber): strin
         return TrackingNumber::generateNumber($trackingNumber->region);
     }
 
-    protected function generateBarcode(string $ownerUuid, string $type): string
+    /**
+     * @return array{qr_code: string, barcode: string}
+     */
+    protected function generateCodeImages(string $trackingNumber, ?string $ownerPublicId): array
     {
-        return DNS2D::getBarcodePNG($ownerUuid, $type);
+        return TrackingNumber::codeImages($trackingNumber, $ownerPublicId);
+    }
+
+    protected function ownerPublicId(TrackingNumber $trackingNumber): ?string
+    {
+        if (empty($trackingNumber->owner_uuid)) {
+            return null;
+        }
+
+        $publicId = data_get($trackingNumber, 'owner.public_id');
+
+        return is_string($publicId) && $publicId !== '' ? $publicId : null;
     }
 
     protected function createTrackingStatus(array $attributes): TrackingStatus
diff --git a/server/src/Support/TrackingCode.php b/server/src/Support/TrackingCode.php
new file mode 100644
index 000000000..907a79c9c
--- /dev/null
+++ b/server/src/Support/TrackingCode.php
@@ -0,0 +1,218 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support;
+
+use Illuminate\Support\Str;
+
+/**
+ * The content printed into a tracking number's QR code and barcode, and the parser that
+ * turns any scanned value back into identifiers.
+ *
+ * QR (v1) is a URL, so a phone camera opens the customer tracking page while scanners
+ * and the navigator app read the parameters:
+ *
+ *     https://<console host>/track-order?order=<tracking number>&r=<owner public_id>&v=1
+ *
+ * Only the tracking number (printed on the label in plain text) and the owner's public
+ * id go in: no uuids, no addresses, no names, no company. The owner's type is its
+ * public_id prefix (order_, waypoint_, entity_, place_), so it is not repeated. Nothing
+ * is signed: a label can be photocopied whatever it carries, so authorization belongs
+ * to the endpoint that acts on a scan, not to the code.
+ *
+ * The linear barcode (Code 128) carries the bare tracking number, matching the text
+ * printed beneath it, because warehouse handhelds type what they scan into a field.
+ *
+ * Codes already on parcels encode the owner's bare uuid, and parse() keeps accepting
+ * them, alongside a bare tracking number or a bare public_id.
+ */
+class TrackingCode
+{
+    public const VERSION = 1;
+
+    /**
+     * Where a phone camera lands. The public tracking page is being rebuilt; when its
+     * route changes, change these two and nothing else. parse() never depends on the
+     * host or the path, since printed labels outlive both.
+     */
+    public const PATH           = 'track-order';
+    public const TRACKING_PARAM = 'order';
+
+    /**
+     * The QR content for a tracking number.
+     */
+    public static function qrContent(string $trackingNumber, ?string $ownerPublicId = null): string
+    {
+        $query = [static::TRACKING_PARAM => $trackingNumber];
+
+        if (!empty($ownerPublicId)) {
+            $query['r'] = $ownerPublicId;
+        }
+
+        $query['v'] = static::VERSION;
+
+        return static::consoleBaseUrl() . '/' . static::PATH . '?' . http_build_query($query);
+    }
+
+    /**
+     * The console origin, from the same config Utils::consoleUrl() reads. It does not
+     * call consoleUrl() because that infers http/https from the app environment: a code
+     * printed on a parcel should not change scheme with where it was generated, so it
+     * is https unless the console is explicitly configured otherwise.
+     */
+    protected static function consoleBaseUrl(): string
+    {
+        $host = rtrim((string) config('fleetbase.console.host', ''), '/');
+
+        if (Str::startsWith($host, 'http')) {
+            return $host;
+        }
+
+        $subdomain = config('fleetbase.console.subdomain');
+        $scheme    = config('fleetbase.console.secure', true) ? 'https://' : 'http://';
+
+        return $scheme . ($subdomain ? $subdomain . '.' : '') . $host;
+    }
+
+    /**
+     * The linear barcode content for a tracking number.
+     */
+    public static function barcodeContent(string $trackingNumber): string
+    {
+        return $trackingNumber;
+    }
+
+    /**
+     * Break a scanned value into the identifiers it carries.
+     *
+     * - `uuid`: a legacy code, the owner's uuid.
+     * - `tracking_number` and `public_id`: from a URL code.
+     * - `reference`: a bare value that is either a tracking number (the barcode, or one
+     *   typed by hand) or a public_id. Consumers try both.
+     *
+     * @return array{uuid: ?string, tracking_number: ?string, public_id: ?string, reference: ?string, version: ?int}
+     */
+    public static function parse(?string $code): array
+    {
+        $parsed = [
+            'uuid'            => null,
+            'tracking_number' => null,
+            'public_id'       => null,
+            'reference'       => null,
+            'version'         => null,
+        ];
+
+        $code = trim((string) $code);
+        if ($code === '') {
+            return $parsed;
+        }
+
+        if (preg_match('#^https?://#i', $code)) {
+            return array_merge($parsed, static::parseUrl($code));
+        }
+
+        if (Str::isUuid($code)) {
+            $parsed['uuid'] = $code;
+
+            return $parsed;
+        }
+
+        $parsed['reference'] = $code;
+
+        return $parsed;
+    }
+
+    /**
+     * Whether a scanned value identifies the given subject (an order, waypoint, entity or
+     * place).
+     */
+    public static function matches(?string $code, $subject): bool
+    {
+        $subjectUuid = data_get($subject, 'uuid');
+        if (!$subject || empty($subjectUuid)) {
+            return false;
+        }
+
+        // Labels printed before v1 encode the subject's bare uuid; compare it exactly, as
+        // scans always have been.
+        if (trim((string) $code) === $subjectUuid) {
+            return true;
+        }
+
+        $parsed = static::parse($code);
+
+        if ($parsed['uuid']) {
+            return false;
+        }
+
+        $publicId       = data_get($subject, 'public_id');
+        $trackingNumber = static::subjectTrackingNumber($subject);
+
+        if ($parsed['reference']) {
+            return static::sameTrackingNumber($parsed['reference'], $trackingNumber) || static::samePublicId($parsed['reference'], $publicId);
+        }
+
+        // A url code names its owner by public id, and that decides: an owner can hold more
+        // than one tracking number (the API issues extra ones), so the number is compared
+        // only when the code names no owner.
+        if ($parsed['public_id']) {
+            return static::samePublicId($parsed['public_id'], $publicId);
+        }
+
+        return $parsed['tracking_number'] !== null && static::sameTrackingNumber($parsed['tracking_number'], $trackingNumber);
+    }
+
+    /**
+     * @return array{tracking_number: ?string, public_id: ?string, version: ?int}
+     */
+    protected static function parseUrl(string $url): array
+    {
+        $parts = parse_url($url);
+        $query = [];
+        parse_str(is_array($parts) ? ($parts['query'] ?? '') : '', $query);
+
+        $trackingNumber = static::stringParam($query, static::TRACKING_PARAM) ?? static::stringParam($query, 'tn');
+
+        // A future route may carry the tracking number in the path (/track/<number>). Only
+        // a path of two or more segments can, so /track-order itself is never mistaken
+        // for one.
+        if ($trackingNumber === null && is_array($parts) && isset($parts['path'])) {
+            $segments = array_values(array_filter(explode('/', $parts['path']), fn ($segment) => $segment !== ''));
+            if (count($segments) >= 2) {
+                $trackingNumber = rawurldecode(end($segments));
+            }
+        }
+
+        $version = static::stringParam($query, 'v');
+
+        return [
+            'tracking_number' => $trackingNumber,
+            'public_id'       => static::stringParam($query, 'r'),
+            'version'         => $version !== null && ctype_digit($version) ? (int) $version : null,
+        ];
+    }
+
+    protected static function stringParam(array $query, string $key): ?string
+    {
+        $value = $query[$key] ?? null;
+
+        return is_string($value) && trim($value) !== '' ? trim($value) : null;
+    }
+
+    protected static function subjectTrackingNumber($subject): ?string
+    {
+        $trackingNumber = data_get($subject, 'trackingNumber.tracking_number') ?? data_get($subject, 'tracking_number');
+
+        return is_string($trackingNumber) && $trackingNumber !== '' ? $trackingNumber : null;
+    }
+
+    protected static function sameTrackingNumber(string $scanned, ?string $trackingNumber): bool
+    {
+        // The label prints the number upper-cased and handhelds may not preserve case.
+        return $trackingNumber !== null && strcasecmp($scanned, $trackingNumber) === 0;
+    }
+
+    protected static function samePublicId(string $scanned, $publicId): bool
+    {
+        return is_string($publicId) && $publicId !== '' && $scanned === $publicId;
+    }
+}

From ccec8c9593e364ad64910bc2ad3ba48f1208bbb0 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 14:40:05 +0800
Subject: [PATCH 06/87] test(tracking): cover tracking-url codes, Code 128
 barcodes and the scan resolver

- TrackingCode: generation, parsing of every format in circulation (legacy uuid,
  tracking url from any host, bare tracking number or public id, hostile urls),
  and subject matching for capture-qr
- TrackingNumber::findOwnerByCode against SQLite: company scoping, disagreeing
  url identifiers, unknown numbers and unmapped prefixes
- insert path, observer and resource expectations moved off the owner uuid
---
 .../tests/ApiOrderControllerContractsTest.php |  40 ++++++
 ...iTrackingNumberControllerContractsTest.php |  15 +-
 .../CompactResourceSerializationTest.php      |  80 +++--------
 .../TrackingNumberControllerHelpersTest.php   |  79 ++++++++---
 server/tests/ObserverContractsTest.php        |  72 +++++++++-
 .../tests/Unit/Models/TrackingNumberTest.php  |  73 +++++++++-
 server/tests/Unit/Models/WaypointTest.php     |   7 +-
 .../tests/Unit/Support/TrackingCodeTest.php   | 132 ++++++++++++++++++
 8 files changed, 392 insertions(+), 106 deletions(-)
 create mode 100644 server/tests/Unit/Support/TrackingCodeTest.php

diff --git a/server/tests/ApiOrderControllerContractsTest.php b/server/tests/ApiOrderControllerContractsTest.php
index cd5c8a4ff..f25dd6d80 100644
--- a/server/tests/ApiOrderControllerContractsTest.php
+++ b/server/tests/ApiOrderControllerContractsTest.php
@@ -1028,3 +1028,43 @@ public function isString(string $key): bool
         'status'   => 400,
     ]);
 });
+
+test('api order controller captures QR proof from tracking url codes and barcodes', function () {
+    session(['company' => 'company-uuid']);
+
+    $subject = (object) [
+        'uuid'           => 'subject-uuid',
+        'public_id'      => 'waypoint_subject',
+        'trackingNumber' => (object) ['tracking_number' => 'ACM1234567890SG'],
+    ];
+
+    // The url printed by current labels, from any host, and the Code 128 barcode.
+    foreach ([
+        'https://console.fleetbase.test/track-order?order=ACM1234567890SG&r=waypoint_subject&v=1',
+        'https://old-host.example/track-order?order=ACM1234567890SG&r=waypoint_subject&v=1',
+        'ACM1234567890SG',
+    ] as $code) {
+        $controller                  = new FleetOpsApiOrderCrudControllerProbe();
+        $controller->order           = new FleetOpsApiOrderCrudFake();
+        $controller->resolvedSubject = $subject;
+
+        expect($controller->captureQrScan(new Request(['code' => $code]), 'order-public', 'waypoint_subject')['resource'])->toBe('proof')
+            ->and($controller->createdProofs[0]['subject_uuid'])->toBe('subject-uuid');
+    }
+
+    // Another parcel's label is refused, whether it names another owner or, naming none,
+    // another tracking number.
+    foreach ([
+        'https://console.fleetbase.test/track-order?order=ACM1234567890SG&r=waypoint_other&v=1',
+        'https://console.fleetbase.test/track-order?order=ACM0000000000SG&v=1',
+    ] as $code) {
+        $controller                  = new FleetOpsApiOrderCrudControllerProbe();
+        $controller->order           = new FleetOpsApiOrderCrudFake();
+        $controller->resolvedSubject = $subject;
+
+        expect($controller->captureQrScan(new Request(['code' => $code]), 'order-public', 'waypoint_subject'))->toBe([
+            'apiError' => 'Unable to validate QR code data.',
+            'status'   => 400,
+        ])->and($controller->createdProofs)->toBe([]);
+    }
+});
diff --git a/server/tests/ApiTrackingNumberControllerContractsTest.php b/server/tests/ApiTrackingNumberControllerContractsTest.php
index 17a21e1a3..83b3e66bc 100644
--- a/server/tests/ApiTrackingNumberControllerContractsTest.php
+++ b/server/tests/ApiTrackingNumberControllerContractsTest.php
@@ -68,9 +68,9 @@ protected function deletedTrackingNumberResource(TrackingNumber $trackingNumber)
         return ['resource' => 'deleted-tracking-number', 'trackingNumber' => $trackingNumber];
     }
 
-    protected function findQrModel(array $tables, array $where)
+    protected function findQrModel(string $code)
     {
-        $this->qrLookups[] = [$tables, $where];
+        $this->qrLookups[] = $code;
 
         return $this->qrModel;
     }
@@ -206,15 +206,12 @@ function fleetopsDecodeTrackingNumberQrRequest(array $input): DecodeTrackingNumb
     $controller          = new FleetOpsApiTrackingNumberControllerProbe();
     $controller->qrModel = $model;
 
-    $response = $controller->fromQR(fleetopsDecodeTrackingNumberQrRequest(['code' => 'order-uuid']));
+    $code     = 'https://console.fleetbase.test/track-order?order=ACM1234567890SG&r=order_public&v=1';
+    $response = $controller->fromQR(fleetopsDecodeTrackingNumberQrRequest(['code' => $code]));
 
+    // The raw scanned value goes to the resolver, which understands every format.
     expect($response)->toBe(['resource' => 'qr-model', 'model' => $model])
-        ->and($controller->qrLookups)->toBe([
-            [
-                ['entities', 'orders'],
-                ['uuid' => 'order-uuid'],
-            ],
-        ]);
+        ->and($controller->qrLookups)->toBe([$code]);
 
     $controller = new FleetOpsApiTrackingNumberControllerProbe();
 
diff --git a/server/tests/CompactResourceSerializationTest.php b/server/tests/CompactResourceSerializationTest.php
index 2f628407d..fb1f87925 100644
--- a/server/tests/CompactResourceSerializationTest.php
+++ b/server/tests/CompactResourceSerializationTest.php
@@ -2739,8 +2739,8 @@ function fleetopsCompactResourceFixture(array $attributes = [], array $loaded =
         'scheduled_at'       => '2026-07-30 09:00:00',
     ]);
 
-    // The decoded QR content is a debug-only field and must never ride along on a webhook,
-    // which is a separate literal payload rather than a filtered toArray().
+    // The webhook is a separate literal payload rather than a filtered toArray(), and its
+    // shape is unchanged: the QR content is not added to it.
     expect(array_key_exists('qr_code_content', (new TrackingNumberResource($trackingNumber))->toWebhookPayload()))->toBeFalse();
 
     expect((new TrackingNumberResource($trackingNumber))->toWebhookPayload())->toMatchArray([
@@ -2790,14 +2790,15 @@ function fleetopsCompactResourceFixture(array $attributes = [], array $loaded =
         ]);
 });
 
-test('tracking number resource publishes the qr code content only in debug mode', function () {
-    // qr_code is a base64 PNG generated from owner_uuid, and the endpoints that consume a
-    // scanned code match on that uuid. Debug builds publish the value beside the image so
-    // an automated client can follow the flow without decoding a PNG; production must not.
+test('tracking number resource publishes a scannable qr code content beside the image', function () {
+    // qr_code is a base64 PNG; qr_code_content is the text current labels encode in it,
+    // a tracking url naming the tracking number and the subject's public id. Both are in
+    // the resource already, so it is published in every environment.
     $trackingNumber = fleetopsCompactResourceFixture([
-        'tracking_number'  => 'TN-DEBUG',
-        'owner_uuid'       => 'owner-uuid-under-the-qr',
+        'tracking_number'  => 'TN-SCAN',
+        'owner_uuid'       => 'owner-uuid-never-published',
         'owner_type'       => 'Fleetbase\\FleetOps\\Models\\Order',
+        'owner'            => (object) ['public_id' => 'order_public'],
         'region'           => 'sg',
         'qr_code'          => 'qr-data',
         'barcode'          => 'barcode-data',
@@ -2811,70 +2812,31 @@ function fleetopsCompactResourceFixture(array $attributes = [], array $loaded =
     // cover the index resource and the webhook payload.
     $previousContainer = Illuminate\Container\Container::getInstance();
     $container         = new class extends Illuminate\Container\Container {
-        public bool $debugMode = false;
-
         public function environment(...$environments)
         {
             return in_array('testing', $environments, true) || $environments === [] ? 'testing' : false;
         }
-
-        // Stands in for the framework's Application::hasDebugModeEnabled().
-        public function hasDebugModeEnabled()
-        {
-            return $this->debugMode;
-        }
     };
     $container->instance('config', new Illuminate\Config\Repository([
         'fleetbase' => ['console' => ['host' => 'console.fleetbase.test', 'subdomain' => null, 'secure' => true]],
     ]));
     Illuminate\Container\Container::setInstance($container);
 
-    // Drive the REAL accessor through the container rather than overriding it, so the
-    // debug check itself is exercised and not just the resource's use of it.
-    $container->debugMode = true;
-    $withDebug            = new TrackingNumberResource($trackingNumber);
-
     try {
-        $debugPayload = $withDebug->resolve($request);
-
-        $container->debugMode = false;
-        $productionPayload    = (new TrackingNumberResource($trackingNumber))->resolve($request);
+        $payload       = (new TrackingNumberResource($trackingNumber))->resolve($request);
+        $withoutNumber = (new TrackingNumberResource(fleetopsCompactResourceFixture([
+            'tracking_number' => null,
+            'owner_type'      => 'Fleetbase\\FleetOps\\Models\\Order',
+            'owner'           => null,
+        ])))->resolve($request);
     } finally {
         Illuminate\Container\Container::setInstance($previousContainer);
     }
 
-    // Present and exactly the value the QR was generated from — not a public id.
-    expect($debugPayload['qr_code_content'])->toBe('owner-uuid-under-the-qr')
-        ->and($debugPayload['qr_code'])->toBe('qr-data')
-        // Absent, not null: `when()` drops the key entirely, so a production response is
-        // byte-identical to one from before the field existed.
-        ->and(array_key_exists('qr_code_content', $productionPayload))->toBeFalse()
-        ->and($productionPayload['qr_code'])->toBe('qr-data');
-});
-
-test('tracking number resource fails closed when the debug state cannot be determined', function () {
-    // Any failure to resolve the debug state must answer false rather than defaulting to
-    // exposure. The real accessor is exercised here with no usable application bound.
-    $expose = new ReflectionMethod(TrackingNumberResource::class, 'exposesQrCodeContent');
-    $expose->setAccessible(true);
-
-    $previous = Illuminate\Container\Container::getInstance();
-
-    try {
-        // A container that is not an Application has no hasDebugModeEnabled().
-        Illuminate\Container\Container::setInstance(new Illuminate\Container\Container());
-        expect($expose->invoke(null))->toBeFalse();
-
-        // And an accessor that throws must also answer false rather than propagating —
-        // a resource must not be able to fail serialization over a debug check.
-        Illuminate\Container\Container::setInstance(new class extends Illuminate\Container\Container {
-            public function hasDebugModeEnabled()
-            {
-                throw new RuntimeException('debug state unavailable');
-            }
-        });
-        expect($expose->invoke(null))->toBeFalse();
-    } finally {
-        Illuminate\Container\Container::setInstance($previous);
-    }
+    expect($payload['qr_code_content'])->toBe('https://console.fleetbase.test/track-order?order=TN-SCAN&r=order_public&v=1')
+        ->and($payload['qr_code_content'])->not->toContain('owner-uuid')
+        ->and($payload['url'])->toBe('https://console.fleetbase.test/track-order?order=TN-SCAN')
+        ->and($payload['qr_code'])->toBe('qr-data')
+        // Nothing to scan without a tracking number: the key is absent, not null.
+        ->and(array_key_exists('qr_code_content', $withoutNumber))->toBeFalse();
 });
diff --git a/server/tests/Feature/Http/Api/TrackingNumberControllerHelpersTest.php b/server/tests/Feature/Http/Api/TrackingNumberControllerHelpersTest.php
index 80baaba8a..7b94621e9 100644
--- a/server/tests/Feature/Http/Api/TrackingNumberControllerHelpersTest.php
+++ b/server/tests/Feature/Http/Api/TrackingNumberControllerHelpersTest.php
@@ -133,28 +133,63 @@ public function __call($method, $arguments)
         ->and($helper('deletedTrackingNumberResource', $found))->toBeInstanceOf(Fleetbase\FleetOps\Http\Resources\v1\DeletedResource::class)
         ->and($helper('jsonResponse', ['ok' => true], 200))->toBeInstanceOf(Illuminate\Http\JsonResponse::class);
 
-    // Qr model resolution finds models and wraps them in fleet-ops v1 resources
-    $qrModel = $helper('findQrModel', ['entities'], ['public_id' => 'entity_tnhelper1']);
-    expect($qrModel)->not->toBeNull()
-        ->and($helper('qrModelResource', $qrModel))->toBeInstanceOf(Fleetbase\FleetOps\Http\Resources\v1\Entity::class);
-
-    // A table with no eloquent mapping resolves to null rather than a raw row.
-    //
-    // The raw-row fallback was removed: it passed the ARRAY of table names to
-    // DB::table(), which stringified it to the literal table "Array" and threw
-    // SQLSTATE[42S02], so every unresolvable QR code answered 500 instead of the 400 the
-    // caller already handles. It could not have helped either way — qrModelResource()
-    // serializes through a typed resource keyed on the model class, and a raw stdClass
-    // row has none.
-    $connection->table('tracking_statuses')->insert([
-        'uuid'      => '44444444-4444-4444-8444-444444444403',
-        'public_id' => 'tracking_status_tnhelper1',
-        'code'      => 'DISPATCHED',
-        'status'    => 'Dispatched',
+    // Qr model resolution goes through the shared resolver and wraps the owner in its
+    // fleet-ops v1 resource.
+    $connection->table('tracking_numbers')->insert([
+        'uuid'            => '44444444-4444-4444-8444-444444444404',
+        'public_id'       => 'track_tnhelper2',
+        'company_uuid'    => 'company-1',
+        'tracking_number' => 'FLB-HELPER-2',
+        'owner_uuid'      => '44444444-4444-4444-8444-444444444402',
+        'owner_type'      => Fleetbase\FleetOps\Models\Entity::class,
+    ]);
+
+    $qrModel = $helper('findQrModel', 'https://console.fleetbase.test/track-order?order=FLB-HELPER-2&r=entity_tnhelper1&v=1');
+    expect($qrModel)->toBeInstanceOf(Fleetbase\FleetOps\Models\Entity::class)
+        ->and($helper('qrModelResource', $qrModel))->toBeInstanceOf(Fleetbase\FleetOps\Http\Resources\v1\Entity::class)
+        ->and($helper('findQrModel', '{{qr_code}}'))->toBeNull();
+});
+
+test('tracking number owners resolve from every code format within the company', function () {
+    $connection = fleetopsTrackingNumberHelpersBoot();
+    $connection->table('orders')->insert(['uuid' => '55555555-5555-4555-8555-555555555501', 'public_id' => 'order_codes1', 'company_uuid' => 'company-1', 'status' => 'created']);
+    $connection->table('entities')->insert(['uuid' => '55555555-5555-4555-8555-555555555502', 'public_id' => 'entity_codes1', 'company_uuid' => 'company-1', 'name' => 'Parcel']);
+    $connection->table('orders')->insert(['uuid' => '55555555-5555-4555-8555-555555555503', 'public_id' => 'order_codes2', 'company_uuid' => 'company-2', 'status' => 'created']);
+    $connection->table('tracking_numbers')->insert([
+        ['uuid' => 'tn-codes-1', 'public_id' => 'track_codes1', 'company_uuid' => 'company-1', 'tracking_number' => 'ACM1111111111SG', 'owner_uuid' => '55555555-5555-4555-8555-555555555501', 'owner_type' => Fleetbase\FleetOps\Models\Order::class],
+        // Entity::insertGetUuid() inserts raw, storing the owner class with a leading slash.
+        ['uuid' => 'tn-codes-2', 'public_id' => 'track_codes2', 'company_uuid' => 'company-1', 'tracking_number' => 'ACM2222222222SG', 'owner_uuid' => '55555555-5555-4555-8555-555555555502', 'owner_type' => '\\' . Fleetbase\FleetOps\Models\Entity::class],
+        ['uuid' => 'tn-codes-3', 'public_id' => 'track_codes3', 'company_uuid' => 'company-2', 'tracking_number' => 'OTH3333333333SG', 'owner_uuid' => '55555555-5555-4555-8555-555555555503', 'owner_type' => Fleetbase\FleetOps\Models\Order::class],
     ]);
 
-    expect($helper('findQrModel', ['tracking_statuses'], ['public_id' => 'tracking_status_tnhelper1']))->toBeNull()
-        // And a mapped table that simply matches nothing is also null, which is the path
-        // an unknown or unresolved code takes.
-        ->and($helper('findQrModel', ['entities', 'orders'], ['uuid' => '{{qr_code}}']))->toBeNull();
+    $owner = fn (?string $code, ?string $company = 'company-1') => TrackingNumber::findOwnerByCode($code, $company)?->public_id;
+
+    // Labels in circulation carry the owner's bare uuid.
+    expect($owner('55555555-5555-4555-8555-555555555501'))->toBe('order_codes1')
+        // Current labels carry a tracking url; the host is irrelevant.
+        ->and($owner('https://console.fleetbase.test/track-order?order=ACM1111111111SG&r=order_codes1&v=1'))->toBe('order_codes1')
+        ->and($owner('https://old-host.example/track-order?order=ACM2222222222SG&v=1'))->toBe('entity_codes1')
+        // The Code 128 barcode, or a value typed by hand: a tracking number or public id.
+        ->and($owner('ACM2222222222SG'))->toBe('entity_codes1')
+        ->and($owner('entity_codes1'))->toBe('entity_codes1')
+        ->and($owner('https://console.fleetbase.test/track-order?r=order_codes1'))->toBe('order_codes1');
+
+    // A url whose two identifiers disagree, or that names an unknown tracking number, is
+    // refused rather than resolved through the half that matches.
+    expect($owner('https://console.fleetbase.test/track-order?order=ACM1111111111SG&r=entity_codes1&v=1'))->toBeNull()
+        ->and($owner('https://console.fleetbase.test/track-order?order=ACM9999999999SG&r=order_codes1&v=1'))->toBeNull()
+        // Unknown values, unmapped prefixes, and values that are no public id at all.
+        ->and($owner('55555555-5555-4555-8555-555555555599'))->toBeNull()
+        ->and($owner('ACM9999999999SG'))->toBeNull()
+        ->and($owner('vehicle_codes1'))->toBeNull()
+        ->and($owner('order_missing'))->toBeNull()
+        ->and($owner(''))->toBeNull();
+
+    // Another company's parcel never resolves, in any format, and without a company
+    // nothing does.
+    expect($owner('55555555-5555-4555-8555-555555555503'))->toBeNull()
+        ->and($owner('OTH3333333333SG'))->toBeNull()
+        ->and($owner('order_codes2'))->toBeNull()
+        ->and($owner('order_codes2', 'company-2'))->toBe('order_codes2')
+        ->and($owner('55555555-5555-4555-8555-555555555501', null))->toBeNull();
 });
diff --git a/server/tests/ObserverContractsTest.php b/server/tests/ObserverContractsTest.php
index 0a15bf65c..b3f7e8f5b 100644
--- a/server/tests/ObserverContractsTest.php
+++ b/server/tests/ObserverContractsTest.php
@@ -397,11 +397,16 @@ protected function generateTrackingNumber(TrackingNumber $trackingNumber): strin
         return 'TN-' . $trackingNumber->region;
     }
 
-    protected function generateBarcode(string $ownerUuid, string $type): string
+    protected function generateCodeImages(string $trackingNumber, ?string $ownerPublicId): array
     {
-        $this->barcodes[] = [$ownerUuid, $type];
+        $this->barcodes[] = [$trackingNumber, $ownerPublicId];
 
-        return $type . '-png';
+        return ['qr_code' => 'qr-png', 'barcode' => 'barcode-png'];
+    }
+
+    protected function ownerPublicId(TrackingNumber $trackingNumber): ?string
+    {
+        return $trackingNumber->owner_uuid ? 'order_public' : null;
     }
 
     protected function createTrackingStatus(array $attributes): TrackingStatus
@@ -1292,11 +1297,12 @@ protected function resolveOrder(PurchaseRate $purchaseRate): ?Order
     $observer->created($trackingNumber);
 
     expect($trackingNumber->tracking_number)->toBe('TN-sg')
-        ->and($trackingNumber->qr_code)->toBe('QRCODE-png')
-        ->and($trackingNumber->barcode)->toBe('PDF417-png')
+        ->and($trackingNumber->qr_code)->toBe('qr-png')
+        ->and($trackingNumber->barcode)->toBe('barcode-png')
+        // Codes are generated from the new tracking number and the owner's public id,
+        // never from the owner's uuid.
         ->and($observer->barcodes)->toBe([
-            ['owner-uuid', 'QRCODE'],
-            ['owner-uuid', 'PDF417'],
+            ['TN-sg', 'order_public'],
         ])
         ->and($observer->statuses[0])->toMatchArray([
             'company_uuid'         => 'company-uuid',
@@ -1309,6 +1315,58 @@ protected function resolveOrder(PurchaseRate $purchaseRate): ?Order
         ->and($trackingNumber->ownerStatuses)->toHaveCount(1);
 });
 
+test('tracking number observer reads the owner public id and renders codes through the model', function () {
+    $observer = new TrackingNumberObserver();
+    $owner    = new ReflectionMethod($observer, 'ownerPublicId');
+    $images   = new ReflectionMethod($observer, 'generateCodeImages');
+    $owner->setAccessible(true);
+    $images->setAccessible(true);
+
+    // No owner: nothing to look up.
+    expect($owner->invoke($observer, new TrackingNumber()))->toBeNull();
+
+    $order = new Order();
+    $order->setRawAttributes(['uuid' => 'owner-uuid', 'public_id' => 'order_public'], true);
+    $trackingNumber = new TrackingNumber();
+    $trackingNumber->setRawAttributes(['owner_uuid' => 'owner-uuid', 'owner_type' => Order::class], true);
+    $trackingNumber->setRelation('owner', $order);
+
+    expect($owner->invoke($observer, $trackingNumber))->toBe('order_public');
+
+    // An owner without a public id yields none rather than an empty `r` parameter.
+    $order->setRawAttributes(['uuid' => 'owner-uuid', 'public_id' => ''], true);
+    expect($owner->invoke($observer, $trackingNumber))->toBeNull();
+
+    $previousConsole = config('fleetbase.console');
+    config(['fleetbase.console' => ['host' => 'console.fleetbase.test', 'secure' => true]]);
+    foreach (['DNS2D', 'DNS1D'] as $facade) {
+        app()->instance($facade, new class($facade) {
+            public function __construct(private string $facade)
+            {
+            }
+
+            public function getBarcodePNG($code, $type, ...$size)
+            {
+                return $this->facade . ':' . $type . ':' . $code;
+            }
+        });
+        Illuminate\Support\Facades\Facade::clearResolvedInstance($facade);
+    }
+
+    try {
+        expect($images->invoke($observer, 'TN-sg', 'order_public'))->toBe([
+            'qr_code' => 'DNS2D:QRCODE,M:https://console.fleetbase.test/track-order?order=TN-sg&r=order_public&v=1',
+            'barcode' => 'DNS1D:C128:TN-sg',
+        ]);
+    } finally {
+        config(['fleetbase.console' => $previousConsole]);
+        foreach (['DNS2D', 'DNS1D'] as $facade) {
+            app()->forgetInstance($facade);
+            Illuminate\Support\Facades\Facade::clearResolvedInstance($facade);
+        }
+    }
+});
+
 test('zone observer invalidates service area cache for lifecycle events and original service area', function () {
     $zone = new Zone();
     $zone->setRawAttributes([
diff --git a/server/tests/Unit/Models/TrackingNumberTest.php b/server/tests/Unit/Models/TrackingNumberTest.php
index 6bef10f36..3587e69ef 100644
--- a/server/tests/Unit/Models/TrackingNumberTest.php
+++ b/server/tests/Unit/Models/TrackingNumberTest.php
@@ -84,13 +84,21 @@ protected static function ownerHasStatusColumn(Fleetbase\Models\Model $owner): b
 
 beforeEach(function () {
     FleetOpsTrackingNumberInsertFake::resetInsertFake();
+
+    $this->previousConsoleConfig = config('fleetbase.console');
+    config(['fleetbase.console' => ['host' => 'console.fleetbase.test', 'subdomain' => null, 'secure' => true]]);
+});
+
+afterEach(function () {
+    config(['fleetbase.console' => $this->previousConsoleConfig]);
 });
 
 test('tracking number insert filters values and creates initial owner status', function () {
     $owner = new Order();
     $owner->setRawAttributes([
-        'uuid'   => 'order-uuid',
-        'status' => 'pending',
+        'uuid'      => 'order-uuid',
+        'public_id' => 'order_public',
+        'status'    => 'pending',
     ], true);
 
     $uuid = FleetOpsTrackingNumberInsertFake::insertGetUuid([
@@ -114,8 +122,10 @@ protected static function ownerHasStatusColumn(Fleetbase\Models\Model $owner): b
         'owner_uuid'      => 'order-uuid',
         'owner_type'      => Utils::getMutationType($owner),
         'tracking_number' => 'TRACK-AE',
-        'qr_code'         => 'QRCODE:order-uuid',
-        'barcode'         => 'PDF417:order-uuid',
+        // The QR carries the tracking url naming the owner by public id, never its uuid;
+        // the barcode carries the bare tracking number printed beneath it.
+        'qr_code'         => 'QRCODE,M:https://console.fleetbase.test/track-order?order=TRACK-AE&r=order_public&v=1',
+        'barcode'         => 'C128:TRACK-AE',
         'meta'            => '{"source":"api"}',
     ])->and($inserted)->not->toHaveKey('not_allowed');
 
@@ -147,8 +157,8 @@ protected static function ownerHasStatusColumn(Fleetbase\Models\Model $owner): b
         ->and(FleetOpsTrackingNumberInsertFake::$insertedValues[0])->toMatchArray([
             'uuid'            => 'tracking-uuid',
             'tracking_number' => 'TRACK-SG',
-            'qr_code'         => 'QRCODE:',
-            'barcode'         => 'PDF417:',
+            'qr_code'         => 'QRCODE,M:https://console.fleetbase.test/track-order?order=TRACK-SG&v=1',
+            'barcode'         => 'C128:TRACK-SG',
         ])
         ->and(FleetOpsTrackingNumberInsertFake::$createdStatuses)->toBe([])
         ->and(FleetOpsTrackingNumberInsertFake::$statusUpdates)->toBe([])
@@ -197,3 +207,54 @@ public function __call($method, $arguments)
         ->and(TrackingNumber::findTrackingOrFail('track_findone1')->uuid)->toBe('tn-find-1')
         ->and(fn () => TrackingNumber::findTrackingOrFail('missing-number'))->toThrow(Illuminate\Database\Eloquent\ModelNotFoundException::class);
 });
+
+test('tracking number insert takes the owner public id from callers without an owner model', function () {
+    // Waypoints and entities insert their owner with a raw query and pass only ids.
+    FleetOpsTrackingNumberInsertFake::insertGetUuid([
+        'owner_uuid'      => 'waypoint-uuid',
+        'owner_type'      => 'Fleetbase\\FleetOps\\Models\\Waypoint',
+        'owner_public_id' => 'waypoint_public',
+        'region'          => 'SG',
+    ]);
+
+    $inserted = FleetOpsTrackingNumberInsertFake::$insertedValues[0];
+
+    expect($inserted['qr_code'])->toBe('QRCODE,M:https://console.fleetbase.test/track-order?order=TRACK-SG&r=waypoint_public&v=1')
+        // A helper key, not a column: the fillable filter keeps it out of the insert.
+        ->and($inserted)->not->toHaveKey('owner_public_id')
+        ->and($inserted['owner_uuid'])->toBe('waypoint-uuid');
+});
+
+test('tracking number code images render a medium-correction QR and a Code 128 barcode', function () {
+    $calls = new ArrayObject();
+    foreach (['DNS2D', 'DNS1D'] as $facade) {
+        app()->instance($facade, new class($facade, $calls) {
+            public function __construct(private string $facade, private ArrayObject $calls)
+            {
+            }
+
+            public function getBarcodePNG(...$arguments)
+            {
+                $this->calls[] = array_merge([$this->facade], $arguments);
+
+                return $this->facade . '-png';
+            }
+        });
+        Illuminate\Support\Facades\Facade::clearResolvedInstance($facade);
+    }
+
+    try {
+        expect(TrackingNumber::codeImages('ACM1234567890SG', 'entity_public'))->toBe([
+            'qr_code' => 'DNS2D-png',
+            'barcode' => 'DNS1D-png',
+        ])->and($calls->getArrayCopy())->toBe([
+            ['DNS2D', 'https://console.fleetbase.test/track-order?order=ACM1234567890SG&r=entity_public&v=1', 'QRCODE,M'],
+            ['DNS1D', 'ACM1234567890SG', 'C128', 2, 60],
+        ]);
+    } finally {
+        foreach (['DNS2D', 'DNS1D'] as $facade) {
+            app()->forgetInstance($facade);
+            Illuminate\Support\Facades\Facade::clearResolvedInstance($facade);
+        }
+    }
+});
diff --git a/server/tests/Unit/Models/WaypointTest.php b/server/tests/Unit/Models/WaypointTest.php
index 0ee6722db..ec97ac515 100644
--- a/server/tests/Unit/Models/WaypointTest.php
+++ b/server/tests/Unit/Models/WaypointTest.php
@@ -218,9 +218,10 @@ public static function with($relations)
     ])->and($inserted)->not->toHaveKey('not_allowed')
         ->and(FleetOpsWaypointInsertFake::$createdTracking)->toHaveCount(1)
         ->and(FleetOpsWaypointInsertFake::$createdTracking[0])->toMatchArray([
-            'owner_uuid' => 'waypoint-uuid',
-            'owner_type' => Utils::getModelClassName('waypoint'),
-            'region'     => 'AE',
+            'owner_uuid'      => 'waypoint-uuid',
+            'owner_type'      => Utils::getModelClassName('waypoint'),
+            'owner_public_id' => FleetOpsWaypointInsertFake::$insertedValues[0]['public_id'],
+            'region'          => 'AE',
         ])
         ->and(FleetOpsWaypointInsertFake::$createdTracking[0]['location'])->toBe('POINT(55.2708 25.2048)')
         ->and(FleetOpsWaypointInsertFake::$trackingNumberWrites)->toBe([
diff --git a/server/tests/Unit/Support/TrackingCodeTest.php b/server/tests/Unit/Support/TrackingCodeTest.php
new file mode 100644
index 000000000..a62f65586
--- /dev/null
+++ b/server/tests/Unit/Support/TrackingCodeTest.php
@@ -0,0 +1,132 @@
+<?php
+
+use Fleetbase\FleetOps\Support\TrackingCode;
+
+beforeEach(function () {
+    $this->previousConsoleConfig = config('fleetbase.console');
+    config(['fleetbase.console' => ['host' => 'console.fleetbase.test', 'subdomain' => null, 'secure' => true]]);
+});
+
+afterEach(function () {
+    config(['fleetbase.console' => $this->previousConsoleConfig]);
+});
+
+test('qr content is a versioned tracking url naming the owner by public id', function () {
+    expect(TrackingCode::qrContent('ACM1234567890SG', 'order_a1b2c3d'))
+        ->toBe('https://console.fleetbase.test/track-order?order=ACM1234567890SG&r=order_a1b2c3d&v=1')
+        // No owner: the tracking number alone still resolves.
+        ->and(TrackingCode::qrContent('ACM1234567890SG'))
+        ->toBe('https://console.fleetbase.test/track-order?order=ACM1234567890SG&v=1')
+        // Tracking numbers start with the company name, which may hold spaces.
+        ->and(TrackingCode::qrContent('A B1234567890SG', ''))
+        ->toBe('https://console.fleetbase.test/track-order?order=A+B1234567890SG&v=1');
+});
+
+test('qr content follows the configured console origin but never the app environment', function () {
+    config(['fleetbase.console' => ['host' => 'fleetbase.test', 'subdomain' => 'console', 'secure' => false]]);
+    expect(TrackingCode::qrContent('TN1', 'order_x'))->toBe('http://console.fleetbase.test/track-order?order=TN1&r=order_x&v=1');
+
+    config(['fleetbase.console' => ['host' => 'https://tracking.example.test/', 'subdomain' => 'ignored']]);
+    expect(TrackingCode::qrContent('TN1'))->toBe('https://tracking.example.test/track-order?order=TN1&v=1');
+
+    // Unset `secure` defaults to https, whatever environment generated the label.
+    config(['fleetbase.console' => ['host' => 'console.fleetbase.test']]);
+    expect(TrackingCode::qrContent('TN1'))->toStartWith('https://console.fleetbase.test/');
+});
+
+test('barcode content is the bare tracking number printed beneath it', function () {
+    expect(TrackingCode::barcodeContent('ACM1234567890SG'))->toBe('ACM1234567890SG');
+});
+
+test('parse reads every code format in circulation', function () {
+    $empty = ['uuid' => null, 'tracking_number' => null, 'public_id' => null, 'reference' => null, 'version' => null];
+
+    // Generated codes round-trip.
+    expect(TrackingCode::parse(TrackingCode::qrContent('ACM1234567890SG', 'waypoint_a1b2c3d')))->toBe(array_merge($empty, [
+        'tracking_number' => 'ACM1234567890SG',
+        'public_id'       => 'waypoint_a1b2c3d',
+        'version'         => 1,
+    ]))
+        // Legacy labels encode the owner's bare uuid.
+        ->and(TrackingCode::parse(' 6f1c2a4e-8b3d-4c5f-9a7e-1d2c3b4a5f60 '))->toBe(array_merge($empty, [
+            'uuid' => '6f1c2a4e-8b3d-4c5f-9a7e-1d2c3b4a5f60',
+        ]))
+        // A barcode, or a value typed by hand, may be a tracking number or a public id.
+        ->and(TrackingCode::parse('ACM1234567890SG'))->toBe(array_merge($empty, ['reference' => 'ACM1234567890SG']))
+        ->and(TrackingCode::parse(''))->toBe($empty)
+        ->and(TrackingCode::parse(null))->toBe($empty);
+});
+
+test('parse ignores host and path and tolerates hostile or partial urls', function () {
+    // Any host, a `tn` alias, and a tracking number carried in a deeper path.
+    expect(TrackingCode::parse('HTTPS://old-domain.example/track-order?tn=TN9&r=entity_e1&v=2'))->toMatchArray([
+        'tracking_number' => 'TN9',
+        'public_id'       => 'entity_e1',
+        'version'         => 2,
+    ])
+        ->and(TrackingCode::parse('https://console.example/~/track/TN%2042?r=order_o1'))->toMatchArray([
+            'tracking_number' => 'TN 42',
+            'public_id'       => 'order_o1',
+            'version'         => null,
+        ])
+        // The tracking page's own path is not mistaken for a tracking number.
+        ->and(TrackingCode::parse('https://console.example/track-order?r=order_o1'))->toMatchArray([
+            'tracking_number' => null,
+            'public_id'       => 'order_o1',
+        ])
+        // Array or blank parameters and a non-numeric version are dropped, not trusted.
+        ->and(TrackingCode::parse('https://console.example/track-order?order[]=a&r=%20&v=1x'))->toMatchArray([
+            'tracking_number' => null,
+            'public_id'       => null,
+            'version'         => null,
+        ])
+        // parse_url() rejects this outright.
+        ->and(TrackingCode::parse('http:///track-order'))->toMatchArray([
+            'tracking_number' => null,
+            'public_id'       => null,
+            'version'         => null,
+        ]);
+});
+
+test('matches accepts legacy and new codes for the scanned subject only', function () {
+    $order = (object) [
+        'uuid'           => '6f1c2a4e-8b3d-4c5f-9a7e-1d2c3b4a5f60',
+        'public_id'      => 'order_a1b2c3d',
+        'trackingNumber' => (object) ['tracking_number' => 'ACM1234567890SG'],
+    ];
+
+    expect(TrackingCode::matches('6f1c2a4e-8b3d-4c5f-9a7e-1d2c3b4a5f60', $order))->toBeTrue()
+        ->and(TrackingCode::matches('00000000-0000-4000-8000-000000000000', $order))->toBeFalse()
+        ->and(TrackingCode::matches(TrackingCode::qrContent('ACM1234567890SG', 'order_a1b2c3d'), $order))->toBeTrue()
+        // Handhelds may not preserve case.
+        ->and(TrackingCode::matches('acm1234567890sg', $order))->toBeTrue()
+        ->and(TrackingCode::matches('order_a1b2c3d', $order))->toBeTrue()
+        ->and(TrackingCode::matches('order_other', $order))->toBeFalse()
+        ->and(TrackingCode::matches(TrackingCode::qrContent('ACM1234567890SG'), $order))->toBeTrue()
+        ->and(TrackingCode::matches('https://console.example/track-order?r=order_a1b2c3d', $order))->toBeTrue()
+        // The owner named in the code decides: another owner is refused even with this
+        // subject's tracking number, while a second tracking number issued for this
+        // subject still names it and matches.
+        ->and(TrackingCode::matches(TrackingCode::qrContent('ACM1234567890SG', 'order_other'), $order))->toBeFalse()
+        ->and(TrackingCode::matches(TrackingCode::qrContent('ACM0000000000SG', 'order_a1b2c3d'), $order))->toBeTrue()
+        // Without an owner, the number must be this subject's.
+        ->and(TrackingCode::matches(TrackingCode::qrContent('ACM0000000000SG'), $order))->toBeFalse()
+        // A URL that names nothing matches nothing.
+        ->and(TrackingCode::matches('https://console.example/track-order', $order))->toBeFalse()
+        ->and(TrackingCode::matches('', $order))->toBeFalse()
+        ->and(TrackingCode::matches('order_a1b2c3d', null))->toBeFalse()
+        ->and(TrackingCode::matches('order_a1b2c3d', (object) ['public_id' => 'order_a1b2c3d']))->toBeFalse();
+});
+
+test('matches decides a subject without its own tracking number by public id', function () {
+    // A service stop resolves to a place, which has no tracking number of its own.
+    $place = (object) ['uuid' => 'place-uuid', 'public_id' => 'place_p1'];
+
+    expect(TrackingCode::matches(TrackingCode::qrContent('ACM1234567890SG', 'place_p1'), $place))->toBeTrue()
+        ->and(TrackingCode::matches(TrackingCode::qrContent('ACM1234567890SG'), $place))->toBeFalse()
+        ->and(TrackingCode::matches('ACM1234567890SG', $place))->toBeFalse()
+        ->and(TrackingCode::matches('place_p1', $place))->toBeTrue()
+        // A tracking number may also sit directly on the subject.
+        ->and(TrackingCode::matches('TN-FLAT', (object) ['uuid' => 'u', 'public_id' => '', 'tracking_number' => 'TN-FLAT']))->toBeTrue()
+        ->and(TrackingCode::matches('TN-FLAT', (object) ['uuid' => 'u', 'public_id' => null]))->toBeFalse();
+});

From 21924b0e90842d2e460302413420a840c6ebbc4d Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 14:42:01 +0800
Subject: [PATCH 07/87] fix(tracking): refuse non-string scan codes with the
 existing 400

capture-qr reads `code` straight from the request. The navigator v3 branch
sends the scanner's whole result object; the old strict comparison answered
400, and the typed matcher would have thrown. Non-strings now match nothing.
---
 server/src/Support/TrackingCode.php              |  9 +++++----
 server/tests/ApiOrderControllerContractsTest.php | 11 +++++++++++
 server/tests/Unit/Support/TrackingCodeTest.php   |  3 +++
 3 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/server/src/Support/TrackingCode.php b/server/src/Support/TrackingCode.php
index 907a79c9c..f043a8a53 100644
--- a/server/src/Support/TrackingCode.php
+++ b/server/src/Support/TrackingCode.php
@@ -123,18 +123,19 @@ public static function parse(?string $code): array
 
     /**
      * Whether a scanned value identifies the given subject (an order, waypoint, entity or
-     * place).
+     * place). The value comes straight from a request, so anything but a string, such as
+     * a scanner library's whole result object, matches nothing.
      */
-    public static function matches(?string $code, $subject): bool
+    public static function matches($code, $subject): bool
     {
         $subjectUuid = data_get($subject, 'uuid');
-        if (!$subject || empty($subjectUuid)) {
+        if (!is_string($code) || !$subject || empty($subjectUuid)) {
             return false;
         }
 
         // Labels printed before v1 encode the subject's bare uuid; compare it exactly, as
         // scans always have been.
-        if (trim((string) $code) === $subjectUuid) {
+        if (trim($code) === $subjectUuid) {
             return true;
         }
 
diff --git a/server/tests/ApiOrderControllerContractsTest.php b/server/tests/ApiOrderControllerContractsTest.php
index f25dd6d80..d22c0394d 100644
--- a/server/tests/ApiOrderControllerContractsTest.php
+++ b/server/tests/ApiOrderControllerContractsTest.php
@@ -1052,6 +1052,17 @@ public function isString(string $key): bool
             ->and($controller->createdProofs[0]['subject_uuid'])->toBe('subject-uuid');
     }
 
+    // A scanner's whole result object, rather than its value, is refused as before
+    // instead of failing the request.
+    $controller                  = new FleetOpsApiOrderCrudControllerProbe();
+    $controller->order           = new FleetOpsApiOrderCrudFake();
+    $controller->resolvedSubject = $subject;
+
+    expect($controller->captureQrScan(new Request(['code' => ['type' => 'qr', 'value' => 'ACM1234567890SG']]), 'order-public', 'waypoint_subject'))->toBe([
+        'apiError' => 'Unable to validate QR code data.',
+        'status'   => 400,
+    ]);
+
     // Another parcel's label is refused, whether it names another owner or, naming none,
     // another tracking number.
     foreach ([
diff --git a/server/tests/Unit/Support/TrackingCodeTest.php b/server/tests/Unit/Support/TrackingCodeTest.php
index a62f65586..deef45224 100644
--- a/server/tests/Unit/Support/TrackingCodeTest.php
+++ b/server/tests/Unit/Support/TrackingCodeTest.php
@@ -114,6 +114,9 @@
         // A URL that names nothing matches nothing.
         ->and(TrackingCode::matches('https://console.example/track-order', $order))->toBeFalse()
         ->and(TrackingCode::matches('', $order))->toBeFalse()
+        // A request may carry a scanner's whole result object instead of its value.
+        ->and(TrackingCode::matches(['type' => 'qr', 'value' => 'order_a1b2c3d'], $order))->toBeFalse()
+        ->and(TrackingCode::matches(null, $order))->toBeFalse()
         ->and(TrackingCode::matches('order_a1b2c3d', null))->toBeFalse()
         ->and(TrackingCode::matches('order_a1b2c3d', (object) ['public_id' => 'order_a1b2c3d']))->toBeFalse();
 });

From 16bacb35611ac78e1370093ecc2a22ac5ab425ba Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 14:47:06 +0800
Subject: [PATCH 08/87] feat(tracking-page): settings screen for the customer
 tracking page

PR 4 of the tracking pages refactor: FleetOps -> Settings -> Tracking Page.

- Pages: own page on/off, its address under /t/ with a live availability
  check, copy and open links, shared-page opt-out, and which page emails and
  labels link to.
- Branding: display name, accent with a live contrast check (the text colour
  on it is derived), an optional dark-mode accent, support contacts,
  Powered by Fleetbase, light/dark behaviour, default and enabled languages.
- Access: status without verification, SMS and email codes (SMS disabled with
  a reason when the instance has no SMS provider), session length, and
  customer sign-in and account upsell when the customer portal is installed.
- What verified customers see, with the privacy rules that always apply.
- A live light and dark preview themed from the same tokens the page will
  use (utils/tracking-page-theme).
- Admin panel 'Tracking Page' under Fleet-Ops Config for the generic page's
  instance defaults; sidebar item, settings hub card, and translation keys
  in all 10 locales (English text until translated).

Settings load in the route's model hook, not a controller constructor.
---
 .../admin/tracking-page-settings.hbs          |  56 ++++
 .../admin/tracking-page-settings.js           |  67 ++++
 addon/components/layout/fleet-ops-sidebar.js  |   8 +-
 .../tracking-page/settings-preview.hbs        |  21 ++
 .../tracking-page/settings-preview.js         |  23 ++
 addon/controllers/settings/index.js           |   6 +
 addon/controllers/settings/tracking-page.js   | 212 ++++++++++++
 addon/extension.js                            |   5 +
 addon/routes.js                               |   1 +
 addon/routes/settings/tracking-page.js        |  31 ++
 addon/styles/fleetops-engine.css              |  97 ++++++
 addon/templates/settings/tracking-page.hbs    | 311 ++++++++++++++++++
 addon/utils/tracking-page-theme.js            | 123 +++++++
 .../admin/tracking-page-settings.js           |   1 +
 .../tracking-page/settings-preview.js         |   1 +
 app/controllers/settings/tracking-page.js     |   1 +
 app/routes/settings/tracking-page.js          |   1 +
 app/templates/settings/tracking-page.js       |   1 +
 app/utils/tracking-page-theme.js              |   1 +
 translations/ar-ae.yml                        |  88 +++++
 translations/bg-bg.yaml                       |  88 +++++
 translations/en-us.yaml                       |  88 +++++
 translations/es-pa.yaml                       |  88 +++++
 translations/fr-fr.yaml                       |  88 +++++
 translations/mn-mn.yaml                       |  88 +++++
 translations/pt-br.yaml                       |  88 +++++
 translations/ru-ru.yaml                       |  88 +++++
 translations/uk-ua.yaml                       |  90 ++++-
 translations/vi-vn.yaml                       |  88 +++++
 29 files changed, 1845 insertions(+), 4 deletions(-)
 create mode 100644 addon/components/admin/tracking-page-settings.hbs
 create mode 100644 addon/components/admin/tracking-page-settings.js
 create mode 100644 addon/components/tracking-page/settings-preview.hbs
 create mode 100644 addon/components/tracking-page/settings-preview.js
 create mode 100644 addon/controllers/settings/tracking-page.js
 create mode 100644 addon/routes/settings/tracking-page.js
 create mode 100644 addon/templates/settings/tracking-page.hbs
 create mode 100644 addon/utils/tracking-page-theme.js
 create mode 100644 app/components/admin/tracking-page-settings.js
 create mode 100644 app/components/tracking-page/settings-preview.js
 create mode 100644 app/controllers/settings/tracking-page.js
 create mode 100644 app/routes/settings/tracking-page.js
 create mode 100644 app/templates/settings/tracking-page.js
 create mode 100644 app/utils/tracking-page-theme.js

diff --git a/addon/components/admin/tracking-page-settings.hbs b/addon/components/admin/tracking-page-settings.hbs
new file mode 100644
index 000000000..452035bdd
--- /dev/null
+++ b/addon/components/admin/tracking-page-settings.hbs
@@ -0,0 +1,56 @@
+<ContentPanel @title="Generic Tracking Page" @open={{true}} @wrapperClass="bordered-classic">
+    <div class="space-y-5">
+        <div class="flex items-start justify-between gap-4">
+            <div>
+                <div class="text-sm font-semibold">Enable the generic tracking page</div>
+                <div class="text-xs text-gray-600 dark:text-gray-300">Serves /track for every organization that allows it. Organizations can also run their own page from their Fleet-Ops settings.</div>
+            </div>
+            <Toggle @isToggled={{this.genericEnabled}} @onToggle={{fn (mut this.genericEnabled)}} />
+        </div>
+        <div>
+            <label for="admin-tracking-page-name" class="block text-sm font-semibold mb-1">Display name</label>
+            <input id="admin-tracking-page-name" type="text" class="form-input w-full" value={{this.displayName}} {{on "input" (fn this.setValue "displayName")}} />
+            <p class="mt-1 text-xs text-gray-600 dark:text-gray-300">Shown before a lookup. The logo comes from the instance branding.</p>
+        </div>
+        <div>
+            <label for="admin-tracking-page-accent" class="block text-sm font-semibold mb-1">Accent colour</label>
+            <div class="flex items-center gap-3">
+                <input id="admin-tracking-page-accent" type="color" class="h-10 w-14 rounded-md border border-gray-300 dark:border-gray-700 bg-transparent cursor-pointer" value={{this.accent}} {{on "input" (fn this.setValue "accent")}} />
+                <span class="font-mono text-sm">{{this.accent}}</span>
+            </div>
+        </div>
+        <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
+            <div>
+                <label for="admin-tracking-page-phone" class="block text-sm font-semibold mb-1">Support phone</label>
+                <input id="admin-tracking-page-phone" type="tel" class="form-input w-full" value={{this.supportPhone}} {{on "input" (fn this.setValue "supportPhone")}} />
+            </div>
+            <div>
+                <label for="admin-tracking-page-email" class="block text-sm font-semibold mb-1">Support email</label>
+                <input id="admin-tracking-page-email" type="email" class="form-input w-full" value={{this.supportEmail}} {{on "input" (fn this.setValue "supportEmail")}} />
+            </div>
+            <div>
+                <label for="admin-tracking-page-website" class="block text-sm font-semibold mb-1">Website</label>
+                <input id="admin-tracking-page-website" type="url" class="form-input w-full" value={{this.website}} {{on "input" (fn this.setValue "website")}} />
+            </div>
+        </div>
+        <div class="flex items-start justify-between gap-4">
+            <div>
+                <div class="text-sm font-semibold">Show "Powered by Fleetbase"</div>
+                <div class="text-xs text-gray-600 dark:text-gray-300">The default for organizations that haven't chosen.</div>
+            </div>
+            <Toggle @isToggled={{this.poweredBy}} @onToggle={{fn (mut this.poweredBy)}} />
+        </div>
+    </div>
+</ContentPanel>
+
+<EmberWormhole @to="next-view-section-subheader-actions">
+    <Button
+        @type="primary"
+        @size="sm"
+        @icon="save"
+        @text="Save Changes"
+        @onClick={{perform this.saveSettings}}
+        @isLoading={{or this.saveSettings.isRunning this.loadSettings.isRunning}}
+        @disabled={{this.saveSettings.isRunning}}
+    />
+</EmberWormhole>
diff --git a/addon/components/admin/tracking-page-settings.js b/addon/components/admin/tracking-page-settings.js
new file mode 100644
index 000000000..daf8eb563
--- /dev/null
+++ b/addon/components/admin/tracking-page-settings.js
@@ -0,0 +1,67 @@
+import Component from '@glimmer/component';
+import { inject as service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import { task } from 'ember-concurrency';
+
+/**
+ * Instance-wide defaults for the generic customer tracking page: whether it is on, and the
+ * branding it shows before a lookup (and for companies without their own).
+ */
+export default class AdminTrackingPageSettingsComponent extends Component {
+    @service fetch;
+    @service notifications;
+    @tracked genericEnabled = true;
+    @tracked displayName = '';
+    @tracked accent = '#1F5FA8';
+    @tracked supportPhone = '';
+    @tracked supportEmail = '';
+    @tracked website = '';
+    @tracked poweredBy = true;
+
+    constructor() {
+        super(...arguments);
+        this.loadSettings.perform();
+    }
+
+    @task *loadSettings() {
+        try {
+            const settings = yield this.fetch.get('fleet-ops/settings/admin-tracking-page-settings');
+            this.genericEnabled = settings?.generic_page?.enabled ?? true;
+            this.displayName = settings?.branding?.display_name ?? '';
+            this.accent = settings?.branding?.accent ?? '#1F5FA8';
+            this.supportPhone = settings?.branding?.support_phone ?? '';
+            this.supportEmail = settings?.branding?.support_email ?? '';
+            this.website = settings?.branding?.website ?? '';
+            this.poweredBy = settings?.branding?.powered_by ?? true;
+        } catch (error) {
+            this.notifications.serverError(error);
+        }
+    }
+
+    @action setValue(property, event) {
+        this[property] = event.target.value;
+    }
+
+    @task *saveSettings() {
+        try {
+            yield this.fetch.post('fleet-ops/settings/admin-tracking-page-settings', {
+                trackingPage: {
+                    generic_page: { enabled: this.genericEnabled },
+                    branding: {
+                        display_name: this.displayName,
+                        accent: this.accent,
+                        support_phone: this.supportPhone,
+                        support_email: this.supportEmail,
+                        website: this.website,
+                        powered_by: this.poweredBy,
+                    },
+                },
+            });
+
+            this.notifications.success('Tracking page defaults saved.');
+        } catch (error) {
+            this.notifications.serverError(error);
+        }
+    }
+}
diff --git a/addon/components/layout/fleet-ops-sidebar.js b/addon/components/layout/fleet-ops-sidebar.js
index 8a2e67bad..850a6b091 100644
--- a/addon/components/layout/fleet-ops-sidebar.js
+++ b/addon/components/layout/fleet-ops-sidebar.js
@@ -208,6 +208,7 @@ export default class LayoutFleetOpsSidebarComponent extends Component {
             this.createItem('menu.routing', 'route', 'settings.routing', 'fleet-ops view routing-settings', 'fleet-ops see routing-settings'),
             this.createItem('menu.orchestrator', 'circle-nodes', 'settings.orchestrator', 'fleet-ops view routing-settings', 'fleet-ops see routing-settings'),
             this.createItem('menu.scheduling', 'calendar-days', 'settings.scheduling', 'fleet-ops view scheduling-settings', 'fleet-ops see scheduling-settings'),
+            this.createItem('tracking-page.settings.menu', 'magnifying-glass-location', 'settings.tracking-page', 'fleet-ops view tracking-page-settings', 'fleet-ops see tracking-page-settings'),
             this.createItem('menu.telematics-settings', 'satellite-dish', 'settings.telematics', 'fleet-ops view telematics-settings', 'fleet-ops see telematics-settings'),
             this.createItem('menu.custom-fields', 'pen-to-square', 'settings.custom-fields', 'fleet-ops list custom-field', 'fleet-ops see custom-field'),
             this.createItem('menu.avatars', 'icons', 'settings.avatars', 'fleet-ops list avatar', 'fleet-ops see avatar'),
@@ -406,9 +407,10 @@ export default class LayoutFleetOpsSidebarComponent extends Component {
             'settings.routing': 5,
             'settings.orchestrator': 6,
             'settings.scheduling': 7,
-            'settings.telematics': 8,
-            'settings.custom-fields': 9,
-            'settings.avatars': 10,
+            'settings.tracking-page': 8,
+            'settings.telematics': 9,
+            'settings.custom-fields': 10,
+            'settings.avatars': 11,
         };
 
         return priorities[route] ?? 0;
diff --git a/addon/components/tracking-page/settings-preview.hbs b/addon/components/tracking-page/settings-preview.hbs
new file mode 100644
index 000000000..94e494435
--- /dev/null
+++ b/addon/components/tracking-page/settings-preview.hbs
@@ -0,0 +1,21 @@
+<div class="tp-preview" style={{this.style}} aria-hidden="true">
+    <div class="tp-preview-header">
+        <span class="tp-preview-monogram">{{this.monogram}}</span>
+        <span class="tp-preview-name">{{@displayName}}</span>
+    </div>
+    <div class="tp-preview-body">
+        <span class="tp-preview-chip">{{t "tracking-page.settings.preview-chip"}}</span>
+        <div class="tp-preview-headline">{{t "tracking-page.settings.preview-headline"}}</div>
+        <div class="tp-preview-sub">{{t "tracking-page.settings.preview-sub"}}</div>
+        <div class="tp-preview-steps">
+            <span class="tp-preview-step tp-preview-step-done"></span>
+            <span class="tp-preview-step tp-preview-step-done"></span>
+            <span class="tp-preview-step tp-preview-step-done"></span>
+            <span class="tp-preview-step"></span>
+        </div>
+        <span class="tp-preview-button">{{t "tracking-page.settings.preview-button"}}</span>
+    </div>
+    {{#if @poweredBy}}
+        <div class="tp-preview-footer">{{t "tracking-page.settings.preview-powered-by"}}</div>
+    {{/if}}
+</div>
diff --git a/addon/components/tracking-page/settings-preview.js b/addon/components/tracking-page/settings-preview.js
new file mode 100644
index 000000000..a4d2a5901
--- /dev/null
+++ b/addon/components/tracking-page/settings-preview.js
@@ -0,0 +1,23 @@
+import Component from '@glimmer/component';
+import { htmlSafe } from '@ember/template';
+
+/**
+ * A small phone-sized preview of the customer tracking page, themed from the settings being edited.
+ */
+export default class TrackingPageSettingsPreviewComponent extends Component {
+    get style() {
+        return htmlSafe(this.args.themeStyle ?? '');
+    }
+
+    get monogram() {
+        const words = (this.args.displayName ?? '').split(/\s+/);
+        let monogram = '';
+        for (const word of words) {
+            if (word && monogram.length < 2) {
+                monogram += word[0].toUpperCase();
+            }
+        }
+
+        return monogram;
+    }
+}
diff --git a/addon/controllers/settings/index.js b/addon/controllers/settings/index.js
index 586754c08..195fa5f19 100644
--- a/addon/controllers/settings/index.js
+++ b/addon/controllers/settings/index.js
@@ -28,6 +28,12 @@ export default class SettingsIndexController extends Controller {
             description: 'Keep commerce, metadata, and visual conventions aligned.',
             links: [
                 { label: 'Payments', route: 'settings.payments', icon: 'cash-register', description: 'Payment setup for operational commerce workflows.' },
+                {
+                    label: 'Tracking Page',
+                    route: 'settings.tracking-page',
+                    icon: 'magnifying-glass-location',
+                    description: 'The page your customers use to follow deliveries: address, branding and how they verify.',
+                },
                 {
                     label: 'Telematics',
                     route: 'settings.telematics',
diff --git a/addon/controllers/settings/tracking-page.js b/addon/controllers/settings/tracking-page.js
new file mode 100644
index 000000000..840b71779
--- /dev/null
+++ b/addon/controllers/settings/tracking-page.js
@@ -0,0 +1,212 @@
+import Controller from '@ember/controller';
+import { tracked } from '@glimmer/tracking';
+import { inject as service } from '@ember/service';
+import { action } from '@ember/object';
+import { task, timeout } from 'ember-concurrency';
+import trackingPageTheme, { contrastRatio, inkFor, normalizeHex, DEFAULT_ACCENT } from '../../utils/tracking-page-theme';
+
+/**
+ * The locales a tracking page can be shown in, labelled in their own language.
+ */
+export const TRACKING_PAGE_LOCALES = [
+    { code: 'en-us', label: 'English' },
+    { code: 'ar-ae', label: 'العربية' },
+    { code: 'bg-bg', label: 'Български' },
+    { code: 'es-pa', label: 'Español' },
+    { code: 'fr-fr', label: 'Français' },
+    { code: 'mn-mn', label: 'Монгол' },
+    { code: 'pt-br', label: 'Português' },
+    { code: 'ru-ru', label: 'Русский' },
+    { code: 'uk-ua', label: 'Українська' },
+    { code: 'vi-vn', label: 'Tiếng Việt' },
+];
+
+/**
+ * Keys the server adds to the saved config when it reads it back. They are facts about
+ * the instance, not settings, so they are kept apart and never sent back on save.
+ */
+const READ_ONLY_KEYS = ['slug_validation', 'accent_ink', 'accent_contrast', 'sms_available', 'customer_portal_installed', 'admin'];
+
+/**
+ * Settings::TrackingPageController
+ *
+ * The company's customer tracking page: which pages are on and at what address, branding,
+ * how customers prove who they are, and what verified customers see.
+ */
+export default class SettingsTrackingPageController extends Controller {
+    @service fetch;
+    @service notifications;
+    @service intl;
+    @service currentUser;
+
+    @tracked config = null;
+    @tracked slugValidation = null;
+    @tracked smsAvailable = false;
+    @tracked customerPortalInstalled = false;
+    @tracked loadFailed = false;
+
+    /**
+     * Take the settings as the server returns them.
+     */
+    load(settings) {
+        if (!settings) {
+            this.loadFailed = true;
+            return;
+        }
+
+        const config = { ...settings };
+        READ_ONLY_KEYS.forEach((key) => delete config[key]);
+
+        this.config = config;
+        this.slugValidation = settings.slug_validation ?? null;
+        this.smsAvailable = settings.sms_available === true;
+        this.customerPortalInstalled = settings.customer_portal_installed === true;
+        this.loadFailed = false;
+    }
+
+    get accent() {
+        return normalizeHex(this.config?.branding?.accent) ?? DEFAULT_ACCENT;
+    }
+
+    get accentInk() {
+        return inkFor(this.accent);
+    }
+
+    get accentContrast() {
+        return contrastRatio(this.accent, this.accentInk);
+    }
+
+    get accentReadable() {
+        return this.accentContrast >= 4.5;
+    }
+
+    get previewLightStyle() {
+        return trackingPageTheme(this.config?.branding, false);
+    }
+
+    get previewDarkStyle() {
+        return trackingPageTheme(this.config?.branding, true);
+    }
+
+    get companyName() {
+        return this.currentUser.companyName ?? '';
+    }
+
+    get displayName() {
+        return this.config?.branding?.display_name || this.companyName;
+    }
+
+    get orgPageBase() {
+        return `${window.location.origin}/t/`;
+    }
+
+    get orgPageUrl() {
+        return `${window.location.origin}/t/${this.config?.org_page?.slug ?? ''}`;
+    }
+
+    get genericPageUrl() {
+        return `${window.location.origin}/track`;
+    }
+
+    get slugIsValid() {
+        return this.slugValidation?.valid === true;
+    }
+
+    get localeOptions() {
+        const enabled = this.config?.branding?.locales ?? [];
+        const defaultLocale = this.config?.branding?.default_locale;
+
+        return TRACKING_PAGE_LOCALES.map((locale) => ({
+            ...locale,
+            enabled: enabled.includes(locale.code),
+            isDefault: locale.code === defaultLocale,
+        }));
+    }
+
+    get linkTargetOptions() {
+        return ['auto', 'org', 'generic'].map((value) => ({ value, label: this.intl.t(`tracking-page.settings.links-target-${value}`) }));
+    }
+
+    get themeOptions() {
+        return ['system', 'light'].map((value) => ({ value, label: this.intl.t(`tracking-page.settings.theme-${value}`) }));
+    }
+
+    get driverContactOptions() {
+        return ['company', 'driver'].map((value) => ({ value, label: this.intl.t(`tracking-page.settings.driver-contact-${value}`) }));
+    }
+
+    /**
+     * Set one value by its dotted path, replacing the config so the form and preview update.
+     */
+    @action update(path, value) {
+        const config = JSON.parse(JSON.stringify(this.config));
+        const keys = path.split('.');
+        const last = keys.pop();
+        let target = config;
+        for (const key of keys) {
+            target = target[key];
+        }
+
+        target[last] = value;
+        this.config = config;
+    }
+
+    @action updateFromEvent(path, event) {
+        this.update(path, event.target.value);
+    }
+
+    @action updateNumber(path, event) {
+        this.update(path, parseInt(event.target.value, 10));
+    }
+
+    @action selectOption(path, option) {
+        this.update(path, option?.value ?? option);
+    }
+
+    @action updateSlug(event) {
+        const slug = event.target.value.toLowerCase().replace(/\s+/g, '-');
+        this.update('org_page.slug', slug);
+        this.validateSlug.perform(slug);
+    }
+
+    @action toggleLocale(code) {
+        const locales = this.config.branding.locales ?? [];
+        if (code === this.config.branding.default_locale) {
+            return;
+        }
+
+        this.update('branding.locales', locales.includes(code) ? locales.filter((locale) => locale !== code) : [...locales, code]);
+    }
+
+    @action setDefaultLocale(option) {
+        const code = option?.value ?? option;
+        const locales = this.config.branding.locales ?? [];
+        this.update('branding.default_locale', code);
+        if (!locales.includes(code)) {
+            this.update('branding.locales', [...locales, code]);
+        }
+    }
+
+    get defaultLocaleOptions() {
+        return TRACKING_PAGE_LOCALES.map((locale) => ({ value: locale.code, label: locale.label }));
+    }
+
+    @task({ restartable: true }) *validateSlug(slug) {
+        yield timeout(350);
+        try {
+            this.slugValidation = yield this.fetch.post('fleet-ops/settings/tracking-page-settings/validate-slug', { slug });
+        } catch (error) {
+            this.notifications.serverError(error);
+        }
+    }
+
+    @task *saveSettings() {
+        try {
+            const settings = yield this.fetch.post('fleet-ops/settings/tracking-page-settings', { trackingPage: this.config });
+            this.load(settings);
+            this.notifications.success(this.intl.t('tracking-page.settings.saved'));
+        } catch (error) {
+            this.notifications.serverError(error);
+        }
+    }
+}
diff --git a/addon/extension.js b/addon/extension.js
index 0427f7d69..d67e72561 100644
--- a/addon/extension.js
+++ b/addon/extension.js
@@ -117,6 +117,11 @@ export default {
                     icon: 'satellite-dish',
                     component: new ExtensionComponent('@fleetbase/fleetops-engine', 'admin/telematics-settings'),
                 }),
+                new MenuItem({
+                    title: 'Tracking Page',
+                    icon: 'magnifying-glass-location',
+                    component: new ExtensionComponent('@fleetbase/fleetops-engine', 'admin/tracking-page-settings'),
+                }),
             ],
             {
                 slug: 'fleet-ops',
diff --git a/addon/routes.js b/addon/routes.js
index 9596e2885..5dc216772 100644
--- a/addon/routes.js
+++ b/addon/routes.js
@@ -323,6 +323,7 @@ export default buildRoutes(function () {
         this.route('map');
         this.route('orchestrator');
         this.route('scheduling');
+        this.route('tracking-page');
         this.route('telematics');
         this.route('payments', function () {
             this.route('index', { path: '/' });
diff --git a/addon/routes/settings/tracking-page.js b/addon/routes/settings/tracking-page.js
new file mode 100644
index 000000000..adb5049f3
--- /dev/null
+++ b/addon/routes/settings/tracking-page.js
@@ -0,0 +1,31 @@
+import Route from '@ember/routing/route';
+import { inject as service } from '@ember/service';
+
+export default class SettingsTrackingPageRoute extends Route {
+    @service notifications;
+    @service hostRouter;
+    @service abilities;
+    @service intl;
+    @service fetch;
+
+    beforeModel() {
+        if (this.abilities.cannot('fleet-ops view tracking-page-settings')) {
+            this.notifications.warning(this.intl.t('common.unauthorized-access'));
+            return this.hostRouter.transitionTo('console.fleet-ops');
+        }
+    }
+
+    async model() {
+        try {
+            return await this.fetch.get('fleet-ops/settings/tracking-page-settings');
+        } catch (error) {
+            this.notifications.serverError(error);
+            return null;
+        }
+    }
+
+    setupController(controller, model) {
+        super.setupController(controller, model);
+        controller.load(model);
+    }
+}
diff --git a/addon/styles/fleetops-engine.css b/addon/styles/fleetops-engine.css
index a17422d2d..1a4d23ee1 100644
--- a/addon/styles/fleetops-engine.css
+++ b/addon/styles/fleetops-engine.css
@@ -12429,3 +12429,100 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     font-size: 0.875rem;
     line-height: 1rem;
 }
+
+/* Customer tracking page settings preview: colours come from the --tp-* tokens on the root. */
+.tp-preview {
+    border: 1px solid var(--tp-border);
+    border-radius: 1.25rem;
+    overflow: hidden;
+    background: var(--tp-bg);
+    color: var(--tp-text);
+    font-size: 0.75rem;
+}
+
+.tp-preview-header {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    padding: 0.625rem 0.875rem;
+    background: var(--tp-surface);
+    border-bottom: 1px solid var(--tp-border);
+}
+
+.tp-preview-monogram {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 1.75rem;
+    height: 1.75rem;
+    border-radius: 0.5rem;
+    background: var(--tp-accent);
+    color: var(--tp-ink);
+    font-weight: 700;
+    font-size: 0.6875rem;
+}
+
+.tp-preview-name {
+    font-weight: 700;
+    font-size: 0.8125rem;
+}
+
+.tp-preview-body {
+    display: flex;
+    flex-direction: column;
+    align-items: flex-start;
+    gap: 0.5rem;
+    padding: 0.875rem;
+}
+
+.tp-preview-chip {
+    padding: 0.125rem 0.5rem;
+    border-radius: 999px;
+    background: var(--tp-accent-soft);
+    color: var(--tp-accent);
+    font-weight: 600;
+}
+
+.tp-preview-headline {
+    font-size: 1.125rem;
+    font-weight: 700;
+    letter-spacing: -0.02em;
+}
+
+.tp-preview-sub {
+    color: var(--tp-muted);
+}
+
+.tp-preview-steps {
+    display: grid;
+    grid-template-columns: repeat(4, minmax(0, 1fr));
+    gap: 0.25rem;
+    width: 100%;
+}
+
+.tp-preview-step {
+    height: 0.25rem;
+    border-radius: 999px;
+    background: var(--tp-border);
+}
+
+.tp-preview-step-done {
+    background: var(--tp-accent);
+}
+
+.tp-preview-button {
+    align-self: stretch;
+    padding: 0.5rem;
+    border-radius: 0.625rem;
+    background: var(--tp-accent);
+    color: var(--tp-ink);
+    font-weight: 600;
+    text-align: center;
+}
+
+.tp-preview-footer {
+    padding: 0.5rem 0.875rem 0.75rem;
+    color: var(--tp-muted);
+    text-align: center;
+    font-size: 0.6875rem;
+}
diff --git a/addon/templates/settings/tracking-page.hbs b/addon/templates/settings/tracking-page.hbs
new file mode 100644
index 000000000..a0e8037b3
--- /dev/null
+++ b/addon/templates/settings/tracking-page.hbs
@@ -0,0 +1,311 @@
+<Layout::Section::Header @title={{t "tracking-page.settings.title"}}>
+    <Button
+        @type="primary"
+        @size="sm"
+        @icon="save"
+        @text={{t "common.save-changes"}}
+        @onClick={{perform this.saveSettings}}
+        @disabled={{or this.saveSettings.isRunning this.loadFailed}}
+        @isLoading={{this.saveSettings.isRunning}}
+    />
+</Layout::Section::Header>
+
+<Layout::Section::Body class="overflow-y-scroll-i h-full">
+    <div class="container mx-auto">
+        {{#if this.loadFailed}}
+            <div class="max-w-3xl my-10 mx-auto rounded-lg border border-gray-200 dark:border-gray-700 p-6 text-sm">
+                <p class="font-semibold mb-1">{{t "tracking-page.settings.load-failed"}}</p>
+                <p class="text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.load-failed-help"}}</p>
+            </div>
+        {{else if this.config}}
+            <div class="my-10 mx-auto max-w-6xl grid grid-cols-1 lg:grid-cols-3 gap-6 items-start">
+                <div class="lg:col-span-2 space-y-6">
+
+                    {{! ── Pages ─────────────────────────────────────────────── }}
+                    <ContentPanel @title={{t "tracking-page.settings.pages"}} @open={{true}} @wrapperClass="bordered-classic">
+                        <div class="space-y-5">
+                            <div class="flex items-start justify-between gap-4">
+                                <div>
+                                    <div class="text-sm font-semibold">{{t "tracking-page.settings.org-page-enabled"}}</div>
+                                    <div class="text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.org-page-enabled-help"}}</div>
+                                </div>
+                                <Toggle @isToggled={{this.config.org_page.enabled}} @onToggle={{fn this.update "org_page.enabled"}} />
+                            </div>
+
+                            <div>
+                                <label for="tracking-page-slug" class="block text-sm font-semibold mb-1">{{t "tracking-page.settings.slug"}}</label>
+                                <div class="flex items-stretch rounded-md border border-gray-300 dark:border-gray-700 overflow-hidden">
+                                    <span class="flex items-center px-3 text-sm text-gray-600 dark:text-gray-300 bg-gray-50 dark:bg-gray-800 border-r border-gray-300 dark:border-gray-700 whitespace-nowrap">{{this.orgPageBase}}</span>
+                                    <input
+                                        id="tracking-page-slug"
+                                        type="text"
+                                        class="form-input border-0 rounded-none flex-1 min-w-0"
+                                        value={{this.config.org_page.slug}}
+                                        autocomplete="off"
+                                        spellcheck="false"
+                                        aria-describedby="tracking-page-slug-status"
+                                        {{on "input" this.updateSlug}}
+                                    />
+                                </div>
+                                <div id="tracking-page-slug-status" class="mt-1 text-xs {{if this.slugIsValid 'text-green-700 dark:text-green-400' 'text-red-700 dark:text-red-400'}}" aria-live="polite">
+                                    {{#if this.validateSlug.isRunning}}
+                                        <span class="text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.slug-checking"}}</span>
+                                    {{else if this.slugValidation}}
+                                        {{this.slugValidation.message}}
+                                    {{/if}}
+                                </div>
+                                <div class="mt-2 flex flex-wrap items-center gap-2">
+                                    <ClickToCopy class="px-3 py-1.5 border rounded-md text-xs bg-gray-100 dark:bg-gray-700 border-gray-200 dark:border-gray-800" @value={{this.orgPageUrl}}>{{this.orgPageUrl}}</ClickToCopy>
+                                    {{#if this.config.org_page.enabled}}
+                                        <a href={{this.orgPageUrl}} target="_blank" rel="noopener noreferrer" class="text-xs font-semibold text-blue-600 dark:text-blue-400">{{t "tracking-page.settings.open-page"}}</a>
+                                    {{/if}}
+                                </div>
+                            </div>
+
+                            <div class="flex items-start justify-between gap-4">
+                                <div>
+                                    <div class="text-sm font-semibold">{{t "tracking-page.settings.generic-page-allowed"}}</div>
+                                    <div class="text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.generic-page-allowed-help" url=this.genericPageUrl}}</div>
+                                </div>
+                                <Toggle @isToggled={{this.config.generic_page.allowed}} @onToggle={{fn this.update "generic_page.allowed"}} />
+                            </div>
+
+                            <InputGroup @name={{t "tracking-page.settings.links-target"}} @helpText={{t "tracking-page.settings.links-target-help"}}>
+                                <Select
+                                    class="w-full"
+                                    @value={{this.config.links.target}}
+                                    @options={{this.linkTargetOptions}}
+                                    @optionLabel="label"
+                                    @optionValue="value"
+                                    @onSelect={{fn this.selectOption "links.target"}}
+                                />
+                            </InputGroup>
+                        </div>
+                    </ContentPanel>
+
+                    {{! ── Branding ──────────────────────────────────────────── }}
+                    <ContentPanel @title={{t "tracking-page.settings.branding"}} @open={{true}} @wrapperClass="bordered-classic">
+                        <div class="space-y-5">
+                            <div>
+                                <label for="tracking-page-display-name" class="block text-sm font-semibold mb-1">{{t "tracking-page.settings.display-name"}}</label>
+                                <input
+                                    id="tracking-page-display-name"
+                                    type="text"
+                                    class="form-input w-full"
+                                    value={{this.config.branding.display_name}}
+                                    placeholder={{this.companyName}}
+                                    {{on "input" (fn this.updateFromEvent "branding.display_name")}}
+                                />
+                                <p class="mt-1 text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.logo-help"}}</p>
+                            </div>
+
+                            <div>
+                                <label for="tracking-page-accent" class="block text-sm font-semibold mb-1">{{t "tracking-page.settings.accent"}}</label>
+                                <div class="flex items-center gap-3">
+                                    <input
+                                        id="tracking-page-accent"
+                                        type="color"
+                                        class="h-10 w-14 rounded-md border border-gray-300 dark:border-gray-700 bg-transparent cursor-pointer"
+                                        value={{this.accent}}
+                                        {{on "input" (fn this.updateFromEvent "branding.accent")}}
+                                    />
+                                    <input
+                                        type="text"
+                                        class="form-input w-32 font-mono uppercase"
+                                        aria-label={{t "tracking-page.settings.accent-hex"}}
+                                        value={{this.config.branding.accent}}
+                                        {{on "change" (fn this.updateFromEvent "branding.accent")}}
+                                    />
+                                    <span class="text-xs {{if this.accentReadable 'text-green-700 dark:text-green-400' 'text-red-700 dark:text-red-400'}}">
+                                        {{#if this.accentReadable}}
+                                            {{t "tracking-page.settings.contrast-ok" ratio=this.accentContrast}}
+                                        {{else}}
+                                            {{t "tracking-page.settings.contrast-low" ratio=this.accentContrast}}
+                                        {{/if}}
+                                    </span>
+                                </div>
+                                <p class="mt-1 text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.accent-help"}}</p>
+                            </div>
+
+                            <div>
+                                <label for="tracking-page-accent-dark" class="block text-sm font-semibold mb-1">{{t "tracking-page.settings.accent-dark"}}</label>
+                                <input
+                                    id="tracking-page-accent-dark"
+                                    type="text"
+                                    class="form-input w-32 font-mono uppercase"
+                                    value={{this.config.branding.accent_dark}}
+                                    placeholder={{t "tracking-page.settings.accent-dark-auto"}}
+                                    {{on "change" (fn this.updateFromEvent "branding.accent_dark")}}
+                                />
+                            </div>
+
+                            <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
+                                <div>
+                                    <label for="tracking-page-phone" class="block text-sm font-semibold mb-1">{{t "tracking-page.settings.support-phone"}}</label>
+                                    <input id="tracking-page-phone" type="tel" class="form-input w-full" value={{this.config.branding.support_phone}} {{on "input" (fn this.updateFromEvent "branding.support_phone")}} />
+                                </div>
+                                <div>
+                                    <label for="tracking-page-email" class="block text-sm font-semibold mb-1">{{t "tracking-page.settings.support-email"}}</label>
+                                    <input id="tracking-page-email" type="email" class="form-input w-full" value={{this.config.branding.support_email}} {{on "input" (fn this.updateFromEvent "branding.support_email")}} />
+                                </div>
+                                <div>
+                                    <label for="tracking-page-website" class="block text-sm font-semibold mb-1">{{t "tracking-page.settings.website"}}</label>
+                                    <input id="tracking-page-website" type="url" class="form-input w-full" value={{this.config.branding.website}} {{on "input" (fn this.updateFromEvent "branding.website")}} />
+                                </div>
+                            </div>
+                            <p class="-mt-3 text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.support-help"}}</p>
+
+                            <div class="flex items-start justify-between gap-4">
+                                <div>
+                                    <div class="text-sm font-semibold">{{t "tracking-page.settings.powered-by"}}</div>
+                                    <div class="text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.powered-by-help"}}</div>
+                                </div>
+                                <Toggle @isToggled={{this.config.branding.powered_by}} @onToggle={{fn this.update "branding.powered_by"}} />
+                            </div>
+
+                            <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                                <InputGroup @name={{t "tracking-page.settings.theme"}}>
+                                    <Select
+                                        class="w-full"
+                                        @value={{this.config.branding.theme}}
+                                        @options={{this.themeOptions}}
+                                        @optionLabel="label"
+                                        @optionValue="value"
+                                        @onSelect={{fn this.selectOption "branding.theme"}}
+                                    />
+                                </InputGroup>
+                                <InputGroup @name={{t "tracking-page.settings.default-language"}}>
+                                    <Select
+                                        class="w-full"
+                                        @value={{this.config.branding.default_locale}}
+                                        @options={{this.defaultLocaleOptions}}
+                                        @optionLabel="label"
+                                        @optionValue="value"
+                                        @onSelect={{this.setDefaultLocale}}
+                                    />
+                                </InputGroup>
+                            </div>
+
+                            <fieldset>
+                                <legend class="text-sm font-semibold mb-2">{{t "tracking-page.settings.languages"}}</legend>
+                                <div class="grid grid-cols-2 md:grid-cols-5 gap-2">
+                                    {{#each this.localeOptions as |locale|}}
+                                        <label class="flex items-center gap-2 text-sm">
+                                            <input type="checkbox" checked={{locale.enabled}} disabled={{locale.isDefault}} {{on "change" (fn this.toggleLocale locale.code)}} />
+                                            <span>{{locale.label}}</span>
+                                        </label>
+                                    {{/each}}
+                                </div>
+                            </fieldset>
+                        </div>
+                    </ContentPanel>
+
+                    {{! ── Access ────────────────────────────────────────────── }}
+                    <ContentPanel @title={{t "tracking-page.settings.access"}} @open={{true}} @wrapperClass="bordered-classic">
+                        <div class="space-y-5">
+                            <div class="flex items-start justify-between gap-4">
+                                <div>
+                                    <div class="text-sm font-semibold">{{t "tracking-page.settings.public-status"}}</div>
+                                    <div class="text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.public-status-help"}}</div>
+                                </div>
+                                <Toggle @isToggled={{this.config.access.public_status}} @onToggle={{fn this.update "access.public_status"}} />
+                            </div>
+
+                            <div class="flex items-start justify-between gap-4">
+                                <div>
+                                    <div class="text-sm font-semibold">{{t "tracking-page.settings.channel-sms"}}</div>
+                                    {{#if this.smsAvailable}}
+                                        <div class="text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.channel-sms-help"}}</div>
+                                    {{else}}
+                                        <div class="text-xs text-red-700 dark:text-red-400">{{t "tracking-page.settings.channel-sms-unavailable"}}</div>
+                                    {{/if}}
+                                </div>
+                                <Toggle @isToggled={{and this.smsAvailable this.config.access.channels.sms}} @disabled={{not this.smsAvailable}} @onToggle={{fn this.update "access.channels.sms"}} />
+                            </div>
+
+                            <div class="flex items-start justify-between gap-4">
+                                <div>
+                                    <div class="text-sm font-semibold">{{t "tracking-page.settings.channel-email"}}</div>
+                                    <div class="text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.channel-email-help"}}</div>
+                                </div>
+                                <Toggle @isToggled={{this.config.access.channels.email}} @onToggle={{fn this.update "access.channels.email"}} />
+                            </div>
+
+                            <div>
+                                <label for="tracking-page-session-hours" class="block text-sm font-semibold mb-1">{{t "tracking-page.settings.session-hours"}}</label>
+                                <input
+                                    id="tracking-page-session-hours"
+                                    type="number"
+                                    min="1"
+                                    max="168"
+                                    class="form-input w-32"
+                                    value={{this.config.access.session_hours}}
+                                    {{on "change" (fn this.updateNumber "access.session_hours")}}
+                                />
+                                <p class="mt-1 text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.session-hours-help"}}</p>
+                            </div>
+
+                            {{#if this.customerPortalInstalled}}
+                                <div class="flex items-start justify-between gap-4">
+                                    <div>
+                                        <div class="text-sm font-semibold">{{t "tracking-page.settings.account-sign-in"}}</div>
+                                        <div class="text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.account-sign-in-help"}}</div>
+                                    </div>
+                                    <Toggle @isToggled={{this.config.access.account_sign_in}} @onToggle={{fn this.update "access.account_sign_in"}} />
+                                </div>
+                                <div class="flex items-start justify-between gap-4">
+                                    <div>
+                                        <div class="text-sm font-semibold">{{t "tracking-page.settings.account-upsell"}}</div>
+                                        <div class="text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.account-upsell-help"}}</div>
+                                    </div>
+                                    <Toggle @isToggled={{this.config.access.account_upsell}} @onToggle={{fn this.update "access.account_upsell"}} />
+                                </div>
+                            {{else}}
+                                <p class="text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.customer-portal-missing"}}</p>
+                            {{/if}}
+
+                            <p class="text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.code-rules"}}</p>
+                        </div>
+                    </ContentPanel>
+
+                    {{! ── What verified customers see ───────────────────────── }}
+                    <ContentPanel @title={{t "tracking-page.settings.visibility"}} @open={{true}} @wrapperClass="bordered-classic">
+                        <div class="space-y-4">
+                            {{#each (array "map" "driver_name" "vehicle" "items" "item_prices" "pod_photo" "pod_signature" "instructions_edit" "report_problem") as |key|}}
+                                <div class="flex items-start justify-between gap-4">
+                                    <div>
+                                        <div class="text-sm font-semibold">{{t (concat "tracking-page.settings.visibility-" key)}}</div>
+                                        <div class="text-xs text-gray-600 dark:text-gray-300">{{t (concat "tracking-page.settings.visibility-" key "-help")}}</div>
+                                    </div>
+                                    <Toggle @isToggled={{get this.config.visibility key}} @onToggle={{fn this.update (concat "visibility." key)}} />
+                                </div>
+                            {{/each}}
+
+                            <InputGroup @name={{t "tracking-page.settings.driver-contact"}} @helpText={{t "tracking-page.settings.driver-contact-help"}}>
+                                <Select
+                                    class="w-full"
+                                    @value={{this.config.visibility.driver_contact}}
+                                    @options={{this.driverContactOptions}}
+                                    @optionLabel="label"
+                                    @optionValue="value"
+                                    @onSelect={{fn this.selectOption "visibility.driver_contact"}}
+                                />
+                            </InputGroup>
+
+                            <p class="text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.privacy-rules"}}</p>
+                        </div>
+                    </ContentPanel>
+                </div>
+
+                {{! ── Live preview ───────────────────────────────────────────── }}
+                <div class="lg:sticky lg:top-6 space-y-3">
+                    <div class="text-sm font-semibold">{{t "tracking-page.settings.preview"}}</div>
+                    <TrackingPage::SettingsPreview @themeStyle={{this.previewLightStyle}} @displayName={{this.displayName}} @poweredBy={{this.config.branding.powered_by}} />
+                    <TrackingPage::SettingsPreview @themeStyle={{this.previewDarkStyle}} @displayName={{this.displayName}} @poweredBy={{this.config.branding.powered_by}} />
+                    <p class="text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.preview-help"}}</p>
+                </div>
+            </div>
+        {{/if}}
+    </div>
+    <Spacer @height="400px" />
+</Layout::Section::Body>
diff --git a/addon/utils/tracking-page-theme.js b/addon/utils/tracking-page-theme.js
new file mode 100644
index 000000000..44cf283b6
--- /dev/null
+++ b/addon/utils/tracking-page-theme.js
@@ -0,0 +1,123 @@
+/**
+ * Colour tokens for the customer tracking page, derived from a company's one accent colour.
+ *
+ * The server sanitizes and checks the same values (TrackingPageConfig); this mirrors it so
+ * the settings preview and the page itself re-theme live without a round trip.
+ */
+export const DEFAULT_ACCENT = '#1F5FA8';
+export const LIGHT_INK = '#FFFFFF';
+export const DARK_INK = '#14191A';
+
+const LIGHT_BASE = {
+    bg: '#F3F4F1',
+    surface: '#FFFFFF',
+    surface2: '#ECEEEA',
+    text: '#14191A',
+    muted: '#545D5F',
+    border: '#D9DED9',
+    warn: '#A8430B',
+    'warn-soft': '#FBEADF',
+    neutral: '#5F686A',
+};
+
+const DARK_BASE = {
+    bg: '#0D1112',
+    surface: '#151A1B',
+    surface2: '#1D2324',
+    text: '#E9EDEA',
+    muted: '#A1ABAB',
+    border: '#2B3335',
+    warn: '#F2A262',
+    'warn-soft': '#3A2416',
+    neutral: '#8E9899',
+};
+
+/**
+ * `#RGB` or `#RRGGBB` as uppercase `#RRGGBB`, or null.
+ */
+export function normalizeHex(value) {
+    const match = typeof value === 'string' ? value.trim().match(/^#?([0-9a-f]{3}|[0-9a-f]{6})$/i) : null;
+    if (!match) {
+        return null;
+    }
+
+    let hex = match[1];
+    if (hex.length === 3) {
+        hex = hex.replace(/./g, (char) => char + char);
+    }
+
+    return `#${hex.toUpperCase()}`;
+}
+
+function channels(hex) {
+    const value = hex.replace('#', '');
+    return [0, 2, 4].map((offset) => parseInt(value.slice(offset, offset + 2), 16));
+}
+
+function luminance(hex) {
+    const [r, g, b] = channels(hex).map((channel) => {
+        const value = channel / 255;
+        return value <= 0.03928 ? value / 12.92 : Math.pow((value + 0.055) / 1.055, 2.4);
+    });
+
+    return 0.2126 * r + 0.7152 * g + 0.0722 * b;
+}
+
+/**
+ * The WCAG contrast ratio of two `#RRGGBB` colours, rounded to two decimals.
+ */
+export function contrastRatio(a, b) {
+    const lighter = Math.max(luminance(a), luminance(b));
+    const darker = Math.min(luminance(a), luminance(b));
+
+    return Math.round(((lighter + 0.05) / (darker + 0.05)) * 100) / 100;
+}
+
+/**
+ * The text colour readable on an accent: white when it reaches 4.5:1, otherwise dark.
+ */
+export function inkFor(accent) {
+    return contrastRatio(accent, LIGHT_INK) >= 4.5 ? LIGHT_INK : DARK_INK;
+}
+
+/**
+ * A lighter accent for dark mode: the accent mixed toward white until it reads on the dark surface.
+ */
+export function darkAccentFor(accent) {
+    const [r, g, b] = channels(accent);
+    for (let weight = 0.25; weight <= 0.85; weight += 0.05) {
+        const mixed = [r, g, b].map((channel) => Math.round(channel + (255 - channel) * weight));
+        const hex = `#${mixed.map((channel) => channel.toString(16).padStart(2, '0')).join('')}`.toUpperCase();
+        if (contrastRatio(hex, DARK_BASE.surface) >= 4.5) {
+            return hex;
+        }
+    }
+
+    return '#FFFFFF';
+}
+
+/**
+ * The CSS custom properties for a page in the given mode, as a style string.
+ *
+ * @param {Object}  branding the config's branding group
+ * @param {Boolean} dark     whether the page renders dark
+ */
+export default function trackingPageTheme(branding = {}, dark = false) {
+    const accent = normalizeHex(branding.accent) ?? DEFAULT_ACCENT;
+    const darkAccent = normalizeHex(branding.accent_dark) ?? darkAccentFor(accent);
+    const modeAccent = dark ? darkAccent : accent;
+    const base = dark ? DARK_BASE : LIGHT_BASE;
+    const tokens = {
+        ...base,
+        accent: modeAccent,
+        ink: inkFor(modeAccent),
+        'accent-soft': `color-mix(in oklab, ${modeAccent} 14%, ${base.surface})`,
+    };
+
+    const declarations = [`color-scheme: ${dark ? 'dark' : 'light'}`];
+    for (const name of Object.keys(tokens)) {
+        declarations.push(`--tp-${name}: ${tokens[name]}`);
+    }
+
+    return declarations.join('; ');
+}
diff --git a/app/components/admin/tracking-page-settings.js b/app/components/admin/tracking-page-settings.js
new file mode 100644
index 000000000..1c9909605
--- /dev/null
+++ b/app/components/admin/tracking-page-settings.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/admin/tracking-page-settings';
diff --git a/app/components/tracking-page/settings-preview.js b/app/components/tracking-page/settings-preview.js
new file mode 100644
index 000000000..ae1b64f67
--- /dev/null
+++ b/app/components/tracking-page/settings-preview.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/settings-preview';
diff --git a/app/controllers/settings/tracking-page.js b/app/controllers/settings/tracking-page.js
new file mode 100644
index 000000000..36aeae542
--- /dev/null
+++ b/app/controllers/settings/tracking-page.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/controllers/settings/tracking-page';
diff --git a/app/routes/settings/tracking-page.js b/app/routes/settings/tracking-page.js
new file mode 100644
index 000000000..60bd69c6c
--- /dev/null
+++ b/app/routes/settings/tracking-page.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/routes/settings/tracking-page';
diff --git a/app/templates/settings/tracking-page.js b/app/templates/settings/tracking-page.js
new file mode 100644
index 000000000..ff6633827
--- /dev/null
+++ b/app/templates/settings/tracking-page.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/templates/settings/tracking-page';
diff --git a/app/utils/tracking-page-theme.js b/app/utils/tracking-page-theme.js
new file mode 100644
index 000000000..d705ae50f
--- /dev/null
+++ b/app/utils/tracking-page-theme.js
@@ -0,0 +1 @@
+export { default, normalizeHex, contrastRatio, inkFor, darkAccentFor, DEFAULT_ACCENT, LIGHT_INK, DARK_INK } from '@fleetbase/fleetops-engine/utils/tracking-page-theme';
diff --git a/translations/ar-ae.yml b/translations/ar-ae.yml
index 41a63f5cd..67da921fb 100644
--- a/translations/ar-ae.yml
+++ b/translations/ar-ae.yml
@@ -2032,3 +2032,91 @@ common:
   offline: غير متصل
   "yes": نعم
   "no": لا
+tracking-page:
+  settings:
+    title: "Tracking Page"
+    menu: "Tracking Page"
+    saved: "Tracking page settings saved."
+    load-failed: "We couldn't load the tracking page settings."
+    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
+    pages: "Pages"
+    org-page-enabled: "Your own tracking page"
+    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
+    slug: "Page address"
+    slug-checking: "Checking the address..."
+    open-page: "Open the page"
+    generic-page-allowed: "Allow tracking on the shared page"
+    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
+    links-target: "Links in emails and labels"
+    links-target-help: "Which page your notifications and labels send customers to."
+    links-target-auto: "Your page when it is on, otherwise the shared page"
+    links-target-org: "Always your page"
+    links-target-generic: "Always the shared page"
+    branding: "Branding"
+    display-name: "Display name"
+    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
+    accent: "Accent colour"
+    accent-hex: "Accent colour as a hex value"
+    contrast-ok: "Text on this colour is readable ({ratio}:1)."
+    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
+    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
+    accent-dark: "Accent colour in dark mode"
+    accent-dark-auto: "Automatic"
+    support-phone: "Support phone"
+    support-email: "Support email"
+    website: "Website"
+    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
+    powered-by: "Show \"Powered by Fleetbase\""
+    powered-by-help: "A small line in the page footer."
+    theme: "Light and dark"
+    theme-system: "Follow the customer's device"
+    theme-light: "Always light"
+    default-language: "Default language"
+    languages: "Languages customers can choose"
+    access: "Access"
+    public-status: "Show the status without verification"
+    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
+    channel-sms: "Verify by text message"
+    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
+    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
+    channel-email: "Verify by email"
+    channel-email-help: "Sends a 6-digit code to the email address on the order."
+    session-hours: "Stay verified for (hours)"
+    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
+    account-sign-in: "Let customers sign in"
+    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
+    account-upsell: "Suggest creating an account"
+    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
+    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
+    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
+    visibility: "What verified customers see"
+    visibility-map: "Live map"
+    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
+    visibility-driver_name: "Driver's first name"
+    visibility-driver_name-help: "Only the first name, never a surname or phone number."
+    visibility-vehicle: "Vehicle description"
+    visibility-vehicle-help: "For example \"White Ford Transit\"."
+    visibility-items: "Items in the delivery"
+    visibility-items-help: "Names, descriptions, quantities and photos."
+    visibility-item_prices: "Item prices"
+    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
+    visibility-pod_photo: "Delivery photo"
+    visibility-pod_photo-help: "The photo taken as proof of delivery."
+    visibility-pod_signature: "Signature"
+    visibility-pod_signature-help: "The signature captured as proof of delivery."
+    visibility-instructions_edit: "Let customers add delivery instructions"
+    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
+    visibility-report_problem: "Report a problem"
+    visibility-report_problem-help: "Lets customers send you a message about their delivery."
+    driver-contact: "Calls and messages go to"
+    driver-contact-help: "Who customers reach from the driver card."
+    driver-contact-company: "Your support team"
+    driver-contact-driver: "The driver directly"
+    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
+    preview: "Preview"
+    preview-help: "A sample in light and dark mode. Save to apply the changes."
+    preview-chip: "Verified on this device"
+    preview-headline: "Arriving today"
+    preview-sub: "2:10 to 2:40 pm"
+    preview-button: "Verify it's you"
+    preview-powered-by: "Powered by Fleetbase"
diff --git a/translations/bg-bg.yaml b/translations/bg-bg.yaml
index c0fd4cddb..bc47638da 100644
--- a/translations/bg-bg.yaml
+++ b/translations/bg-bg.yaml
@@ -2347,3 +2347,91 @@ trailer:
     dolly: Доли
     specialty: Специализирано
     other: Друго
+tracking-page:
+  settings:
+    title: "Tracking Page"
+    menu: "Tracking Page"
+    saved: "Tracking page settings saved."
+    load-failed: "We couldn't load the tracking page settings."
+    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
+    pages: "Pages"
+    org-page-enabled: "Your own tracking page"
+    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
+    slug: "Page address"
+    slug-checking: "Checking the address..."
+    open-page: "Open the page"
+    generic-page-allowed: "Allow tracking on the shared page"
+    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
+    links-target: "Links in emails and labels"
+    links-target-help: "Which page your notifications and labels send customers to."
+    links-target-auto: "Your page when it is on, otherwise the shared page"
+    links-target-org: "Always your page"
+    links-target-generic: "Always the shared page"
+    branding: "Branding"
+    display-name: "Display name"
+    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
+    accent: "Accent colour"
+    accent-hex: "Accent colour as a hex value"
+    contrast-ok: "Text on this colour is readable ({ratio}:1)."
+    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
+    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
+    accent-dark: "Accent colour in dark mode"
+    accent-dark-auto: "Automatic"
+    support-phone: "Support phone"
+    support-email: "Support email"
+    website: "Website"
+    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
+    powered-by: "Show \"Powered by Fleetbase\""
+    powered-by-help: "A small line in the page footer."
+    theme: "Light and dark"
+    theme-system: "Follow the customer's device"
+    theme-light: "Always light"
+    default-language: "Default language"
+    languages: "Languages customers can choose"
+    access: "Access"
+    public-status: "Show the status without verification"
+    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
+    channel-sms: "Verify by text message"
+    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
+    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
+    channel-email: "Verify by email"
+    channel-email-help: "Sends a 6-digit code to the email address on the order."
+    session-hours: "Stay verified for (hours)"
+    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
+    account-sign-in: "Let customers sign in"
+    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
+    account-upsell: "Suggest creating an account"
+    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
+    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
+    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
+    visibility: "What verified customers see"
+    visibility-map: "Live map"
+    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
+    visibility-driver_name: "Driver's first name"
+    visibility-driver_name-help: "Only the first name, never a surname or phone number."
+    visibility-vehicle: "Vehicle description"
+    visibility-vehicle-help: "For example \"White Ford Transit\"."
+    visibility-items: "Items in the delivery"
+    visibility-items-help: "Names, descriptions, quantities and photos."
+    visibility-item_prices: "Item prices"
+    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
+    visibility-pod_photo: "Delivery photo"
+    visibility-pod_photo-help: "The photo taken as proof of delivery."
+    visibility-pod_signature: "Signature"
+    visibility-pod_signature-help: "The signature captured as proof of delivery."
+    visibility-instructions_edit: "Let customers add delivery instructions"
+    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
+    visibility-report_problem: "Report a problem"
+    visibility-report_problem-help: "Lets customers send you a message about their delivery."
+    driver-contact: "Calls and messages go to"
+    driver-contact-help: "Who customers reach from the driver card."
+    driver-contact-company: "Your support team"
+    driver-contact-driver: "The driver directly"
+    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
+    preview: "Preview"
+    preview-help: "A sample in light and dark mode. Save to apply the changes."
+    preview-chip: "Verified on this device"
+    preview-headline: "Arriving today"
+    preview-sub: "2:10 to 2:40 pm"
+    preview-button: "Verify it's you"
+    preview-powered-by: "Powered by Fleetbase"
diff --git a/translations/en-us.yaml b/translations/en-us.yaml
index 058bd0f46..0a4b1b6bc 100644
--- a/translations/en-us.yaml
+++ b/translations/en-us.yaml
@@ -3612,3 +3612,91 @@ resource-summary:
         work-order: Work order
         zone: Zone
         zones: Zones
+tracking-page:
+  settings:
+    title: "Tracking Page"
+    menu: "Tracking Page"
+    saved: "Tracking page settings saved."
+    load-failed: "We couldn't load the tracking page settings."
+    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
+    pages: "Pages"
+    org-page-enabled: "Your own tracking page"
+    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
+    slug: "Page address"
+    slug-checking: "Checking the address..."
+    open-page: "Open the page"
+    generic-page-allowed: "Allow tracking on the shared page"
+    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
+    links-target: "Links in emails and labels"
+    links-target-help: "Which page your notifications and labels send customers to."
+    links-target-auto: "Your page when it is on, otherwise the shared page"
+    links-target-org: "Always your page"
+    links-target-generic: "Always the shared page"
+    branding: "Branding"
+    display-name: "Display name"
+    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
+    accent: "Accent colour"
+    accent-hex: "Accent colour as a hex value"
+    contrast-ok: "Text on this colour is readable ({ratio}:1)."
+    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
+    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
+    accent-dark: "Accent colour in dark mode"
+    accent-dark-auto: "Automatic"
+    support-phone: "Support phone"
+    support-email: "Support email"
+    website: "Website"
+    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
+    powered-by: "Show \"Powered by Fleetbase\""
+    powered-by-help: "A small line in the page footer."
+    theme: "Light and dark"
+    theme-system: "Follow the customer's device"
+    theme-light: "Always light"
+    default-language: "Default language"
+    languages: "Languages customers can choose"
+    access: "Access"
+    public-status: "Show the status without verification"
+    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
+    channel-sms: "Verify by text message"
+    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
+    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
+    channel-email: "Verify by email"
+    channel-email-help: "Sends a 6-digit code to the email address on the order."
+    session-hours: "Stay verified for (hours)"
+    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
+    account-sign-in: "Let customers sign in"
+    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
+    account-upsell: "Suggest creating an account"
+    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
+    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
+    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
+    visibility: "What verified customers see"
+    visibility-map: "Live map"
+    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
+    visibility-driver_name: "Driver's first name"
+    visibility-driver_name-help: "Only the first name, never a surname or phone number."
+    visibility-vehicle: "Vehicle description"
+    visibility-vehicle-help: "For example \"White Ford Transit\"."
+    visibility-items: "Items in the delivery"
+    visibility-items-help: "Names, descriptions, quantities and photos."
+    visibility-item_prices: "Item prices"
+    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
+    visibility-pod_photo: "Delivery photo"
+    visibility-pod_photo-help: "The photo taken as proof of delivery."
+    visibility-pod_signature: "Signature"
+    visibility-pod_signature-help: "The signature captured as proof of delivery."
+    visibility-instructions_edit: "Let customers add delivery instructions"
+    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
+    visibility-report_problem: "Report a problem"
+    visibility-report_problem-help: "Lets customers send you a message about their delivery."
+    driver-contact: "Calls and messages go to"
+    driver-contact-help: "Who customers reach from the driver card."
+    driver-contact-company: "Your support team"
+    driver-contact-driver: "The driver directly"
+    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
+    preview: "Preview"
+    preview-help: "A sample in light and dark mode. Save to apply the changes."
+    preview-chip: "Verified on this device"
+    preview-headline: "Arriving today"
+    preview-sub: "2:10 to 2:40 pm"
+    preview-button: "Verify it's you"
+    preview-powered-by: "Powered by Fleetbase"
diff --git a/translations/es-pa.yaml b/translations/es-pa.yaml
index 29a939394..82ae796e4 100644
--- a/translations/es-pa.yaml
+++ b/translations/es-pa.yaml
@@ -2226,3 +2226,91 @@ trailer:
     dolly: Dolly
     specialty: Especializado
     other: Otro
+tracking-page:
+  settings:
+    title: "Tracking Page"
+    menu: "Tracking Page"
+    saved: "Tracking page settings saved."
+    load-failed: "We couldn't load the tracking page settings."
+    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
+    pages: "Pages"
+    org-page-enabled: "Your own tracking page"
+    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
+    slug: "Page address"
+    slug-checking: "Checking the address..."
+    open-page: "Open the page"
+    generic-page-allowed: "Allow tracking on the shared page"
+    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
+    links-target: "Links in emails and labels"
+    links-target-help: "Which page your notifications and labels send customers to."
+    links-target-auto: "Your page when it is on, otherwise the shared page"
+    links-target-org: "Always your page"
+    links-target-generic: "Always the shared page"
+    branding: "Branding"
+    display-name: "Display name"
+    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
+    accent: "Accent colour"
+    accent-hex: "Accent colour as a hex value"
+    contrast-ok: "Text on this colour is readable ({ratio}:1)."
+    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
+    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
+    accent-dark: "Accent colour in dark mode"
+    accent-dark-auto: "Automatic"
+    support-phone: "Support phone"
+    support-email: "Support email"
+    website: "Website"
+    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
+    powered-by: "Show \"Powered by Fleetbase\""
+    powered-by-help: "A small line in the page footer."
+    theme: "Light and dark"
+    theme-system: "Follow the customer's device"
+    theme-light: "Always light"
+    default-language: "Default language"
+    languages: "Languages customers can choose"
+    access: "Access"
+    public-status: "Show the status without verification"
+    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
+    channel-sms: "Verify by text message"
+    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
+    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
+    channel-email: "Verify by email"
+    channel-email-help: "Sends a 6-digit code to the email address on the order."
+    session-hours: "Stay verified for (hours)"
+    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
+    account-sign-in: "Let customers sign in"
+    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
+    account-upsell: "Suggest creating an account"
+    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
+    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
+    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
+    visibility: "What verified customers see"
+    visibility-map: "Live map"
+    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
+    visibility-driver_name: "Driver's first name"
+    visibility-driver_name-help: "Only the first name, never a surname or phone number."
+    visibility-vehicle: "Vehicle description"
+    visibility-vehicle-help: "For example \"White Ford Transit\"."
+    visibility-items: "Items in the delivery"
+    visibility-items-help: "Names, descriptions, quantities and photos."
+    visibility-item_prices: "Item prices"
+    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
+    visibility-pod_photo: "Delivery photo"
+    visibility-pod_photo-help: "The photo taken as proof of delivery."
+    visibility-pod_signature: "Signature"
+    visibility-pod_signature-help: "The signature captured as proof of delivery."
+    visibility-instructions_edit: "Let customers add delivery instructions"
+    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
+    visibility-report_problem: "Report a problem"
+    visibility-report_problem-help: "Lets customers send you a message about their delivery."
+    driver-contact: "Calls and messages go to"
+    driver-contact-help: "Who customers reach from the driver card."
+    driver-contact-company: "Your support team"
+    driver-contact-driver: "The driver directly"
+    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
+    preview: "Preview"
+    preview-help: "A sample in light and dark mode. Save to apply the changes."
+    preview-chip: "Verified on this device"
+    preview-headline: "Arriving today"
+    preview-sub: "2:10 to 2:40 pm"
+    preview-button: "Verify it's you"
+    preview-powered-by: "Powered by Fleetbase"
diff --git a/translations/fr-fr.yaml b/translations/fr-fr.yaml
index ea8c3ee59..23806d26d 100644
--- a/translations/fr-fr.yaml
+++ b/translations/fr-fr.yaml
@@ -2372,3 +2372,91 @@ trailer:
     dolly: Dolly
     specialty: Spécialisée
     other: Autre
+tracking-page:
+  settings:
+    title: "Tracking Page"
+    menu: "Tracking Page"
+    saved: "Tracking page settings saved."
+    load-failed: "We couldn't load the tracking page settings."
+    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
+    pages: "Pages"
+    org-page-enabled: "Your own tracking page"
+    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
+    slug: "Page address"
+    slug-checking: "Checking the address..."
+    open-page: "Open the page"
+    generic-page-allowed: "Allow tracking on the shared page"
+    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
+    links-target: "Links in emails and labels"
+    links-target-help: "Which page your notifications and labels send customers to."
+    links-target-auto: "Your page when it is on, otherwise the shared page"
+    links-target-org: "Always your page"
+    links-target-generic: "Always the shared page"
+    branding: "Branding"
+    display-name: "Display name"
+    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
+    accent: "Accent colour"
+    accent-hex: "Accent colour as a hex value"
+    contrast-ok: "Text on this colour is readable ({ratio}:1)."
+    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
+    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
+    accent-dark: "Accent colour in dark mode"
+    accent-dark-auto: "Automatic"
+    support-phone: "Support phone"
+    support-email: "Support email"
+    website: "Website"
+    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
+    powered-by: "Show \"Powered by Fleetbase\""
+    powered-by-help: "A small line in the page footer."
+    theme: "Light and dark"
+    theme-system: "Follow the customer's device"
+    theme-light: "Always light"
+    default-language: "Default language"
+    languages: "Languages customers can choose"
+    access: "Access"
+    public-status: "Show the status without verification"
+    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
+    channel-sms: "Verify by text message"
+    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
+    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
+    channel-email: "Verify by email"
+    channel-email-help: "Sends a 6-digit code to the email address on the order."
+    session-hours: "Stay verified for (hours)"
+    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
+    account-sign-in: "Let customers sign in"
+    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
+    account-upsell: "Suggest creating an account"
+    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
+    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
+    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
+    visibility: "What verified customers see"
+    visibility-map: "Live map"
+    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
+    visibility-driver_name: "Driver's first name"
+    visibility-driver_name-help: "Only the first name, never a surname or phone number."
+    visibility-vehicle: "Vehicle description"
+    visibility-vehicle-help: "For example \"White Ford Transit\"."
+    visibility-items: "Items in the delivery"
+    visibility-items-help: "Names, descriptions, quantities and photos."
+    visibility-item_prices: "Item prices"
+    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
+    visibility-pod_photo: "Delivery photo"
+    visibility-pod_photo-help: "The photo taken as proof of delivery."
+    visibility-pod_signature: "Signature"
+    visibility-pod_signature-help: "The signature captured as proof of delivery."
+    visibility-instructions_edit: "Let customers add delivery instructions"
+    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
+    visibility-report_problem: "Report a problem"
+    visibility-report_problem-help: "Lets customers send you a message about their delivery."
+    driver-contact: "Calls and messages go to"
+    driver-contact-help: "Who customers reach from the driver card."
+    driver-contact-company: "Your support team"
+    driver-contact-driver: "The driver directly"
+    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
+    preview: "Preview"
+    preview-help: "A sample in light and dark mode. Save to apply the changes."
+    preview-chip: "Verified on this device"
+    preview-headline: "Arriving today"
+    preview-sub: "2:10 to 2:40 pm"
+    preview-button: "Verify it's you"
+    preview-powered-by: "Powered by Fleetbase"
diff --git a/translations/mn-mn.yaml b/translations/mn-mn.yaml
index 556d1b3c4..c48782398 100644
--- a/translations/mn-mn.yaml
+++ b/translations/mn-mn.yaml
@@ -2316,3 +2316,91 @@ trailer:
     dolly: Долли
     specialty: Тусгай зориулалтын
     other: Бусад
+tracking-page:
+  settings:
+    title: "Tracking Page"
+    menu: "Tracking Page"
+    saved: "Tracking page settings saved."
+    load-failed: "We couldn't load the tracking page settings."
+    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
+    pages: "Pages"
+    org-page-enabled: "Your own tracking page"
+    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
+    slug: "Page address"
+    slug-checking: "Checking the address..."
+    open-page: "Open the page"
+    generic-page-allowed: "Allow tracking on the shared page"
+    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
+    links-target: "Links in emails and labels"
+    links-target-help: "Which page your notifications and labels send customers to."
+    links-target-auto: "Your page when it is on, otherwise the shared page"
+    links-target-org: "Always your page"
+    links-target-generic: "Always the shared page"
+    branding: "Branding"
+    display-name: "Display name"
+    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
+    accent: "Accent colour"
+    accent-hex: "Accent colour as a hex value"
+    contrast-ok: "Text on this colour is readable ({ratio}:1)."
+    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
+    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
+    accent-dark: "Accent colour in dark mode"
+    accent-dark-auto: "Automatic"
+    support-phone: "Support phone"
+    support-email: "Support email"
+    website: "Website"
+    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
+    powered-by: "Show \"Powered by Fleetbase\""
+    powered-by-help: "A small line in the page footer."
+    theme: "Light and dark"
+    theme-system: "Follow the customer's device"
+    theme-light: "Always light"
+    default-language: "Default language"
+    languages: "Languages customers can choose"
+    access: "Access"
+    public-status: "Show the status without verification"
+    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
+    channel-sms: "Verify by text message"
+    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
+    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
+    channel-email: "Verify by email"
+    channel-email-help: "Sends a 6-digit code to the email address on the order."
+    session-hours: "Stay verified for (hours)"
+    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
+    account-sign-in: "Let customers sign in"
+    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
+    account-upsell: "Suggest creating an account"
+    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
+    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
+    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
+    visibility: "What verified customers see"
+    visibility-map: "Live map"
+    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
+    visibility-driver_name: "Driver's first name"
+    visibility-driver_name-help: "Only the first name, never a surname or phone number."
+    visibility-vehicle: "Vehicle description"
+    visibility-vehicle-help: "For example \"White Ford Transit\"."
+    visibility-items: "Items in the delivery"
+    visibility-items-help: "Names, descriptions, quantities and photos."
+    visibility-item_prices: "Item prices"
+    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
+    visibility-pod_photo: "Delivery photo"
+    visibility-pod_photo-help: "The photo taken as proof of delivery."
+    visibility-pod_signature: "Signature"
+    visibility-pod_signature-help: "The signature captured as proof of delivery."
+    visibility-instructions_edit: "Let customers add delivery instructions"
+    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
+    visibility-report_problem: "Report a problem"
+    visibility-report_problem-help: "Lets customers send you a message about their delivery."
+    driver-contact: "Calls and messages go to"
+    driver-contact-help: "Who customers reach from the driver card."
+    driver-contact-company: "Your support team"
+    driver-contact-driver: "The driver directly"
+    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
+    preview: "Preview"
+    preview-help: "A sample in light and dark mode. Save to apply the changes."
+    preview-chip: "Verified on this device"
+    preview-headline: "Arriving today"
+    preview-sub: "2:10 to 2:40 pm"
+    preview-button: "Verify it's you"
+    preview-powered-by: "Powered by Fleetbase"
diff --git a/translations/pt-br.yaml b/translations/pt-br.yaml
index 40d2fdde7..ffedae57b 100644
--- a/translations/pt-br.yaml
+++ b/translations/pt-br.yaml
@@ -2337,3 +2337,91 @@ trailer:
     dolly: Dolly
     specialty: Especial
     other: Outro
+tracking-page:
+  settings:
+    title: "Tracking Page"
+    menu: "Tracking Page"
+    saved: "Tracking page settings saved."
+    load-failed: "We couldn't load the tracking page settings."
+    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
+    pages: "Pages"
+    org-page-enabled: "Your own tracking page"
+    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
+    slug: "Page address"
+    slug-checking: "Checking the address..."
+    open-page: "Open the page"
+    generic-page-allowed: "Allow tracking on the shared page"
+    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
+    links-target: "Links in emails and labels"
+    links-target-help: "Which page your notifications and labels send customers to."
+    links-target-auto: "Your page when it is on, otherwise the shared page"
+    links-target-org: "Always your page"
+    links-target-generic: "Always the shared page"
+    branding: "Branding"
+    display-name: "Display name"
+    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
+    accent: "Accent colour"
+    accent-hex: "Accent colour as a hex value"
+    contrast-ok: "Text on this colour is readable ({ratio}:1)."
+    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
+    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
+    accent-dark: "Accent colour in dark mode"
+    accent-dark-auto: "Automatic"
+    support-phone: "Support phone"
+    support-email: "Support email"
+    website: "Website"
+    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
+    powered-by: "Show \"Powered by Fleetbase\""
+    powered-by-help: "A small line in the page footer."
+    theme: "Light and dark"
+    theme-system: "Follow the customer's device"
+    theme-light: "Always light"
+    default-language: "Default language"
+    languages: "Languages customers can choose"
+    access: "Access"
+    public-status: "Show the status without verification"
+    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
+    channel-sms: "Verify by text message"
+    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
+    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
+    channel-email: "Verify by email"
+    channel-email-help: "Sends a 6-digit code to the email address on the order."
+    session-hours: "Stay verified for (hours)"
+    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
+    account-sign-in: "Let customers sign in"
+    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
+    account-upsell: "Suggest creating an account"
+    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
+    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
+    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
+    visibility: "What verified customers see"
+    visibility-map: "Live map"
+    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
+    visibility-driver_name: "Driver's first name"
+    visibility-driver_name-help: "Only the first name, never a surname or phone number."
+    visibility-vehicle: "Vehicle description"
+    visibility-vehicle-help: "For example \"White Ford Transit\"."
+    visibility-items: "Items in the delivery"
+    visibility-items-help: "Names, descriptions, quantities and photos."
+    visibility-item_prices: "Item prices"
+    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
+    visibility-pod_photo: "Delivery photo"
+    visibility-pod_photo-help: "The photo taken as proof of delivery."
+    visibility-pod_signature: "Signature"
+    visibility-pod_signature-help: "The signature captured as proof of delivery."
+    visibility-instructions_edit: "Let customers add delivery instructions"
+    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
+    visibility-report_problem: "Report a problem"
+    visibility-report_problem-help: "Lets customers send you a message about their delivery."
+    driver-contact: "Calls and messages go to"
+    driver-contact-help: "Who customers reach from the driver card."
+    driver-contact-company: "Your support team"
+    driver-contact-driver: "The driver directly"
+    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
+    preview: "Preview"
+    preview-help: "A sample in light and dark mode. Save to apply the changes."
+    preview-chip: "Verified on this device"
+    preview-headline: "Arriving today"
+    preview-sub: "2:10 to 2:40 pm"
+    preview-button: "Verify it's you"
+    preview-powered-by: "Powered by Fleetbase"
diff --git a/translations/ru-ru.yaml b/translations/ru-ru.yaml
index 492dacfbb..089e1773c 100644
--- a/translations/ru-ru.yaml
+++ b/translations/ru-ru.yaml
@@ -2330,3 +2330,91 @@ trailer:
     dolly: Подкатная тележка
     specialty: Специальный
     other: Другое
+tracking-page:
+  settings:
+    title: "Tracking Page"
+    menu: "Tracking Page"
+    saved: "Tracking page settings saved."
+    load-failed: "We couldn't load the tracking page settings."
+    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
+    pages: "Pages"
+    org-page-enabled: "Your own tracking page"
+    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
+    slug: "Page address"
+    slug-checking: "Checking the address..."
+    open-page: "Open the page"
+    generic-page-allowed: "Allow tracking on the shared page"
+    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
+    links-target: "Links in emails and labels"
+    links-target-help: "Which page your notifications and labels send customers to."
+    links-target-auto: "Your page when it is on, otherwise the shared page"
+    links-target-org: "Always your page"
+    links-target-generic: "Always the shared page"
+    branding: "Branding"
+    display-name: "Display name"
+    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
+    accent: "Accent colour"
+    accent-hex: "Accent colour as a hex value"
+    contrast-ok: "Text on this colour is readable ({ratio}:1)."
+    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
+    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
+    accent-dark: "Accent colour in dark mode"
+    accent-dark-auto: "Automatic"
+    support-phone: "Support phone"
+    support-email: "Support email"
+    website: "Website"
+    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
+    powered-by: "Show \"Powered by Fleetbase\""
+    powered-by-help: "A small line in the page footer."
+    theme: "Light and dark"
+    theme-system: "Follow the customer's device"
+    theme-light: "Always light"
+    default-language: "Default language"
+    languages: "Languages customers can choose"
+    access: "Access"
+    public-status: "Show the status without verification"
+    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
+    channel-sms: "Verify by text message"
+    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
+    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
+    channel-email: "Verify by email"
+    channel-email-help: "Sends a 6-digit code to the email address on the order."
+    session-hours: "Stay verified for (hours)"
+    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
+    account-sign-in: "Let customers sign in"
+    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
+    account-upsell: "Suggest creating an account"
+    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
+    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
+    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
+    visibility: "What verified customers see"
+    visibility-map: "Live map"
+    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
+    visibility-driver_name: "Driver's first name"
+    visibility-driver_name-help: "Only the first name, never a surname or phone number."
+    visibility-vehicle: "Vehicle description"
+    visibility-vehicle-help: "For example \"White Ford Transit\"."
+    visibility-items: "Items in the delivery"
+    visibility-items-help: "Names, descriptions, quantities and photos."
+    visibility-item_prices: "Item prices"
+    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
+    visibility-pod_photo: "Delivery photo"
+    visibility-pod_photo-help: "The photo taken as proof of delivery."
+    visibility-pod_signature: "Signature"
+    visibility-pod_signature-help: "The signature captured as proof of delivery."
+    visibility-instructions_edit: "Let customers add delivery instructions"
+    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
+    visibility-report_problem: "Report a problem"
+    visibility-report_problem-help: "Lets customers send you a message about their delivery."
+    driver-contact: "Calls and messages go to"
+    driver-contact-help: "Who customers reach from the driver card."
+    driver-contact-company: "Your support team"
+    driver-contact-driver: "The driver directly"
+    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
+    preview: "Preview"
+    preview-help: "A sample in light and dark mode. Save to apply the changes."
+    preview-chip: "Verified on this device"
+    preview-headline: "Arriving today"
+    preview-sub: "2:10 to 2:40 pm"
+    preview-button: "Verify it's you"
+    preview-powered-by: "Powered by Fleetbase"
diff --git a/translations/uk-ua.yaml b/translations/uk-ua.yaml
index 86363b30f..e3985830d 100644
--- a/translations/uk-ua.yaml
+++ b/translations/uk-ua.yaml
@@ -3472,4 +3472,92 @@ resource-summary:
         window: Вікно (часове)
         work-order: Робоче завдання
         zone: Зона
-        zones: Зони
\ No newline at end of file
+        zones: Зони
+tracking-page:
+  settings:
+    title: "Tracking Page"
+    menu: "Tracking Page"
+    saved: "Tracking page settings saved."
+    load-failed: "We couldn't load the tracking page settings."
+    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
+    pages: "Pages"
+    org-page-enabled: "Your own tracking page"
+    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
+    slug: "Page address"
+    slug-checking: "Checking the address..."
+    open-page: "Open the page"
+    generic-page-allowed: "Allow tracking on the shared page"
+    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
+    links-target: "Links in emails and labels"
+    links-target-help: "Which page your notifications and labels send customers to."
+    links-target-auto: "Your page when it is on, otherwise the shared page"
+    links-target-org: "Always your page"
+    links-target-generic: "Always the shared page"
+    branding: "Branding"
+    display-name: "Display name"
+    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
+    accent: "Accent colour"
+    accent-hex: "Accent colour as a hex value"
+    contrast-ok: "Text on this colour is readable ({ratio}:1)."
+    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
+    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
+    accent-dark: "Accent colour in dark mode"
+    accent-dark-auto: "Automatic"
+    support-phone: "Support phone"
+    support-email: "Support email"
+    website: "Website"
+    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
+    powered-by: "Show \"Powered by Fleetbase\""
+    powered-by-help: "A small line in the page footer."
+    theme: "Light and dark"
+    theme-system: "Follow the customer's device"
+    theme-light: "Always light"
+    default-language: "Default language"
+    languages: "Languages customers can choose"
+    access: "Access"
+    public-status: "Show the status without verification"
+    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
+    channel-sms: "Verify by text message"
+    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
+    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
+    channel-email: "Verify by email"
+    channel-email-help: "Sends a 6-digit code to the email address on the order."
+    session-hours: "Stay verified for (hours)"
+    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
+    account-sign-in: "Let customers sign in"
+    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
+    account-upsell: "Suggest creating an account"
+    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
+    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
+    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
+    visibility: "What verified customers see"
+    visibility-map: "Live map"
+    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
+    visibility-driver_name: "Driver's first name"
+    visibility-driver_name-help: "Only the first name, never a surname or phone number."
+    visibility-vehicle: "Vehicle description"
+    visibility-vehicle-help: "For example \"White Ford Transit\"."
+    visibility-items: "Items in the delivery"
+    visibility-items-help: "Names, descriptions, quantities and photos."
+    visibility-item_prices: "Item prices"
+    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
+    visibility-pod_photo: "Delivery photo"
+    visibility-pod_photo-help: "The photo taken as proof of delivery."
+    visibility-pod_signature: "Signature"
+    visibility-pod_signature-help: "The signature captured as proof of delivery."
+    visibility-instructions_edit: "Let customers add delivery instructions"
+    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
+    visibility-report_problem: "Report a problem"
+    visibility-report_problem-help: "Lets customers send you a message about their delivery."
+    driver-contact: "Calls and messages go to"
+    driver-contact-help: "Who customers reach from the driver card."
+    driver-contact-company: "Your support team"
+    driver-contact-driver: "The driver directly"
+    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
+    preview: "Preview"
+    preview-help: "A sample in light and dark mode. Save to apply the changes."
+    preview-chip: "Verified on this device"
+    preview-headline: "Arriving today"
+    preview-sub: "2:10 to 2:40 pm"
+    preview-button: "Verify it's you"
+    preview-powered-by: "Powered by Fleetbase"
diff --git a/translations/vi-vn.yaml b/translations/vi-vn.yaml
index c0ebc5e5a..16c0f1496 100644
--- a/translations/vi-vn.yaml
+++ b/translations/vi-vn.yaml
@@ -2146,3 +2146,91 @@ trailer:
     dolly: Dolly
     specialty: Chuyên dụng
     other: Khác
+tracking-page:
+  settings:
+    title: "Tracking Page"
+    menu: "Tracking Page"
+    saved: "Tracking page settings saved."
+    load-failed: "We couldn't load the tracking page settings."
+    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
+    pages: "Pages"
+    org-page-enabled: "Your own tracking page"
+    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
+    slug: "Page address"
+    slug-checking: "Checking the address..."
+    open-page: "Open the page"
+    generic-page-allowed: "Allow tracking on the shared page"
+    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
+    links-target: "Links in emails and labels"
+    links-target-help: "Which page your notifications and labels send customers to."
+    links-target-auto: "Your page when it is on, otherwise the shared page"
+    links-target-org: "Always your page"
+    links-target-generic: "Always the shared page"
+    branding: "Branding"
+    display-name: "Display name"
+    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
+    accent: "Accent colour"
+    accent-hex: "Accent colour as a hex value"
+    contrast-ok: "Text on this colour is readable ({ratio}:1)."
+    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
+    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
+    accent-dark: "Accent colour in dark mode"
+    accent-dark-auto: "Automatic"
+    support-phone: "Support phone"
+    support-email: "Support email"
+    website: "Website"
+    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
+    powered-by: "Show \"Powered by Fleetbase\""
+    powered-by-help: "A small line in the page footer."
+    theme: "Light and dark"
+    theme-system: "Follow the customer's device"
+    theme-light: "Always light"
+    default-language: "Default language"
+    languages: "Languages customers can choose"
+    access: "Access"
+    public-status: "Show the status without verification"
+    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
+    channel-sms: "Verify by text message"
+    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
+    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
+    channel-email: "Verify by email"
+    channel-email-help: "Sends a 6-digit code to the email address on the order."
+    session-hours: "Stay verified for (hours)"
+    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
+    account-sign-in: "Let customers sign in"
+    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
+    account-upsell: "Suggest creating an account"
+    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
+    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
+    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
+    visibility: "What verified customers see"
+    visibility-map: "Live map"
+    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
+    visibility-driver_name: "Driver's first name"
+    visibility-driver_name-help: "Only the first name, never a surname or phone number."
+    visibility-vehicle: "Vehicle description"
+    visibility-vehicle-help: "For example \"White Ford Transit\"."
+    visibility-items: "Items in the delivery"
+    visibility-items-help: "Names, descriptions, quantities and photos."
+    visibility-item_prices: "Item prices"
+    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
+    visibility-pod_photo: "Delivery photo"
+    visibility-pod_photo-help: "The photo taken as proof of delivery."
+    visibility-pod_signature: "Signature"
+    visibility-pod_signature-help: "The signature captured as proof of delivery."
+    visibility-instructions_edit: "Let customers add delivery instructions"
+    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
+    visibility-report_problem: "Report a problem"
+    visibility-report_problem-help: "Lets customers send you a message about their delivery."
+    driver-contact: "Calls and messages go to"
+    driver-contact-help: "Who customers reach from the driver card."
+    driver-contact-company: "Your support team"
+    driver-contact-driver: "The driver directly"
+    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
+    preview: "Preview"
+    preview-help: "A sample in light and dark mode. Save to apply the changes."
+    preview-chip: "Verified on this device"
+    preview-headline: "Arriving today"
+    preview-sub: "2:10 to 2:40 pm"
+    preview-button: "Verify it's you"
+    preview-powered-by: "Powered by Fleetbase"

From cab38a60400813af074e76e11b92756c8276964c Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 14:49:35 +0800
Subject: [PATCH 09/87] fix(tracking-page): fall back to defaults for missing
 booleans

filter_var(null, FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE) returns
false, not null, so every unset toggle (generic page allowed, powered by, the
visibility defaults) came out false instead of its default.
---
 server/src/Support/TrackingPage/TrackingPageConfig.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server/src/Support/TrackingPage/TrackingPageConfig.php b/server/src/Support/TrackingPage/TrackingPageConfig.php
index 783965d07..646c79de1 100644
--- a/server/src/Support/TrackingPage/TrackingPageConfig.php
+++ b/server/src/Support/TrackingPage/TrackingPageConfig.php
@@ -185,6 +185,11 @@ protected static function bool(mixed $value, bool $default): bool
             return $value;
         }
 
+        // filter_var() reads null as false, so a missing value must fall back explicitly.
+        if ($value === null || $value === '') {
+            return $default;
+        }
+
         return filter_var($value, FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE) ?? $default;
     }
 

From 4ef4dd8bb4013945faba5022fe71160ec7d24d94 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 14:58:57 +0800
Subject: [PATCH 10/87] style: wrap the tracking page sidebar item for prettier

---
 addon/components/layout/fleet-ops-sidebar.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/addon/components/layout/fleet-ops-sidebar.js b/addon/components/layout/fleet-ops-sidebar.js
index 850a6b091..6c643569d 100644
--- a/addon/components/layout/fleet-ops-sidebar.js
+++ b/addon/components/layout/fleet-ops-sidebar.js
@@ -208,7 +208,13 @@ export default class LayoutFleetOpsSidebarComponent extends Component {
             this.createItem('menu.routing', 'route', 'settings.routing', 'fleet-ops view routing-settings', 'fleet-ops see routing-settings'),
             this.createItem('menu.orchestrator', 'circle-nodes', 'settings.orchestrator', 'fleet-ops view routing-settings', 'fleet-ops see routing-settings'),
             this.createItem('menu.scheduling', 'calendar-days', 'settings.scheduling', 'fleet-ops view scheduling-settings', 'fleet-ops see scheduling-settings'),
-            this.createItem('tracking-page.settings.menu', 'magnifying-glass-location', 'settings.tracking-page', 'fleet-ops view tracking-page-settings', 'fleet-ops see tracking-page-settings'),
+            this.createItem(
+                'tracking-page.settings.menu',
+                'magnifying-glass-location',
+                'settings.tracking-page',
+                'fleet-ops view tracking-page-settings',
+                'fleet-ops see tracking-page-settings'
+            ),
             this.createItem('menu.telematics-settings', 'satellite-dish', 'settings.telematics', 'fleet-ops view telematics-settings', 'fleet-ops see telematics-settings'),
             this.createItem('menu.custom-fields', 'pen-to-square', 'settings.custom-fields', 'fleet-ops list custom-field', 'fleet-ops see custom-field'),
             this.createItem('menu.avatars', 'icons', 'settings.avatars', 'fleet-ops list avatar', 'fleet-ops see avatar'),

From 9b8c582d62e83e54687a5fe029666cc9fa648e93 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 15:07:04 +0800
Subject: [PATCH 11/87] feat(socket-auth): fleetops channel resolvers, driver
 socket tokens, per-customer tracking channel

- Register who may subscribe to every FleetOps channel prefix with the core
  SocketChannelRegistry: company match for console users and API credentials;
  narrow rules for drivers (own record, current vehicle and its devices and
  positions, assigned orders incl. via payload entities) and customers (own
  orders, driver and vehicle of their active orders). tracking.* is denied
  by the registry (reachable only through a scoped tracking token).
- Claim Sanctum users who drive for the current company as driver socket
  principals on v1/socket/token.
- positions/replay validates channel_id with the ChannelAuthorizer when socket
  authentication is on.
- Public tracking channel: TrackingScope (one customer of one order),
  TrackingChannel (name/opaque id/token via core-api), TrackingUpdate
  (sanitized per-customer payload) and TrackingPublisher (gated, throttled,
  queued) publishing on order, stop and position changes.
- Require fleetbase/core-api ^1.6.69.
---
 composer.json                                 |   2 +-
 .../Controllers/Api/v1/DriverController.php   |   2 +
 .../Controllers/Api/v1/VehicleController.php  |   2 +
 .../Internal/v1/PositionController.php        |  22 +
 server/src/Jobs/PublishTrackingUpdate.php     |  50 +++
 .../src/Listeners/PublishTrackingUpdates.php  |  27 ++
 server/src/Observers/OrderObserver.php        |   4 +
 server/src/Providers/EventServiceProvider.php |  11 +
 .../src/Providers/FleetOpsServiceProvider.php |  11 +
 server/src/Support/SocketChannels.php         | 346 +++++++++++++++
 .../Support/Telematics/TelematicService.php   |   2 +
 server/src/Support/TrackingChannel.php        |  55 +++
 server/src/Support/TrackingPublisher.php      | 249 +++++++++++
 server/src/Support/TrackingScope.php          | 182 ++++++++
 server/src/Support/TrackingUpdate.php         | 400 +++++++++++++++++
 .../PositionControllerReplayChannelTest.php   | 131 ++++++
 .../tests/Unit/Support/SocketChannelsTest.php | 394 +++++++++++++++++
 .../Unit/Support/TrackingChannelTest.php      | 228 ++++++++++
 .../Unit/Support/TrackingPublisherTest.php    | 417 ++++++++++++++++++
 .../tests/Unit/Support/TrackingUpdateTest.php | 363 +++++++++++++++
 20 files changed, 2897 insertions(+), 1 deletion(-)
 create mode 100644 server/src/Jobs/PublishTrackingUpdate.php
 create mode 100644 server/src/Listeners/PublishTrackingUpdates.php
 create mode 100644 server/src/Support/SocketChannels.php
 create mode 100644 server/src/Support/TrackingChannel.php
 create mode 100644 server/src/Support/TrackingPublisher.php
 create mode 100644 server/src/Support/TrackingScope.php
 create mode 100644 server/src/Support/TrackingUpdate.php
 create mode 100644 server/tests/Feature/Http/Internal/PositionControllerReplayChannelTest.php
 create mode 100644 server/tests/Unit/Support/SocketChannelsTest.php
 create mode 100644 server/tests/Unit/Support/TrackingChannelTest.php
 create mode 100644 server/tests/Unit/Support/TrackingPublisherTest.php
 create mode 100644 server/tests/Unit/Support/TrackingUpdateTest.php

diff --git a/composer.json b/composer.json
index b7a38393e..aada759a1 100644
--- a/composer.json
+++ b/composer.json
@@ -25,7 +25,7 @@
         "barryvdh/laravel-dompdf": "^3.1",
         "brick/geo": "0.7.2",
         "cknow/laravel-money": "^7.1",
-        "fleetbase/core-api": ">=1.6.65",
+        "fleetbase/core-api": "^1.6.69",
         "geocoder-php/google-maps-places-provider": "^1.4",
         "giggsey/libphonenumber-for-php": "^8.13",
         "league/geotools": "^1.1.0",
diff --git a/server/src/Http/Controllers/Api/v1/DriverController.php b/server/src/Http/Controllers/Api/v1/DriverController.php
index 1fbacbe1d..82d0d6b16 100644
--- a/server/src/Http/Controllers/Api/v1/DriverController.php
+++ b/server/src/Http/Controllers/Api/v1/DriverController.php
@@ -24,6 +24,7 @@
 use Fleetbase\FleetOps\Support\GeofenceIntersectionService;
 use Fleetbase\FleetOps\Support\OSRM;
 use Fleetbase\FleetOps\Support\ProfileAccountManager;
+use Fleetbase\FleetOps\Support\TrackingPublisher;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Http\Requests\SwitchOrganizationRequest;
@@ -374,6 +375,7 @@ public function track(string $id, Request $request)
         }
 
         broadcast(new DriverLocationChanged($driver));
+        app(TrackingPublisher::class)->driverMoved($driver);
 
         // ----------------------------------------------------------------
         // Geofence intersection detection
diff --git a/server/src/Http/Controllers/Api/v1/VehicleController.php b/server/src/Http/Controllers/Api/v1/VehicleController.php
index 04f293d1a..099d1b9ab 100644
--- a/server/src/Http/Controllers/Api/v1/VehicleController.php
+++ b/server/src/Http/Controllers/Api/v1/VehicleController.php
@@ -18,6 +18,7 @@
 use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Models\Warranty;
 use Fleetbase\FleetOps\Support\GeofenceIntersectionService;
+use Fleetbase\FleetOps\Support\TrackingPublisher;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\LaravelMysqlSpatial\Types\Point;
@@ -298,6 +299,7 @@ public function track(string $id, Request $request)
         $vehicle->createPosition($positionData);
 
         broadcast(new VehicleLocationChanged($vehicle));
+        app(TrackingPublisher::class)->vehicleMoved($vehicle);
 
         try {
             $newLocation     = new Point($latitude, $longitude);
diff --git a/server/src/Http/Controllers/Internal/v1/PositionController.php b/server/src/Http/Controllers/Internal/v1/PositionController.php
index df12743e9..0d6865e9c 100644
--- a/server/src/Http/Controllers/Internal/v1/PositionController.php
+++ b/server/src/Http/Controllers/Internal/v1/PositionController.php
@@ -6,6 +6,10 @@
 use Fleetbase\FleetOps\Jobs\ReplayPositions;
 use Fleetbase\FleetOps\Models\Position;
 use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\Models\User;
+use Fleetbase\Support\SocketCluster\ChannelAuthorizer;
+use Fleetbase\Support\SocketCluster\SocketPrincipal;
+use Fleetbase\Support\SocketCluster\SocketToken;
 use Illuminate\Http\Request;
 
 class PositionController extends FleetOpsController
@@ -37,6 +41,11 @@ public function replay(Request $request)
             return response()->error('Position IDs are required');
         }
 
+        // With socket authentication on, the replay may only publish to a channel the user could subscribe to.
+        if (SocketToken::enabled() && !$this->canReplayTo($request, $channelId)) {
+            return response()->error('You are not allowed to replay positions to this channel.', 403);
+        }
+
         $positions = Position::whereIn('uuid', $positionIds)
             ->where('company_uuid', session('company'))
             ->orderBy('created_at')
@@ -57,6 +66,19 @@ public function replay(Request $request)
         ]);
     }
 
+    /**
+     * Whether the requesting user may subscribe to, and so receive a replay on, the channel.
+     */
+    protected function canReplayTo(Request $request, mixed $channelId): bool
+    {
+        $user = $request->user();
+        if (!$user instanceof User || !is_string($channelId) || $channelId === '' || strlen($channelId) > 255 || preg_match('/\s/', $channelId)) {
+            return false;
+        }
+
+        return app(ChannelAuthorizer::class)->authorize(SocketPrincipal::forUser($user, session('company')), $channelId)->allow;
+    }
+
     /**
      * Get position statistics/metrics.
      *
diff --git a/server/src/Jobs/PublishTrackingUpdate.php b/server/src/Jobs/PublishTrackingUpdate.php
new file mode 100644
index 000000000..63dba3e4c
--- /dev/null
+++ b/server/src/Jobs/PublishTrackingUpdate.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace Fleetbase\FleetOps\Jobs;
+
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Support\TrackingPublisher;
+use Fleetbase\FleetOps\Support\TrackingUpdate;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Support\Facades\Cache;
+
+/**
+ * Builds and publishes an order's public tracking updates off the request path.
+ *
+ * Location jobs publish the position only, except that at most once per ETA interval they
+ * publish the full update instead so that customers' ETAs follow the vehicle.
+ */
+class PublishTrackingUpdate implements ShouldQueue
+{
+    use Dispatchable;
+    use InteractsWithQueue;
+    use Queueable;
+
+    public $tries   = 1;
+    public $timeout = 60;
+
+    public function __construct(public string $orderUuid, public string $reason = TrackingUpdate::REASON_STATUS, public ?string $dbConnection = null)
+    {
+    }
+
+    public function handle(TrackingPublisher $publisher): int
+    {
+        $order = Order::on($this->dbConnection)->where('uuid', $this->orderUuid)->first();
+        if (!$order) {
+            return 0;
+        }
+
+        if ($this->reason !== TrackingUpdate::REASON_LOCATION) {
+            return $publisher->publishOrder($order, $this->reason);
+        }
+
+        if (Cache::add('fleetops:tracking:eta:' . $order->uuid, 1, TrackingPublisher::ETA_INTERVAL)) {
+            return $publisher->publishOrder($order, TrackingUpdate::REASON_ETA);
+        }
+
+        return $publisher->publishLocation($order);
+    }
+}
diff --git a/server/src/Listeners/PublishTrackingUpdates.php b/server/src/Listeners/PublishTrackingUpdates.php
new file mode 100644
index 000000000..20a4b1e81
--- /dev/null
+++ b/server/src/Listeners/PublishTrackingUpdates.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Fleetbase\FleetOps\Listeners;
+
+use Fleetbase\FleetOps\Support\TrackingPublisher;
+
+/**
+ * Queues public tracking updates when a waypoint's or an entity's activity changes.
+ *
+ * Runs synchronously but only looks up the order and queues a job, and does nothing at all
+ * while socket authentication is off.
+ */
+class PublishTrackingUpdates
+{
+    public function __construct(protected ?TrackingPublisher $publisher = null)
+    {
+        $this->publisher ??= app(TrackingPublisher::class);
+    }
+
+    /**
+     * @param \Fleetbase\FleetOps\Events\WaypointActivityChanged|\Fleetbase\FleetOps\Events\WaypointCompleted|\Fleetbase\FleetOps\Events\EntityActivityChanged|\Fleetbase\FleetOps\Events\EntityCompleted $event
+     */
+    public function handle(object $event): bool
+    {
+        return $this->publisher->stopChanged($event->waypoint ?? $event->entity ?? null);
+    }
+}
diff --git a/server/src/Observers/OrderObserver.php b/server/src/Observers/OrderObserver.php
index 0bd432c4e..83c8f4ead 100644
--- a/server/src/Observers/OrderObserver.php
+++ b/server/src/Observers/OrderObserver.php
@@ -4,6 +4,7 @@
 
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Support\LiveCacheService;
+use Fleetbase\FleetOps\Support\TrackingPublisher;
 use Illuminate\Support\Facades\Cache;
 
 class OrderObserver
@@ -46,6 +47,9 @@ public function updated(Order $order)
         }
 
         $this->invalidateCache($order);
+
+        // Public tracking channels follow status, assignment and ETA changes.
+        app(TrackingPublisher::class)->orderChanged($order);
     }
 
     /**
diff --git a/server/src/Providers/EventServiceProvider.php b/server/src/Providers/EventServiceProvider.php
index 83c19771c..9afc23ac4 100644
--- a/server/src/Providers/EventServiceProvider.php
+++ b/server/src/Providers/EventServiceProvider.php
@@ -23,6 +23,17 @@ class EventServiceProvider extends ServiceProvider
         \Fleetbase\FleetOps\Events\OrderFailed::class         => [\Fleetbase\Listeners\SendResourceLifecycleWebhook::class, \Fleetbase\FleetOps\Listeners\NotifyOrderEvent::class],
         \Fleetbase\FleetOps\Events\OrderReady::class          => [\Fleetbase\FleetOps\Listeners\HandleOrderReady::class],
 
+        /*
+         * Stop Events
+         *
+         * Public tracking channels follow waypoint and entity activity. Order status, assignment
+         * and ETA changes are published from the order observer; positions from the tracking endpoints.
+         */
+        \Fleetbase\FleetOps\Events\WaypointActivityChanged::class => [\Fleetbase\FleetOps\Listeners\PublishTrackingUpdates::class],
+        \Fleetbase\FleetOps\Events\WaypointCompleted::class       => [\Fleetbase\FleetOps\Listeners\PublishTrackingUpdates::class],
+        \Fleetbase\FleetOps\Events\EntityActivityChanged::class   => [\Fleetbase\FleetOps\Listeners\PublishTrackingUpdates::class],
+        \Fleetbase\FleetOps\Events\EntityCompleted::class         => [\Fleetbase\FleetOps\Listeners\PublishTrackingUpdates::class],
+
         /*
          * Geofence Events
          *
diff --git a/server/src/Providers/FleetOpsServiceProvider.php b/server/src/Providers/FleetOpsServiceProvider.php
index bb91d464a..32ddd9bdc 100644
--- a/server/src/Providers/FleetOpsServiceProvider.php
+++ b/server/src/Providers/FleetOpsServiceProvider.php
@@ -159,6 +159,7 @@ public function boot()
         });
         $this->registerNotifications();
         $this->registerAiCapabilities();
+        $this->registerSocketChannels();
         $this->registerExpansionsFrom(__DIR__ . '/../Expansions');
 
         // Register built-in orchestration engines.
@@ -265,6 +266,16 @@ public function registerNotifications()
         ]);
     }
 
+    /**
+     * Register who may subscribe to FleetOps realtime channels, and the driver socket principal.
+     */
+    protected function registerSocketChannels(): void
+    {
+        $this->callAfterResolving(\Fleetbase\Support\SocketCluster\SocketChannelRegistry::class, function (\Fleetbase\Support\SocketCluster\SocketChannelRegistry $registry) {
+            \Fleetbase\FleetOps\Support\SocketChannels::register($registry);
+        });
+    }
+
     protected function registerAiCapabilities(): void
     {
         if (!Utils::classExists(\Fleetbase\Ai\Support\AiCapabilityRegistry::class)) {
diff --git a/server/src/Support/SocketChannels.php b/server/src/Support/SocketChannels.php
new file mode 100644
index 000000000..84c7590c2
--- /dev/null
+++ b/server/src/Support/SocketChannels.php
@@ -0,0 +1,346 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support;
+
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Device;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Fleet;
+use Fleetbase\FleetOps\Models\IntegratedVendor;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Payload;
+use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Models\Position;
+use Fleetbase\FleetOps\Models\PurchaseRate;
+use Fleetbase\FleetOps\Models\ServiceArea;
+use Fleetbase\FleetOps\Models\ServiceQuote;
+use Fleetbase\FleetOps\Models\ServiceRate;
+use Fleetbase\FleetOps\Models\TrackingNumber;
+use Fleetbase\FleetOps\Models\TrackingStatus;
+use Fleetbase\FleetOps\Models\Trailer;
+use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Models\Zone;
+use Fleetbase\Models\Company;
+use Fleetbase\Models\User;
+use Fleetbase\Support\SocketCluster\SocketChannelRegistry;
+use Fleetbase\Support\SocketCluster\SocketPrincipal;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Http\Request;
+
+/**
+ * Who may subscribe to FleetOps realtime channels.
+ *
+ * Channel names are "{prefix}.{id}" where the prefix is the snake_case model name the lifecycle
+ * events broadcast on (plus `driverAssigned`, which the order's assigned-driver channel uses) and
+ * the id is the model's uuid or public_id.
+ *
+ * Console users and API credentials may subscribe to any of their own company's records. Drivers
+ * and customers get narrow access only:
+ *
+ * - a driver: their own driver record, their current vehicle and its devices and positions, and
+ *   orders assigned to them (directly, or through one of the order's payload entities);
+ * - a customer: orders they are the customer of, and the driver and vehicle of those orders while
+ *   they are active.
+ *
+ * Public tracking channels (`tracking.{opaque}`) are denied here to everyone: only a `tracking`
+ * token, whose scope names the channel exactly, can subscribe to one.
+ */
+class SocketChannels
+{
+    /**
+     * Order statuses after which a customer no longer sees the order's driver or vehicle.
+     */
+    public const TERMINAL_ORDER_STATUSES = ['completed', 'canceled'];
+
+    /**
+     * Prefixes resolved by the generic model resolver, with their model.
+     */
+    public const MODEL_PREFIXES = [
+        'order'           => Order::class,
+        'driver'          => Driver::class,
+        'driverAssigned'  => Driver::class,
+        'vehicle'         => Vehicle::class,
+        'trailer'         => Trailer::class,
+        'device'          => Device::class,
+        'waypoint'        => Waypoint::class,
+        'entity'          => Entity::class,
+        'place'           => Place::class,
+        'contact'         => Contact::class,
+        'fleet'           => Fleet::class,
+        'zone'            => Zone::class,
+        'service_area'    => ServiceArea::class,
+        'service_rate'    => ServiceRate::class,
+        'service_quote'   => ServiceQuote::class,
+        'purchase_rate'   => PurchaseRate::class,
+        'tracking_status' => TrackingStatus::class,
+        'tracking_number' => TrackingNumber::class,
+        'payload'         => Payload::class,
+    ];
+
+    /**
+     * Prefixes whose id may name more than one kind of record, with the models tried in order.
+     */
+    public const MORPH_PREFIXES = [
+        'customer'    => [Contact::class, Vendor::class],
+        'vendor'      => [Vendor::class, IntegratedVendor::class],
+        'facilitator' => [Vendor::class, IntegratedVendor::class, Contact::class],
+    ];
+
+    /**
+     * Register every FleetOps prefix and the driver principal resolver.
+     */
+    public static function register(SocketChannelRegistry $registry): void
+    {
+        foreach (self::MODEL_PREFIXES as $prefix => $modelClass) {
+            $registry->registerModel($prefix, $modelClass, static::narrowFor($prefix));
+        }
+
+        foreach (self::MORPH_PREFIXES as $prefix => $modelClasses) {
+            $registry->register($prefix, static::resolver($modelClasses, [static::class, 'narrowSelf']));
+        }
+
+        // Positions have no public_id, so they are looked up by uuid only.
+        $registry->register('position', static::resolver([Position::class], [static::class, 'narrowPosition'], false));
+
+        // tracking.{opaque} is reachable only through a tracking token's exact scope.
+        $registry->register(TrackingChannel::PREFIX, static fn (): bool => false);
+
+        $registry->registerPrincipalResolver([static::class, 'driverPrincipal']);
+    }
+
+    /**
+     * The narrow rule used for driver and customer principals on a generic model prefix.
+     */
+    public static function narrowFor(string $prefix): ?callable
+    {
+        return match ($prefix) {
+            'order'                    => [static::class, 'narrowOrder'],
+            'driver', 'driverAssigned' => [static::class, 'narrowDriver'],
+            'vehicle'                  => [static::class, 'narrowVehicle'],
+            'device'                   => [static::class, 'narrowDevice'],
+            'contact'                  => [static::class, 'narrowSelf'],
+            default                    => null,
+        };
+    }
+
+    /**
+     * A resolver over one or more models: company match for user and API principals, the narrow
+     * rule for driver and customer principals, deny for everyone else.
+     *
+     * @param array<int, class-string<Model>> $modelClasses
+     */
+    public static function resolver(array $modelClasses, ?callable $narrow = null, bool $byPublicId = true): \Closure
+    {
+        return static function (SocketPrincipal $principal, string $id, string $channel = '') use ($modelClasses, $narrow, $byPublicId): bool {
+            $narrowed = $principal->kind === 'driver' || $principal->kind === 'customer';
+            if ((!$principal->isCompanyScoped() && !$narrowed) || $id === '') {
+                return false;
+            }
+
+            $model = static::find($modelClasses, $principal, $id, $byPublicId);
+            if ($model === null) {
+                return false;
+            }
+
+            if ($principal->isCompanyScoped()) {
+                return $principal->cid !== null && $model->company_uuid === $principal->cid;
+            }
+
+            return $narrow !== null && (bool) $narrow($principal, $model);
+        };
+    }
+
+    /**
+     * The first of the models whose uuid (or public_id) is the id, in the principal's environment.
+     *
+     * @param array<int, class-string<Model>> $modelClasses
+     */
+    public static function find(array $modelClasses, SocketPrincipal $principal, string $id, bool $byPublicId = true): ?Model
+    {
+        foreach ($modelClasses as $modelClass) {
+            $model = $modelClass::on(static::connection($principal))
+                ->where(function ($query) use ($id, $byPublicId) {
+                    $query->where('uuid', $id);
+                    if ($byPublicId) {
+                        $query->orWhere('public_id', $id);
+                    }
+                })
+                ->first();
+
+            if ($model) {
+                return $model;
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * The database connection for the principal's environment; null is the default one.
+     */
+    public static function connection(SocketPrincipal $principal): ?string
+    {
+        return $principal->env === 'test' ? 'sandbox' : null;
+    }
+
+    /**
+     * Orders: a driver's when assigned to them (directly or on one of its payload entities), a customer's own.
+     */
+    public static function narrowOrder(SocketPrincipal $principal, Model $order): bool
+    {
+        if ($principal->kind === 'customer') {
+            return static::isSelf($principal, $order->customer_uuid);
+        }
+
+        if ($principal->kind !== 'driver') {
+            return false;
+        }
+
+        if (static::isSelf($principal, $order->driver_assigned_uuid)) {
+            return true;
+        }
+
+        return !empty($order->payload_uuid)
+            && Entity::on($order->getConnectionName())
+                ->where('payload_uuid', $order->payload_uuid)
+                ->where('driver_assigned_uuid', $principal->sub)
+                ->exists();
+    }
+
+    /**
+     * Drivers: a driver only themselves; a customer the driver of one of their active orders.
+     */
+    public static function narrowDriver(SocketPrincipal $principal, Model $driver): bool
+    {
+        if ($principal->kind === 'driver') {
+            return static::isSelf($principal, $driver->uuid);
+        }
+
+        return $principal->kind === 'customer'
+            && static::activeCustomerOrders($principal, $driver->getConnectionName())
+                ->where('driver_assigned_uuid', $driver->uuid)
+                ->exists();
+    }
+
+    /**
+     * Vehicles: a driver their current vehicle; a customer the vehicle of one of their active orders,
+     * whether assigned to the order or driven by the order's driver.
+     */
+    public static function narrowVehicle(SocketPrincipal $principal, Model $vehicle): bool
+    {
+        if ($principal->kind === 'driver') {
+            return static::driverVehicleUuid($principal, $vehicle->getConnectionName()) === $vehicle->uuid;
+        }
+
+        if ($principal->kind !== 'customer') {
+            return false;
+        }
+
+        $connection = $vehicle->getConnectionName();
+        $drivers    = Driver::on($connection)->where('vehicle_uuid', $vehicle->uuid)->select('uuid')->toBase();
+
+        return static::activeCustomerOrders($principal, $connection)
+            ->where(function ($query) use ($vehicle, $drivers) {
+                $query->where('vehicle_assigned_uuid', $vehicle->uuid)->orWhereIn('driver_assigned_uuid', $drivers);
+            })
+            ->exists();
+    }
+
+    /**
+     * Devices: a driver those attached to themselves or to their current vehicle.
+     */
+    public static function narrowDevice(SocketPrincipal $principal, Model $device): bool
+    {
+        return $principal->kind === 'driver' && static::ownsDriverSubject($principal, $device->attachable_uuid, $device->getConnectionName());
+    }
+
+    /**
+     * Positions: a driver those recorded for themselves or for their current vehicle.
+     */
+    public static function narrowPosition(SocketPrincipal $principal, Model $position): bool
+    {
+        return $principal->kind === 'driver' && static::ownsDriverSubject($principal, $position->subject_uuid, $position->getConnectionName());
+    }
+
+    /**
+     * Contacts, customers, vendors, facilitators: a customer only themselves.
+     */
+    public static function narrowSelf(SocketPrincipal $principal, Model $model): bool
+    {
+        return $principal->kind === 'customer' && static::isSelf($principal, $model->uuid);
+    }
+
+    /**
+     * Claim a Sanctum-authenticated user who is a driver of the current company as a driver principal.
+     */
+    public static function driverPrincipal(Request $request, $user): ?SocketPrincipal
+    {
+        if (!$user instanceof User || !$user->uuid) {
+            return null;
+        }
+
+        $companyUuid = session('company') ?: $user->company_uuid;
+        if (!$companyUuid) {
+            return null;
+        }
+
+        $driver = Driver::where('user_uuid', $user->uuid)->where('company_uuid', $companyUuid)->first();
+        if (!$driver) {
+            return null;
+        }
+
+        $connection = $driver->getConnectionName();
+        $cpid       = Company::on($connection)->where('uuid', $companyUuid)->value('public_id');
+
+        return new SocketPrincipal(
+            kind: 'driver',
+            sub: (string) $driver->uuid,
+            cid: (string) $companyUuid,
+            cpid: is_string($cpid) && $cpid !== '' ? $cpid : null,
+            env: $connection === 'sandbox' ? 'test' : 'live',
+            ids: array_values(array_filter([$driver->uuid, $driver->public_id, $user->uuid, $user->public_id], fn ($id) => is_string($id) && $id !== '')),
+            adm: false,
+        );
+    }
+
+    /**
+     * The customer's orders that are not completed or canceled.
+     */
+    protected static function activeCustomerOrders(SocketPrincipal $principal, ?string $connection): Builder
+    {
+        return Order::on($connection)
+            ->whereIn('customer_uuid', array_values(array_unique([$principal->sub, ...$principal->ids])))
+            ->whereNotIn('status', self::TERMINAL_ORDER_STATUSES);
+    }
+
+    /**
+     * Whether a record's subject is the driver principal or the driver's current vehicle.
+     */
+    protected static function ownsDriverSubject(SocketPrincipal $principal, ?string $subjectUuid, ?string $connection): bool
+    {
+        if (!$subjectUuid) {
+            return false;
+        }
+
+        return static::isSelf($principal, $subjectUuid) || static::driverVehicleUuid($principal, $connection) === $subjectUuid;
+    }
+
+    /**
+     * Whether an id is the principal's own (its subject or one of its ids).
+     */
+    protected static function isSelf(SocketPrincipal $principal, mixed $id): bool
+    {
+        return is_string($id) && $id !== '' && ($id === $principal->sub || $principal->owns($id));
+    }
+
+    protected static function driverVehicleUuid(SocketPrincipal $principal, ?string $connection): ?string
+    {
+        $vehicleUuid = Driver::on($connection)->where('uuid', $principal->sub)->value('vehicle_uuid');
+
+        return is_string($vehicleUuid) && $vehicleUuid !== '' ? $vehicleUuid : null;
+    }
+}
diff --git a/server/src/Support/Telematics/TelematicService.php b/server/src/Support/Telematics/TelematicService.php
index b1541f88d..2f7f10ce1 100644
--- a/server/src/Support/Telematics/TelematicService.php
+++ b/server/src/Support/Telematics/TelematicService.php
@@ -13,6 +13,7 @@
 use Fleetbase\FleetOps\Models\Telematic;
 use Fleetbase\FleetOps\Models\Trailer;
 use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Support\TrackingPublisher;
 use Fleetbase\LaravelMysqlSpatial\Types\Point as SpatialPoint;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Crypt;
@@ -811,6 +812,7 @@ protected function updateVehicleTelemetry(Vehicle $vehicle, array $location, arr
             'position_at'       => $event->occurred_at?->toISOString(),
         ]);
         $this->broadcastTelemetry($broadcast, $eventData['_ordered_telemetry'] ?? false);
+        app(TrackingPublisher::class)->vehicleMoved($vehicle);
     }
 
     protected function broadcastTelemetry(object $event, bool $afterCommit): void
diff --git a/server/src/Support/TrackingChannel.php b/server/src/Support/TrackingChannel.php
new file mode 100644
index 000000000..0298c38ac
--- /dev/null
+++ b/server/src/Support/TrackingChannel.php
@@ -0,0 +1,55 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support;
+
+use Fleetbase\Support\SocketCluster\SocketToken;
+
+/**
+ * The public tracking channel of one customer on one order: `tracking.{opaque}`.
+ *
+ * The opaque id is derived by core-api (SocketToken::trackingId): lowercase, unpadded base32 of
+ * HMAC-SHA256(tracking key, "{order_uuid}:{customer_type}:{customer_uuid}"), first 26 characters,
+ * where the tracking key is derived from SOCKETCLUSTER_AUTH_KEY. Nobody can guess or enumerate it
+ * without the auth key, and it reveals nothing about the order.
+ *
+ * The channel registry denies the `tracking` prefix to every principal; the only way in is a
+ * `tracking` token from token(), whose scope names exactly this channel.
+ */
+final class TrackingChannel
+{
+    public const PREFIX = 'tracking';
+
+    /**
+     * The channel name for a customer's scope.
+     *
+     * @throws \RuntimeException when socket authentication is not configured
+     */
+    public static function name(TrackingScope $scope): string
+    {
+        return self::PREFIX . '.' . static::opaqueId($scope);
+    }
+
+    /**
+     * The opaque id for a customer's scope.
+     *
+     * @throws \RuntimeException when socket authentication is not configured
+     */
+    public static function opaqueId(TrackingScope $scope): string
+    {
+        return SocketToken::trackingId($scope->order_uuid, $scope->customer_type, $scope->customer_uuid);
+    }
+
+    /**
+     * Mint the token (kind `tracking`, 1800 s) that may subscribe to this scope's channel and nothing else.
+     *
+     * The caller (the public tracking API) checks its own grant for the scope first.
+     *
+     * @return array{token: string, expires_in: int, expires_at: string}
+     *
+     * @throws \RuntimeException when socket authentication is not configured
+     */
+    public static function token(TrackingScope $scope): array
+    {
+        return SocketToken::forTracking($scope);
+    }
+}
diff --git a/server/src/Support/TrackingPublisher.php b/server/src/Support/TrackingPublisher.php
new file mode 100644
index 000000000..5a9ab4679
--- /dev/null
+++ b/server/src/Support/TrackingPublisher.php
@@ -0,0 +1,249 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support;
+
+use Fleetbase\FleetOps\Jobs\PublishTrackingUpdate;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Tracking\TrackingContextBuilder;
+use Fleetbase\FleetOps\Tracking\TrackingIntelligenceService;
+use Fleetbase\FleetOps\Tracking\TrackingOptions;
+use Fleetbase\FleetOps\Tracking\TrackingStop;
+use Fleetbase\Support\SocketCluster\SocketClusterService;
+use Fleetbase\Support\SocketCluster\SocketToken;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Cache;
+
+/**
+ * Publishes per-customer updates to public tracking channels.
+ *
+ * The request-path hooks (orderChanged, stopChanged, driverMoved, vehicleMoved) do almost
+ * nothing: they bail out when socket authentication is off, throttle location changes through
+ * the cache, and queue a PublishTrackingUpdate job. The job builds and publishes the updates.
+ */
+class TrackingPublisher
+{
+    /**
+     * Seconds between position updates for one order (and between order lookups for one driver or vehicle).
+     */
+    public const LOCATION_INTERVAL = 5;
+
+    /**
+     * Seconds between ETA refreshes for one order driven by position changes.
+     */
+    public const ETA_INTERVAL = 60;
+
+    /**
+     * Most active orders a single driver or vehicle position change fans out to.
+     */
+    public const MAX_ORDERS_PER_SUBJECT = 25;
+
+    /**
+     * Order attributes whose change is published, with the reason reported.
+     */
+    public const ORDER_ATTRIBUTES = [
+        'status'                => TrackingUpdate::REASON_STATUS,
+        'started'               => TrackingUpdate::REASON_STATUS,
+        'dispatched'            => TrackingUpdate::REASON_STATUS,
+        'driver_assigned_uuid'  => TrackingUpdate::REASON_ASSIGNMENT,
+        'vehicle_assigned_uuid' => TrackingUpdate::REASON_ASSIGNMENT,
+        'time'                  => TrackingUpdate::REASON_ETA,
+        'distance'              => TrackingUpdate::REASON_ETA,
+    ];
+
+    public static function enabled(): bool
+    {
+        return SocketToken::enabled();
+    }
+
+    /**
+     * An order was saved: queue an update when a published attribute changed.
+     */
+    public function orderChanged(Order $order): bool
+    {
+        if (!static::enabled() || !$order->uuid) {
+            return false;
+        }
+
+        $changed = array_intersect_key(self::ORDER_ATTRIBUTES, $order->getChanges());
+        if ($changed === []) {
+            return false;
+        }
+
+        $reasons = array_values($changed);
+        $reason  = in_array(TrackingUpdate::REASON_STATUS, $reasons, true) ? TrackingUpdate::REASON_STATUS : $reasons[0];
+
+        return $this->queue($order->uuid, $reason, $order->getConnectionName());
+    }
+
+    /**
+     * A waypoint or entity activity changed: queue an update for its order.
+     */
+    public function stopChanged(Waypoint|Entity|null $subject): bool
+    {
+        if (!static::enabled() || !$subject || !$subject->payload_uuid) {
+            return false;
+        }
+
+        $connection = $subject->getConnectionName();
+        $orderUuid  = Order::on($connection)->where('payload_uuid', $subject->payload_uuid)->value('uuid');
+
+        return $orderUuid ? $this->queue($orderUuid, TrackingUpdate::REASON_STOP, $connection) : false;
+    }
+
+    /**
+     * A driver reported a position: queue a location update for each of their en-route orders.
+     */
+    public function driverMoved(Driver $driver): int
+    {
+        if (!static::enabled() || !$driver->uuid || !Cache::add('fleetops:tracking:driver:' . $driver->uuid, 1, self::LOCATION_INTERVAL)) {
+            return 0;
+        }
+
+        $connection = $driver->getConnectionName();
+
+        return $this->queueLocations($this->enRouteOrders($connection)->where('driver_assigned_uuid', $driver->uuid)->limit(self::MAX_ORDERS_PER_SUBJECT)->pluck('uuid'), $connection);
+    }
+
+    /**
+     * A vehicle reported a position: queue a location update for each en-route order it serves.
+     */
+    public function vehicleMoved(Vehicle $vehicle): int
+    {
+        if (!static::enabled() || !$vehicle->uuid || !Cache::add('fleetops:tracking:vehicle:' . $vehicle->uuid, 1, self::LOCATION_INTERVAL)) {
+            return 0;
+        }
+
+        $connection = $vehicle->getConnectionName();
+        $drivers    = Driver::on($connection)->where('vehicle_uuid', $vehicle->uuid)->select('uuid')->toBase();
+        $orders     = $this->enRouteOrders($connection)
+            ->where(function ($query) use ($vehicle, $drivers) {
+                $query->where('vehicle_assigned_uuid', $vehicle->uuid)->orWhereIn('driver_assigned_uuid', $drivers);
+            })
+            ->limit(self::MAX_ORDERS_PER_SUBJECT)
+            ->pluck('uuid');
+
+        return $this->queueLocations($orders, $connection);
+    }
+
+    /**
+     * Publish the full update to every customer of the order. Returns the channels published to.
+     */
+    public function publishOrder(Order $order, string $reason = TrackingUpdate::REASON_STATUS): int
+    {
+        if (!static::enabled()) {
+            return 0;
+        }
+
+        $stops   = $this->stopsFor($order);
+        $tracker = $this->trackerFor($order);
+        $sent    = 0;
+
+        foreach (TrackingScope::allForOrder($order, $this->waypointsOf($stops)) as $scope) {
+            $update = TrackingUpdate::for($order, $scope, $stops, $tracker);
+            $sent += (int) $this->send(TrackingChannel::name($scope), $update->toArray($reason));
+        }
+
+        return $sent;
+    }
+
+    /**
+     * Publish the position to every customer of the order who may see it. Returns the channels published to.
+     */
+    public function publishLocation(Order $order): int
+    {
+        if (!static::enabled()) {
+            return 0;
+        }
+
+        $stops = $this->stopsFor($order);
+        $sent  = 0;
+
+        foreach (TrackingScope::allForOrder($order, $this->waypointsOf($stops)) as $scope) {
+            $payload = (new TrackingUpdate($order, $scope, $stops))->locationPayload();
+            if ($payload !== null) {
+                $sent += (int) $this->send(TrackingChannel::name($scope), $payload);
+            }
+        }
+
+        return $sent;
+    }
+
+    /**
+     * Every stop of the order in route order, with completion state.
+     *
+     * @return Collection<int, TrackingStop>
+     */
+    protected function stopsFor(Order $order): Collection
+    {
+        return app(TrackingContextBuilder::class)->build($order, TrackingOptions::fromArray([], $order->company_uuid))->stops;
+    }
+
+    /**
+     * The tracking intelligence result for the order's ETAs; empty when it cannot be computed.
+     */
+    protected function trackerFor(Order $order): array
+    {
+        if (in_array(strtolower((string) $order->status), TrackingUpdate::TERMINAL_STATUSES, true)) {
+            return [];
+        }
+
+        try {
+            return app(TrackingIntelligenceService::class)->track($order);
+        } catch (\Throwable) {
+            return [];
+        }
+    }
+
+    protected function send(string $channel, array $payload): bool
+    {
+        return SocketClusterService::publish($channel, $payload);
+    }
+
+    protected function queue(string $orderUuid, string $reason, ?string $connection = null): bool
+    {
+        PublishTrackingUpdate::dispatch($orderUuid, $reason, $connection);
+
+        return true;
+    }
+
+    /**
+     * Queue a location update for each order not updated within the location interval.
+     */
+    protected function queueLocations(iterable $orderUuids, ?string $connection): int
+    {
+        $queued = 0;
+        foreach ($orderUuids as $orderUuid) {
+            if (Cache::add('fleetops:tracking:location:' . $orderUuid, 1, self::LOCATION_INTERVAL)) {
+                $queued += (int) $this->queue($orderUuid, TrackingUpdate::REASON_LOCATION, $connection);
+            }
+        }
+
+        return $queued;
+    }
+
+    /**
+     * Orders that have started and are not yet completed or canceled.
+     */
+    protected function enRouteOrders(?string $connection)
+    {
+        return Order::on($connection)
+            ->whereNotIn('status', TrackingUpdate::TERMINAL_STATUSES)
+            ->where(function ($query) {
+                $query->where('started', 1)->orWhereNotNull('started_at')->orWhere('status', 'started');
+            });
+    }
+
+    /**
+     * @param Collection<int, TrackingStop> $stops
+     *
+     * @return array<int, Waypoint>
+     */
+    protected function waypointsOf(Collection $stops): array
+    {
+        return $stops->map(fn (TrackingStop $stop) => $stop->waypoint)->filter()->values()->all();
+    }
+}
diff --git a/server/src/Support/TrackingScope.php b/server/src/Support/TrackingScope.php
new file mode 100644
index 000000000..9259c4153
--- /dev/null
+++ b/server/src/Support/TrackingScope.php
@@ -0,0 +1,182 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support;
+
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\Relation;
+
+/**
+ * One customer's view of one order, the unit a public tracking channel is scoped to.
+ *
+ * A stop's customer is the waypoint's `customer` morph (a Contact or a Vendor); stops without
+ * one belong to the order's customer. Every customer of an order therefore gets their own
+ * scope, their own `tracking.{opaque}` channel and their own sanitized updates.
+ *
+ * Identity is (order_uuid, customer_type, customer_uuid). customer_type is the morph class as
+ * stored on the order or waypoint (a fully qualified model class), normalized without a
+ * leading backslash so that every caller derives the same channel.
+ */
+final class TrackingScope implements \JsonSerializable
+{
+    public readonly string $order_uuid;
+
+    public readonly string $customer_type;
+
+    public readonly string $customer_uuid;
+
+    /**
+     * The order's company, when known. Not part of the scope's identity.
+     */
+    public readonly ?string $company_uuid;
+
+    private ?Order $order;
+
+    public function __construct(string $orderUuid, string $customerType, string $customerUuid, ?Order $order = null)
+    {
+        $customerType = static::normalizeType($customerType);
+
+        if ($orderUuid === '' || $customerType === '' || $customerUuid === '') {
+            throw new \InvalidArgumentException('A tracking scope requires an order, a customer type and a customer.');
+        }
+
+        $this->order_uuid    = $orderUuid;
+        $this->customer_type = $customerType;
+        $this->customer_uuid = $customerUuid;
+        $this->order         = $order && $order->uuid === $orderUuid ? $order : null;
+        $this->company_uuid  = $this->order?->company_uuid ?: null;
+    }
+
+    /**
+     * The scope of the order's own customer, or null when the order has none.
+     */
+    public static function forOrder(Order $order): ?self
+    {
+        return static::make($order, $order->customer_type, $order->customer_uuid);
+    }
+
+    /**
+     * The scope a stop belongs to: the waypoint's customer, else the order's customer.
+     */
+    public static function forStop(Order $order, ?Waypoint $waypoint = null): ?self
+    {
+        return static::make($order, $waypoint?->customer_type, $waypoint?->customer_uuid) ?? static::forOrder($order);
+    }
+
+    /**
+     * The scope of an explicit customer on an order.
+     */
+    public static function forCustomer(Order $order, Model $customer): self
+    {
+        return new self((string) $order->uuid, $customer->getMorphClass(), (string) $customer->uuid, $order);
+    }
+
+    /**
+     * Every customer scope of an order: the order's customer first, then each distinct waypoint customer.
+     *
+     * @param iterable<Waypoint>|null $waypoints the order's waypoints; loaded from the payload when null
+     *
+     * @return array<int, self>
+     */
+    public static function allForOrder(Order $order, ?iterable $waypoints = null): array
+    {
+        if ($waypoints === null) {
+            $waypoints = $order->payload_uuid ? Waypoint::on($order->getConnectionName())->where('payload_uuid', $order->payload_uuid)->without(['place'])->get(['uuid', 'payload_uuid', 'customer_uuid', 'customer_type']) : [];
+        }
+
+        $scopes = [];
+        if ($scope = static::forOrder($order)) {
+            $scopes[$scope->key()] = $scope;
+        }
+
+        foreach ($waypoints as $waypoint) {
+            $scope = $waypoint instanceof Waypoint ? static::make($order, $waypoint->customer_type, $waypoint->customer_uuid) : null;
+            if ($scope && !isset($scopes[$scope->key()])) {
+                $scopes[$scope->key()] = $scope;
+            }
+        }
+
+        return array_values($scopes);
+    }
+
+    /**
+     * The message the channel id is derived from: "{order_uuid}:{customer_type}:{customer_uuid}".
+     */
+    public function key(): string
+    {
+        return $this->order_uuid . ':' . $this->customer_type . ':' . $this->customer_uuid;
+    }
+
+    /**
+     * Whether this scope is the given customer (type and uuid).
+     */
+    public function is(?string $customerType, ?string $customerUuid): bool
+    {
+        return $customerUuid !== null
+            && $customerUuid !== ''
+            && $customerUuid === $this->customer_uuid
+            && static::normalizeType((string) $customerType) === $this->customer_type;
+    }
+
+    /**
+     * Whether this scope is the order's own customer.
+     */
+    public function isOrderCustomer(Order $order): bool
+    {
+        return $order->uuid === $this->order_uuid && $this->is($order->customer_type, $order->customer_uuid);
+    }
+
+    /**
+     * Whether a stop belongs to this scope: its waypoint's customer, else the order's customer.
+     */
+    public function ownsStop(Order $order, ?Waypoint $waypoint = null): bool
+    {
+        if ($waypoint && $waypoint->customer_uuid && $waypoint->customer_type) {
+            return $this->is($waypoint->customer_type, $waypoint->customer_uuid);
+        }
+
+        return $this->isOrderCustomer($order);
+    }
+
+    /**
+     * The order this scope is about, loaded once when not given.
+     */
+    public function order(): ?Order
+    {
+        return $this->order ??= Order::where('uuid', $this->order_uuid)->first();
+    }
+
+    public function toArray(): array
+    {
+        return [
+            'order_uuid'    => $this->order_uuid,
+            'customer_type' => $this->customer_type,
+            'customer_uuid' => $this->customer_uuid,
+        ];
+    }
+
+    public function jsonSerialize(): array
+    {
+        return $this->toArray();
+    }
+
+    /**
+     * A morph type as a model class without a leading backslash; morph map aliases resolve to their class.
+     */
+    public static function normalizeType(string $type): string
+    {
+        $type = ltrim(trim($type), '\\');
+
+        return ltrim((string) (Relation::getMorphedModel($type) ?? $type), '\\');
+    }
+
+    private static function make(Order $order, ?string $customerType, ?string $customerUuid): ?self
+    {
+        if (!$order->uuid || !$customerType || !$customerUuid) {
+            return null;
+        }
+
+        return new self((string) $order->uuid, $customerType, $customerUuid, $order);
+    }
+}
diff --git a/server/src/Support/TrackingUpdate.php b/server/src/Support/TrackingUpdate.php
new file mode 100644
index 000000000..fdcdffc6a
--- /dev/null
+++ b/server/src/Support/TrackingUpdate.php
@@ -0,0 +1,400 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support;
+
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\TrackingStatus;
+use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Tracking\TrackingStop;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Str;
+
+/**
+ * The payload published to one customer's public tracking channel.
+ *
+ * It carries only what that customer may see: their own stops (status, ETA, timeline), whole-route
+ * counts, the driver's first name, the vehicle's label and online flag, and the vehicle's rounded
+ * position. It never carries another customer's stops, places, items or people, the driver's
+ * photo or phone, or free-text activity details. The driver and position are included only while
+ * the order is en route and this customer still has a stop to be served.
+ */
+final class TrackingUpdate
+{
+    public const EVENT_UPDATED = 'tracking.updated';
+
+    public const EVENT_LOCATION = 'tracking.location';
+
+    public const REASON_STATUS = 'status';
+
+    public const REASON_STOP = 'stop';
+
+    public const REASON_ASSIGNMENT = 'assignment';
+
+    public const REASON_ETA = 'eta';
+
+    public const REASON_LOCATION = 'location';
+
+    /**
+     * Decimal places kept on published coordinates: 4 places is roughly 11 m.
+     */
+    public const COORDINATE_PRECISION = 4;
+
+    public const TERMINAL_STATUSES = ['completed', 'canceled'];
+
+    /**
+     * Most timeline entries published per tracking number.
+     */
+    public const TIMELINE_LIMIT = 20;
+
+    /**
+     * @var Collection<int, TrackingStop>
+     */
+    private Collection $stops;
+
+    /**
+     * @param iterable<TrackingStop>                  $stops     every stop of the order, in route order
+     * @param array<int, array>                       $etas      ETA per stop sequence: seconds, at, distance_m
+     * @param array<string, array<int, array>>        $timelines timeline entries per tracking number uuid
+     */
+    public function __construct(
+        private Order $order,
+        private TrackingScope $scope,
+        iterable $stops = [],
+        private array $etas = [],
+        private array $timelines = [],
+    ) {
+        $this->stops = collect($stops)->filter(fn ($stop) => $stop instanceof TrackingStop)->values();
+    }
+
+    /**
+     * Build the update for a scope from the order's stops and, optionally, a tracking intelligence result.
+     *
+     * @param iterable<TrackingStop> $stops
+     * @param array                  $tracker a TrackingIntelligenceService::track() result; its route legs give the ETAs
+     */
+    public static function for(Order $order, TrackingScope $scope, iterable $stops, array $tracker = []): self
+    {
+        $update = new self($order, $scope, $stops, static::etasFromTracker($tracker));
+
+        $update->timelines = static::loadTimelines($update->timelineTrackingNumbers(), $order->getConnectionName());
+
+        return $update;
+    }
+
+    /**
+     * The full update: order state, route counts, this customer's stops, driver and position.
+     */
+    public function toArray(string $reason = self::REASON_STATUS): array
+    {
+        return $this->envelope(self::EVENT_UPDATED, $reason, [
+            'order'    => $this->orderState(),
+            'route'    => $this->route(),
+            'stops'    => $this->ownStops()->map(fn (TrackingStop $stop) => $this->stop($stop))->values()->all(),
+            'driver'   => $this->driver(),
+            'location' => $this->location(),
+        ]);
+    }
+
+    /**
+     * The position-only update, or null when this customer may not see the vehicle right now.
+     */
+    public function locationPayload(): ?array
+    {
+        $location = $this->location();
+        if ($location === null) {
+            return null;
+        }
+
+        return $this->envelope(self::EVENT_LOCATION, self::REASON_LOCATION, [
+            'driver'   => $this->driver(),
+            'location' => $location,
+        ]);
+    }
+
+    /**
+     * This customer's stops.
+     *
+     * @return Collection<int, TrackingStop>
+     */
+    public function ownStops(): Collection
+    {
+        return $this->stops->filter(fn (TrackingStop $stop) => $this->scope->ownsStop($this->order, $stop->waypoint))->values();
+    }
+
+    public function isTerminal(): bool
+    {
+        return in_array(strtolower((string) $this->order->status), self::TERMINAL_STATUSES, true);
+    }
+
+    /**
+     * Whether the order is under way: started and not yet completed or canceled.
+     */
+    public function isEnRoute(): bool
+    {
+        if ($this->isTerminal()) {
+            return false;
+        }
+
+        return (bool) $this->order->started || !empty($this->order->started_at) || strtolower((string) $this->order->status) === 'started';
+    }
+
+    public function customerHasIncompleteStop(): bool
+    {
+        return $this->ownStops()->contains(fn (TrackingStop $stop) => !$stop->completed);
+    }
+
+    /**
+     * Whether the driver and the vehicle position may be shown to this customer now.
+     */
+    public function showsVehicle(): bool
+    {
+        return $this->isEnRoute() && $this->customerHasIncompleteStop();
+    }
+
+    /**
+     * Whole-route counts: stops in total, stops done, and stops still ahead of this customer's next one.
+     */
+    public function route(): array
+    {
+        $next = $this->ownStops()->first(fn (TrackingStop $stop) => !$stop->completed);
+
+        return [
+            'total_stops'     => $this->stops->count(),
+            'completed_stops' => $this->stops->filter(fn (TrackingStop $stop) => $stop->completed)->count(),
+            'stops_before'    => $next ? $this->stops->filter(fn (TrackingStop $stop) => !$stop->completed && (int) $stop->sequence < (int) $next->sequence)->count() : 0,
+        ];
+    }
+
+    /**
+     * The driver as this customer may see them: first name, vehicle label, online flag.
+     */
+    public function driver(): ?array
+    {
+        $driver = $this->assignedDriver();
+        if (!$driver || !$this->showsVehicle()) {
+            return null;
+        }
+
+        return [
+            'name'    => static::firstName($driver->name),
+            'vehicle' => $this->vehicleLabel(),
+            'online'  => (bool) $driver->online,
+        ];
+    }
+
+    /**
+     * The vehicle position rounded to ~10 m, its heading and when it was seen.
+     */
+    public function location(): ?array
+    {
+        if (!$this->showsVehicle()) {
+            return null;
+        }
+
+        $source = $this->locationSource();
+        if (!$source) {
+            return null;
+        }
+
+        [$subject, $point] = $source;
+
+        return [
+            'latitude'  => round($point->getLat(), self::COORDINATE_PRECISION),
+            'longitude' => round($point->getLng(), self::COORDINATE_PRECISION),
+            'heading'   => is_numeric($subject->heading) ? (int) round((float) $subject->heading) : null,
+            'seen_at'   => $subject->updated_at ? Carbon::parse($subject->updated_at)->toISOString() : null,
+        ];
+    }
+
+    /**
+     * Tracking numbers whose timeline this customer may read: their stops', plus the order's own for the order customer.
+     *
+     * @return array<int, string>
+     */
+    public function timelineTrackingNumbers(): array
+    {
+        $uuids = $this->ownStops()->map(fn (TrackingStop $stop) => $stop->trackingNumberUuid)->all();
+
+        if ($this->scope->isOrderCustomer($this->order)) {
+            $uuids[] = $this->order->tracking_number_uuid;
+        }
+
+        return array_values(array_unique(array_filter($uuids, fn ($uuid) => is_string($uuid) && $uuid !== '')));
+    }
+
+    /**
+     * ETAs keyed by stop sequence from a tracking intelligence result's route legs.
+     */
+    public static function etasFromTracker(array $tracker): array
+    {
+        $etas = [];
+        foreach ((array) data_get($tracker, 'route.legs', []) as $leg) {
+            $sequence = data_get($leg, 'stop.sequence');
+            if ($sequence === null) {
+                continue;
+            }
+
+            $etas[(int) $sequence] = [
+                'seconds'    => is_numeric(data_get($leg, 'eta_seconds')) ? (int) round((float) data_get($leg, 'eta_seconds')) : null,
+                'at'         => data_get($leg, 'eta_at'),
+                'distance_m' => is_numeric(data_get($leg, 'distance_m')) ? (int) round((float) data_get($leg, 'distance_m')) : null,
+            ];
+        }
+
+        return $etas;
+    }
+
+    /**
+     * Timeline entries per tracking number: status, code, complete and time only.
+     *
+     * @param array<int, string> $trackingNumberUuids
+     *
+     * @return array<string, array<int, array>>
+     */
+    public static function loadTimelines(array $trackingNumberUuids, ?string $connection = null): array
+    {
+        if ($trackingNumberUuids === []) {
+            return [];
+        }
+
+        return TrackingStatus::on($connection)
+            ->whereIn('tracking_number_uuid', $trackingNumberUuids)
+            ->orderBy('created_at')
+            ->get(['tracking_number_uuid', 'status', 'code', 'complete', 'created_at'])
+            ->groupBy('tracking_number_uuid')
+            ->map(fn (Collection $statuses) => $statuses->take(-self::TIMELINE_LIMIT)->map(fn (TrackingStatus $status) => static::timelineEntry($status))->values()->all())
+            ->all();
+    }
+
+    /**
+     * The first word of a name.
+     */
+    public static function firstName(?string $name): ?string
+    {
+        $name = trim((string) $name);
+
+        return $name === '' ? null : Str::before($name, ' ');
+    }
+
+    private function envelope(string $event, string $reason, array $data): array
+    {
+        return [
+            'event'   => $event,
+            'reason'  => $reason,
+            'sent_at' => Carbon::now()->toISOString(),
+            'data'    => $data,
+        ];
+    }
+
+    private function orderState(): array
+    {
+        $status = strtolower((string) $this->order->status);
+
+        return [
+            'status'    => $status !== '' ? $status : null,
+            'en_route'  => $this->isEnRoute(),
+            'completed' => $status === 'completed',
+            'canceled'  => $status === 'canceled',
+            'timeline'  => $this->scope->isOrderCustomer($this->order) ? $this->timeline($this->order->tracking_number_uuid) : [],
+        ];
+    }
+
+    private function stop(TrackingStop $stop): array
+    {
+        $eta = $stop->completed ? null : ($this->etas[(int) $stop->sequence] ?? null);
+
+        return [
+            'id'       => $stop->waypoint?->public_id,
+            'type'     => $stop->type,
+            'sequence' => $stop->sequence,
+            'status'   => $stop->status,
+            'complete' => $stop->completed,
+            'eta'      => $eta,
+            'timeline' => $this->timeline($stop->trackingNumberUuid),
+        ];
+    }
+
+    private function timeline(?string $trackingNumberUuid): array
+    {
+        return $trackingNumberUuid ? ($this->timelines[$trackingNumberUuid] ?? []) : [];
+    }
+
+    private static function timelineEntry(TrackingStatus $status): array
+    {
+        $createdAt = $status->getRawOriginal('created_at') ?? $status->created_at;
+
+        return [
+            'status'     => $status->status,
+            'code'       => $status->code !== null ? strtolower((string) $status->code) : null,
+            'complete'   => (bool) $status->complete,
+            'created_at' => $createdAt ? Carbon::parse($createdAt)->toISOString() : null,
+        ];
+    }
+
+    private function assignedDriver(): ?Driver
+    {
+        $driver = $this->order->driverAssigned;
+
+        return $driver instanceof Driver ? $driver : null;
+    }
+
+    private function assignedVehicle(): ?Vehicle
+    {
+        $vehicle = $this->order->vehicleAssigned ?? $this->assignedDriver()?->vehicle;
+
+        return $vehicle instanceof Vehicle ? $vehicle : null;
+    }
+
+    private function vehicleLabel(): ?string
+    {
+        $label = trim((string) $this->assignedVehicle()?->display_name);
+
+        return $label === '' ? null : $label;
+    }
+
+    /**
+     * The most recently updated of the driver and the vehicle that has a usable position.
+     *
+     * @return array{0: Driver|Vehicle, 1: \Fleetbase\LaravelMysqlSpatial\Types\Point}|null
+     */
+    private function locationSource(): ?array
+    {
+        $candidates = [];
+        foreach ([$this->assignedDriver(), $this->assignedVehicle()] as $subject) {
+            $point = $subject ? static::usablePoint($subject) : null;
+            if ($point) {
+                $candidates[] = [$subject, $point];
+            }
+        }
+
+        usort($candidates, fn (array $a, array $b) => static::seenAt($b[0]) <=> static::seenAt($a[0]));
+
+        return $candidates[0] ?? null;
+    }
+
+    private static function seenAt(Driver|Vehicle $subject): int
+    {
+        return $subject->updated_at ? Carbon::parse($subject->updated_at)->getTimestamp() : 0;
+    }
+
+    private static function usablePoint(Driver|Vehicle $subject)
+    {
+        try {
+            $point = $subject->location ? Utils::getPointFromMixed($subject->location) : null;
+        } catch (\Throwable) {
+            return null;
+        }
+
+        if (!$point) {
+            return null;
+        }
+
+        $lat = (float) $point->getLat();
+        $lng = (float) $point->getLng();
+        $valid = is_finite($lat) && is_finite($lng) && abs($lat) <= 90 && abs($lng) <= 180 && !(abs($lat) < 0.000001 && abs($lng) < 0.000001);
+
+        return $valid ? $point : null;
+    }
+}
diff --git a/server/tests/Feature/Http/Internal/PositionControllerReplayChannelTest.php b/server/tests/Feature/Http/Internal/PositionControllerReplayChannelTest.php
new file mode 100644
index 000000000..261a5b323
--- /dev/null
+++ b/server/tests/Feature/Http/Internal/PositionControllerReplayChannelTest.php
@@ -0,0 +1,131 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\PositionController;
+use Fleetbase\Models\User;
+use Fleetbase\Support\SocketCluster\ChannelAuthorizer;
+use Fleetbase\Support\SocketCluster\ChannelDecision;
+use Fleetbase\Support\SocketCluster\SocketPrincipal;
+use Fleetbase\TestSupport\DispatchRecorder;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Http\Request;
+
+/**
+ * Covers the positions/replay channel check: with socket authentication on, a replay may only
+ * target a channel the requesting user could subscribe to; with it off the endpoint is unchanged.
+ */
+class PositionReplayChannelAuthorizerFake
+{
+    public array $checked = [];
+
+    public function __construct(public array $allowed = [])
+    {
+    }
+
+    public function authorize(?SocketPrincipal $principal, string $channel): ChannelDecision
+    {
+        $this->checked[] = [$principal, $channel];
+
+        return in_array($channel, $this->allowed, true) ? ChannelDecision::allowed('resolver') : ChannelDecision::denied('forbidden');
+    }
+}
+
+function positionReplayChannelBoot(bool $enabled): PositionReplayChannelAuthorizerFake
+{
+    config(['broadcasting.connections.socketcluster.auth_key' => $enabled ? 'fleetops-position-replay-test-key-0123456789' : null]);
+
+    $pdo = new PDO('sqlite::memory:');
+    $pdo->sqliteCreateFunction('ST_PointFromText', fn ($wkt, $srid = 0, $axisOrder = null) => $wkt);
+    $connection = new SQLiteConnection($pdo);
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+
+    $schema = $connection->getSchemaBuilder();
+    foreach (['positions' => ['uuid', 'company_uuid', 'subject_uuid', 'coordinates', 'speed'], 'companies' => ['uuid', 'public_id']] as $table => $columns) {
+        $schema->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+    $connection->table('companies')->insert(['uuid' => 'company-1', 'public_id' => 'company_one']);
+    $connection->table('positions')->insert(['uuid' => 'pos-1', 'company_uuid' => 'company-1', 'subject_uuid' => 'vehicle-1', 'created_at' => '2026-10-06 08:00:00']);
+
+    session(['company' => 'company-1']);
+    DispatchRecorder::$dispatched = [];
+
+    $authorizer = new PositionReplayChannelAuthorizerFake(['vehicle.vehicle-1']);
+    app()->instance(ChannelAuthorizer::class, $authorizer);
+
+    return $authorizer;
+}
+
+function positionReplayChannelRequest(mixed $channel, ?User $user = null): Request
+{
+    $request = Request::create('/int/v1/positions/replay', 'POST', ['channel_id' => $channel, 'position_ids' => ['pos-1']]);
+    $request->setUserResolver(fn () => $user);
+
+    return $request;
+}
+
+function positionReplayChannelUser(): User
+{
+    $user = (new ReflectionClass(User::class))->newInstanceWithoutConstructor();
+    $user->setRawAttributes(['uuid' => 'user-1', 'public_id' => 'user_one', 'company_uuid' => 'company-1', 'type' => 'user'], true);
+
+    return $user;
+}
+
+afterEach(function () {
+    config(['broadcasting.connections.socketcluster.auth_key' => null]);
+});
+
+test('a replay to a channel the user may subscribe to is started', function () {
+    $authorizer = positionReplayChannelBoot(true);
+
+    $response = (new PositionController())->replay(positionReplayChannelRequest('vehicle.vehicle-1', positionReplayChannelUser()));
+
+    [$principal, $channel] = $authorizer->checked[0];
+    expect($response->getData(true)['status'])->toBe('ok')
+        ->and(DispatchRecorder::$dispatched)->toHaveCount(1)
+        ->and($channel)->toBe('vehicle.vehicle-1')
+        ->and($principal->kind)->toBe('user')
+        ->and($principal->sub)->toBe('user-1')
+        ->and($principal->cid)->toBe('company-1')
+        ->and($principal->adm)->toBeFalse();
+});
+
+test('a replay to any other channel is refused before anything is queued', function () {
+    $authorizer = positionReplayChannelBoot(true);
+    $controller = new PositionController();
+    $user       = positionReplayChannelUser();
+
+    foreach ([
+        positionReplayChannelRequest('chat_channel.someone-elses', $user),
+        positionReplayChannelRequest('vehicle.vehicle-1', null),
+        positionReplayChannelRequest('vehicle. vehicle-1', $user),
+        positionReplayChannelRequest(str_repeat('x', 256), $user),
+        positionReplayChannelRequest(['vehicle.vehicle-1'], $user),
+    ] as $request) {
+        $response = $controller->replay($request);
+        expect($response->getStatusCode())->toBe(403)
+            ->and($response->getData(true)['error'])->toContain('not allowed');
+    }
+
+    expect(DispatchRecorder::$dispatched)->toBe([])
+        ->and(array_column($authorizer->checked, 1))->toBe(['chat_channel.someone-elses']);
+});
+
+test('without socket authentication the replay endpoint does not check the channel', function () {
+    $authorizer = positionReplayChannelBoot(false);
+
+    $response = (new PositionController())->replay(positionReplayChannelRequest('anything.at-all'));
+
+    expect($response->getData(true)['status'])->toBe('ok')
+        ->and($authorizer->checked)->toBe([]);
+});
diff --git a/server/tests/Unit/Support/SocketChannelsTest.php b/server/tests/Unit/Support/SocketChannelsTest.php
new file mode 100644
index 000000000..b404cbfca
--- /dev/null
+++ b/server/tests/Unit/Support/SocketChannelsTest.php
@@ -0,0 +1,394 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Trailer;
+use Fleetbase\FleetOps\Providers\FleetOpsServiceProvider;
+use Fleetbase\FleetOps\Support\SocketChannels;
+use Fleetbase\Models\User;
+use Fleetbase\Support\SocketCluster\ChannelAuthorizer;
+use Fleetbase\Support\SocketCluster\ChannelDecision;
+use Fleetbase\Support\SocketCluster\SocketChannelRegistry;
+use Fleetbase\Support\SocketCluster\SocketPrincipal;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Http\Request;
+
+/**
+ * Covers the FleetOps realtime channel resolvers against SQLite through the core
+ * ChannelAuthorizer: company scoping for console users and API credentials across two
+ * companies on every prefix, the narrow driver and customer rules, the denied public
+ * tracking prefix, the driver socket principal, and the service provider wiring.
+ */
+const SOCKET_CHANNELS_TABLES = [
+    'orders'             => 'order',
+    'drivers'            => 'driver',
+    'vehicles'           => 'vehicle',
+    'assets'             => 'trailer',
+    'devices'            => 'device',
+    'waypoints'          => 'waypoint',
+    'entities'           => 'entity',
+    'places'             => 'place',
+    'contacts'           => 'contact',
+    'vendors'            => 'vendor',
+    'integrated_vendors' => 'integrated_vendor',
+    'fleets'             => 'fleet',
+    'zones'              => 'zone',
+    'service_areas'      => 'service_area',
+    'service_rates'      => 'service_rate',
+    'service_quotes'     => 'service_quote',
+    'purchase_rates'     => 'purchase_rate',
+    'tracking_statuses'  => 'tracking_status',
+    'tracking_numbers'   => 'tracking_number',
+    'payloads'           => 'payload',
+    'positions'          => 'position',
+    'companies'          => 'company',
+    'users'              => 'user',
+];
+
+const SOCKET_CHANNELS_COLUMNS = [
+    'uuid', 'public_id', 'company_uuid', 'customer_uuid', 'customer_type', 'driver_assigned_uuid', 'vehicle_assigned_uuid',
+    'payload_uuid', 'vehicle_uuid', 'user_uuid', 'attachable_uuid', 'attachable_type', 'subject_uuid', 'subject_type',
+    'status', 'name', 'email', 'type', 'asset_class', 'started', 'started_at', 'place_uuid', 'service_area_uuid', '_key',
+];
+
+function socketChannelsBoot(): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection, 'sandbox' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+
+    $schema = $connection->getSchemaBuilder();
+    foreach (array_keys(SOCKET_CHANNELS_TABLES) as $table) {
+        $schema->create($table, function ($blueprint) use ($table) {
+            $blueprint->increments('id');
+            foreach (SOCKET_CHANNELS_COLUMNS as $column) {
+                // Positions have no public_id, as in the real schema.
+                if ($table === 'positions' && $column === 'public_id') {
+                    continue;
+                }
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    // One record of every kind in each of two companies.
+    foreach (['a', 'b'] as $company) {
+        $connection->table('companies')->insert(['uuid' => "company-{$company}", 'public_id' => "company_{$company}"]);
+        $connection->table('users')->insert(['uuid' => "drivers-user-{$company}", 'public_id' => "user_drivers_{$company}", 'company_uuid' => "company-{$company}"]);
+        foreach (SOCKET_CHANNELS_TABLES as $table => $name) {
+            if (in_array($table, ['companies', 'users'], true)) {
+                continue;
+            }
+
+            $row = ['uuid' => "{$table}-{$company}", 'company_uuid' => "company-{$company}"];
+            if ($table !== 'positions') {
+                $row['public_id'] = "{$name}_{$company}";
+            }
+            if ($table === 'drivers') {
+                $row['user_uuid'] = "drivers-user-{$company}";
+            }
+            if ($table === 'assets') {
+                $row['asset_class'] = Trailer::ASSET_CLASS;
+            }
+            $connection->table($table)->insert($row);
+        }
+    }
+
+    // Company A's operation: drivers, their vehicles, customers and orders.
+    $connection->table('users')->insert([
+        ['uuid' => 'user-driver-a1', 'public_id' => 'user_drivera1', 'company_uuid' => 'company-a'],
+        ['uuid' => 'user-driver-a2', 'public_id' => 'user_drivera2', 'company_uuid' => 'company-a'],
+        ['uuid' => 'user-driver-a3', 'public_id' => 'user_drivera3', 'company_uuid' => 'company-a'],
+        ['uuid' => 'user-office-a', 'public_id' => 'user_officea', 'company_uuid' => 'company-a'],
+    ]);
+    $connection->table('drivers')->insert([
+        ['uuid' => 'driver-a1', 'public_id' => 'driver_a1', 'company_uuid' => 'company-a', 'user_uuid' => 'user-driver-a1', 'vehicle_uuid' => 'vehicle-a1'],
+        ['uuid' => 'driver-a2', 'public_id' => 'driver_a2', 'company_uuid' => 'company-a', 'user_uuid' => 'user-driver-a2', 'vehicle_uuid' => 'vehicle-a2'],
+        ['uuid' => 'driver-a3', 'public_id' => 'driver_a3', 'company_uuid' => 'company-a', 'user_uuid' => 'user-driver-a3', 'vehicle_uuid' => 'vehicle-a3'],
+    ]);
+    $connection->table('vehicles')->insert([
+        ['uuid' => 'vehicle-a1', 'public_id' => 'vehicle_a1', 'company_uuid' => 'company-a'],
+        ['uuid' => 'vehicle-a2', 'public_id' => 'vehicle_a2', 'company_uuid' => 'company-a'],
+        ['uuid' => 'vehicle-a3', 'public_id' => 'vehicle_a3', 'company_uuid' => 'company-a'],
+    ]);
+    $connection->table('contacts')->insert([
+        ['uuid' => 'contact-a1', 'public_id' => 'contact_a1', 'company_uuid' => 'company-a', 'type' => 'customer'],
+        ['uuid' => 'contact-a2', 'public_id' => 'contact_a2', 'company_uuid' => 'company-a', 'type' => 'customer'],
+    ]);
+    $connection->table('orders')->insert([
+        // driver-a1 drives contact-a1's active order in vehicle-a1
+        ['uuid' => 'order-a1', 'public_id' => 'order_a1', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a1', 'driver_assigned_uuid' => 'driver-a1', 'vehicle_assigned_uuid' => 'vehicle-a1', 'status' => 'started'],
+        // driver-a2's order for contact-a2, on which driver-a1 carries an entity
+        ['uuid' => 'order-a2', 'public_id' => 'order_a2', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a2', 'driver_assigned_uuid' => 'driver-a2', 'vehicle_assigned_uuid' => 'vehicle-a2', 'status' => 'dispatched', 'payload_uuid' => 'payload-a2'],
+        // contact-a1's completed order with driver-a2
+        ['uuid' => 'order-a3', 'public_id' => 'order_a3', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a1', 'driver_assigned_uuid' => 'driver-a2', 'vehicle_assigned_uuid' => 'vehicle-a2', 'status' => 'completed'],
+        // driver-a2's order with nothing to do with driver-a1
+        ['uuid' => 'order-a4', 'public_id' => 'order_a4', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a2', 'driver_assigned_uuid' => 'driver-a2', 'status' => 'started', 'payload_uuid' => 'payload-a4'],
+        // contact-a1's active order with driver-a3 and no vehicle assigned to the order
+        ['uuid' => 'order-a5', 'public_id' => 'order_a5', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a1', 'driver_assigned_uuid' => 'driver-a3', 'status' => 'created'],
+    ]);
+    $connection->table('entities')->insert([
+        ['uuid' => 'entity-a2', 'public_id' => 'entity_a2', 'company_uuid' => 'company-a', 'payload_uuid' => 'payload-a2', 'driver_assigned_uuid' => 'driver-a1'],
+        ['uuid' => 'entity-a4', 'public_id' => 'entity_a4', 'company_uuid' => 'company-a', 'payload_uuid' => 'payload-a4', 'driver_assigned_uuid' => 'driver-a2'],
+    ]);
+    $connection->table('devices')->insert([
+        ['uuid' => 'device-a1', 'public_id' => 'device_a1', 'company_uuid' => 'company-a', 'attachable_uuid' => 'vehicle-a1'],
+        ['uuid' => 'device-a2', 'public_id' => 'device_a2', 'company_uuid' => 'company-a', 'attachable_uuid' => 'vehicle-a2'],
+        ['uuid' => 'device-loose', 'public_id' => 'device_loose', 'company_uuid' => 'company-a', 'attachable_uuid' => null],
+    ]);
+    $connection->table('positions')->insert([
+        ['uuid' => 'position-own', 'company_uuid' => 'company-a', 'subject_uuid' => 'driver-a1'],
+        ['uuid' => 'position-vehicle', 'company_uuid' => 'company-a', 'subject_uuid' => 'vehicle-a1'],
+        ['uuid' => 'position-other', 'company_uuid' => 'company-a', 'subject_uuid' => 'driver-a2'],
+    ]);
+
+    $registry = new SocketChannelRegistry();
+    SocketChannels::register($registry);
+    app()->instance(SocketChannelRegistry::class, $registry);
+    session(['company' => null]);
+
+    return $connection;
+}
+
+function socketChannelsPrincipal(string $kind, string $sub, array $claims = []): SocketPrincipal
+{
+    return SocketPrincipal::fromClaims(array_merge([
+        'kind' => $kind,
+        'sub'  => $sub,
+        'cid'  => 'company-a',
+        'cpid' => 'company_a',
+        'env'  => 'live',
+        'ids'  => [$sub],
+    ], $claims));
+}
+
+function socketChannelsDecide(SocketPrincipal $principal, string $channel): ChannelDecision
+{
+    return app(ChannelAuthorizer::class)->authorize($principal, $channel);
+}
+
+function socketChannelsAllows(SocketPrincipal $principal, string $channel): bool
+{
+    $decision = socketChannelsDecide($principal, $channel);
+
+    // A resolver error would also deny: make sure every denial here is a real decision.
+    expect($decision->reason)->not->toBe('resolver_error');
+
+    return $decision->allow;
+}
+
+function socketChannelsDriver(): SocketPrincipal
+{
+    return socketChannelsPrincipal('driver', 'driver-a1', ['ids' => ['driver-a1', 'driver_a1', 'user-driver-a1', 'user_drivera1']]);
+}
+
+function socketChannelsCustomer(): SocketPrincipal
+{
+    return socketChannelsPrincipal('customer', 'contact-a1', ['ids' => ['contact-a1', 'contact_a1']]);
+}
+
+test('every fleetops prefix is registered and tracking channels are denied to everyone', function () {
+    socketChannelsBoot();
+    $registry = app(SocketChannelRegistry::class);
+
+    foreach ([...array_keys(SocketChannels::MODEL_PREFIXES), ...array_keys(SocketChannels::MORPH_PREFIXES), 'position', 'tracking'] as $prefix) {
+        expect($registry->resolve($prefix))->not->toBeNull();
+    }
+
+    $user = socketChannelsPrincipal('user', 'user-office-a', ['ids' => ['user-office-a']]);
+    expect(socketChannelsAllows($user, 'tracking.abcdefghijklmnopqrstuvwxyz'))->toBeFalse()
+        ->and(socketChannelsAllows(socketChannelsDriver(), 'tracking.abcdefghijklmnopqrstuvwxyz'))->toBeFalse()
+        ->and(socketChannelsAllows(socketChannelsCustomer(), 'tracking.abcdefghijklmnopqrstuvwxyz'))->toBeFalse();
+});
+
+test('console users and api credentials reach every record of their own company and nothing of another', function () {
+    socketChannelsBoot();
+    $user = socketChannelsPrincipal('user', 'user-office-a', ['ids' => ['user-office-a', 'user_officea']]);
+    $api  = socketChannelsPrincipal('api', 'api-credential-a', ['ids' => ['api-credential-a']]);
+
+    $prefixes = [
+        ...array_map(fn ($class) => (new $class())->getTable(), SocketChannels::MODEL_PREFIXES),
+        'customer'    => 'contacts',
+        'vendor'      => 'vendors',
+        'facilitator' => 'integrated_vendors',
+    ];
+
+    foreach ($prefixes as $prefix => $table) {
+        $name = SOCKET_CHANNELS_TABLES[$table];
+        foreach ([$user, $api] as $principal) {
+            expect(socketChannelsAllows($principal, "{$prefix}.{$table}-a"))->toBeTrue("{$principal->kind} {$prefix} by uuid")
+                ->and(socketChannelsAllows($principal, "{$prefix}.{$name}_a"))->toBeTrue("{$principal->kind} {$prefix} by public id")
+                ->and(socketChannelsAllows($principal, "{$prefix}.{$table}-b"))->toBeFalse("{$principal->kind} {$prefix} of another company")
+                ->and(socketChannelsAllows($principal, "{$prefix}.missing-record"))->toBeFalse("{$principal->kind} {$prefix} unknown id");
+        }
+    }
+
+    // Morph prefixes try each kind of record in turn.
+    expect(socketChannelsAllows($user, 'customer.vendors-a'))->toBeTrue()
+        ->and(socketChannelsAllows($user, 'facilitator.vendors-a'))->toBeTrue()
+        ->and(socketChannelsAllows($user, 'facilitator.contacts-a'))->toBeTrue()
+        ->and(socketChannelsAllows($user, 'vendor.integrated_vendors-b'))->toBeFalse();
+
+    // Positions have no public id and are found by uuid only.
+    expect(socketChannelsAllows($user, 'position.positions-a'))->toBeTrue()
+        ->and(socketChannelsAllows($api, 'position.positions-b'))->toBeFalse();
+
+    // Sandbox principals look records up on the sandbox connection.
+    $sandbox = socketChannelsPrincipal('user', 'user-office-a', ['env' => 'test']);
+    expect(socketChannelsAllows($sandbox, 'customer.contacts-a'))->toBeTrue()
+        ->and(SocketChannels::connection($sandbox))->toBe('sandbox')
+        ->and(SocketChannels::connection($user))->toBeNull();
+
+    // A company-scoped principal without a company sees nothing.
+    $orphan = SocketPrincipal::fromClaims(['kind' => 'user', 'sub' => 'user-orphan', 'ids' => ['user-orphan']]);
+    expect(socketChannelsAllows($orphan, 'customer.contacts-a'))->toBeFalse()
+        ->and(socketChannelsAllows($orphan, 'position.positions-a'))->toBeFalse();
+});
+
+test('a driver reaches only their own driver record, vehicle, devices, positions and assigned orders', function () {
+    socketChannelsBoot();
+    $driver = socketChannelsDriver();
+
+    // Orders: assigned directly, or through an entity on the payload; never someone else's.
+    expect(socketChannelsAllows($driver, 'order.order-a1'))->toBeTrue()
+        ->and(socketChannelsAllows($driver, 'order.order_a1'))->toBeTrue()
+        ->and(socketChannelsAllows($driver, 'order.order-a2'))->toBeTrue()
+        ->and(socketChannelsAllows($driver, 'order.order-a4'))->toBeFalse()
+        ->and(socketChannelsAllows($driver, 'order.order-a3'))->toBeFalse()
+        ->and(socketChannelsAllows($driver, 'order.orders-b'))->toBeFalse();
+
+    // Their own driver record, under either channel the order events use.
+    expect(socketChannelsAllows($driver, 'driver.driver-a1'))->toBeTrue()
+        ->and(socketChannelsAllows($driver, 'driverAssigned.driver-a1'))->toBeTrue()
+        ->and(socketChannelsAllows($driver, 'driverAssigned.driver_a1'))->toBeTrue()
+        ->and(socketChannelsAllows($driver, 'driverAssigned.driver-a2'))->toBeFalse()
+        ->and(socketChannelsAllows($driver, 'driver.driver-a2'))->toBeFalse();
+
+    // Their current vehicle, its devices and positions; not another driver's.
+    expect(socketChannelsAllows($driver, 'vehicle.vehicle-a1'))->toBeTrue()
+        ->and(socketChannelsAllows($driver, 'vehicle.vehicle-a2'))->toBeFalse()
+        ->and(socketChannelsAllows($driver, 'device.device-a1'))->toBeTrue()
+        ->and(socketChannelsAllows($driver, 'device.device-a2'))->toBeFalse()
+        ->and(socketChannelsAllows($driver, 'device.device-loose'))->toBeFalse()
+        ->and(socketChannelsAllows($driver, 'position.position-own'))->toBeTrue()
+        ->and(socketChannelsAllows($driver, 'position.position-vehicle'))->toBeTrue()
+        ->and(socketChannelsAllows($driver, 'position.position-other'))->toBeFalse();
+
+    // Nothing without a narrow rule, and no customer records.
+    expect(socketChannelsAllows($driver, 'waypoint.waypoints-a'))->toBeFalse()
+        ->and(socketChannelsAllows($driver, 'place.places-a'))->toBeFalse()
+        ->and(socketChannelsAllows($driver, 'contact.contact-a1'))->toBeFalse()
+        ->and(socketChannelsAllows($driver, 'customer.contact-a1'))->toBeFalse()
+        ->and(socketChannelsAllows($driver, 'vendor.vendors-a'))->toBeFalse();
+
+    // A driver with no current vehicle owns no vehicle records.
+    $walker = socketChannelsPrincipal('driver', 'driver-without-vehicle');
+    expect(socketChannelsAllows($walker, 'vehicle.vehicles-a'))->toBeFalse();
+});
+
+test('a customer reaches their own orders and the driver and vehicle of their active orders', function () {
+    socketChannelsBoot();
+    $customer = socketChannelsCustomer();
+
+    expect(socketChannelsAllows($customer, 'order.order-a1'))->toBeTrue()
+        ->and(socketChannelsAllows($customer, 'order.order_a1'))->toBeTrue()
+        ->and(socketChannelsAllows($customer, 'order.order-a3'))->toBeTrue()
+        ->and(socketChannelsAllows($customer, 'order.order-a2'))->toBeFalse()
+        ->and(socketChannelsAllows($customer, 'order.orders-b'))->toBeFalse();
+
+    // driver-a1 drives an active order of theirs; driver-a2 only a completed one.
+    expect(socketChannelsAllows($customer, 'driver.driver-a1'))->toBeTrue()
+        ->and(socketChannelsAllows($customer, 'driverAssigned.driver_a1'))->toBeTrue()
+        ->and(socketChannelsAllows($customer, 'driver.driver-a3'))->toBeTrue()
+        ->and(socketChannelsAllows($customer, 'driver.driver-a2'))->toBeFalse();
+
+    // vehicle-a1 is assigned to an active order; vehicle-a3 is driven by an active order's driver.
+    expect(socketChannelsAllows($customer, 'vehicle.vehicle-a1'))->toBeTrue()
+        ->and(socketChannelsAllows($customer, 'vehicle.vehicle-a3'))->toBeTrue()
+        ->and(socketChannelsAllows($customer, 'vehicle.vehicle-a2'))->toBeFalse();
+
+    // Themselves, and no other contact, device or position.
+    expect(socketChannelsAllows($customer, 'contact.contact-a1'))->toBeTrue()
+        ->and(socketChannelsAllows($customer, 'customer.contact_a1'))->toBeTrue()
+        ->and(socketChannelsAllows($customer, 'contact.contact-a2'))->toBeFalse()
+        ->and(socketChannelsAllows($customer, 'customer.contact-a2'))->toBeFalse()
+        ->and(socketChannelsAllows($customer, 'device.device-a1'))->toBeFalse()
+        ->and(socketChannelsAllows($customer, 'position.position-vehicle'))->toBeFalse()
+        ->and(socketChannelsAllows($customer, 'waypoint.waypoints-a'))->toBeFalse();
+});
+
+test('other principal kinds are denied by the fleetops resolvers', function () {
+    socketChannelsBoot();
+    $checkout = socketChannelsPrincipal('checkout', 'checkout-a');
+    $resolver = SocketChannels::resolver([Order::class], fn () => true);
+
+    expect($resolver($checkout, 'order-a1', 'order.order-a1'))->toBeFalse()
+        ->and($resolver(socketChannelsDriver(), '', 'order.'))->toBeFalse()
+        ->and(SocketChannels::resolver([Order::class])(socketChannelsDriver(), 'order-a1'))->toBeFalse()
+        ->and(SocketChannels::narrowFor('waypoint'))->toBeNull();
+
+    $order = Order::where('uuid', 'order-a1')->first();
+    expect(SocketChannels::narrowOrder($checkout, $order))->toBeFalse()
+        ->and(SocketChannels::narrowDriver($checkout, $order))->toBeFalse()
+        ->and(SocketChannels::narrowVehicle($checkout, $order))->toBeFalse()
+        ->and(SocketChannels::narrowSelf($checkout, $order))->toBeFalse();
+});
+
+test('a sanctum user who drives for the current company gets a driver principal', function () {
+    socketChannelsBoot();
+    $request = Request::create('/v1/socket/token', 'POST');
+    $user    = User::where('uuid', 'user-driver-a1')->first();
+
+    session(['company' => 'company-a']);
+    $principal = SocketChannels::driverPrincipal($request, $user);
+
+    expect($principal)->toBeInstanceOf(SocketPrincipal::class)
+        ->and($principal->kind)->toBe('driver')
+        ->and($principal->sub)->toBe('driver-a1')
+        ->and($principal->ids)->toBe(['driver-a1', 'driver_a1', 'user-driver-a1', 'user_drivera1'])
+        ->and($principal->cid)->toBe('company-a')
+        ->and($principal->cpid)->toBe('company_a')
+        ->and($principal->env)->toBe('live')
+        ->and($principal->adm)->toBeFalse();
+
+    // The registry offers the same principal to the token endpoint.
+    expect(app(SocketChannelRegistry::class)->resolvePrincipal($request, $user)?->sub)->toBe('driver-a1');
+
+    // Without a session company the user's own company is used.
+    session(['company' => null]);
+    expect(SocketChannels::driverPrincipal($request, $user)?->sub)->toBe('driver-a1');
+
+    // A driver of another company, an office user, a stranger object: no claim.
+    session(['company' => 'company-b']);
+    expect(SocketChannels::driverPrincipal($request, $user))->toBeNull();
+
+    session(['company' => 'company-a']);
+    expect(SocketChannels::driverPrincipal($request, User::where('uuid', 'user-office-a')->first()))->toBeNull()
+        ->and(SocketChannels::driverPrincipal($request, (object) ['uuid' => 'user-driver-a1']))->toBeNull()
+        ->and(SocketChannels::driverPrincipal($request, new User()))->toBeNull();
+
+    session(['company' => null]);
+    $homeless = User::where('uuid', 'user-driver-a1')->first();
+    $homeless->setRawAttributes(array_merge($homeless->getAttributes(), ['company_uuid' => null]));
+    expect(SocketChannels::driverPrincipal($request, $homeless))->toBeNull();
+});
+
+test('the service provider registers the fleetops channels when the registry is built', function () {
+    socketChannelsBoot();
+    app()->forgetInstance(SocketChannelRegistry::class);
+
+    $provider = new FleetOpsServiceProvider(app());
+    $register = new ReflectionMethod(FleetOpsServiceProvider::class, 'registerSocketChannels');
+    $register->setAccessible(true);
+    $register->invoke($provider);
+
+    $registry = app(SocketChannelRegistry::class);
+
+    expect($registry->resolve('order'))->not->toBeNull()
+        ->and($registry->resolve('position'))->not->toBeNull()
+        ->and($registry->resolve('tracking'))->not->toBeNull();
+});
diff --git a/server/tests/Unit/Support/TrackingChannelTest.php b/server/tests/Unit/Support/TrackingChannelTest.php
new file mode 100644
index 000000000..ef612beef
--- /dev/null
+++ b/server/tests/Unit/Support/TrackingChannelTest.php
@@ -0,0 +1,228 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingChannel;
+use Fleetbase\FleetOps\Support\TrackingScope;
+use Fleetbase\Support\SocketCluster\SocketToken;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+
+/**
+ * Covers the public tracking channel: the per-customer TrackingScope, the opaque channel id
+ * (deterministic, keyed, distinct per customer), and the scoped tracking token.
+ */
+const TRACKING_CHANNEL_KEY = 'fleetops-tracking-channel-test-key-0123456789';
+
+function trackingChannelModel(string $class, array $attributes): EloquentModel
+{
+    $model = (new ReflectionClass($class))->newInstanceWithoutConstructor();
+    $model->setRawAttributes($attributes, true);
+
+    return $model;
+}
+
+function trackingChannelOrder(array $attributes = []): Order
+{
+    return trackingChannelModel(Order::class, array_merge([
+        'uuid'          => 'order-1111',
+        'company_uuid'  => 'company-1111',
+        'customer_type' => 'Fleetbase\\FleetOps\\Models\\Contact',
+        'customer_uuid' => 'contact-1111',
+        'payload_uuid'  => 'payload-1111',
+    ], $attributes));
+}
+
+function trackingChannelWaypoint(?string $customerUuid, string $customerType = 'Fleetbase\\FleetOps\\Models\\Contact'): Waypoint
+{
+    return trackingChannelModel(Waypoint::class, ['uuid' => 'waypoint-' . ($customerUuid ?? 'none'), 'customer_uuid' => $customerUuid, 'customer_type' => $customerUuid ? $customerType : null]);
+}
+
+/**
+ * Independent base32 (RFC 4648, lowercase, unpadded) to check the channel id against.
+ */
+function trackingChannelBase32(string $bytes): string
+{
+    $alphabet = 'abcdefghijklmnopqrstuvwxyz234567';
+    $buffer   = 0;
+    $bits     = 0;
+    $out      = '';
+    foreach (unpack('C*', $bytes) as $byte) {
+        $buffer = ($buffer << 8) | $byte;
+        $bits += 8;
+        while ($bits >= 5) {
+            $bits -= 5;
+            $out .= $alphabet[($buffer >> $bits) & 31];
+        }
+    }
+    if ($bits > 0) {
+        $out .= $alphabet[($buffer << (5 - $bits)) & 31];
+    }
+
+    return $out;
+}
+
+function trackingChannelEnable(?string $key = TRACKING_CHANNEL_KEY): void
+{
+    config(['broadcasting.connections.socketcluster.auth_key' => $key]);
+}
+
+afterEach(function () {
+    trackingChannelEnable(null);
+});
+
+test('a tracking scope identifies one customer of one order', function () {
+    $order = trackingChannelOrder();
+    $scope = TrackingScope::forOrder($order);
+
+    expect($scope->order_uuid)->toBe('order-1111')
+        ->and($scope->customer_type)->toBe('Fleetbase\\FleetOps\\Models\\Contact')
+        ->and($scope->customer_uuid)->toBe('contact-1111')
+        ->and($scope->company_uuid)->toBe('company-1111')
+        ->and($scope->key())->toBe('order-1111:Fleetbase\\FleetOps\\Models\\Contact:contact-1111')
+        ->and($scope->toArray())->toBe(['order_uuid' => 'order-1111', 'customer_type' => 'Fleetbase\\FleetOps\\Models\\Contact', 'customer_uuid' => 'contact-1111'])
+        ->and(json_encode($scope))->toBe(json_encode($scope->toArray()))
+        ->and($scope->order())->toBe($order)
+        ->and($scope->isOrderCustomer($order))->toBeTrue();
+
+    // A leading backslash on a stored morph type does not change the scope.
+    expect((new TrackingScope('order-1111', '\\Fleetbase\\FleetOps\\Models\\Contact', 'contact-1111'))->key())->toBe($scope->key())
+        ->and($scope->is('\\Fleetbase\\FleetOps\\Models\\Contact', 'contact-1111'))->toBeTrue()
+        ->and($scope->is('Fleetbase\\FleetOps\\Models\\Vendor', 'contact-1111'))->toBeFalse()
+        ->and($scope->is('Fleetbase\\FleetOps\\Models\\Contact', null))->toBeFalse();
+
+    // An order without a customer has no order scope.
+    expect(TrackingScope::forOrder(trackingChannelOrder(['customer_uuid' => null])))->toBeNull();
+
+    expect(fn () => new TrackingScope('order-1111', '', 'contact-1111'))->toThrow(InvalidArgumentException::class);
+});
+
+test('each stop belongs to its waypoint customer, else to the order customer', function () {
+    $order      = trackingChannelOrder();
+    $own        = trackingChannelWaypoint(null);
+    $neighbour  = trackingChannelWaypoint('contact-2222');
+    $vendorStop = trackingChannelWaypoint('vendor-3333', 'Fleetbase\\FleetOps\\Models\\Vendor');
+
+    $orderScope     = TrackingScope::forOrder($order);
+    $neighbourScope = TrackingScope::forStop($order, $neighbour);
+
+    expect(TrackingScope::forStop($order, $own)->key())->toBe($orderScope->key())
+        ->and(TrackingScope::forStop($order)->key())->toBe($orderScope->key())
+        ->and($neighbourScope->customer_uuid)->toBe('contact-2222')
+        ->and($orderScope->ownsStop($order, $own))->toBeTrue()
+        ->and($orderScope->ownsStop($order, null))->toBeTrue()
+        ->and($orderScope->ownsStop($order, $neighbour))->toBeFalse()
+        ->and($neighbourScope->ownsStop($order, $neighbour))->toBeTrue()
+        ->and($neighbourScope->ownsStop($order, $own))->toBeFalse()
+        ->and($neighbourScope->isOrderCustomer($order))->toBeFalse();
+
+    $scopes = TrackingScope::allForOrder($order, [$own, $neighbour, $vendorStop, $neighbour, 'not a waypoint']);
+    expect(array_map(fn (TrackingScope $scope) => $scope->customer_uuid, $scopes))->toBe(['contact-1111', 'contact-2222', 'vendor-3333'])
+        ->and($scopes[2]->customer_type)->toBe(Vendor::class);
+
+    // An explicit customer model.
+    $contact = trackingChannelModel(Contact::class, ['uuid' => 'contact-2222']);
+    expect(TrackingScope::forCustomer($order, $contact)->key())->toBe($neighbourScope->key());
+});
+
+test('a tracking scope loads its order and its waypoints when not given', function () {
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+    $schema = $connection->getSchemaBuilder();
+    foreach (['orders', 'waypoints'] as $table) {
+        $schema->create($table, function ($blueprint) {
+            $blueprint->increments('id');
+            foreach (['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'place_uuid', 'customer_uuid', 'customer_type'] as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+    $connection->table('orders')->insert(['uuid' => 'order-1111', 'company_uuid' => 'company-1111', 'customer_uuid' => 'contact-1111', 'customer_type' => 'Fleetbase\\FleetOps\\Models\\Contact', 'payload_uuid' => 'payload-1111']);
+    $connection->table('waypoints')->insert([
+        ['uuid' => 'waypoint-1', 'payload_uuid' => 'payload-1111', 'customer_uuid' => 'contact-2222', 'customer_type' => 'Fleetbase\\FleetOps\\Models\\Contact'],
+        ['uuid' => 'waypoint-2', 'payload_uuid' => 'payload-1111', 'customer_uuid' => null, 'customer_type' => null],
+        ['uuid' => 'waypoint-3', 'payload_uuid' => 'payload-other', 'customer_uuid' => 'contact-9999', 'customer_type' => 'Fleetbase\\FleetOps\\Models\\Contact'],
+    ]);
+
+    $scope = new TrackingScope('order-1111', 'Fleetbase\\FleetOps\\Models\\Contact', 'contact-1111');
+    expect($scope->company_uuid)->toBeNull()
+        ->and($scope->order()?->uuid)->toBe('order-1111');
+
+    $order = $scope->order();
+    expect(array_map(fn (TrackingScope $scope) => $scope->customer_uuid, TrackingScope::allForOrder($order)))->toBe(['contact-1111', 'contact-2222'])
+        ->and(TrackingScope::allForOrder(trackingChannelOrder(['payload_uuid' => null])))->toHaveCount(1);
+
+    // A scope given another order's model ignores it.
+    expect((new TrackingScope('order-1111', 'Fleetbase\\FleetOps\\Models\\Contact', 'contact-1111', trackingChannelOrder(['uuid' => 'order-other'])))->company_uuid)->toBeNull();
+});
+
+test('the channel id is an unguessable keyed hmac of the scope, distinct per customer', function () {
+    trackingChannelEnable();
+    $order     = trackingChannelOrder();
+    $scope     = TrackingScope::forOrder($order);
+    $neighbour = TrackingScope::forStop($order, trackingChannelWaypoint('contact-2222'));
+
+    $trackingKey = hash_hmac('sha256', 'fleetbase-socket:tracking', TRACKING_CHANNEL_KEY);
+    $expected    = substr(trackingChannelBase32(hash_hmac('sha256', 'order-1111:Fleetbase\\FleetOps\\Models\\Contact:contact-1111', $trackingKey, true)), 0, 26);
+
+    expect(TrackingChannel::opaqueId($scope))->toBe($expected)
+        ->and(TrackingChannel::opaqueId($scope))->toMatch('/^[a-z2-7]{26}$/')
+        ->and(TrackingChannel::name($scope))->toBe('tracking.' . $expected)
+        ->and(TrackingChannel::name(TrackingScope::forOrder(trackingChannelOrder())))->toBe('tracking.' . $expected)
+        ->and(TrackingChannel::name($neighbour))->not->toBe(TrackingChannel::name($scope))
+        ->and(trackingChannelBase32('foobar'))->toBe('mzxw6ytboi');
+
+    // Another key yields other channels: the id cannot be computed without the key.
+    trackingChannelEnable('another-fleetops-tracking-channel-key-987654321');
+    expect(TrackingChannel::opaqueId($scope))->not->toBe($expected);
+});
+
+test('channels and tokens need socket authentication to be configured', function () {
+    trackingChannelEnable(null);
+    $scope = TrackingScope::forOrder(trackingChannelOrder());
+
+    expect(fn () => TrackingChannel::name($scope))->toThrow(RuntimeException::class)
+        ->and(fn () => TrackingChannel::token($scope))->toThrow(RuntimeException::class);
+});
+
+test('a tracking token may subscribe to its own channel only', function () {
+    trackingChannelEnable();
+    $scope = TrackingScope::forOrder(trackingChannelOrder());
+
+    $minted    = TrackingChannel::token($scope);
+    $principal = SocketToken::verify($minted['token']);
+
+    expect($minted['expires_in'])->toBe(1800)
+        ->and($minted['expires_at'])->toBeString()
+        ->and($principal->kind)->toBe('tracking')
+        ->and($principal->sub)->toBe(TrackingChannel::opaqueId($scope))
+        ->and($principal->scp)->toBe([TrackingChannel::name($scope)])
+        ->and($principal->cid)->toBe('company-1111')
+        ->and($principal->adm)->toBeFalse();
+
+    // A scope without its order model still mints a token scoped to its channel.
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+    $connection->getSchemaBuilder()->create('orders', function ($blueprint) {
+        $blueprint->increments('id');
+        $blueprint->string('uuid')->nullable();
+        $blueprint->string('company_uuid')->nullable();
+        $blueprint->timestamps();
+        $blueprint->timestamp('deleted_at')->nullable();
+    });
+    $connection->table('orders')->insert(['uuid' => 'order-2222', 'company_uuid' => 'company-2222']);
+
+    $scope  = new TrackingScope('order-2222', Contact::class, 'contact-1111');
+    $loaded = SocketToken::verify(TrackingChannel::token($scope)['token']);
+    expect($loaded->cid)->toBe('company-2222')
+        ->and($loaded->scp)->toBe([TrackingChannel::name($scope)]);
+});
diff --git a/server/tests/Unit/Support/TrackingPublisherTest.php b/server/tests/Unit/Support/TrackingPublisherTest.php
new file mode 100644
index 000000000..c913840f8
--- /dev/null
+++ b/server/tests/Unit/Support/TrackingPublisherTest.php
@@ -0,0 +1,417 @@
+<?php
+
+use Fleetbase\FleetOps\Events\EntityCompleted;
+use Fleetbase\FleetOps\Events\WaypointActivityChanged;
+use Fleetbase\FleetOps\Jobs\PublishTrackingUpdate;
+use Fleetbase\FleetOps\Listeners\PublishTrackingUpdates;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingChannel;
+use Fleetbase\FleetOps\Support\TrackingPublisher;
+use Fleetbase\FleetOps\Support\TrackingScope;
+use Fleetbase\FleetOps\Tracking\TrackingContext;
+use Fleetbase\FleetOps\Tracking\TrackingContextBuilder;
+use Fleetbase\FleetOps\Tracking\TrackingIntelligenceService;
+use Fleetbase\FleetOps\Tracking\TrackingOptions;
+use Fleetbase\FleetOps\Tracking\TrackingStop;
+use Fleetbase\LaravelMysqlSpatial\Types\Point;
+use Fleetbase\Models\User;
+use Fleetbase\TestSupport\DispatchRecorder;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Http\Client\Factory as HttpFactory;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+
+/**
+ * Covers publishing to public tracking channels: the request-path hooks (gated on socket
+ * authentication, throttled for positions, queueing a job), the queued job, the stop listener,
+ * and the per-customer publication of full and position-only updates.
+ */
+class TrackingPublisherProbe extends TrackingPublisher
+{
+    public array $sent   = [];
+    public bool $accepts = true;
+
+    protected function send(string $channel, array $payload): bool
+    {
+        $this->sent[] = [$channel, $payload];
+
+        return $this->accepts;
+    }
+
+    public function realSend(string $channel, array $payload): bool
+    {
+        return parent::send($channel, $payload);
+    }
+
+    public function tracker(Order $order): array
+    {
+        return $this->trackerFor($order);
+    }
+}
+
+class TrackingPublisherContextBuilderFake extends TrackingContextBuilder
+{
+    public function __construct(public Collection $stops)
+    {
+    }
+
+    public function build(Order $order, TrackingOptions $options): TrackingContext
+    {
+        return new TrackingContext(
+            order: $order,
+            payload: null,
+            driver: null,
+            origin: null,
+            driverLocation: null,
+            stops: $this->stops,
+            completedStops: collect(),
+            remainingStops: collect(),
+            activeStop: null,
+            nextStop: null,
+            driverLocationAgeSeconds: null,
+        );
+    }
+}
+
+class TrackingPublisherIntelligenceFake extends TrackingIntelligenceService
+{
+    public int $calls = 0;
+
+    public function __construct(public array|Throwable $result)
+    {
+    }
+
+    public function track(Order $order, array|TrackingOptions $options = []): array
+    {
+        $this->calls++;
+        if ($this->result instanceof Throwable) {
+            throw $this->result;
+        }
+
+        return $this->result;
+    }
+}
+
+const TRACKING_PUBLISHER_KEY     = 'fleetops-tracking-publisher-test-key-0123456789';
+const TRACKING_PUBLISHER_CONTACT = 'Fleetbase\\FleetOps\\Models\\Contact';
+
+function trackingPublisherBoot(bool $enabled = true): SQLiteConnection
+{
+    config(['broadcasting.connections.socketcluster.auth_key' => $enabled ? TRACKING_PUBLISHER_KEY : null]);
+    config(['broadcasting.connections.socketcluster.publish_url' => 'http://socket.test:8001']);
+    config(['broadcasting.connections.socketcluster.options' => ['host' => 'socket.test', 'port' => 8000, 'secure' => false, 'path' => '/socketcluster/', 'query' => []]]);
+    Cache::flush();
+    DispatchRecorder::$dispatched = [];
+
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+
+    $schema = $connection->getSchemaBuilder();
+    $tables = [
+        'orders'            => ['uuid', 'public_id', 'company_uuid', 'customer_uuid', 'customer_type', 'driver_assigned_uuid', 'vehicle_assigned_uuid', 'payload_uuid', 'tracking_number_uuid', 'status', 'started', 'started_at'],
+        'drivers'           => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'vehicle_uuid'],
+        'users'             => ['uuid', 'public_id', 'company_uuid', 'name'],
+        'tracking_statuses' => ['uuid', 'tracking_number_uuid', 'status', 'code', 'complete'],
+    ];
+    foreach ($tables as $table => $columns) {
+        $schema->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    $connection->table('users')->insert([['uuid' => 'user-1', 'company_uuid' => 'company-1'], ['uuid' => 'user-2', 'company_uuid' => 'company-1']]);
+    $connection->table('drivers')->insert([
+        ['uuid' => 'driver-1', 'company_uuid' => 'company-1', 'user_uuid' => 'user-1', 'vehicle_uuid' => 'vehicle-1'],
+        ['uuid' => 'driver-2', 'company_uuid' => 'company-1', 'user_uuid' => 'user-2', 'vehicle_uuid' => 'vehicle-2'],
+    ]);
+    $connection->table('orders')->insert([
+        ['uuid' => 'order-started', 'payload_uuid' => 'payload-1', 'driver_assigned_uuid' => 'driver-1', 'status' => 'enroute', 'started' => '1'],
+        ['uuid' => 'order-status', 'payload_uuid' => 'payload-2', 'driver_assigned_uuid' => 'driver-1', 'status' => 'started', 'started' => null],
+        ['uuid' => 'order-timestamp', 'payload_uuid' => 'payload-3', 'driver_assigned_uuid' => 'driver-1', 'status' => 'arrived', 'started' => '0', 'started_at' => '2026-10-06 09:00:00'],
+        ['uuid' => 'order-completed', 'payload_uuid' => 'payload-4', 'driver_assigned_uuid' => 'driver-1', 'status' => 'completed', 'started' => '1'],
+        ['uuid' => 'order-waiting', 'payload_uuid' => 'payload-5', 'driver_assigned_uuid' => 'driver-1', 'status' => 'dispatched', 'started' => '0'],
+        ['uuid' => 'order-other-driver', 'payload_uuid' => 'payload-6', 'driver_assigned_uuid' => 'driver-2', 'status' => 'started', 'started' => '1'],
+        ['uuid' => 'order-vehicle', 'payload_uuid' => 'payload-7', 'driver_assigned_uuid' => null, 'vehicle_assigned_uuid' => 'vehicle-1', 'status' => 'started', 'started' => '1'],
+    ]);
+    $connection->table('orders')->insert(['uuid' => 'order-job', 'company_uuid' => 'company-1', 'customer_uuid' => 'contact-1111', 'customer_type' => TRACKING_PUBLISHER_CONTACT, 'payload_uuid' => 'payload-8', 'status' => 'enroute', 'started' => '1']);
+
+    return $connection;
+}
+
+function trackingPublisherModel(string $class, array $attributes): EloquentModel
+{
+    $model = (new ReflectionClass($class))->newInstanceWithoutConstructor();
+    $model->setRawAttributes($attributes, true);
+
+    return $model;
+}
+
+function trackingPublisherWaypoint(string $publicId, ?string $customerUuid): Waypoint
+{
+    return trackingPublisherModel(Waypoint::class, ['uuid' => 'uuid-' . $publicId, 'public_id' => $publicId, 'payload_uuid' => 'payload-1', 'customer_uuid' => $customerUuid, 'customer_type' => $customerUuid ? TRACKING_PUBLISHER_CONTACT : null]);
+}
+
+function trackingPublisherStops(bool $janeDone = false): Collection
+{
+    $stop = fn (string $type, int $sequence, bool $completed, ?Waypoint $waypoint) => new TrackingStop(
+        uuid: 'place-' . $sequence,
+        publicId: 'place_' . $sequence,
+        type: $type,
+        status: $completed ? 'completed' : 'enroute',
+        place: null,
+        waypoint: $waypoint,
+        completed: $completed,
+        sequence: $sequence,
+        trackingNumberUuid: 'tn-' . $sequence,
+    );
+
+    return collect([
+        $stop('pickup', 1, true, null),
+        $stop('waypoint', 2, $janeDone, trackingPublisherWaypoint('waypoint_jane', 'contact-2222')),
+        $stop('waypoint', 3, false, trackingPublisherWaypoint('waypoint_own', null)),
+    ]);
+}
+
+function trackingPublisherOrder(array $attributes = []): Order
+{
+    $driver = trackingPublisherModel(Driver::class, ['uuid' => 'driver-1', 'online' => true, 'heading' => 90, 'location' => new Point(1.352083, 103.819836), 'updated_at' => Carbon::parse('2026-10-06 10:00:00')]);
+    $driver->setRelation('user', trackingPublisherModel(User::class, ['name' => 'Ana Lopez']));
+    $driver->setRelation('vehicle', null);
+
+    $order = trackingPublisherModel(Order::class, array_merge([
+        'uuid'                 => 'order-started',
+        'company_uuid'         => 'company-1',
+        'customer_type'        => TRACKING_PUBLISHER_CONTACT,
+        'customer_uuid'        => 'contact-1111',
+        'tracking_number_uuid' => 'tn-order',
+        'status'               => 'enroute',
+        'started'              => true,
+    ], $attributes));
+    $order->setRelation('driverAssigned', $driver);
+    $order->setRelation('vehicleAssigned', null);
+
+    return $order;
+}
+
+function trackingPublisherUseStops(Collection $stops, array|Throwable $tracker = []): TrackingPublisherIntelligenceFake
+{
+    app()->instance(TrackingContextBuilder::class, new TrackingPublisherContextBuilderFake($stops));
+    $intelligence = new TrackingPublisherIntelligenceFake($tracker);
+    app()->instance(TrackingIntelligenceService::class, $intelligence);
+
+    return $intelligence;
+}
+
+afterEach(function () {
+    config(['broadcasting.connections.socketcluster.auth_key' => null]);
+    Http::swap(new HttpFactory());
+});
+
+test('nothing is queued or published while socket authentication is off', function () {
+    trackingPublisherBoot(false);
+    $publisher = new TrackingPublisherProbe();
+    $order     = trackingPublisherOrder();
+    $order->status = 'completed';
+    $order->syncChanges();
+
+    expect(TrackingPublisher::enabled())->toBeFalse()
+        ->and($publisher->orderChanged($order))->toBeFalse()
+        ->and($publisher->stopChanged(trackingPublisherWaypoint('waypoint_own', null)))->toBeFalse()
+        ->and($publisher->driverMoved(trackingPublisherModel(Driver::class, ['uuid' => 'driver-1'])))->toBe(0)
+        ->and($publisher->vehicleMoved(trackingPublisherModel(Vehicle::class, ['uuid' => 'vehicle-1'])))->toBe(0)
+        ->and($publisher->publishOrder($order))->toBe(0)
+        ->and($publisher->publishLocation($order))->toBe(0)
+        ->and(DispatchRecorder::$dispatched)->toBe([])
+        ->and($publisher->sent)->toBe([]);
+});
+
+test('order changes queue an update with the most significant reason', function () {
+    trackingPublisherBoot();
+    $publisher = new TrackingPublisher();
+    $order     = trackingPublisherOrder();
+    $save      = function (array $changes) use ($order, $publisher): bool {
+        foreach ($changes as $key => $value) {
+            $order->{$key} = $value;
+        }
+        $order->syncChanges();
+        $queued = $publisher->orderChanged($order);
+        $order->syncOriginal();
+
+        return $queued;
+    };
+
+    expect($save(['time' => 900, 'distance' => 4000]))->toBeTrue()
+        ->and($save(['driver_assigned_uuid' => 'driver-2', 'time' => 950]))->toBeTrue()
+        ->and($save(['status' => 'completed', 'distance' => 1]))->toBeTrue()
+        ->and($save(['notes' => 'Leave at the door']))->toBeFalse();
+
+    $unsaved = trackingPublisherOrder(['uuid' => null]);
+    $unsaved->status = 'started';
+    $unsaved->syncChanges();
+    expect($publisher->orderChanged($unsaved))->toBeFalse();
+
+    expect(array_map(fn ($dispatch) => [$dispatch['job'], ...$dispatch['arguments']], DispatchRecorder::$dispatched))->toBe([
+        [PublishTrackingUpdate::class, 'order-started', 'eta', 'mysql'],
+        [PublishTrackingUpdate::class, 'order-started', 'assignment', 'mysql'],
+        [PublishTrackingUpdate::class, 'order-started', 'status', 'mysql'],
+    ]);
+});
+
+test('waypoint and entity activity queue an update for their order through the listener', function () {
+    trackingPublisherBoot();
+    $listener = new PublishTrackingUpdates();
+
+    $waypointEvent = (new ReflectionClass(WaypointActivityChanged::class))->newInstanceWithoutConstructor();
+    $waypointEvent->waypoint = trackingPublisherWaypoint('waypoint_own', null);
+    $entityEvent = (new ReflectionClass(EntityCompleted::class))->newInstanceWithoutConstructor();
+    $entityEvent->entity = trackingPublisherModel(Entity::class, ['uuid' => 'entity-1', 'payload_uuid' => 'payload-2']);
+    $orphanEvent = (new ReflectionClass(EntityCompleted::class))->newInstanceWithoutConstructor();
+    $orphanEvent->entity = trackingPublisherModel(Entity::class, ['uuid' => 'entity-2', 'payload_uuid' => 'payload-none']);
+    $looseEvent = (new ReflectionClass(EntityCompleted::class))->newInstanceWithoutConstructor();
+    $looseEvent->entity = trackingPublisherModel(Entity::class, ['uuid' => 'entity-3', 'payload_uuid' => null]);
+
+    expect($listener->handle($waypointEvent))->toBeTrue()
+        ->and($listener->handle($entityEvent))->toBeTrue()
+        ->and($listener->handle($orphanEvent))->toBeFalse()
+        ->and($listener->handle($looseEvent))->toBeFalse()
+        ->and($listener->handle(new stdClass()))->toBeFalse()
+        ->and(array_map(fn ($dispatch) => $dispatch['arguments'], DispatchRecorder::$dispatched))->toBe([
+            ['order-started', 'stop', 'mysql'],
+            ['order-status', 'stop', 'mysql'],
+        ]);
+});
+
+test('positions queue at most one location update per order and interval', function () {
+    trackingPublisherBoot();
+    $publisher = new TrackingPublisher();
+    $driver    = Driver::where('uuid', 'driver-1')->first();
+
+    // Every en-route order of the driver: started by flag, by status or by timestamp.
+    expect($publisher->driverMoved($driver))->toBe(3)
+        ->and(array_map(fn ($dispatch) => $dispatch['arguments'], DispatchRecorder::$dispatched))->toBe([
+            ['order-started', 'location', 'mysql'],
+            ['order-status', 'location', 'mysql'],
+            ['order-timestamp', 'location', 'mysql'],
+        ]);
+
+    // The same driver again within the interval: no lookup at all.
+    expect($publisher->driverMoved($driver))->toBe(0);
+
+    // Another report for the same orders within the interval is dropped per order.
+    Cache::forget('fleetops:tracking:driver:driver-1');
+    expect($publisher->driverMoved($driver))->toBe(0);
+
+    // The vehicle reaches orders assigned to it and orders of drivers driving it.
+    Cache::flush();
+    DispatchRecorder::$dispatched = [];
+    expect($publisher->vehicleMoved(trackingPublisherModel(Vehicle::class, ['uuid' => 'vehicle-1'])))->toBe(4)
+        ->and(array_column(array_column(DispatchRecorder::$dispatched, 'arguments'), 0))->toEqualCanonicalizing(['order-started', 'order-status', 'order-timestamp', 'order-vehicle'])
+        ->and($publisher->vehicleMoved(trackingPublisherModel(Vehicle::class, ['uuid' => 'vehicle-1'])))->toBe(0);
+
+    // Records without a uuid are ignored.
+    expect($publisher->driverMoved(trackingPublisherModel(Driver::class, [])))->toBe(0)
+        ->and($publisher->vehicleMoved(trackingPublisherModel(Vehicle::class, [])))->toBe(0);
+});
+
+test('a full update goes to every customer of the order with their own view', function () {
+    trackingPublisherBoot();
+    $intelligence = trackingPublisherUseStops(trackingPublisherStops(), ['route' => ['legs' => [['stop' => ['sequence' => 3], 'eta_seconds' => 600, 'eta_at' => '2026-10-06T10:11:00.000000Z']]]]);
+    $publisher    = new TrackingPublisherProbe();
+    $order        = trackingPublisherOrder();
+
+    expect($publisher->publishOrder($order, 'stop'))->toBe(2)
+        ->and($intelligence->calls)->toBe(1);
+
+    [$ownChannel, $ownPayload]   = $publisher->sent[0];
+    [$janeChannel, $janePayload] = $publisher->sent[1];
+
+    expect($ownChannel)->toBe(TrackingChannel::name(TrackingScope::forOrder($order)))
+        ->and($janeChannel)->toBe(TrackingChannel::name(TrackingScope::forStop($order, trackingPublisherWaypoint('waypoint_jane', 'contact-2222'))))
+        ->and($ownPayload['reason'])->toBe('stop')
+        ->and(array_column($ownPayload['data']['stops'], 'id'))->toBe([null, 'waypoint_own'])
+        ->and($ownPayload['data']['stops'][1]['eta']['seconds'])->toBe(600)
+        ->and(array_column($janePayload['data']['stops'], 'id'))->toBe(['waypoint_jane'])
+        ->and(json_encode($janePayload))->not->toContain('waypoint_own');
+
+    // A publish the socket server refuses is not counted.
+    $publisher->accepts = false;
+    expect($publisher->publishOrder($order))->toBe(0);
+});
+
+test('a position update goes only to customers still waiting for the vehicle', function () {
+    trackingPublisherBoot();
+    trackingPublisherUseStops(trackingPublisherStops(true));
+    $publisher = new TrackingPublisherProbe();
+    $order     = trackingPublisherOrder();
+
+    expect($publisher->publishLocation($order))->toBe(1)
+        ->and($publisher->sent[0][0])->toBe(TrackingChannel::name(TrackingScope::forOrder($order)))
+        ->and($publisher->sent[0][1]['event'])->toBe('tracking.location')
+        ->and($publisher->sent[0][1]['data']['location'])->toBe(['latitude' => 1.3521, 'longitude' => 103.8198, 'heading' => 90, 'seen_at' => '2026-10-06T10:00:00.000000Z']);
+});
+
+test('etas come from tracking intelligence unless the order is over or it fails', function () {
+    trackingPublisherBoot();
+    $publisher = new TrackingPublisherProbe();
+
+    $intelligence = trackingPublisherUseStops(collect(), ['route' => ['legs' => []]]);
+    expect($publisher->tracker(trackingPublisherOrder()))->toBe(['route' => ['legs' => []]]);
+
+    expect($publisher->tracker(trackingPublisherOrder(['status' => 'Canceled'])))->toBe([])
+        ->and($intelligence->calls)->toBe(1);
+
+    trackingPublisherUseStops(collect(), new RuntimeException('routing provider down'));
+    expect($publisher->tracker(trackingPublisherOrder()))->toBe([]);
+});
+
+test('updates are published through the socket server publish endpoint', function () {
+    trackingPublisherBoot();
+    Http::fake(['*' => Http::response(['published' => 1], 202)]);
+
+    expect((new TrackingPublisherProbe())->realSend('tracking.abcdefghijklmnopqrstuvwxyz', ['event' => 'tracking.updated']))->toBeTrue();
+
+    Http::assertSent(fn ($request) => str_contains((string) $request->url(), '/publish') && str_contains($request->body(), 'tracking.abcdefghijklmnopqrstuvwxyz'));
+});
+
+test('the queued job publishes the right kind of update', function () {
+    trackingPublisherBoot();
+    trackingPublisherUseStops(trackingPublisherStops());
+    $publisher = new TrackingPublisherProbe();
+
+    // A missing order publishes nothing.
+    expect((new PublishTrackingUpdate('order-gone'))->handle($publisher))->toBe(0);
+
+    // A status update publishes the full update to both customers.
+    expect((new PublishTrackingUpdate('order-job', 'status', 'mysql'))->handle($publisher))->toBe(2)
+        ->and(array_column(array_column($publisher->sent, 1), 'reason'))->toBe(['status', 'status']);
+
+    // The first position in an ETA interval refreshes the full update...
+    $publisher->sent = [];
+    expect((new PublishTrackingUpdate('order-job', 'location'))->handle($publisher))->toBe(2)
+        ->and(array_column(array_column($publisher->sent, 1), 'reason'))->toBe(['eta', 'eta']);
+
+    // ...later ones publish the position only, and this order has no vehicle to show.
+    $publisher->sent = [];
+    expect((new PublishTrackingUpdate('order-job', 'location'))->handle($publisher))->toBe(0)
+        ->and($publisher->sent)->toBe([]);
+
+    $job = new PublishTrackingUpdate('order-job');
+    expect($job->reason)->toBe('status')
+        ->and($job->dbConnection)->toBeNull()
+        ->and($job->tries)->toBe(1);
+});
diff --git a/server/tests/Unit/Support/TrackingUpdateTest.php b/server/tests/Unit/Support/TrackingUpdateTest.php
new file mode 100644
index 000000000..85e1df085
--- /dev/null
+++ b/server/tests/Unit/Support/TrackingUpdateTest.php
@@ -0,0 +1,363 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingScope;
+use Fleetbase\FleetOps\Support\TrackingUpdate;
+use Fleetbase\FleetOps\Tracking\TrackingStop;
+use Fleetbase\LaravelMysqlSpatial\Types\Point;
+use Fleetbase\Models\User;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Support\Carbon;
+
+/**
+ * Covers the per-customer public tracking payload: only the viewing customer's stops, ETAs and
+ * timelines; whole-route counts; the driver's first name, vehicle label and online flag with no
+ * photo or phone; and the rounded vehicle position only while en route to a stop of theirs.
+ */
+class TrackingUpdateExplodingDriver extends Driver
+{
+    public function getLocationAttribute()
+    {
+        throw new RuntimeException('unreadable location');
+    }
+}
+
+const TRACKING_UPDATE_CONTACT = 'Fleetbase\\FleetOps\\Models\\Contact';
+
+function trackingUpdateModel(string $class, array $attributes): EloquentModel
+{
+    $model = (new ReflectionClass($class))->newInstanceWithoutConstructor();
+    $model->setRawAttributes($attributes, true);
+
+    return $model;
+}
+
+function trackingUpdatePlace(string $name, string $address): Place
+{
+    return trackingUpdateModel(Place::class, ['uuid' => 'place-' . md5($name), 'public_id' => 'place_' . substr(md5($name), 0, 7), 'name' => $name, 'street1' => $address, 'location' => new Point(1.4, 103.9)]);
+}
+
+function trackingUpdateWaypoint(string $publicId, ?string $customerUuid): Waypoint
+{
+    return trackingUpdateModel(Waypoint::class, [
+        'uuid'          => 'uuid-' . $publicId,
+        'public_id'     => $publicId,
+        'customer_uuid' => $customerUuid,
+        'customer_type' => $customerUuid ? TRACKING_UPDATE_CONTACT : null,
+    ]);
+}
+
+function trackingUpdateStop(string $type, int $sequence, bool $completed, ?Waypoint $waypoint, string $trackingNumber, string $placeName): TrackingStop
+{
+    return new TrackingStop(
+        uuid: 'place-' . $sequence,
+        publicId: 'place_' . $sequence,
+        type: $type,
+        status: $completed ? 'completed' : 'enroute',
+        place: trackingUpdatePlace($placeName, $placeName . ' Street'),
+        waypoint: $waypoint,
+        completed: $completed,
+        sequence: $sequence,
+        trackingNumberUuid: $trackingNumber,
+    );
+}
+
+/**
+ * A started order for contact-1111 sharing its route with contact-2222:
+ * pickup (theirs, done), Jane's stop, their own drop, Jane's second stop.
+ */
+function trackingUpdateStops(bool $janeDone = false): array
+{
+    return [
+        trackingUpdateStop('pickup', 1, true, null, 'tn-pickup', 'Acme Warehouse'),
+        trackingUpdateStop('waypoint', 2, $janeDone, trackingUpdateWaypoint('waypoint_jane1', 'contact-2222'), 'tn-jane1', 'Jane Home'),
+        trackingUpdateStop('waypoint', 3, false, trackingUpdateWaypoint('waypoint_own', null), 'tn-own', 'Own Office'),
+        trackingUpdateStop('waypoint', 4, $janeDone, trackingUpdateWaypoint('waypoint_jane2', 'contact-2222'), 'tn-jane2', 'Jane Gym'),
+    ];
+}
+
+function trackingUpdateDriver(array $attributes = [], string $class = Driver::class): Driver
+{
+    $driver = trackingUpdateModel($class, array_merge([
+        'uuid'       => 'driver-1111',
+        'public_id'  => 'driver_1111',
+        'online'     => true,
+        'heading'    => 87.6,
+        'location'   => new Point(1.352083, 103.819836),
+        'phone'      => '+6591234567',
+        'updated_at' => Carbon::parse('2026-10-06 10:00:30'),
+    ], $attributes));
+    $driver->setRelation('user', trackingUpdateModel(User::class, ['name' => 'Ana Lopez', 'phone' => '+6591234567', 'avatar_url' => 'https://cdn.example/ana.jpg']));
+    $driver->setRelation('vehicle', null);
+
+    return $driver;
+}
+
+function trackingUpdateVehicle(array $attributes = []): Vehicle
+{
+    return trackingUpdateModel(Vehicle::class, array_merge([
+        'uuid'         => 'vehicle-1111',
+        'name'         => 'Van 7',
+        'plate_number' => 'SGX1234A',
+        'heading'      => 10,
+        'location'     => new Point(1.30001, 103.80001),
+        'updated_at'   => Carbon::parse('2026-10-06 10:00:00'),
+    ], $attributes));
+}
+
+function trackingUpdateOrder(array $attributes = [], ?Driver $driver = null, ?Vehicle $vehicle = null): Order
+{
+    $order = trackingUpdateModel(Order::class, array_merge([
+        'uuid'                 => 'order-1111',
+        'company_uuid'         => 'company-1111',
+        'customer_type'        => TRACKING_UPDATE_CONTACT,
+        'customer_uuid'        => 'contact-1111',
+        'tracking_number_uuid' => 'tn-order',
+        'status'               => 'started',
+        'started'              => true,
+    ], $attributes));
+    $order->setRelation('driverAssigned', $driver);
+    $order->setRelation('vehicleAssigned', $vehicle);
+
+    return $order;
+}
+
+function trackingUpdateTimelines(): array
+{
+    $entry = fn (string $status, string $code) => ['status' => $status, 'code' => $code, 'complete' => false, 'created_at' => '2026-10-06T09:00:00.000000Z'];
+
+    return [
+        'tn-order'  => [$entry('Order started', 'started')],
+        'tn-pickup' => [$entry('Picked up', 'picked_up')],
+        'tn-own'    => [$entry('Driver en route', 'enroute')],
+        'tn-jane1'  => [$entry('Arriving at Jane Home', 'enroute')],
+        'tn-jane2'  => [$entry('Queued for Jane Gym', 'pending')],
+    ];
+}
+
+function trackingUpdateEtas(): array
+{
+    return [
+        2 => ['seconds' => 300, 'at' => '2026-10-06T10:05:00.000000Z', 'distance_m' => 1200],
+        3 => ['seconds' => 600, 'at' => '2026-10-06T10:10:00.000000Z', 'distance_m' => 2500],
+        4 => ['seconds' => 900, 'at' => '2026-10-06T10:15:00.000000Z', 'distance_m' => 4100],
+    ];
+}
+
+beforeEach(function () {
+    Carbon::setTestNow('2026-10-06 10:01:00');
+});
+
+afterEach(function () {
+    Carbon::setTestNow();
+});
+
+test('the order customer sees only their own stops with whole-route counts', function () {
+    $order  = trackingUpdateOrder([], trackingUpdateDriver(), trackingUpdateVehicle());
+    $scope  = TrackingScope::forOrder($order);
+    $update = new TrackingUpdate($order, $scope, trackingUpdateStops(), trackingUpdateEtas(), trackingUpdateTimelines());
+
+    $payload = $update->toArray(TrackingUpdate::REASON_STOP);
+
+    expect($payload['event'])->toBe('tracking.updated')
+        ->and($payload['reason'])->toBe('stop')
+        ->and($payload['sent_at'])->toBe('2026-10-06T10:01:00.000000Z')
+        ->and($payload['data']['order'])->toBe([
+            'status'    => 'started',
+            'en_route'  => true,
+            'completed' => false,
+            'canceled'  => false,
+            'timeline'  => trackingUpdateTimelines()['tn-order'],
+        ])
+        ->and($payload['data']['route'])->toBe(['total_stops' => 4, 'completed_stops' => 1, 'stops_before' => 1])
+        ->and($payload['data']['stops'])->toBe([
+            ['id' => null, 'type' => 'pickup', 'sequence' => 1, 'status' => 'completed', 'complete' => true, 'eta' => null, 'timeline' => trackingUpdateTimelines()['tn-pickup']],
+            ['id' => 'waypoint_own', 'type' => 'waypoint', 'sequence' => 3, 'status' => 'enroute', 'complete' => false, 'eta' => trackingUpdateEtas()[3], 'timeline' => trackingUpdateTimelines()['tn-own']],
+        ])
+        ->and($payload['data']['driver'])->toBe(['name' => 'Ana', 'vehicle' => 'Van 7', 'online' => true])
+        ->and($payload['data']['location'])->toBe(['latitude' => 1.3521, 'longitude' => 103.8198, 'heading' => 88, 'seen_at' => '2026-10-06T10:00:30.000000Z'])
+        ->and($update->timelineTrackingNumbers())->toBe(['tn-pickup', 'tn-own', 'tn-order']);
+
+    // Nothing of the other customer's stops, places or people, and nothing personal about the driver.
+    $json = json_encode($payload);
+    foreach (['waypoint_jane1', 'waypoint_jane2', 'Jane', 'contact-2222', 'Acme Warehouse', 'Own Office', 'Street', 'Lopez', '+6591234567', 'ana.jpg', 'SGX1234A', 'tn-'] as $forbidden) {
+        expect($json)->not->toContain($forbidden);
+    }
+});
+
+test('a waypoint customer sees only their stops and never the order timeline', function () {
+    $order  = trackingUpdateOrder([], trackingUpdateDriver(), trackingUpdateVehicle());
+    $scope  = TrackingScope::forStop($order, trackingUpdateWaypoint('waypoint_jane1', 'contact-2222'));
+    $update = new TrackingUpdate($order, $scope, trackingUpdateStops(), trackingUpdateEtas(), trackingUpdateTimelines());
+
+    $payload = $update->toArray();
+
+    expect($payload['reason'])->toBe('status')
+        ->and(array_column($payload['data']['stops'], 'id'))->toBe(['waypoint_jane1', 'waypoint_jane2'])
+        ->and(array_column($payload['data']['stops'], 'eta'))->toBe([trackingUpdateEtas()[2], trackingUpdateEtas()[4]])
+        ->and($payload['data']['stops'][0]['timeline'])->toBe(trackingUpdateTimelines()['tn-jane1'])
+        ->and($payload['data']['order']['timeline'])->toBe([])
+        ->and($payload['data']['route'])->toBe(['total_stops' => 4, 'completed_stops' => 1, 'stops_before' => 0])
+        ->and($update->timelineTrackingNumbers())->toBe(['tn-jane1', 'tn-jane2'])
+        ->and($payload['data']['location'])->not->toBeNull();
+
+    $json = json_encode($payload);
+    foreach (['waypoint_own', 'contact-1111', 'Order started', 'Picked up', 'Driver en route', 'Acme', 'Own Office', 'Lopez', '+6591234567', 'ana.jpg'] as $forbidden) {
+        expect($json)->not->toContain($forbidden);
+    }
+});
+
+test('the driver and position are shown only while en route to a stop of the viewer', function () {
+    $driver  = trackingUpdateDriver();
+    $vehicle = trackingUpdateVehicle();
+
+    // Not started yet: no driver and no position.
+    $order  = trackingUpdateOrder(['status' => 'dispatched', 'started' => false], $driver, $vehicle);
+    $update = new TrackingUpdate($order, TrackingScope::forOrder($order), trackingUpdateStops());
+    expect($update->isEnRoute())->toBeFalse()
+        ->and($update->driver())->toBeNull()
+        ->and($update->location())->toBeNull()
+        ->and($update->locationPayload())->toBeNull();
+
+    // Started by status or timestamp alone.
+    $byStatus = trackingUpdateOrder(['status' => 'started', 'started' => false], $driver, $vehicle);
+    $byTime   = trackingUpdateOrder(['status' => 'enroute', 'started' => false, 'started_at' => Carbon::parse('2026-10-06 09:00:00')], $driver, $vehicle);
+    expect((new TrackingUpdate($byStatus, TrackingScope::forOrder($byStatus), trackingUpdateStops()))->isEnRoute())->toBeTrue()
+        ->and((new TrackingUpdate($byTime, TrackingScope::forOrder($byTime), trackingUpdateStops()))->isEnRoute())->toBeTrue();
+
+    // Delivered or canceled: hidden, and the order state says so.
+    foreach (['completed', 'canceled'] as $status) {
+        $done    = trackingUpdateOrder(['status' => $status], $driver, $vehicle);
+        $payload = (new TrackingUpdate($done, TrackingScope::forOrder($done), trackingUpdateStops()))->toArray();
+        expect($payload['data']['driver'])->toBeNull()
+            ->and($payload['data']['location'])->toBeNull()
+            ->and($payload['data']['order'][$status])->toBeTrue()
+            ->and($payload['data']['order']['en_route'])->toBeFalse();
+    }
+
+    // En route, but every stop of this customer is done: hidden for them, shown to the other.
+    $order = trackingUpdateOrder([], $driver, $vehicle);
+    $jane  = new TrackingUpdate($order, TrackingScope::forStop($order, trackingUpdateWaypoint('waypoint_jane1', 'contact-2222')), trackingUpdateStops(true));
+    $own   = new TrackingUpdate($order, TrackingScope::forOrder($order), trackingUpdateStops(true));
+    expect($jane->customerHasIncompleteStop())->toBeFalse()
+        ->and($jane->locationPayload())->toBeNull()
+        ->and($jane->route()['stops_before'])->toBe(0)
+        ->and($own->locationPayload()['event'])->toBe('tracking.location')
+        ->and($own->locationPayload()['reason'])->toBe('location')
+        ->and($own->locationPayload()['data'])->toBe([
+            'driver'   => ['name' => 'Ana', 'vehicle' => 'Van 7', 'online' => true],
+            'location' => ['latitude' => 1.3521, 'longitude' => 103.8198, 'heading' => 88, 'seen_at' => '2026-10-06T10:00:30.000000Z'],
+        ]);
+
+    // A customer with no stops on the route sees no vehicle.
+    $stranger = new TrackingUpdate($order, new TrackingScope('order-1111', TRACKING_UPDATE_CONTACT, 'contact-9999'), trackingUpdateStops());
+    expect($stranger->ownStops())->toHaveCount(0)
+        ->and($stranger->location())->toBeNull()
+        ->and($stranger->toArray()['data']['stops'])->toBe([]);
+});
+
+test('the position comes from the most recently seen of driver and vehicle', function () {
+    $stops = trackingUpdateStops();
+
+    // The vehicle reported last.
+    $order = trackingUpdateOrder([], trackingUpdateDriver(['updated_at' => Carbon::parse('2026-10-06 09:00:00')]), trackingUpdateVehicle(['updated_at' => Carbon::parse('2026-10-06 10:00:50')]));
+    expect((new TrackingUpdate($order, TrackingScope::forOrder($order), $stops))->location())
+        ->toBe(['latitude' => 1.3, 'longitude' => 103.8, 'heading' => 10, 'seen_at' => '2026-10-06T10:00:50.000000Z']);
+
+    // The driver's position is unusable (null island), so the vehicle's is used.
+    $order = trackingUpdateOrder([], trackingUpdateDriver(['location' => new Point(0, 0)]), trackingUpdateVehicle(['heading' => 'n/a', 'updated_at' => null]));
+    expect((new TrackingUpdate($order, TrackingScope::forOrder($order), $stops))->location())
+        ->toBe(['latitude' => 1.3, 'longitude' => 103.8, 'heading' => null, 'seen_at' => null]);
+
+    // Unreadable or missing positions everywhere: no position, but the driver is still named.
+    $order  = trackingUpdateOrder([], trackingUpdateDriver([], TrackingUpdateExplodingDriver::class), trackingUpdateVehicle(['location' => null]));
+    $update = new TrackingUpdate($order, TrackingScope::forOrder($order), $stops);
+    expect($update->location())->toBeNull()
+        ->and($update->locationPayload())->toBeNull()
+        ->and($update->driver()['name'])->toBe('Ana');
+
+    // Without a driver, the assigned vehicle alone gives the position.
+    $order = trackingUpdateOrder([], null, trackingUpdateVehicle());
+    $update = new TrackingUpdate($order, TrackingScope::forOrder($order), $stops);
+    expect($update->driver())->toBeNull()
+        ->and($update->location()['latitude'])->toBe(1.3);
+
+    // Without an assigned vehicle the driver's current vehicle is labelled; an unnamed one has no label.
+    $driver = trackingUpdateDriver();
+    $driver->setRelation('vehicle', trackingUpdateVehicle(['name' => 'Truck 9']));
+    $order = trackingUpdateOrder([], $driver, null);
+    expect((new TrackingUpdate($order, TrackingScope::forOrder($order), $stops))->driver()['vehicle'])->toBe('Truck 9');
+
+    $driver->setRelation('vehicle', trackingUpdateVehicle(['name' => null]));
+    expect((new TrackingUpdate($order, TrackingScope::forOrder($order), $stops))->driver()['vehicle'])->toBeNull();
+
+    // Nobody assigned at all.
+    $order = trackingUpdateOrder([], null, null);
+    expect((new TrackingUpdate($order, TrackingScope::forOrder($order), $stops))->location())->toBeNull();
+});
+
+test('order state, names and etas tolerate missing values', function () {
+    $order  = trackingUpdateOrder(['status' => null, 'started' => false], null, null);
+    $update = new TrackingUpdate($order, TrackingScope::forOrder($order), ['not a stop', ...trackingUpdateStops()]);
+
+    expect($update->toArray()['data']['order']['status'])->toBeNull()
+        ->and($update->route()['total_stops'])->toBe(4)
+        ->and($update->isTerminal())->toBeFalse()
+        ->and(TrackingUpdate::firstName(null))->toBeNull()
+        ->and(TrackingUpdate::firstName('  '))->toBeNull()
+        ->and(TrackingUpdate::firstName('Cher'))->toBe('Cher')
+        ->and(TrackingUpdate::firstName(' Ana Maria Lopez '))->toBe('Ana');
+
+    expect(TrackingUpdate::etasFromTracker([]))->toBe([])
+        ->and(TrackingUpdate::etasFromTracker(['route' => ['legs' => [
+            ['stop' => null, 'eta_seconds' => 10],
+            ['stop' => ['sequence' => 2], 'eta_seconds' => 299.6, 'eta_at' => '2026-10-06T10:05:00.000000Z', 'distance_m' => 1199.7],
+            ['stop' => ['sequence' => '3'], 'eta_seconds' => null, 'eta_at' => null],
+        ]]]))->toBe([
+            2 => ['seconds' => 300, 'at' => '2026-10-06T10:05:00.000000Z', 'distance_m' => 1200],
+            3 => ['seconds' => null, 'at' => null, 'distance_m' => null],
+        ]);
+});
+
+test('timelines are loaded for the viewer\'s tracking numbers only, without free-text details', function () {
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+    $connection->getSchemaBuilder()->create('tracking_statuses', function ($blueprint) {
+        $blueprint->increments('id');
+        foreach (['uuid', 'public_id', 'tracking_number_uuid', 'status', 'details', 'code', 'complete'] as $column) {
+            $blueprint->string($column)->nullable();
+        }
+        $blueprint->timestamp('created_at')->nullable();
+        $blueprint->timestamp('updated_at')->nullable();
+        $blueprint->timestamp('deleted_at')->nullable();
+    });
+    $connection->table('tracking_statuses')->insert([
+        ['uuid' => 's1', 'tracking_number_uuid' => 'tn-order', 'status' => 'Order created', 'details' => 'Created by Jane', 'code' => 'CREATED', 'complete' => '0', 'created_at' => '2026-10-06 08:00:00'],
+        ['uuid' => 's2', 'tracking_number_uuid' => 'tn-order', 'status' => 'Order started', 'details' => 'Driver left Acme', 'code' => 'started', 'complete' => '0', 'created_at' => '2026-10-06 09:00:00'],
+        ['uuid' => 's3', 'tracking_number_uuid' => 'tn-own', 'status' => 'Driver en route', 'details' => null, 'code' => null, 'complete' => '0', 'created_at' => null],
+        ['uuid' => 's4', 'tracking_number_uuid' => 'tn-jane1', 'status' => 'Arriving at Jane Home', 'details' => null, 'code' => 'enroute', 'complete' => '0', 'created_at' => '2026-10-06 09:30:00'],
+    ]);
+
+    $order   = trackingUpdateOrder([], trackingUpdateDriver(), trackingUpdateVehicle());
+    $tracker = ['route' => ['legs' => [['stop' => ['sequence' => 3], 'eta_seconds' => 600, 'eta_at' => '2026-10-06T10:11:00.000000Z', 'distance_m' => 2500]]]];
+    $update  = TrackingUpdate::for($order, TrackingScope::forOrder($order), trackingUpdateStops(), $tracker);
+    $payload = $update->toArray();
+
+    expect($payload['data']['order']['timeline'])->toBe([
+        ['status' => 'Order created', 'code' => 'created', 'complete' => false, 'created_at' => '2026-10-06T08:00:00.000000Z'],
+        ['status' => 'Order started', 'code' => 'started', 'complete' => false, 'created_at' => '2026-10-06T09:00:00.000000Z'],
+    ])
+        ->and($payload['data']['stops'][1]['timeline'])->toBe([['status' => 'Driver en route', 'code' => null, 'complete' => false, 'created_at' => null]])
+        ->and($payload['data']['stops'][1]['eta'])->toBe(['seconds' => 600, 'at' => '2026-10-06T10:11:00.000000Z', 'distance_m' => 2500])
+        ->and(json_encode($payload))->not->toContain('Jane')
+        ->and(json_encode($payload))->not->toContain('Acme')
+        ->and(TrackingUpdate::loadTimelines([]))->toBe([]);
+});

From 15ad8bd88f351a0a32cb1630ef077e06847d00ae Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 15:07:11 +0800
Subject: [PATCH 12/87] fix(socket-auth): scheduler listens only to driver
 channels and closes only its own

The scheduler subscribed to company.{id}.orders, which nothing publishes to,
and its teardown closed every socket channel, chat included. It now opens
the per-driver channels only and on teardown closes just those (sweeping
once more for subscriptions still pending).
---
 .../controllers/operations/scheduler/index.js |  59 ++++++--
 addon/routes/operations/scheduler/index.js    |   2 +-
 .../operations/scheduler/index-test.js        | 128 ++++++++++++++++++
 3 files changed, 174 insertions(+), 15 deletions(-)
 create mode 100644 tests/unit/controllers/operations/scheduler/index-test.js

diff --git a/addon/controllers/operations/scheduler/index.js b/addon/controllers/operations/scheduler/index.js
index 1e6ff2bfe..ba91409d8 100644
--- a/addon/controllers/operations/scheduler/index.js
+++ b/addon/controllers/operations/scheduler/index.js
@@ -4,6 +4,7 @@ import { inject as service } from '@ember/service';
 import { action, computed } from '@ember/object';
 import { isNone } from '@ember/utils';
 import { isValid as isValidDate } from 'date-fns';
+import { later } from '@ember/runloop';
 import { task } from 'ember-concurrency';
 import isObject from '@fleetbase/ember-core/utils/is-object';
 import isJson from '@fleetbase/ember-core/utils/is-json';
@@ -11,6 +12,9 @@ import createFullCalendarEventFromOrder from '../../../utils/create-full-calenda
 import createFullCalendarEventFromScheduleItem from '../../../utils/create-full-calendar-event-from-schedule-item';
 import toCalendarDate from '../../../utils/to-calendar-date';
 
+// The ember-core socket service subscribes ~300 ms after listen() is called.
+const SOCKET_SUBSCRIBE_SETTLE_MS = 500;
+
 /**
  * OperationsSchedulerIndexController
  *
@@ -722,28 +726,55 @@ export default class OperationsSchedulerIndexController extends Controller {
     // Real-Time Socket Subscriptions
     // -------------------------------------------------------------------------
 
+    // Names of the socket channels this board opened, so teardown closes only those
+    // and leaves every other subscription (chat, notifications, ...) alone.
+    _socketChannelNames = new Set();
+
     @action async subscribeToRealTimeUpdates() {
-        const orgId = this.currentUser?.companyId ?? this.currentUser?.company?.id;
-        if (!orgId) return;
-        await this.socket.listen(`company.${orgId}.orders`, (payload) => this._handleOrderSocketEvent(payload));
-        this.drivers.forEach(async (driver) => {
-            await this.socket.listen(`driver.${driver.id}`, (payload) => this._handleDriverSocketEvent(payload));
-        });
+        const drivers = this.drivers ?? [];
+        await Promise.all(
+            drivers.map((driver) => {
+                if (!driver?.id) return;
+                const channelName = `driver.${driver.id}`;
+                if (this._socketChannelNames.has(channelName)) return;
+                this._socketChannelNames.add(channelName);
+                return this.socket.listen(channelName, (payload) => this._handleDriverSocketEvent(payload));
+            })
+        );
     }
 
     @action unsubscribeFromRealTimeUpdates() {
-        if (this.socket && typeof this.socket.closeChannels === 'function') {
-            this.socket.closeChannels();
+        const names = this._socketChannelNames;
+        this._socketChannelNames = new Set();
+        if (!this.socket || names.size === 0) return;
+
+        if (typeof this.socket.closeChannel === 'function') {
+            names.forEach((name) => this.socket.closeChannel(name));
+            return;
         }
+
+        const remaining = this._closeOpenedChannels(names);
+        if (remaining.size === 0) return;
+
+        // The socket service subscribes after a short delay, so a channel requested just before
+        // teardown may not exist yet: sweep once more after that delay.
+        later(this, () => this._closeOpenedChannels(remaining), SOCKET_SUBSCRIBE_SETTLE_MS);
     }
 
-    _handleOrderSocketEvent({ data } = {}) {
-        if (!data?.id) return;
-        try {
-            this.store.pushPayload('order', { order: data });
-        } catch {
-            /* ignore */
+    /**
+     * Close the socket's channels with the given names, except any the board has opened again
+     * since. Returns the names that had no channel yet.
+     */
+    _closeOpenedChannels(names) {
+        const remaining = new Set([...names].filter((name) => !this._socketChannelNames.has(name)));
+        const channels = Array.isArray(this.socket.channels) ? this.socket.channels : [];
+        for (const channel of channels) {
+            if (!names.has(channel?.name) || this._socketChannelNames.has(channel.name)) continue;
+            remaining.delete(channel.name);
+            channel.close();
         }
+
+        return remaining;
     }
 
     _handleDriverSocketEvent({ event, data } = {}) {
diff --git a/addon/routes/operations/scheduler/index.js b/addon/routes/operations/scheduler/index.js
index 8f8f1d7d4..5f3f76d4f 100644
--- a/addon/routes/operations/scheduler/index.js
+++ b/addon/routes/operations/scheduler/index.js
@@ -61,7 +61,7 @@ export default class OperationsSchedulerIndexRoute extends Route {
     }
 
     resetController(controller) {
-        // Close all socket channels when the dispatcher navigates away
+        // Close the board's own socket channels when the dispatcher navigates away
         // to prevent memory leaks and stale event handlers.
         controller.unsubscribeFromRealTimeUpdates();
     }
diff --git a/tests/unit/controllers/operations/scheduler/index-test.js b/tests/unit/controllers/operations/scheduler/index-test.js
new file mode 100644
index 000000000..539eb870c
--- /dev/null
+++ b/tests/unit/controllers/operations/scheduler/index-test.js
@@ -0,0 +1,128 @@
+import Service from '@ember/service';
+import { module, test } from 'qunit';
+import { settled } from '@ember/test-helpers';
+import { setupTest } from 'dummy/tests/helpers';
+
+class SocketStub extends Service {
+    listened = [];
+    callbacks = {};
+    channels = [];
+    closed = [];
+    // Channels named here are only "subscribed" when subscribeNow() runs, like the real
+    // service, which subscribes a moment after listen() returns.
+    deferred = new Set();
+
+    listen(name, callback) {
+        this.listened.push(name);
+        this.callbacks[name] = callback;
+        if (!this.deferred.has(name)) {
+            this.subscribeNow(name);
+        }
+
+        return Promise.resolve();
+    }
+
+    subscribeNow(name) {
+        this.channels = [...this.channels, { name, close: () => this.closed.push(name) }];
+    }
+
+    closeChannels() {
+        throw new Error('the scheduler must not close every channel');
+    }
+}
+
+class StoreStub extends Service {
+    pushed = [];
+
+    pushPayload(modelName, payload) {
+        this.pushed.push([modelName, payload]);
+    }
+
+    peekAll() {
+        return [];
+    }
+}
+
+module('Unit | Controller | operations/scheduler/index', function (hooks) {
+    setupTest(hooks);
+
+    hooks.beforeEach(function () {
+        this.owner.register('service:socket', SocketStub);
+        this.owner.register('service:store', StoreStub);
+        this.socket = this.owner.lookup('service:socket');
+        this.controller = this.owner.lookup('controller:operations/scheduler/index');
+        this.controller.drivers = [{ id: 'driver_a' }, { id: 'driver_b' }, {}];
+    });
+
+    test('it listens on each driver channel and not on a company orders channel', async function (assert) {
+        await this.controller.subscribeToRealTimeUpdates();
+        await this.controller.subscribeToRealTimeUpdates();
+
+        assert.deepEqual(this.socket.listened, ['driver.driver_a', 'driver.driver_b'], 'one listener per driver, opened once');
+        assert.notOk(this.socket.listened.some((name) => name.startsWith('company.')), 'the dead company orders channel is gone');
+    });
+
+    test('teardown closes only the channels the board opened', async function (assert) {
+        this.socket.subscribeNow('chat_channel.abc');
+        await this.controller.subscribeToRealTimeUpdates();
+
+        this.controller.unsubscribeFromRealTimeUpdates();
+        await settled();
+
+        assert.deepEqual(this.socket.closed.sort(), ['driver.driver_a', 'driver.driver_b'], 'chat and other channels stay open');
+
+        this.controller.unsubscribeFromRealTimeUpdates();
+        await settled();
+        assert.strictEqual(this.socket.closed.length, 2, 'a second teardown has nothing to close');
+    });
+
+    test('teardown also closes a channel the socket subscribed after teardown began', async function (assert) {
+        this.socket.deferred.add('driver.driver_b');
+        await this.controller.subscribeToRealTimeUpdates();
+
+        this.controller.unsubscribeFromRealTimeUpdates();
+        assert.deepEqual(this.socket.closed, ['driver.driver_a']);
+
+        this.socket.subscribeNow('driver.driver_b');
+        await settled();
+
+        assert.deepEqual(this.socket.closed, ['driver.driver_a', 'driver.driver_b']);
+    });
+
+    test('the delayed sweep leaves a channel the board opened again', async function (assert) {
+        this.socket.deferred.add('driver.driver_b');
+        await this.controller.subscribeToRealTimeUpdates();
+        this.controller.unsubscribeFromRealTimeUpdates();
+
+        // The board is entered again before the sweep runs.
+        await this.controller.subscribeToRealTimeUpdates();
+        this.socket.subscribeNow('driver.driver_b');
+        await settled();
+
+        assert.deepEqual(this.socket.closed, ['driver.driver_a']);
+    });
+
+    test('teardown prefers closing channels by name when the socket service supports it', async function (assert) {
+        const closedByName = [];
+        this.socket.closeChannel = (name) => closedByName.push(name);
+        await this.controller.subscribeToRealTimeUpdates();
+
+        this.controller.unsubscribeFromRealTimeUpdates();
+        await settled();
+
+        assert.deepEqual(closedByName, ['driver.driver_a', 'driver.driver_b']);
+        assert.deepEqual(this.socket.closed, []);
+    });
+
+    test('driver events update the store but location pings do not', async function (assert) {
+        const store = this.owner.lookup('service:store');
+        await this.controller.subscribeToRealTimeUpdates();
+
+        const callback = this.socket.callbacks['driver.driver_a'];
+        callback({ event: 'driver.location_changed', data: { id: 'driver_a' } });
+        callback({ event: 'driver.updated', data: {} });
+        callback({ event: 'driver.updated', data: { id: 'driver_a', status: 'active' } });
+
+        assert.deepEqual(store.pushed, [['driver', { driver: { id: 'driver_a', status: 'active' } }]]);
+    });
+});

From 4ba8680f01ce6ad4309fde5ad7defeec3d3cb0ea Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 15:21:05 +0800
Subject: [PATCH 13/87] test(socket-auth): match prettier line wrapping in the
 scheduler test

---
 tests/unit/controllers/operations/scheduler/index-test.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tests/unit/controllers/operations/scheduler/index-test.js b/tests/unit/controllers/operations/scheduler/index-test.js
index 539eb870c..6dd83a66a 100644
--- a/tests/unit/controllers/operations/scheduler/index-test.js
+++ b/tests/unit/controllers/operations/scheduler/index-test.js
@@ -59,7 +59,10 @@ module('Unit | Controller | operations/scheduler/index', function (hooks) {
         await this.controller.subscribeToRealTimeUpdates();
 
         assert.deepEqual(this.socket.listened, ['driver.driver_a', 'driver.driver_b'], 'one listener per driver, opened once');
-        assert.notOk(this.socket.listened.some((name) => name.startsWith('company.')), 'the dead company orders channel is gone');
+        assert.notOk(
+            this.socket.listened.some((name) => name.startsWith('company.')),
+            'the dead company orders channel is gone'
+        );
     });
 
     test('teardown closes only the channels the board opened', async function (assert) {

From c255ee6dabf36871833726c62759b75250d0e90d Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Wed, 7 Oct 2026 13:33:24 +0800
Subject: [PATCH 14/87] fix(service-rate): resolve parcel box images after
 production fingerprinting

Production console builds fingerprint .png files, so boxes/small.png ships
as boxes/small-<hash>.png. broccoli-asset-rev rewrites literal asset URLs to
the hashed names, but it cannot rewrite the interpolated
/engines-dist/images/boxes/{{parcelFee.size}}.png, so the request misses and
the server answers with index.html.

Add a parcel-box-image helper that maps each size to a literal URL the
fingerprinter can rewrite, and use it in the service rate form and details.
---
 addon/components/service-rate/details.hbs     |  2 +-
 addon/components/service-rate/form.hbs        |  2 +-
 addon/helpers/parcel-box-image.js             | 16 ++++++++++++++
 app/helpers/parcel-box-image.js               |  1 +
 .../helpers/parcel-box-image-test.js          | 22 +++++++++++++++++++
 5 files changed, 41 insertions(+), 2 deletions(-)
 create mode 100644 addon/helpers/parcel-box-image.js
 create mode 100644 app/helpers/parcel-box-image.js
 create mode 100644 tests/integration/helpers/parcel-box-image-test.js

diff --git a/addon/components/service-rate/details.hbs b/addon/components/service-rate/details.hbs
index 14118c398..3d7d15590 100644
--- a/addon/components/service-rate/details.hbs
+++ b/addon/components/service-rate/details.hbs
@@ -214,7 +214,7 @@
                     <div class="dark:text-gray-100">
                         <div class="grid grid-cols-7">
                             <div class="flex flex-col items-start justify-start pt-3">
-                                <img src="/engines-dist/images/boxes/{{parcelFee.size}}.png" alt="parcel size {{parcelFee.size}}" width="44" class="w-11" />
+                                <img src={{parcel-box-image parcelFee.size}} alt="parcel size {{parcelFee.size}}" width="44" class="w-11" />
                                 <div class="mt-2 text-sm font-medium">
                                     {{humanize parcelFee.size}}
                                 </div>
diff --git a/addon/components/service-rate/form.hbs b/addon/components/service-rate/form.hbs
index f6729a39c..b7bd773af 100644
--- a/addon/components/service-rate/form.hbs
+++ b/addon/components/service-rate/form.hbs
@@ -423,7 +423,7 @@
                     <div class="dark:text-gray-100">
                         <div class="grid grid-cols-7">
                             <div class="flex flex-col items-start justify-start pt-3">
-                                <img src="/engines-dist/images/boxes/{{parcelFee.size}}.png" alt="parcel size {{parcelFee.size}}" width="44" class="w-11" />
+                                <img src={{parcel-box-image parcelFee.size}} alt="parcel size {{parcelFee.size}}" width="44" class="w-11" />
                                 <label class="mt-2">{{humanize parcelFee.size}}</label>
                             </div>
                             <div class="col-span-6 dimensions-box space-x-2">
diff --git a/addon/helpers/parcel-box-image.js b/addon/helpers/parcel-box-image.js
new file mode 100644
index 000000000..5d28d8f53
--- /dev/null
+++ b/addon/helpers/parcel-box-image.js
@@ -0,0 +1,16 @@
+import { helper } from '@ember/component/helper';
+
+// Each URL is written out in full so a production build's fingerprinting
+// (broccoli-asset-rev) rewrites it to the hashed file name. An interpolated
+// path such as `boxes/${size}.png` is never rewritten, so it misses the
+// fingerprinted file and the server answers with the console's index.html.
+const PARCEL_BOX_IMAGES = {
+    small: '/engines-dist/images/boxes/small.png',
+    medium: '/engines-dist/images/boxes/medium.png',
+    large: '/engines-dist/images/boxes/large.png',
+    'x-large': '/engines-dist/images/boxes/x-large.png',
+};
+
+export default helper(function parcelBoxImage([size]) {
+    return PARCEL_BOX_IMAGES[size] ?? PARCEL_BOX_IMAGES.medium;
+});
diff --git a/app/helpers/parcel-box-image.js b/app/helpers/parcel-box-image.js
new file mode 100644
index 000000000..debc6410a
--- /dev/null
+++ b/app/helpers/parcel-box-image.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/helpers/parcel-box-image';
diff --git a/tests/integration/helpers/parcel-box-image-test.js b/tests/integration/helpers/parcel-box-image-test.js
new file mode 100644
index 000000000..306222e8f
--- /dev/null
+++ b/tests/integration/helpers/parcel-box-image-test.js
@@ -0,0 +1,22 @@
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'dummy/tests/helpers';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+
+module('Integration | Helper | parcel-box-image', function (hooks) {
+    setupRenderingTest(hooks);
+
+    test('it returns the box image for each parcel size', async function (assert) {
+        for (const size of ['small', 'medium', 'large', 'x-large']) {
+            this.set('size', size);
+            await render(hbs`{{parcel-box-image this.size}}`);
+            assert.dom().hasText(`/engines-dist/images/boxes/${size}.png`);
+        }
+    });
+
+    test('it falls back to the medium box for an unknown size', async function (assert) {
+        this.set('size', 'oversized');
+        await render(hbs`{{parcel-box-image this.size}}`);
+        assert.dom().hasText('/engines-dist/images/boxes/medium.png');
+    });
+});

From 65a429b62f1b2a1f3328df05418e2f4e169fbac7 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Wed, 7 Oct 2026 13:57:06 +0800
Subject: [PATCH 15/87] fix(live-map): fall back to the shipped map-marker.png
 for drivers and vehicles

The Google live map fell back to /engines-dist/images/driver-marker.png and
vehicle-marker.png, neither of which exists in assets/images, so a driver or
vehicle without an avatar rendered a broken marker. Point both at the existing
map-marker.png, as the leaflet live-fleet widget already does. The URLs stay
literal strings so broccoli-asset-rev can fingerprint them in production.
---
 addon/components/map/google-live-map.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/addon/components/map/google-live-map.js b/addon/components/map/google-live-map.js
index 9908e5ae2..ec43beea9 100644
--- a/addon/components/map/google-live-map.js
+++ b/addon/components/map/google-live-map.js
@@ -59,7 +59,7 @@ export default class MapGoogleLiveMapComponent extends Component {
             const marker = this.mapManager.getMarker(driver.id);
             if (!marker) {
                 const createdMarker = await this.mapManager.addMarker(driver.id, coords.lat, coords.lng, {
-                    iconUrl: driver.vehicle_avatar ?? '/engines-dist/images/driver-marker.png',
+                    iconUrl: driver.vehicle_avatar ?? '/engines-dist/images/map-marker.png',
                     iconSize: [20, 20],
                     title: driver.name,
                     tooltip: buildDriverLiveMapContent(driver),
@@ -89,7 +89,7 @@ export default class MapGoogleLiveMapComponent extends Component {
             const marker = this.mapManager.getMarker(vehicle.id);
             if (!marker) {
                 const createdMarker = await this.mapManager.addMarker(vehicle.id, coords.lat, coords.lng, {
-                    iconUrl: vehicle.avatar_url ?? '/engines-dist/images/vehicle-marker.png',
+                    iconUrl: vehicle.avatar_url ?? '/engines-dist/images/map-marker.png',
                     iconSize: [20, 20],
                     title: vehicle.displayName,
                     tooltip: buildVehicleLiveMapContent(vehicle),

From 317929a030d619401c4dd2c842288db754d84ba3 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Wed, 7 Oct 2026 13:58:46 +0800
Subject: [PATCH 16/87] chore(release): v0.6.72

---
 RELEASE.md     | 33 +++++++++++++++------------------
 composer.json  |  2 +-
 extension.json |  2 +-
 package.json   |  2 +-
 4 files changed, 18 insertions(+), 21 deletions(-)

diff --git a/RELEASE.md b/RELEASE.md
index 88f7e2c79..73554321a 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -1,29 +1,26 @@
-> v0.6.71 ~ "Extensible tables and panels, configured order lifecycles and order presentation profiles"
+> v0.6.72 ~ "Customer tracking page settings, safer public tracking and structured label codes"
 
 ---
 ## Highlights
 
-- **Resource view registries.** Extensions can add the following through `fleet-ops:<resource>:table:<slot>` and `fleet-ops:<resource>:details:<slot>`:
-  - columns, row actions, bulk actions and toolbar buttons on every top-level Fleet-Ops table;
-  - header buttons and "…" menu items on its details panels and side panels.
+- **Tracking Page settings.** A new Fleet-Ops → Settings → Tracking Page lets each organization configure the customer tracking page:
+  - its own page at `/t/{slug}`, with a live address check;
+  - whether its numbers can be tracked on the shared page;
+  - branding: display name, accent colour with a live contrast check, an optional dark-mode accent, support contacts, "Powered by Fleetbase", and languages;
+  - how customers verify (text message or email codes, session length, customer sign-in);
+  - what verified customers see.
 
-  Built-in items carry stable ids, so registered items can be placed before or after them.
-- **Configured order lifecycles.** An order config can define its own lifecycle in `meta.lifecycle`: `initial`, `completed`, `canceled` and `terminal` activities, `dispatch: false` and `strict_transitions`. The internal API starts orders at the initial activity, refuses to dispatch when dispatch is off, accepts only the flow's transitions when strict, and cancels to the configured activity. Configs without a lifecycle behave as before.
-  - **Lifecycle tab** in Order Configuration, to view and edit a config's lifecycle.
-  - **The board** shows a configured lifecycle's activities as its columns.
-  - **The activity flow editor** roots at the configured initial activity, and handles flows with cycles.
-- **Order presentation profiles.** An extension can give its order type its own order form sections, extra and hidden fields, details view sections and hidden actions, registered in `fleet-ops:order-presentation`. **Edit details** opens the profiled form. Other order types are unchanged.
-- **The Order Configuration manager lists every config**, including configs created while the console is open.
-- **An order's activity timeline follows status changes made on the server.**
-- **Fix: the Activity Flow crashed on a flow with a cycle.**
-- **Fix: order details now load the assigned vehicle with the order.**
-- **Fix: the order form failed when its custom fields couldn't load.**
-- **Fix: registered details tabs.** Opening a driver, vehicle or trailer side panel removed the route from tabs other extensions had registered, which broke them in the full details view. Side panels also left out the tabs they could render.
-- **Fix: the sensor details view showed the tabs registered for places.**
+  Administrators set the shared page's defaults under Fleet-Ops Config → Tracking Page. The new tracking pages themselves arrive in a later release; these settings are what they will read.
+- **Safer public order lookup.** `GET int/v1/fleet-ops/lookup` is rate limited per address and returns a minimal resource: tracking number, status, timeline, ETA, stop coordinates and items. It no longer returns notes, meta, internal ids, files, rates or customer details. The driver's location is included only while the order is under way. Unknown and malformed tracking numbers get the same answer.
+- **Structured label codes.** Tracking-number QR codes now carry a tracking URL holding the tracking number and the owner's public id, which a phone camera opens as the tracking page. Barcodes use Code 128. Every scan endpoint still accepts the uuid codes already printed on parcels.
+- **Fix: signatures on private S3 buckets.** Signatures were not stored on buckets that reject ACLs; they are now written without one and served through signed URLs. Legacy absolute avatar URLs on vehicles, drivers and places are re-signed when read.
+- **Fix: the customer credentials email** linked to an unrouted page; it now links to `/customer-access/{slug}`.
+- **Fix: parcel box images** on the service rate form and details showed broken images in production builds.
 
 ---
 ## Upgrading
-Needs fleetbase/ember-core v0.3.25 and fleetbase/ember-ui v0.4.5.
+- Run `php artisan fleetbase:create-permissions` to register the new `tracking-page-settings` permission.
+- Private-bucket signature storage pairs with fleetbase/core-api's `File::signStoredUrl()`; on older core-api releases stored avatar URLs pass through unchanged.
 
 ---
 ## Need help?
diff --git a/composer.json b/composer.json
index b7a38393e..20587d830 100644
--- a/composer.json
+++ b/composer.json
@@ -1,6 +1,6 @@
 {
     "name": "fleetbase/fleetops-api",
-    "version": "0.6.71",
+    "version": "0.6.72",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "keywords": [
         "fleetbase-extension",
diff --git a/extension.json b/extension.json
index 92d303f0f..9c00e12e1 100644
--- a/extension.json
+++ b/extension.json
@@ -1,6 +1,6 @@
 {
     "name": "Fleet-Ops",
-    "version": "0.6.71",
+    "version": "0.6.72",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "repository": "https://github.com/fleetbase/fleetops",
     "license": "AGPL-3.0-or-later",
diff --git a/package.json b/package.json
index 085756ea4..5a0ea58ff 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@fleetbase/fleetops-engine",
-    "version": "0.6.71",
+    "version": "0.6.72",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "fleetbase": {
         "route": "fleet-ops"

From 1fbf11f920f9eef3e2283581d3826896efd0db42 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Thu, 8 Oct 2026 13:09:14 +0800
Subject: [PATCH 17/87] fix(tracking): open tracking links for signed-in users
 too

Tracking links, the TrackingNumber url field and label QR codes pointed at
/track-order?order=..., which falls into the console's own routes. A signed-out
visitor was sent on to the public /~/track-order page after login, but a
signed-in user (staff or admin) landed on an empty console page.

- TrackingCode::PATH is now ~/track-order, the console's public route prefix,
  which renders whether or not the visitor is signed in. The notifications'
  Track Order buttons build their link from the same constants.
- The tracking page is also registered in the console registry, so links
  already emailed or printed without the prefix show it to signed-in staff.
- The scan parser never reads the tracking page path itself as a tracking
  number; old /track-order codes still parse.
---
 addon/extension.js                            | 15 +++++++++++++
 server/src/Notifications/OrderAssigned.php    |  3 ++-
 server/src/Notifications/OrderCanceled.php    |  3 ++-
 server/src/Notifications/OrderCompleted.php   |  3 ++-
 .../src/Notifications/OrderDispatchFailed.php |  3 ++-
 server/src/Notifications/OrderDispatched.php  |  3 ++-
 server/src/Notifications/OrderFailed.php      |  3 ++-
 .../src/Notifications/WaypointCompleted.php   |  3 ++-
 server/src/Support/TrackingCode.php           | 14 ++++++++-----
 .../CompactResourceSerializationTest.php      |  4 ++--
 server/tests/ObserverContractsTest.php        |  2 +-
 .../tests/Unit/Models/TrackingNumberTest.php  |  8 +++----
 .../tests/Unit/Support/TrackingCodeTest.php   | 21 ++++++++++++++-----
 13 files changed, 61 insertions(+), 24 deletions(-)

diff --git a/addon/extension.js b/addon/extension.js
index d67e72561..2cc2515a1 100644
--- a/addon/extension.js
+++ b/addon/extension.js
@@ -128,6 +128,21 @@ export default {
             }
         );
 
+        // Links printed or emailed without the public `~/` prefix (/track-order?order=...) land
+        // inside the console. Signed-out visitors are sent on to the public route after login;
+        // registering the page in the console too shows it to signed-in staff instead of an
+        // empty console page.
+        menuService.registerMenuItem(
+            'console',
+            new MenuItem({
+                title: 'Track Order',
+                slug: 'track-order',
+                section: null,
+                view: null,
+                component: new ExtensionComponent('@fleetbase/fleetops-engine', 'order-tracking-lookup'),
+            })
+        );
+
         // Register track order button
         menuService.registerMenuItem(
             'auth:login',
diff --git a/server/src/Notifications/OrderAssigned.php b/server/src/Notifications/OrderAssigned.php
index ea3bcf82b..d1648d93a 100644
--- a/server/src/Notifications/OrderAssigned.php
+++ b/server/src/Notifications/OrderAssigned.php
@@ -4,6 +4,7 @@
 
 use Fleetbase\FleetOps\Http\Resources\v1\Order as OrderResource;
 use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Support\TrackingCode;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Support\PushNotification;
 use Illuminate\Broadcasting\Channel;
@@ -128,7 +129,7 @@ public function toMail($notifiable)
             $message->line('Dispatch is scheduled for ' . $this->order->scheduled_at);
         }
 
-        $message->action('Track Order', Utils::consoleUrl('track-order', ['order' => $this->order->trackingNumber->tracking_number]));
+        $message->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->order->trackingNumber->tracking_number]));
 
         return $message;
     }
diff --git a/server/src/Notifications/OrderCanceled.php b/server/src/Notifications/OrderCanceled.php
index 3641f0c02..05153856f 100644
--- a/server/src/Notifications/OrderCanceled.php
+++ b/server/src/Notifications/OrderCanceled.php
@@ -5,6 +5,7 @@
 use Fleetbase\FleetOps\Http\Resources\v1\Order as OrderResource;
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingCode;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Support\PushNotification;
 use Illuminate\Broadcasting\Channel;
@@ -138,7 +139,7 @@ public function toMail($notifiable)
             ->line($this->message)
             ->line($this->reason)
             ->line('No further action is necessary.')
-            ->action('Track Order', Utils::consoleUrl('track-order', ['order' => $this->getTrackingNumber()]));
+            ->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->getTrackingNumber()]));
     }
 
     /**
diff --git a/server/src/Notifications/OrderCompleted.php b/server/src/Notifications/OrderCompleted.php
index b6c2401e4..b3fc1736a 100644
--- a/server/src/Notifications/OrderCompleted.php
+++ b/server/src/Notifications/OrderCompleted.php
@@ -5,6 +5,7 @@
 use Fleetbase\FleetOps\Http\Resources\v1\Order as OrderResource;
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingCode;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Support\PushNotification;
 use Illuminate\Broadcasting\Channel;
@@ -131,7 +132,7 @@ public function toMail($notifiable)
             ->subject($this->title)
             ->line($this->message)
             ->line('No further action is necessary.')
-            ->action('Track Order', Utils::consoleUrl('track-order', ['order' => $this->getTrackingNumber()]));
+            ->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->getTrackingNumber()]));
     }
 
     /**
diff --git a/server/src/Notifications/OrderDispatchFailed.php b/server/src/Notifications/OrderDispatchFailed.php
index cd7e92b52..3ba38457d 100644
--- a/server/src/Notifications/OrderDispatchFailed.php
+++ b/server/src/Notifications/OrderDispatchFailed.php
@@ -5,6 +5,7 @@
 use Fleetbase\FleetOps\Events\OrderDispatchFailed as OrderDispatchFailedEvent;
 use Fleetbase\FleetOps\Http\Resources\v1\Order as OrderResource;
 use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Support\TrackingCode;
 use Fleetbase\FleetOps\Support\Utils;
 use Illuminate\Broadcasting\Channel;
 use Illuminate\Bus\Queueable;
@@ -127,6 +128,6 @@ public function toMail($notifiable)
         return (new MailMessage())
             ->subject($this->title)
             ->line($this->message)
-            ->action('Track Order', Utils::consoleUrl('track-order', ['order' => $this->order->trackingNumber->tracking_number]));
+            ->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->order->trackingNumber->tracking_number]));
     }
 }
diff --git a/server/src/Notifications/OrderDispatched.php b/server/src/Notifications/OrderDispatched.php
index 8f954a131..c57eae2c8 100644
--- a/server/src/Notifications/OrderDispatched.php
+++ b/server/src/Notifications/OrderDispatched.php
@@ -6,6 +6,7 @@
 use Fleetbase\FleetOps\Http\Resources\v1\Order as OrderResource;
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingCode;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Support\PushNotification;
 use Illuminate\Broadcasting\Channel;
@@ -170,7 +171,7 @@ public function toMail($notifiable)
         return (new MailMessage())
             ->subject($this->title)
             ->line($this->message)
-            ->action('Track Order', Utils::consoleUrl('track-order', ['order' => $this->getTrackingNumber()]));
+            ->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->getTrackingNumber()]));
     }
 
     /**
diff --git a/server/src/Notifications/OrderFailed.php b/server/src/Notifications/OrderFailed.php
index e44da70cf..010ca0100 100644
--- a/server/src/Notifications/OrderFailed.php
+++ b/server/src/Notifications/OrderFailed.php
@@ -5,6 +5,7 @@
 use Fleetbase\FleetOps\Http\Resources\v1\Order as OrderResource;
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingCode;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Support\PushNotification;
 use Illuminate\Broadcasting\Channel;
@@ -138,7 +139,7 @@ public function toMail($notifiable)
             ->line($this->message)
             ->line($this->reason)
             ->line('No further action is necessary.')
-            ->action('Track Order', Utils::consoleUrl('track-order', ['order' => $this->getTrackingNumber()]));
+            ->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->getTrackingNumber()]));
     }
 
     /**
diff --git a/server/src/Notifications/WaypointCompleted.php b/server/src/Notifications/WaypointCompleted.php
index 233318ea6..98555072a 100644
--- a/server/src/Notifications/WaypointCompleted.php
+++ b/server/src/Notifications/WaypointCompleted.php
@@ -5,6 +5,7 @@
 use Fleetbase\FleetOps\Flow\Activity;
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingCode;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Support\PushNotification;
 use Illuminate\Broadcasting\Channel;
@@ -132,7 +133,7 @@ public function toMail($notifiable)
             ->subject($this->title)
             ->line($this->message)
             ->line('No further action is necessary.')
-            ->action('Track Order', Utils::consoleUrl('track-order', ['order' => $this->waypoint->trackingNumber->tracking_number]));
+            ->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->waypoint->trackingNumber->tracking_number]));
     }
 
     /**
diff --git a/server/src/Support/TrackingCode.php b/server/src/Support/TrackingCode.php
index f043a8a53..53d5e7653 100644
--- a/server/src/Support/TrackingCode.php
+++ b/server/src/Support/TrackingCode.php
@@ -11,7 +11,7 @@
  * QR (v1) is a URL, so a phone camera opens the customer tracking page while scanners
  * and the navigator app read the parameters:
  *
- *     https://<console host>/track-order?order=<tracking number>&r=<owner public_id>&v=1
+ *     https://<console host>/~/track-order?order=<tracking number>&r=<owner public_id>&v=1
  *
  * Only the tracking number (printed on the label in plain text) and the owner's public
  * id go in: no uuids, no addresses, no names, no company. The owner's type is its
@@ -33,8 +33,12 @@ class TrackingCode
      * Where a phone camera lands. The public tracking page is being rebuilt; when its
      * route changes, change these two and nothing else. parse() never depends on the
      * host or the path, since printed labels outlive both.
+     *
+     * `~/` is the console's public route prefix: it renders the page whether or not the
+     * visitor is signed in. A bare `/track-order` falls into the console's own routes, so
+     * a signed-in user landed on an empty console page instead of the tracking page.
      */
-    public const PATH           = 'track-order';
+    public const PATH           = '~/track-order';
     public const TRACKING_PARAM = 'order';
 
     /**
@@ -174,11 +178,11 @@ protected static function parseUrl(string $url): array
         $trackingNumber = static::stringParam($query, static::TRACKING_PARAM) ?? static::stringParam($query, 'tn');
 
         // A future route may carry the tracking number in the path (/track/<number>). Only
-        // a path of two or more segments can, so /track-order itself is never mistaken
-        // for one.
+        // a path of two or more segments can, and the tracking page's own path
+        // (/track-order, /~/track-order) is never mistaken for one.
         if ($trackingNumber === null && is_array($parts) && isset($parts['path'])) {
             $segments = array_values(array_filter(explode('/', $parts['path']), fn ($segment) => $segment !== ''));
-            if (count($segments) >= 2) {
+            if (count($segments) >= 2 && end($segments) !== basename(static::PATH)) {
                 $trackingNumber = rawurldecode(end($segments));
             }
         }
diff --git a/server/tests/CompactResourceSerializationTest.php b/server/tests/CompactResourceSerializationTest.php
index fb1f87925..97e5c664c 100644
--- a/server/tests/CompactResourceSerializationTest.php
+++ b/server/tests/CompactResourceSerializationTest.php
@@ -2833,9 +2833,9 @@ public function environment(...$environments)
         Illuminate\Container\Container::setInstance($previousContainer);
     }
 
-    expect($payload['qr_code_content'])->toBe('https://console.fleetbase.test/track-order?order=TN-SCAN&r=order_public&v=1')
+    expect($payload['qr_code_content'])->toBe('https://console.fleetbase.test/~/track-order?order=TN-SCAN&r=order_public&v=1')
         ->and($payload['qr_code_content'])->not->toContain('owner-uuid')
-        ->and($payload['url'])->toBe('https://console.fleetbase.test/track-order?order=TN-SCAN')
+        ->and($payload['url'])->toBe('https://console.fleetbase.test/~/track-order?order=TN-SCAN')
         ->and($payload['qr_code'])->toBe('qr-data')
         // Nothing to scan without a tracking number: the key is absent, not null.
         ->and(array_key_exists('qr_code_content', $withoutNumber))->toBeFalse();
diff --git a/server/tests/ObserverContractsTest.php b/server/tests/ObserverContractsTest.php
index b3f7e8f5b..3893c2b05 100644
--- a/server/tests/ObserverContractsTest.php
+++ b/server/tests/ObserverContractsTest.php
@@ -1355,7 +1355,7 @@ public function getBarcodePNG($code, $type, ...$size)
 
     try {
         expect($images->invoke($observer, 'TN-sg', 'order_public'))->toBe([
-            'qr_code' => 'DNS2D:QRCODE,M:https://console.fleetbase.test/track-order?order=TN-sg&r=order_public&v=1',
+            'qr_code' => 'DNS2D:QRCODE,M:https://console.fleetbase.test/~/track-order?order=TN-sg&r=order_public&v=1',
             'barcode' => 'DNS1D:C128:TN-sg',
         ]);
     } finally {
diff --git a/server/tests/Unit/Models/TrackingNumberTest.php b/server/tests/Unit/Models/TrackingNumberTest.php
index 3587e69ef..c0084249d 100644
--- a/server/tests/Unit/Models/TrackingNumberTest.php
+++ b/server/tests/Unit/Models/TrackingNumberTest.php
@@ -124,7 +124,7 @@ protected static function ownerHasStatusColumn(Fleetbase\Models\Model $owner): b
         'tracking_number' => 'TRACK-AE',
         // The QR carries the tracking url naming the owner by public id, never its uuid;
         // the barcode carries the bare tracking number printed beneath it.
-        'qr_code'         => 'QRCODE,M:https://console.fleetbase.test/track-order?order=TRACK-AE&r=order_public&v=1',
+        'qr_code'         => 'QRCODE,M:https://console.fleetbase.test/~/track-order?order=TRACK-AE&r=order_public&v=1',
         'barcode'         => 'C128:TRACK-AE',
         'meta'            => '{"source":"api"}',
     ])->and($inserted)->not->toHaveKey('not_allowed');
@@ -157,7 +157,7 @@ protected static function ownerHasStatusColumn(Fleetbase\Models\Model $owner): b
         ->and(FleetOpsTrackingNumberInsertFake::$insertedValues[0])->toMatchArray([
             'uuid'            => 'tracking-uuid',
             'tracking_number' => 'TRACK-SG',
-            'qr_code'         => 'QRCODE,M:https://console.fleetbase.test/track-order?order=TRACK-SG&v=1',
+            'qr_code'         => 'QRCODE,M:https://console.fleetbase.test/~/track-order?order=TRACK-SG&v=1',
             'barcode'         => 'C128:TRACK-SG',
         ])
         ->and(FleetOpsTrackingNumberInsertFake::$createdStatuses)->toBe([])
@@ -219,7 +219,7 @@ public function __call($method, $arguments)
 
     $inserted = FleetOpsTrackingNumberInsertFake::$insertedValues[0];
 
-    expect($inserted['qr_code'])->toBe('QRCODE,M:https://console.fleetbase.test/track-order?order=TRACK-SG&r=waypoint_public&v=1')
+    expect($inserted['qr_code'])->toBe('QRCODE,M:https://console.fleetbase.test/~/track-order?order=TRACK-SG&r=waypoint_public&v=1')
         // A helper key, not a column: the fillable filter keeps it out of the insert.
         ->and($inserted)->not->toHaveKey('owner_public_id')
         ->and($inserted['owner_uuid'])->toBe('waypoint-uuid');
@@ -248,7 +248,7 @@ public function getBarcodePNG(...$arguments)
             'qr_code' => 'DNS2D-png',
             'barcode' => 'DNS1D-png',
         ])->and($calls->getArrayCopy())->toBe([
-            ['DNS2D', 'https://console.fleetbase.test/track-order?order=ACM1234567890SG&r=entity_public&v=1', 'QRCODE,M'],
+            ['DNS2D', 'https://console.fleetbase.test/~/track-order?order=ACM1234567890SG&r=entity_public&v=1', 'QRCODE,M'],
             ['DNS1D', 'ACM1234567890SG', 'C128', 2, 60],
         ]);
     } finally {
diff --git a/server/tests/Unit/Support/TrackingCodeTest.php b/server/tests/Unit/Support/TrackingCodeTest.php
index deef45224..9057892a3 100644
--- a/server/tests/Unit/Support/TrackingCodeTest.php
+++ b/server/tests/Unit/Support/TrackingCodeTest.php
@@ -13,21 +13,21 @@
 
 test('qr content is a versioned tracking url naming the owner by public id', function () {
     expect(TrackingCode::qrContent('ACM1234567890SG', 'order_a1b2c3d'))
-        ->toBe('https://console.fleetbase.test/track-order?order=ACM1234567890SG&r=order_a1b2c3d&v=1')
+        ->toBe('https://console.fleetbase.test/~/track-order?order=ACM1234567890SG&r=order_a1b2c3d&v=1')
         // No owner: the tracking number alone still resolves.
         ->and(TrackingCode::qrContent('ACM1234567890SG'))
-        ->toBe('https://console.fleetbase.test/track-order?order=ACM1234567890SG&v=1')
+        ->toBe('https://console.fleetbase.test/~/track-order?order=ACM1234567890SG&v=1')
         // Tracking numbers start with the company name, which may hold spaces.
         ->and(TrackingCode::qrContent('A B1234567890SG', ''))
-        ->toBe('https://console.fleetbase.test/track-order?order=A+B1234567890SG&v=1');
+        ->toBe('https://console.fleetbase.test/~/track-order?order=A+B1234567890SG&v=1');
 });
 
 test('qr content follows the configured console origin but never the app environment', function () {
     config(['fleetbase.console' => ['host' => 'fleetbase.test', 'subdomain' => 'console', 'secure' => false]]);
-    expect(TrackingCode::qrContent('TN1', 'order_x'))->toBe('http://console.fleetbase.test/track-order?order=TN1&r=order_x&v=1');
+    expect(TrackingCode::qrContent('TN1', 'order_x'))->toBe('http://console.fleetbase.test/~/track-order?order=TN1&r=order_x&v=1');
 
     config(['fleetbase.console' => ['host' => 'https://tracking.example.test/', 'subdomain' => 'ignored']]);
-    expect(TrackingCode::qrContent('TN1'))->toBe('https://tracking.example.test/track-order?order=TN1&v=1');
+    expect(TrackingCode::qrContent('TN1'))->toBe('https://tracking.example.test/~/track-order?order=TN1&v=1');
 
     // Unset `secure` defaults to https, whatever environment generated the label.
     config(['fleetbase.console' => ['host' => 'console.fleetbase.test']]);
@@ -133,3 +133,14 @@
         ->and(TrackingCode::matches('TN-FLAT', (object) ['uuid' => 'u', 'public_id' => '', 'tracking_number' => 'TN-FLAT']))->toBeTrue()
         ->and(TrackingCode::matches('TN-FLAT', (object) ['uuid' => 'u', 'public_id' => null]))->toBeFalse();
 });
+
+test('the tracking page path itself is never read as a tracking number', function () {
+    expect(TrackingCode::parse('https://console.example/~/track-order?r=order_o1'))->toMatchArray([
+        'tracking_number' => null,
+        'public_id'       => 'order_o1',
+    ])
+        ->and(TrackingCode::parse('https://console.example/~/track-order?order=TN1&v=1'))->toMatchArray([
+            'tracking_number' => 'TN1',
+            'version'         => 1,
+        ]);
+});

From 9529b4e0f8e575df8fae5894e4e566fa42f308e0 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Thu, 8 Oct 2026 14:31:42 +0800
Subject: [PATCH 18/87] feat(tracking-page): the customer tracking page, end to
 end

The public tracking page the settings configure, at /~/track (shared) and
/~/track?org={slug} (a company's own), with /~/track-order kept for links
already sent. Works signed in or out; signed-in staff see what the customer
sees.

Server (public/track/*, FleetOps):
- TrackingResolver: a tracking number (order, stop, item or service-stop
  place) opens its order for one customer within it (TrackingScope).
  Unknown, malformed, opted-out and other-company numbers all resolve to
  nothing and get one identical 404; lookups throttle inside the controller
  so a throttled lookup looks the same.
- TrackingAccess: one-time codes hashed via VerificationCode::issue(), sent
  only to contact details on the order (masked), with a 30 s resend
  cooldown, 3 sends per scope and 5 per address per 15 min, and a 5-minute
  pause after 3 wrong codes. A correct code gives the device an httpOnly
  session cookie (fb_track, stored as SHA-256) with a grant per customer.
- TrackingView: level 0 (stage, last update, how to verify) and levels 1/2
  built on TrackingUpdate, filtered to the customer's own stops, items,
  timeline and proof of delivery. Never sends uuids, notes, meta, rates,
  the sender's address or other customers' stops; the route line only when
  every stop is the customer's; the driver and position only while en
  route to them.
- Endpoints for codes, sign-out, delivery instructions, proof images,
  reporting a problem, the socket token, and a signed-in customer's orders.
- Links (TrackingNumber url, notification buttons) follow the company's
  'links in emails and labels' setting.

Page (Ember): lookup, limited view, verify (every code state), the full
view with live map, ETA, driver, updates, items, proof lightbox, delivery
instructions and reports, the order list, toasts, light/dark from the
company's tokens, RTL, and polling live updates behind a swappable source.

Tests for the resolver, recipient, access, view, controller, links and routes.
---
 addon/components/tracking-page.hbs            |  147 ++
 addon/components/tracking-page.js             |  539 ++++++++
 addon/components/tracking-page/full-view.hbs  |  258 ++++
 addon/components/tracking-page/full-view.js   |  445 +++++++
 addon/components/tracking-page/map.hbs        |   32 +
 addon/components/tracking-page/map.js         |  100 ++
 addon/components/tracking-page/order-list.hbs |   35 +
 .../components/tracking-page/public-view.hbs  |   60 +
 .../components/tracking-page/verify-panel.hbs |  109 ++
 addon/controllers/settings/tracking-page.js   |    6 +-
 addon/extension.js                            |   40 +-
 addon/styles/fleetops-engine.css              | 1177 +++++++++++++++++
 addon/utils/tracking-live-source.js           |  123 ++
 app/components/tracking-page.js               |    1 +
 app/components/tracking-page/full-view.js     |    1 +
 app/components/tracking-page/map.js           |    1 +
 app/components/tracking-page/order-list.js    |    1 +
 app/components/tracking-page/public-view.js   |    1 +
 app/components/tracking-page/verify-panel.js  |    1 +
 app/utils/tracking-live-source.js             |    1 +
 server/config/fleetops.php                    |    4 +
 ...000001_create_tracking_sessions_tables.php |   51 +
 .../Controllers/Public/TrackingController.php |  517 ++++++++
 .../src/Http/Resources/v1/TrackingNumber.php  |    2 +-
 server/src/Models/TrackingSession.php         |   33 +
 server/src/Models/TrackingSessionGrant.php    |   22 +
 server/src/Notifications/OrderAssigned.php    |    2 +-
 server/src/Notifications/OrderCanceled.php    |    2 +-
 server/src/Notifications/OrderCompleted.php   |    2 +-
 .../src/Notifications/OrderDispatchFailed.php |    2 +-
 server/src/Notifications/OrderDispatched.php  |    2 +-
 server/src/Notifications/OrderFailed.php      |    2 +-
 .../src/Notifications/WaypointCompleted.php   |    2 +-
 server/src/Support/TrackingCode.php           |   21 +
 .../Support/TrackingPage/TrackingAccess.php   |  344 +++++
 .../TrackingPage/TrackingRecipient.php        |  111 ++
 .../Support/TrackingPage/TrackingResolver.php |  201 +++
 .../Support/TrackingPage/TrackingTarget.php   |   40 +
 .../src/Support/TrackingPage/TrackingView.php |  408 ++++++
 server/src/routes.php                         |   17 +
 .../Http/Public/TrackingControllerTest.php    |  495 +++++++
 .../tests/RouteRegistrationExecutionTest.php  |   20 +
 server/tests/Support/TrackingPageDatabase.php |  197 +++
 .../tests/Unit/Support/TrackingCodeTest.php   |   22 +
 .../TrackingPage/TrackingAccessTest.php       |  177 +++
 .../TrackingPage/TrackingRecipientTest.php    |   51 +
 .../TrackingPage/TrackingResolverTest.php     |  181 +++
 .../Support/TrackingPage/TrackingViewTest.php |  417 ++++++
 translations/ar-ae.yml                        |  173 +++
 translations/bg-bg.yaml                       |  173 +++
 translations/en-us.yaml                       |  173 +++
 translations/es-pa.yaml                       |  173 +++
 translations/fr-fr.yaml                       |  173 +++
 translations/mn-mn.yaml                       |  173 +++
 translations/pt-br.yaml                       |  173 +++
 translations/ru-ru.yaml                       |  173 +++
 translations/uk-ua.yaml                       |  173 +++
 translations/vi-vn.yaml                       |  173 +++
 58 files changed, 8131 insertions(+), 22 deletions(-)
 create mode 100644 addon/components/tracking-page.hbs
 create mode 100644 addon/components/tracking-page.js
 create mode 100644 addon/components/tracking-page/full-view.hbs
 create mode 100644 addon/components/tracking-page/full-view.js
 create mode 100644 addon/components/tracking-page/map.hbs
 create mode 100644 addon/components/tracking-page/map.js
 create mode 100644 addon/components/tracking-page/order-list.hbs
 create mode 100644 addon/components/tracking-page/public-view.hbs
 create mode 100644 addon/components/tracking-page/verify-panel.hbs
 create mode 100644 addon/utils/tracking-live-source.js
 create mode 100644 app/components/tracking-page.js
 create mode 100644 app/components/tracking-page/full-view.js
 create mode 100644 app/components/tracking-page/map.js
 create mode 100644 app/components/tracking-page/order-list.js
 create mode 100644 app/components/tracking-page/public-view.js
 create mode 100644 app/components/tracking-page/verify-panel.js
 create mode 100644 app/utils/tracking-live-source.js
 create mode 100644 server/migrations/2026_10_08_000001_create_tracking_sessions_tables.php
 create mode 100644 server/src/Http/Controllers/Public/TrackingController.php
 create mode 100644 server/src/Models/TrackingSession.php
 create mode 100644 server/src/Models/TrackingSessionGrant.php
 create mode 100644 server/src/Support/TrackingPage/TrackingAccess.php
 create mode 100644 server/src/Support/TrackingPage/TrackingRecipient.php
 create mode 100644 server/src/Support/TrackingPage/TrackingResolver.php
 create mode 100644 server/src/Support/TrackingPage/TrackingTarget.php
 create mode 100644 server/src/Support/TrackingPage/TrackingView.php
 create mode 100644 server/tests/Feature/Http/Public/TrackingControllerTest.php
 create mode 100644 server/tests/Support/TrackingPageDatabase.php
 create mode 100644 server/tests/Unit/Support/TrackingPage/TrackingAccessTest.php
 create mode 100644 server/tests/Unit/Support/TrackingPage/TrackingRecipientTest.php
 create mode 100644 server/tests/Unit/Support/TrackingPage/TrackingResolverTest.php
 create mode 100644 server/tests/Unit/Support/TrackingPage/TrackingViewTest.php

diff --git a/addon/components/tracking-page.hbs b/addon/components/tracking-page.hbs
new file mode 100644
index 000000000..6bee0d56a
--- /dev/null
+++ b/addon/components/tracking-page.hbs
@@ -0,0 +1,147 @@
+<div class="tp-root {{if this.dark 'tp-dark'}}" style={{this.themeStyle}} dir={{this.dir}} lang={{this.locale}}>
+    <header class="tp-header">
+        <div class="tp-brand">
+            {{#if this.company.logo_url}}
+                <img class="tp-brand-logo" src={{this.company.logo_url}} alt="" />
+            {{else}}
+                <span class="tp-brand-monogram" aria-hidden="true">{{this.monogram}}</span>
+            {{/if}}
+            <span class="tp-brand-name">{{this.company.name}}</span>
+        </div>
+        {{#if (or (eq this.screen "public") (eq this.screen "track"))}}
+            <button type="button" class="tp-link-button" {{on "click" this.lookupAnother}}>{{t "tracking-page.page.track-another"}}</button>
+        {{/if}}
+    </header>
+
+    <main class="tp-main">
+        {{#if (or this.boot.isRunning (eq this.screen "loading"))}}
+            <div class="tp-narrow" aria-busy="true">
+                <div class="tp-skeleton tp-skeleton-title"></div>
+                <div class="tp-skeleton tp-skeleton-line"></div>
+                <div class="tp-skeleton tp-skeleton-card"></div>
+            </div>
+        {{else if (eq this.screen "unavailable")}}
+            <section class="tp-narrow tp-stack">
+                <h1 class="tp-h1">{{t "tracking-page.page.unavailable-title"}}</h1>
+                <p class="tp-muted">{{t "tracking-page.page.unavailable-help"}}</p>
+            </section>
+        {{else if (eq this.screen "lookup")}}
+            <section class="tp-narrow tp-stack">
+                <div class="tp-stack-sm">
+                    <h1 class="tp-h1">{{t "tracking-page.page.lookup-title"}}</h1>
+                    <p class="tp-muted">{{t "tracking-page.page.lookup-sub"}}</p>
+                </div>
+                <form class="tp-stack-sm" novalidate {{on "submit" this.submitLookup}}>
+                    <label for="tp-tracking-number" class="tp-label">{{t "tracking-page.page.tracking-number"}}</label>
+                    <input
+                        id="tp-tracking-number"
+                        class="tp-input tp-mono"
+                        value={{this.trackingInput}}
+                        autocomplete="off"
+                        autocapitalize="characters"
+                        spellcheck="false"
+                        placeholder={{t "tracking-page.page.tracking-number-placeholder"}}
+                        aria-describedby="tp-tracking-help tp-tracking-error"
+                        {{on "input" this.updateTracking}}
+                    />
+                    <p id="tp-tracking-help" class="tp-small tp-muted">{{t "tracking-page.page.tracking-number-help"}}</p>
+                    <div id="tp-tracking-error" role="alert">
+                        {{#if (eq this.lookupError "rate")}}
+                            <p class="tp-notice">{{t "tracking-page.page.lookup-rate"}}</p>
+                        {{else if (eq this.lookupError "neutral")}}
+                            <p class="tp-notice">{{t "tracking-page.page.lookup-neutral"}}</p>
+                        {{/if}}
+                    </div>
+                    <button type="submit" class="tp-button tp-button-primary" disabled={{or this.rateLimited this.lookup.isRunning}}>
+                        {{#if this.lookup.isRunning}}{{t "tracking-page.page.looking-up"}}{{else}}{{t "tracking-page.page.track"}}{{/if}}
+                    </button>
+                </form>
+                {{#if this.page.sign_in}}
+                    <div class="tp-divider"><span>{{t "tracking-page.page.or"}}</span></div>
+                    {{#if this.signedIn}}
+                        <button type="button" class="tp-button tp-button-secondary" {{on "click" (perform this.loadOrders)}}>{{t "tracking-page.page.your-orders"}}</button>
+                    {{else}}
+                        <a class="tp-button tp-button-secondary" href={{this.signInUrl}}>{{t "tracking-page.page.sign-in"}}</a>
+                    {{/if}}
+                {{/if}}
+            </section>
+        {{else if (eq this.screen "public")}}
+            <TrackingPage::PublicView @data={{this.data}} @signInUrl={{this.signInUrl}} @onVerify={{this.startVerify}} />
+        {{else if (eq this.screen "verify")}}
+            <section class="tp-narrow tp-stack">
+                <button type="button" class="tp-back" {{on "click" this.cancelVerify}}><FaIcon @icon="chevron-left" class="tp-flip" /> {{t "tracking-page.page.back"}}</button>
+                <TrackingPage::VerifyPanel
+                    @step={{this.verifyStep}}
+                    @channels={{this.channels}}
+                    @selectedChannel={{this.selectedChannel}}
+                    @otherChannel={{this.otherChannel}}
+                    @masked={{this.masked}}
+                    @code={{this.code}}
+                    @boxes={{this.codeBoxes}}
+                    @attemptsLeft={{this.attemptsLeft}}
+                    @cooldown={{this.cooldown}}
+                    @cooldownText={{this.cooldownText}}
+                    @lockText={{this.lockText}}
+                    @message={{this.verifyMessage}}
+                    @company={{this.company}}
+                    @sessionHours={{this.page.session_hours}}
+                    @onPick={{this.pickChannel}}
+                    @onSend={{perform this.sendCode}}
+                    @onCode={{this.updateCode}}
+                    @onResend={{this.resend}}
+                    @onSwitch={{this.switchChannel}}
+                />
+            </section>
+        {{else if (eq this.screen "list")}}
+            <TrackingPage::OrderList @orders={{this.orders}} @isLoading={{this.loadOrders.isRunning}} @onOpen={{this.openOrder}} />
+        {{else if (eq this.screen "track")}}
+            <TrackingPage::FullView
+                @data={{this.data}}
+                @company={{this.company}}
+                @liveState={{this.liveState}}
+                @fromList={{this.orders}}
+                @onBack={{this.backToOrders}}
+                @onShare={{this.share}}
+                @onSignOut={{perform this.signOut}}
+                @saveInstructions={{perform this.saveInstructions}}
+                @reportProblem={{perform this.reportProblem}}
+                @loadProof={{perform this.loadProof}}
+            />
+        {{/if}}
+    </main>
+
+    <footer class="tp-footer">
+        {{#if (or this.company.support_phone this.company.support_email)}}
+            <div>
+                {{t "tracking-page.page.help"}}
+                {{#if this.company.support_phone}}<a href="tel:{{this.company.support_phone}}">{{this.company.support_phone}}</a>{{/if}}
+                {{#if (and this.company.support_phone this.company.support_email)}} · {{/if}}
+                {{#if this.company.support_email}}<a href="mailto:{{this.company.support_email}}">{{this.company.support_email}}</a>{{/if}}
+            </div>
+        {{/if}}
+        <label class="tp-footer-language">
+            <span>{{t "tracking-page.page.language"}}</span>
+            <select class="tp-select" {{on "change" this.changeLocale}}>
+                {{#each this.localeOptions as |option|}}
+                    <option value={{option.code}} selected={{option.selected}}>{{option.label}}</option>
+                {{/each}}
+            </select>
+        </label>
+        {{#if this.company.powered_by}}
+            <div>{{t "tracking-page.page.powered-by"}}</div>
+        {{/if}}
+    </footer>
+
+    <div class="tp-toast-region" role="status" aria-live="polite">
+        {{#if this.toast}}
+            <div class="tp-toast">
+                <FaIcon @icon="check" />
+                <div>
+                    <div class="tp-toast-title">{{this.toast.title}}</div>
+                    {{#if this.toast.text}}<div class="tp-toast-text">{{this.toast.text}}</div>{{/if}}
+                </div>
+                <button type="button" class="tp-toast-close" aria-label={{t "tracking-page.page.dismiss"}} {{on "click" this.dismissToast}}><FaIcon @icon="xmark" /></button>
+            </div>
+        {{/if}}
+    </div>
+</div>
diff --git a/addon/components/tracking-page.js b/addon/components/tracking-page.js
new file mode 100644
index 000000000..a17635f9d
--- /dev/null
+++ b/addon/components/tracking-page.js
@@ -0,0 +1,539 @@
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { inject as service } from '@ember/service';
+import { action } from '@ember/object';
+import { htmlSafe } from '@ember/template';
+import { task, timeout } from 'ember-concurrency';
+import trackingPageTheme from '../utils/tracking-page-theme';
+import TrackingLiveSource from '../utils/tracking-live-source';
+
+/**
+ * The FleetOps API is mounted at the application root, so its public routes live under `public`.
+ * `rawError` makes a failed request reject with its JSON body, whose `code` or `error` drives the page.
+ */
+const REQUEST_OPTIONS = { namespace: 'public', rawError: true };
+
+/** How many neutral misses in a row before the page suggests a short break. */
+const GENTLE_LIMIT_AFTER = 4;
+
+/** The code length the server issues. */
+export const CODE_LENGTH = 6;
+
+/** Each locale, labelled in its own language. */
+const LOCALE_LABELS = {
+    'en-us': 'English',
+    'ar-ae': 'العربية',
+    'bg-bg': 'Български',
+    'es-pa': 'Español',
+    'fr-fr': 'Français',
+    'mn-mn': 'Монгол',
+    'pt-br': 'Português',
+    'ru-ru': 'Русский',
+    'uk-ua': 'Українська',
+    'vi-vn': 'Tiếng Việt',
+};
+
+/**
+ * The customer tracking page.
+ *
+ * Registered in the `auth:login` registry as `track` and `track-order`, so the console's
+ * public `virtual` route serves it at `/~/track` and `/~/track-order`: outside the console,
+ * signed in or not. `?order=` (or `?number=`) opens a tracking number and `?org=` a
+ * company's own page.
+ *
+ * A tracking number alone shows a coarse status. A one-time code to the customer's own
+ * contact details unlocks their stops on this device; a signed-in customer, or staff of
+ * the owning company, sees them straight away. Live updates poll the same endpoint.
+ */
+export default class TrackingPageComponent extends Component {
+    @service fetch;
+    @service intl;
+    @service urlSearchParams;
+    @service session;
+
+    @tracked screen = 'loading';
+    @tracked page = null;
+    @tracked data = null;
+    @tracked trackingInput = '';
+    @tracked lookupError = null;
+    @tracked misses = 0;
+    @tracked liveState = 'live';
+    @tracked toast = null;
+    @tracked orders = null;
+    @tracked prefersDark = false;
+
+    /* verification */
+    @tracked verifyStep = 'choose';
+    @tracked channel = null;
+    @tracked masked = null;
+    @tracked code = '';
+    @tracked attemptsLeft = 3;
+    @tracked cooldown = 0;
+    @tracked lockLeft = 0;
+    @tracked verifyMessage = null;
+
+    live = null;
+    ticker = null;
+
+    constructor() {
+        super(...arguments);
+        this.org = this.urlSearchParams.get('org') || null;
+        this.trackingInput = this.urlSearchParams.get('order') || this.urlSearchParams.get('number') || '';
+        this.watchColorScheme();
+        this.ticker = setInterval(() => this.tick(), 1000);
+        this.boot.perform();
+    }
+
+    willDestroy() {
+        super.willDestroy(...arguments);
+        clearInterval(this.ticker);
+        this.live?.stop();
+        this.colorScheme?.removeEventListener?.('change', this.onColorScheme);
+    }
+
+    /* ── Derived state ─────────────────────────────────────────────── */
+
+    get company() {
+        return this.data?.company ?? this.page?.company ?? {};
+    }
+
+    get monogram() {
+        let monogram = '';
+        for (const word of String(this.company.name ?? '').split(/\s+/)) {
+            if (word && monogram.length < 2) {
+                monogram += word[0].toUpperCase();
+            }
+        }
+
+        return monogram;
+    }
+
+    get dark() {
+        return this.company.theme !== 'light' && this.prefersDark;
+    }
+
+    get themeStyle() {
+        return htmlSafe(trackingPageTheme(this.company, this.dark));
+    }
+
+    get locale() {
+        return this.intl.primaryLocale ?? 'en-us';
+    }
+
+    get dir() {
+        return this.locale.startsWith('ar') ? 'rtl' : 'ltr';
+    }
+
+    get localeOptions() {
+        const enabled = this.company.locales?.length ? this.company.locales : Object.keys(LOCALE_LABELS);
+
+        return enabled.map((code) => ({ code, label: LOCALE_LABELS[code] ?? code, selected: code === this.locale }));
+    }
+
+    get number() {
+        return (this.data?.tracking_number ?? this.trackingInput ?? '').trim();
+    }
+
+    get isFull() {
+        return this.data?.level >= 1;
+    }
+
+    get rateLimited() {
+        return this.misses >= GENTLE_LIMIT_AFTER;
+    }
+
+    get channels() {
+        return this.data?.verify?.channels ?? [];
+    }
+
+    get hasChannels() {
+        return this.channels.length > 0;
+    }
+
+    get signInUrl() {
+        return `/customer-portal/auth/login?redirect=${encodeURIComponent(window.location.pathname + window.location.search)}`;
+    }
+
+    get signedIn() {
+        return this.session.isAuthenticated === true;
+    }
+
+    get cooldownText() {
+        return formatCountdown(this.cooldown);
+    }
+
+    get lockText() {
+        return formatCountdown(this.lockLeft);
+    }
+
+    get codeBoxes() {
+        const digits = this.code.split('');
+        return Array.from({ length: CODE_LENGTH }, (_, index) => ({
+            digit: digits[index] ?? '',
+            active: (this.verifyStep === 'sent' || this.verifyStep === 'wrong') && index === Math.min(digits.length, CODE_LENGTH - 1),
+        }));
+    }
+
+    get selectedChannel() {
+        return this.channel ?? this.channels[0]?.type ?? null;
+    }
+
+    get otherChannel() {
+        return this.channels.find((channel) => channel.type !== this.selectedChannel) ?? null;
+    }
+
+    /* ── Loading ───────────────────────────────────────────────────── */
+
+    @task *boot() {
+        try {
+            this.page = yield this.fetch.get('track/config', this.query(), REQUEST_OPTIONS);
+            this.applyLocale(this.page?.company);
+        } catch {
+            this.screen = 'unavailable';
+            return;
+        }
+
+        if (this.trackingInput) {
+            yield this.lookup.perform(this.trackingInput, { quiet: true });
+        } else {
+            this.screen = 'lookup';
+        }
+
+        if (this.signedIn && !this.data) {
+            this.loadOrders.perform();
+        }
+    }
+
+    @task({ restartable: true }) *lookup(number, { quiet = false } = {}) {
+        this.lookupError = null;
+        const value = String(number ?? '').trim();
+        if (!value) {
+            this.lookupError = 'neutral';
+            return;
+        }
+
+        try {
+            const data = yield this.fetch.get(`track/${encodeURIComponent(value)}`, this.query(), REQUEST_OPTIONS);
+            this.misses = 0;
+            this.show(data);
+            this.urlSearchParams.addParamToCurrentUrl('order', data.tracking_number);
+        } catch (error) {
+            this.misses += 1;
+            this.lookupError = this.rateLimited ? 'rate' : 'neutral';
+            this.screen = 'lookup';
+            if (quiet) {
+                this.misses = Math.max(0, this.misses - 1);
+            }
+            return error;
+        }
+    }
+
+    @task *refresh() {
+        return yield this.fetch.get(`track/${encodeURIComponent(this.number)}`, this.query(), REQUEST_OPTIONS);
+    }
+
+    @task *loadOrders() {
+        try {
+            const response = yield this.fetch.get('track/account/orders', {}, REQUEST_OPTIONS);
+            this.orders = response?.orders ?? [];
+            if (!this.data) {
+                this.screen = 'list';
+            }
+        } catch {
+            this.orders = null;
+        }
+    }
+
+    show(data) {
+        const before = this.data;
+        this.data = data;
+        this.applyLocale(data?.company);
+        this.screen = data?.level >= 1 ? 'track' : 'public';
+
+        if (before && before.stage !== data.stage && data.level >= 1) {
+            this.notify(this.intl.t(`tracking-page.page.stage-toast-${data.stage}`), '');
+        }
+
+        if (!this.isFull) {
+            this.live?.stop();
+        } else if (!this.live?.running) {
+            this.startLive();
+        }
+    }
+
+    startLive() {
+        this.live?.stop();
+
+        this.live = new TrackingLiveSource(() => this.refresh.perform(), { isActive: () => this.data?.stage === 'in_transit' });
+        this.live.start(this.onLiveUpdate, this.onLiveState);
+    }
+
+    onLiveUpdate = (data) => {
+        this.show(data);
+    };
+
+    onLiveState = (state) => {
+        this.liveState = state;
+    };
+
+    /* ── Lookup ────────────────────────────────────────────────────── */
+
+    @action updateTracking(event) {
+        this.trackingInput = event.target.value;
+    }
+
+    @action submitLookup(event) {
+        event?.preventDefault?.();
+        if (this.rateLimited) {
+            return;
+        }
+
+        this.lookup.perform(this.trackingInput);
+    }
+
+    @action lookupAnother() {
+        this.live?.stop();
+        this.data = null;
+        this.trackingInput = '';
+        this.lookupError = null;
+        this.urlSearchParams.removeParamFromCurrentUrl('order');
+        this.screen = 'lookup';
+    }
+
+    @action openOrder(order) {
+        this.trackingInput = order.tracking_number;
+        this.lookup.perform(order.tracking_number);
+    }
+
+    @action backToOrders() {
+        this.live?.stop();
+        this.data = null;
+        this.urlSearchParams.removeParamFromCurrentUrl('order');
+        this.screen = 'list';
+    }
+
+    /* ── Verification ──────────────────────────────────────────────── */
+
+    @action startVerify() {
+        this.verifyStep = this.hasChannels ? 'choose' : 'none';
+        this.channel = this.channels[0]?.type ?? null;
+        this.code = '';
+        this.verifyMessage = null;
+        this.screen = 'verify';
+    }
+
+    @action cancelVerify() {
+        this.screen = 'public';
+    }
+
+    @action pickChannel(type) {
+        this.channel = type;
+    }
+
+    @action switchChannel() {
+        if (this.otherChannel) {
+            this.channel = this.otherChannel.type;
+            this.sendCode.perform();
+        }
+    }
+
+    @task({ drop: true }) *sendCode() {
+        this.verifyStep = 'sending';
+        this.code = '';
+        this.verifyMessage = null;
+
+        try {
+            const response = yield this.fetch.post(`track/${encodeURIComponent(this.number)}/codes${this.queryString()}`, { channel: this.selectedChannel }, REQUEST_OPTIONS);
+            this.masked = response.masked;
+            this.cooldown = response.resend_after ?? 30;
+            this.attemptsLeft = 3;
+            this.verifyStep = 'sent';
+        } catch (error) {
+            this.handleVerifyError(error);
+        }
+    }
+
+    @action resend() {
+        if (this.cooldown === 0) {
+            this.sendCode.perform();
+        }
+    }
+
+    @action updateCode(event) {
+        if (['locked', 'sending', 'success'].includes(this.verifyStep)) {
+            return;
+        }
+
+        this.code = String(event.target.value ?? '').replace(/\D/g, '').slice(0, CODE_LENGTH);
+        if (this.verifyStep === 'wrong') {
+            this.verifyStep = 'sent';
+        }
+
+        if (this.code.length === CODE_LENGTH) {
+            this.verifyCode.perform(this.code);
+        }
+    }
+
+    @task({ drop: true }) *verifyCode(code) {
+        try {
+            const data = yield this.fetch.post(`track/${encodeURIComponent(this.number)}/codes/verify${this.queryString()}`, { code }, REQUEST_OPTIONS);
+            this.verifyStep = 'success';
+            yield timeout(700);
+            this.show(data);
+            this.notify(this.intl.t('tracking-page.page.verified-toast'), this.intl.t('tracking-page.page.verified-toast-help'));
+        } catch (error) {
+            this.code = '';
+            this.handleVerifyError(error);
+        }
+    }
+
+    handleVerifyError(error) {
+        const code = error?.error ?? error?.code;
+        if (code === 'invalid') {
+            this.attemptsLeft = error.attempts_left ?? 0;
+            this.verifyStep = 'wrong';
+        } else if (code === 'paused') {
+            this.lockLeft = error.retry_after ?? 300;
+            this.verifyStep = 'locked';
+        } else if (code === 'cooldown') {
+            this.cooldown = error.retry_after ?? 30;
+            this.verifyStep = 'sent';
+        } else if (code === 'expired') {
+            this.verifyStep = 'renew';
+            this.verifyMessage = 'expired';
+        } else if (code === 'limited') {
+            this.verifyStep = 'renew';
+            this.verifyMessage = 'limited';
+        } else {
+            this.verifyStep = this.hasChannels ? 'choose' : 'none';
+            this.verifyMessage = 'failed';
+        }
+    }
+
+    @task *signOut() {
+        try {
+            yield this.fetch.delete(`track/session${this.queryString()}`, {}, REQUEST_OPTIONS);
+        } catch {
+            // Signed out locally either way: the next lookup shows what the server allows.
+        }
+
+        this.live?.stop();
+        this.notify(this.intl.t('tracking-page.page.signed-out-toast'), '');
+        yield this.lookup.perform(this.number);
+    }
+
+    /* ── Full view actions ─────────────────────────────────────────── */
+
+    @task *saveInstructions(text) {
+        try {
+            const data = yield this.fetch.put(`track/${encodeURIComponent(this.number)}/instructions${this.queryString()}`, { text }, REQUEST_OPTIONS);
+            this.show(data);
+            this.notify(this.intl.t('tracking-page.page.instructions-saved'), '');
+        } catch {
+            this.notify(this.intl.t('tracking-page.page.action-failed'), '');
+        }
+    }
+
+    @task *reportProblem(message) {
+        try {
+            yield this.fetch.post(`track/${encodeURIComponent(this.number)}/report${this.queryString()}`, { message }, REQUEST_OPTIONS);
+            this.notify(this.intl.t('tracking-page.page.report-sent'), this.intl.t('tracking-page.page.report-sent-help', { name: this.company.name }));
+            return true;
+        } catch {
+            this.notify(this.intl.t('tracking-page.page.action-failed'), '');
+            return false;
+        }
+    }
+
+    @task *loadProof(id) {
+        return yield this.fetch.get(`track/${encodeURIComponent(this.number)}/proofs/${encodeURIComponent(id)}`, this.query(), REQUEST_OPTIONS);
+    }
+
+    @action share() {
+        const url = `${window.location.origin}/~/track?order=${encodeURIComponent(this.number)}${this.org ? `&org=${encodeURIComponent(this.org)}` : ''}`;
+        try {
+            if (navigator.share) {
+                navigator.share({ url }).catch(() => {});
+            } else {
+                navigator.clipboard?.writeText(url);
+            }
+        } catch {
+            // Copying is a convenience; the address bar still has the link.
+        }
+
+        this.notify(this.intl.t('tracking-page.page.share-copied'), this.intl.t('tracking-page.page.share-copied-help'));
+    }
+
+    /* ── Page chrome ───────────────────────────────────────────────── */
+
+    @action changeLocale(event) {
+        this.intl.setLocale([event.target.value]);
+    }
+
+    @action dismissToast() {
+        this.toast = null;
+    }
+
+    notify(title, text) {
+        this.toast = { title, text, id: Date.now() };
+        const id = this.toast.id;
+        setTimeout(() => {
+            if (this.toast?.id === id && !this.isDestroyed) {
+                this.toast = null;
+            }
+        }, 4500);
+    }
+
+    tick() {
+        if (this.cooldown > 0) {
+            this.cooldown -= 1;
+        }
+
+        if (this.verifyStep === 'locked') {
+            if (this.lockLeft > 1) {
+                this.lockLeft -= 1;
+            } else {
+                this.lockLeft = 0;
+                this.verifyStep = 'renew';
+                this.verifyMessage = 'unlocked';
+            }
+        }
+    }
+
+    applyLocale(company) {
+        const preferred = this.urlSearchParams.get('lang') || company?.default_locale;
+        if (!this.localeApplied && preferred && company?.locales?.includes(preferred)) {
+            this.localeApplied = true;
+            this.intl.setLocale([preferred]);
+        }
+    }
+
+    watchColorScheme() {
+        if (typeof window === 'undefined' || !window.matchMedia) {
+            return;
+        }
+
+        this.colorScheme = window.matchMedia('(prefers-color-scheme: dark)');
+        this.prefersDark = this.colorScheme.matches;
+        this.onColorScheme = (event) => {
+            this.prefersDark = event.matches;
+        };
+        this.colorScheme.addEventListener?.('change', this.onColorScheme);
+    }
+
+    query() {
+        return this.org ? { org: this.org } : {};
+    }
+
+    queryString() {
+        return this.org ? `?org=${encodeURIComponent(this.org)}` : '';
+    }
+}
+
+export function formatCountdown(seconds) {
+    const value = Math.max(0, Math.floor(seconds ?? 0));
+    const minutes = Math.floor(value / 60);
+    const rest = value % 60;
+
+    return `${minutes}:${rest < 10 ? '0' : ''}${rest}`;
+}
diff --git a/addon/components/tracking-page/full-view.hbs b/addon/components/tracking-page/full-view.hbs
new file mode 100644
index 000000000..aeff45968
--- /dev/null
+++ b/addon/components/tracking-page/full-view.hbs
@@ -0,0 +1,258 @@
+<div class="tp-full {{if @data.location 'tp-full-with-map'}}" {{did-insert this.loadProofs}} {{did-update this.loadProofs @data.proofs}}>
+    <div class="tp-row-wrap tp-full-chips">
+        {{#if @fromList}}
+            <button type="button" class="tp-back" {{on "click" @onBack}}><FaIcon @icon="chevron-left" class="tp-flip" /> {{t "tracking-page.page.your-orders"}}</button>
+        {{/if}}
+        <span class="tp-chip tp-chip-accent"><FaIcon @icon={{this.viewerChip.icon}} /> {{this.viewerChip.label}}</span>
+        {{#if this.canSignOut}}
+            <button type="button" class="tp-link-button tp-muted" {{on "click" @onSignOut}}>{{t "tracking-page.page.sign-out"}}</button>
+        {{/if}}
+    </div>
+
+    <div class="tp-full-head">
+        {{#if this.hasSeveralStops}}
+            <div class="tp-segmented" role="group" aria-label={{t "tracking-page.page.your-stops"}}>
+                {{#each this.stopOptions as |option|}}
+                    <button type="button" class="tp-segment {{if option.selected 'tp-segment-selected'}}" aria-pressed={{if option.selected "true" "false"}} {{on "click" (fn this.selectStop option.id)}}>
+                        {{option.label}}{{#if option.complete}} <FaIcon @icon="check" />{{/if}}
+                    </button>
+                {{/each}}
+            </div>
+        {{/if}}
+
+        <section class="tp-stack-sm" aria-labelledby="tp-headline">
+            <div aria-live="polite" aria-atomic="true" class="tp-stack-xs">
+                <h1 id="tp-headline" class="tp-headline {{if (eq this.tone 'warn') 'tp-warn-text'}} {{if (eq this.tone 'muted') 'tp-muted'}}">{{this.headline}}</h1>
+                {{#if this.subline}}
+                    <p class="tp-subline">{{this.subline}}</p>
+                {{/if}}
+            </div>
+            <div class="tp-row-wrap tp-small tp-muted">
+                {{#if this.live}}
+                    <span class="tp-live"><span class="tp-live-dot" aria-hidden="true"></span>{{t "tracking-page.page.live"}}</span>
+                {{/if}}
+                {{#if (eq @liveState "reconnecting")}}
+                    <span class="tp-warn-text">{{t "tracking-page.page.reconnecting"}}</span>
+                {{/if}}
+                {{#if this.timezoneNote}}<span>{{this.timezoneNote}}</span>{{/if}}
+            </div>
+        </section>
+
+        <ol class="tp-steps" aria-label={{t "tracking-page.page.progress"}}>
+            {{#each this.steps as |step|}}
+                <li class="tp-step tp-step-{{step.state}}" aria-current={{if step.isCurrent "step"}}>
+                    <div class="tp-step-track">
+                        <span class="tp-step-dot">
+                            {{#if step.isDone}}<FaIcon @icon="check" />{{/if}}
+                            {{#if step.isFailed}}<FaIcon @icon="xmark" />{{/if}}
+                            {{#if step.isStop}}<FaIcon @icon="minus" />{{/if}}
+                        </span>
+                        {{#unless step.last}}<span class="tp-step-line"></span>{{/unless}}
+                    </div>
+                    <span class="tp-step-label">{{step.label}}</span>
+                </li>
+            {{/each}}
+        </ol>
+
+        {{#if this.delayed}}
+            <div class="tp-notice tp-notice-warn" role="note">
+                <FaIcon @icon="triangle-exclamation" />
+                <span><strong>{{t "tracking-page.page.delayed-title"}}</strong> {{t "tracking-page.page.delayed-help"}}</span>
+            </div>
+        {{/if}}
+
+        {{#if this.isMultiStop}}
+            <section class="tp-card tp-stack-sm">
+                <h2 class="tp-h3">{{t "tracking-page.page.stop-of" position=this.stopPosition total=this.route.total_stops}}</h2>
+                <p class="tp-small tp-muted">{{t "tracking-page.page.stops-private" count=this.route.stops_before}}</p>
+            </section>
+        {{/if}}
+
+        <div class="tp-row-between tp-card tp-card-tight">
+            <div class="tp-stack-xs">
+                <span class="tp-small tp-muted">{{t "tracking-page.page.tracking-number"}}</span>
+                <span class="tp-mono tp-strong">{{@data.tracking_number}}</span>
+            </div>
+            <ClickToCopy class="tp-button tp-button-small" @value={{@data.tracking_number}}>{{t "tracking-page.page.copy"}}</ClickToCopy>
+        </div>
+    </div>
+
+    {{#if @data.map}}
+        {{#if (or @data.location (gt this.stops.length 0))}}
+            <div class="tp-full-map">
+                <TrackingPage::Map
+                    @data={{@data}}
+                    @live={{this.live}}
+                    @stale={{this.stale}}
+                    @staleText={{if this.stale this.staleText}}
+                    @label={{t "tracking-page.page.map-label"}}
+                />
+            </div>
+        {{/if}}
+    {{else if (eq this.stage "delivered")}}
+        <p class="tp-notice">{{t "tracking-page.page.map-hidden"}}</p>
+    {{/if}}
+
+    <div class="tp-full-body">
+        {{#if (or this.etaCard this.driver)}}
+            <div class="tp-card-grid">
+                {{#if this.etaCard}}
+                    <section class="tp-card tp-stack-sm" aria-labelledby="tp-eta-title">
+                        <h2 id="tp-eta-title" class="tp-eyebrow">{{t "tracking-page.page.eta"}}</h2>
+                        <div class="tp-row-wrap tp-baseline">
+                            <span class="tp-eta-time">{{this.etaCard.time}}</span>
+                            {{#if this.etaCard.relative}}<span class="tp-muted">{{this.etaCard.relative}}</span>{{/if}}
+                        </div>
+                        <dl class="tp-dl">
+                            {{#if this.etaCard.window}}
+                                <div><dt>{{t "tracking-page.page.window"}}</dt><dd>{{this.etaCard.window}}</dd></div>
+                            {{/if}}
+                            <div><dt>{{t "tracking-page.page.before-yours"}}</dt><dd>{{t "tracking-page.page.stops-count" count=this.etaCard.stopsBefore}}</dd></div>
+                        </dl>
+                        {{#if this.etaCard.low}}
+                            <span class="tp-chip tp-chip-warn">{{t "tracking-page.page.estimate-may-change"}}</span>
+                        {{/if}}
+                    </section>
+                {{/if}}
+                {{#if this.driver}}
+                    <section class="tp-card tp-stack-sm" aria-labelledby="tp-driver-title">
+                        <h2 id="tp-driver-title" class="tp-eyebrow">{{t "tracking-page.page.driver"}}</h2>
+                        <div class="tp-row">
+                            <span class="tp-avatar" aria-hidden="true">{{this.driverInitial}}</span>
+                            <div class="tp-stack-xs">
+                                {{#if this.driver.name}}<span class="tp-strong">{{this.driver.name}}</span>{{/if}}
+                                {{#if this.driver.vehicle}}<span class="tp-small tp-muted">{{this.driver.vehicle}}</span>{{/if}}
+                                <span class="tp-small {{if this.driver.online 'tp-accent-text' 'tp-muted'}}">
+                                    {{#if this.driver.online}}{{t "tracking-page.page.online"}}{{else}}{{t "tracking-page.page.location-paused"}}{{/if}}
+                                </span>
+                            </div>
+                        </div>
+                        {{#if this.contactPhone}}
+                            <div class="tp-row-wrap">
+                                <a class="tp-button tp-button-primary tp-grow" href="tel:{{this.contactPhone}}"><FaIcon @icon="phone" /> {{t "tracking-page.page.call-short"}}</a>
+                                <a class="tp-button tp-button-secondary tp-grow" href="sms:{{this.contactPhone}}"><FaIcon @icon="message" /> {{t "tracking-page.page.message"}}</a>
+                            </div>
+                            <p class="tp-small tp-muted">{{t "tracking-page.page.contact-note" name=@company.name}}</p>
+                        {{/if}}
+                    </section>
+                {{/if}}
+            </div>
+        {{/if}}
+
+        {{#if (gt this.proofs.length 0)}}
+            <section class="tp-card tp-stack-sm" aria-labelledby="tp-proof-title">
+                <h2 id="tp-proof-title" class="tp-h3">{{t "tracking-page.page.proof"}}</h2>
+                <div class="tp-proof-grid">
+                    {{#each this.proofs as |proof|}}
+                        {{#if proof.url}}
+                            <button type="button" class="tp-proof" aria-label={{t (concat "tracking-page.page.open-" proof.type)}} {{on "click" (fn this.openProof proof)}}>
+                                <img src={{proof.url}} alt="" />
+                            </button>
+                        {{else}}
+                            <div class="tp-proof tp-proof-empty">
+                                <FaIcon @icon={{if (eq proof.type "scan") "qrcode" "image"}} />
+                                <span class="tp-small">{{t (concat "tracking-page.page.proof-" proof.type)}}</span>
+                            </div>
+                        {{/if}}
+                    {{/each}}
+                </div>
+            </section>
+        {{/if}}
+
+        {{#if (or this.instructions.text this.instructions.editable)}}
+            <section class="tp-card tp-stack-sm" aria-labelledby="tp-instructions-title">
+                <div class="tp-row-between">
+                    <h2 id="tp-instructions-title" class="tp-h3">{{t "tracking-page.page.instructions"}}</h2>
+                    {{#if (and this.instructions.editable (not this.editing))}}
+                        <button type="button" class="tp-button tp-button-small" {{on "click" this.editInstructions}}>{{t "tracking-page.page.edit"}}</button>
+                    {{/if}}
+                </div>
+                {{#if this.editing}}
+                    <label for="tp-instructions" class="tp-small tp-muted">{{t "tracking-page.page.instructions-help"}}</label>
+                    <textarea id="tp-instructions" class="tp-input tp-textarea" rows="3" maxlength="500" {{on "input" this.updateDraft}}>{{this.draft}}</textarea>
+                    <div class="tp-row-end">
+                        <button type="button" class="tp-link-button" {{on "click" this.cancelInstructions}}>{{t "tracking-page.page.cancel"}}</button>
+                        <button type="button" class="tp-button tp-button-primary tp-button-small" {{on "click" this.saveInstructions}}>{{t "tracking-page.page.save"}}</button>
+                    </div>
+                {{else}}
+                    <p>{{or this.instructions.text (t "tracking-page.page.no-instructions")}}</p>
+                {{/if}}
+            </section>
+        {{/if}}
+
+        <section class="tp-card tp-stack-xs" aria-labelledby="tp-timeline-title">
+            <h2 id="tp-timeline-title" class="tp-h3">{{t "tracking-page.page.updates"}}</h2>
+            {{#each this.timelineGroups as |group|}}
+                <div class="tp-eyebrow tp-timeline-day">{{group.day}}</div>
+                <ol class="tp-timeline">
+                    {{#each group.entries as |entry|}}
+                        <li class="tp-timeline-entry {{if entry.latest 'tp-timeline-latest'}}">
+                            <span class="tp-timeline-dot" aria-hidden="true"></span>
+                            <div class="tp-row-between tp-grow">
+                                <span class="tp-strong">{{entry.status}}</span>
+                                <span class="tp-small tp-muted">{{entry.time}}</span>
+                            </div>
+                        </li>
+                    {{/each}}
+                </ol>
+            {{else}}
+                <p class="tp-muted">{{t "tracking-page.page.no-updates"}}</p>
+            {{/each}}
+            {{#if this.hasOlder}}
+                <button type="button" class="tp-button tp-button-small tp-self-start" aria-expanded={{if this.showOlder "true" "false"}} {{on "click" this.toggleOlder}}>
+                    {{#if this.showOlder}}{{t "tracking-page.page.show-fewer"}}{{else}}{{t "tracking-page.page.show-earlier" count=this.olderCount}}{{/if}}
+                </button>
+            {{/if}}
+        </section>
+
+        {{#if (gt this.items.length 0)}}
+            <section class="tp-card tp-stack-xs" aria-labelledby="tp-items-title">
+                <h2 id="tp-items-title" class="tp-h3">{{t "tracking-page.page.items"}}</h2>
+                {{#each this.items as |item|}}
+                    <div class="tp-item">
+                        <span class="tp-item-photo" aria-hidden="true">
+                            {{#if item.photo_url}}<img src={{item.photo_url}} alt="" />{{else}}<FaIcon @icon="box" />{{/if}}
+                        </span>
+                        <div class="tp-stack-xs tp-grow">
+                            <span class="tp-strong">{{or item.name (t "tracking-page.page.item")}}</span>
+                            {{#if item.description}}<span class="tp-small tp-muted">{{item.description}}</span>{{/if}}
+                            {{#if item.quantity}}<span class="tp-small tp-muted">{{t "tracking-page.page.quantity" count=item.quantity}}</span>{{/if}}
+                            {{#if item.tracking}}<span class="tp-mono tp-small tp-muted">{{item.tracking}}</span>{{/if}}
+                        </div>
+                        {{#if item.price}}<span class="tp-strong">{{format-currency item.price item.currency}}</span>{{/if}}
+                    </div>
+                {{/each}}
+            </section>
+        {{/if}}
+
+        <div class="tp-actions">
+            <button type="button" class="tp-button tp-button-secondary" {{on "click" @onShare}}><FaIcon @icon="share-from-square" /> {{t "tracking-page.page.share"}}</button>
+            {{#if this.canReport}}
+                <button type="button" class="tp-button tp-button-secondary" aria-expanded={{if this.reporting "true" "false"}} {{on "click" this.toggleReport}}><FaIcon @icon="flag" /> {{t "tracking-page.page.report"}}</button>
+            {{/if}}
+            {{#if this.contactEmail}}
+                <a class="tp-button tp-button-secondary" href="mailto:{{this.contactEmail}}"><FaIcon @icon="envelope" /> {{t "tracking-page.page.contact" name=@company.name}}</a>
+            {{/if}}
+        </div>
+        {{#if this.reporting}}
+            <section class="tp-card tp-stack-sm">
+                <label for="tp-report" class="tp-label">{{t "tracking-page.page.report-label"}}</label>
+                <textarea id="tp-report" class="tp-input tp-textarea" rows="4" maxlength="1000" {{on "input" this.updateReport}}>{{this.reportText}}</textarea>
+                <div class="tp-row-end">
+                    <button type="button" class="tp-link-button" {{on "click" this.toggleReport}}>{{t "tracking-page.page.cancel"}}</button>
+                    <button type="button" class="tp-button tp-button-primary tp-button-small" disabled={{not this.reportText}} {{on "click" this.sendReport}}>{{t "tracking-page.page.send"}}</button>
+                </div>
+            </section>
+        {{/if}}
+    </div>
+
+    {{#if this.lightbox}}
+        <div class="tp-lightbox" role="dialog" aria-modal="true" aria-label={{t "tracking-page.page.proof"}} {{on "keydown" this.closeOnEscape}}>
+            <button type="button" class="tp-lightbox-close" aria-label={{t "tracking-page.page.close"}} {{on "click" this.closeProof}} {{did-insert this.focusElement}}><FaIcon @icon="xmark" /></button>
+            <figure class="tp-lightbox-figure">
+                <img src={{this.lightbox.url}} alt={{t (concat "tracking-page.page.proof-" this.lightbox.type)}} />
+                <figcaption>{{t (concat "tracking-page.page.proof-" this.lightbox.type)}}</figcaption>
+            </figure>
+        </div>
+    {{/if}}
+</div>
diff --git a/addon/components/tracking-page/full-view.js b/addon/components/tracking-page/full-view.js
new file mode 100644
index 000000000..53cff86c5
--- /dev/null
+++ b/addon/components/tracking-page/full-view.js
@@ -0,0 +1,445 @@
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { inject as service } from '@ember/service';
+import { action } from '@ember/object';
+
+/**
+ * Coarse stages, in order, and the step each one has reached.
+ */
+const STEPS = ['created', 'dispatched', 'started', 'enroute', 'delivered'];
+const REACHED = { preparing: 0, scheduled: 0, dispatched: 1, in_transit: 3, delivered: 5 };
+
+function step(key, state, label, last) {
+    return {
+        key,
+        state,
+        label,
+        last,
+        isDone: state === 'done',
+        isCurrent: state === 'current',
+        isFailed: state === 'failed',
+        isStop: state === 'stop',
+    };
+}
+
+/**
+ * One customer's view of their delivery: status, progress, live map, arrival, driver,
+ * updates, items and proof of delivery. Everything it shows has already been filtered to
+ * that customer's stops by the server.
+ */
+export default class TrackingPageFullViewComponent extends Component {
+    @service intl;
+
+    @tracked showOlder = false;
+    @tracked editing = false;
+    @tracked draft = '';
+    @tracked reporting = false;
+    @tracked reportText = '';
+    @tracked proofUrls = {};
+    @tracked lightbox = null;
+    @tracked selectedStopId = null;
+
+    get data() {
+        return this.args.data ?? {};
+    }
+
+    get stage() {
+        return this.data.stage ?? 'preparing';
+    }
+
+    get delayed() {
+        return this.data.status?.delayed === true && this.stage === 'in_transit';
+    }
+
+    get tone() {
+        if (this.stage === 'issue' || this.delayed) {
+            return 'warn';
+        }
+
+        return this.stage === 'canceled' ? 'muted' : 'normal';
+    }
+
+    get viewerChip() {
+        const viewer = this.data.viewer;
+        if (viewer === 'staff') {
+            return { icon: 'user-shield', label: this.intl.t('tracking-page.page.chip-staff') };
+        }
+
+        if (viewer === 'account') {
+            return { icon: 'user', label: this.intl.t('tracking-page.page.chip-account') };
+        }
+
+        return { icon: 'shield-halved', label: this.intl.t('tracking-page.page.chip-verified') };
+    }
+
+    get canSignOut() {
+        return this.data.viewer === 'verified';
+    }
+
+    /* ── Stops ─────────────────────────────────────────────────────── */
+
+    get stops() {
+        return this.data.stops ?? [];
+    }
+
+    get hasSeveralStops() {
+        return this.stops.length > 1;
+    }
+
+    get stopOptions() {
+        return this.stops.map((stop, index) => ({
+            id: stop.id,
+            label: this.intl.t('tracking-page.page.your-stop', { number: index + 1 }),
+            selected: stop.id === this.currentStop?.id,
+            complete: stop.complete,
+        }));
+    }
+
+    get currentStop() {
+        const chosen = this.stops.find((stop) => stop.id === (this.selectedStopId ?? this.data.focus_stop));
+
+        return chosen ?? this.stops.find((stop) => !stop.complete) ?? this.stops[this.stops.length - 1] ?? null;
+    }
+
+    get route() {
+        return this.data.route ?? { total_stops: 0, completed_stops: 0, stops_before: 0 };
+    }
+
+    get isMultiStop() {
+        return this.route.total_stops > 2 && this.stage === 'in_transit';
+    }
+
+    get stopPosition() {
+        return this.route.completed_stops + this.route.stops_before + 1;
+    }
+
+    @action selectStop(id) {
+        this.selectedStopId = id;
+    }
+
+    /* ── Headline ──────────────────────────────────────────────────── */
+
+    get eta() {
+        return this.currentStop?.eta ?? this.data.eta ?? null;
+    }
+
+    get window() {
+        const own = this.currentStop?.window;
+        if (own?.start || own?.end) {
+            return own;
+        }
+
+        return this.data.time_window ?? {};
+    }
+
+    get windowText() {
+        const { start, end } = this.window;
+        if (start && end) {
+            return `${this.time(start)} – ${this.time(end)}`;
+        }
+
+        return start ? this.time(start) : end ? this.time(end) : null;
+    }
+
+    get headline() {
+        const t = (key, values) => this.intl.t(`tracking-page.page.${key}`, values);
+        switch (this.stage) {
+            case 'scheduled':
+                return t('headline-scheduled', { date: this.date(this.data.scheduled_at) });
+            case 'dispatched':
+                return t('headline-dispatched');
+            case 'in_transit':
+                if (this.delayed) {
+                    return t('headline-delayed');
+                }
+
+                return this.eta?.at ? t('headline-arriving', { day: this.relativeDay(this.eta.at) }) : t('headline-in-transit');
+            case 'delivered':
+                return t('headline-delivered');
+            case 'issue':
+                return t('headline-issue');
+            case 'canceled':
+                return t('headline-canceled');
+            default:
+                return t('headline-preparing');
+        }
+    }
+
+    get subline() {
+        const t = (key, values) => this.intl.t(`tracking-page.page.${key}`, values);
+        if (this.stage === 'in_transit' && this.eta?.at) {
+            const relative = this.minutesUntil(this.eta.at);
+            const window = this.windowText ?? this.time(this.eta.at);
+
+            return relative > 0 ? t('sub-arriving', { window, minutes: relative }) : window;
+        }
+
+        if (this.stage === 'scheduled') {
+            return this.windowText ? t('sub-window', { window: this.windowText }) : null;
+        }
+
+        if (this.stage === 'delivered') {
+            const delivered = this.timeline.find((entry) => entry.complete) ?? this.timeline[0];
+
+            return delivered?.created_at ? t('sub-delivered', { when: this.dateTime(delivered.created_at) }) : null;
+        }
+
+        if (this.stage === 'issue' || this.stage === 'canceled') {
+            return this.timeline[0]?.status ?? null;
+        }
+
+        return this.stage === 'dispatched' ? t('sub-dispatched') : t('sub-preparing');
+    }
+
+    get live() {
+        return this.stage === 'in_transit' && !!this.data.location && this.args.liveState === 'live' && !this.stale;
+    }
+
+    get stale() {
+        const seenAt = this.data.location?.seen_at;
+        if (!seenAt) {
+            return false;
+        }
+
+        return (Date.now() - new Date(seenAt).getTime()) / 1000 > (this.data.stale_after ?? 300);
+    }
+
+    get staleText() {
+        const minutes = Math.max(1, Math.round((Date.now() - new Date(this.data.location.seen_at).getTime()) / 60000));
+
+        return this.intl.t('tracking-page.page.last-seen', { minutes });
+    }
+
+    get timezoneNote() {
+        try {
+            const format = new Intl.DateTimeFormat(this.locale, { timeZoneName: 'short' });
+            const parts = format.formatToParts(new Date());
+            const zone = parts.find((part) => part.type === 'timeZoneName')?.value;
+
+            return zone ? this.intl.t('tracking-page.page.timezone', { zone }) : null;
+        } catch {
+            return null;
+        }
+    }
+
+    /* ── Stepper ───────────────────────────────────────────────────── */
+
+    get steps() {
+        if (this.stage === 'canceled') {
+            return [step('created', 'done', this.intl.t('tracking-page.page.step-created'), false), step('canceled', 'stop', this.intl.t('tracking-page.page.step-canceled'), true)];
+        }
+
+        const reached = REACHED[this.stage] ?? 3;
+
+        return STEPS.map((key, index) => {
+            let state = index < reached ? 'done' : index === reached ? 'current' : 'todo';
+            let label = this.intl.t(`tracking-page.page.step-${key}`);
+            if (this.stage === 'issue' && key === 'enroute') {
+                state = 'failed';
+                label = this.intl.t('tracking-page.page.step-issue');
+            }
+
+            return step(key, state, label, index === STEPS.length - 1);
+        });
+    }
+
+    /* ── Cards ─────────────────────────────────────────────────────── */
+
+    get etaCard() {
+        if (this.stage !== 'in_transit' || !this.eta?.at) {
+            return null;
+        }
+
+        return {
+            time: this.time(this.eta.at),
+            relative: this.minutesUntil(this.eta.at) > 0 ? this.intl.t('tracking-page.page.in-minutes', { minutes: this.minutesUntil(this.eta.at) }) : null,
+            window: this.windowText,
+            stopsBefore: this.route.stops_before,
+            low: this.delayed || ['low', 'medium'].includes(this.eta.confidence ?? this.data.status?.confidence),
+        };
+    }
+
+    get driver() {
+        return this.stage === 'in_transit' ? this.data.driver : null;
+    }
+
+    get driverInitial() {
+        return (this.driver?.name ?? '?').charAt(0).toUpperCase();
+    }
+
+    get contactPhone() {
+        return this.args.company?.support_phone;
+    }
+
+    get contactEmail() {
+        return this.args.company?.support_email;
+    }
+
+    get timeline() {
+        return this.data.timeline ?? [];
+    }
+
+    get timelineGroups() {
+        const groups = [];
+        this.timeline.forEach((entry, index) => {
+            const day = this.dayLabel(entry.created_at);
+            let group = groups[groups.length - 1];
+            if (!group || group.day !== day) {
+                group = { day, entries: [] };
+                groups.push(group);
+            }
+
+            group.entries.push({ ...entry, time: this.time(entry.created_at), latest: index === 0 });
+        });
+
+        return this.showOlder ? groups : groups.slice(0, 1);
+    }
+
+    get olderCount() {
+        const first = this.timelineGroups[0]?.entries.length ?? 0;
+
+        return Math.max(0, this.timeline.length - (this.showOlder ? this.timeline.length : first));
+    }
+
+    get hasOlder() {
+        return this.showOlder || this.olderCount > 0;
+    }
+
+    @action toggleOlder() {
+        this.showOlder = !this.showOlder;
+    }
+
+    get items() {
+        return this.data.items ?? [];
+    }
+
+    get proofs() {
+        return (this.data.proofs ?? []).map((proof) => ({ ...proof, url: this.proofUrls[proof.id] ?? null }));
+    }
+
+    @action async loadProofs() {
+        for (const proof of this.data.proofs ?? []) {
+            if (this.proofUrls[proof.id] || proof.type === 'scan') {
+                continue;
+            }
+
+            try {
+                const response = await this.args.loadProof(proof.id);
+                this.proofUrls = { ...this.proofUrls, [proof.id]: response?.url ?? null };
+            } catch {
+                // The proof is listed even when its image can't be fetched.
+            }
+        }
+    }
+
+    @action openProof(proof) {
+        if (proof.url) {
+            this.lightbox = proof;
+        }
+    }
+
+    @action closeProof() {
+        this.lightbox = null;
+    }
+
+    @action focusElement(element) {
+        element.focus();
+    }
+
+    @action closeOnEscape(event) {
+        if (event.key === 'Escape') {
+            this.closeProof();
+        }
+    }
+
+    /* ── Instructions and reports ──────────────────────────────────── */
+
+    get instructions() {
+        return this.data.instructions ?? {};
+    }
+
+    @action editInstructions() {
+        this.draft = this.instructions.text ?? '';
+        this.editing = true;
+    }
+
+    @action updateDraft(event) {
+        this.draft = event.target.value;
+    }
+
+    @action cancelInstructions() {
+        this.editing = false;
+    }
+
+    @action async saveInstructions() {
+        await this.args.saveInstructions(this.draft);
+        this.editing = false;
+    }
+
+    @action toggleReport() {
+        this.reporting = !this.reporting;
+    }
+
+    @action updateReport(event) {
+        this.reportText = event.target.value;
+    }
+
+    @action async sendReport() {
+        const sent = await this.args.reportProblem(this.reportText);
+        if (sent) {
+            this.reportText = '';
+            this.reporting = false;
+        }
+    }
+
+    get canReport() {
+        return this.data.actions?.report === true && !!this.contactEmail;
+    }
+
+    /* ── Formatting ────────────────────────────────────────────────── */
+
+    get locale() {
+        return this.intl.primaryLocale ?? 'en-us';
+    }
+
+    time(value) {
+        return value ? new Intl.DateTimeFormat(this.locale, { hour: 'numeric', minute: '2-digit' }).format(new Date(value)) : '';
+    }
+
+    date(value) {
+        return value ? new Intl.DateTimeFormat(this.locale, { weekday: 'short', day: 'numeric', month: 'short' }).format(new Date(value)) : '';
+    }
+
+    dateTime(value) {
+        return `${this.dayLabel(value)}, ${this.time(value)}`;
+    }
+
+    dayLabel(value) {
+        if (!value) {
+            return '';
+        }
+
+        const day = new Date(value);
+        const today = new Date();
+        const yesterday = new Date(today.getTime() - 86400000);
+        if (day.toDateString() === today.toDateString()) {
+            return this.intl.t('tracking-page.page.today');
+        }
+
+        if (day.toDateString() === yesterday.toDateString()) {
+            return this.intl.t('tracking-page.page.yesterday');
+        }
+
+        return this.date(value);
+    }
+
+    relativeDay(value) {
+        const day = this.dayLabel(value);
+
+        return day === this.intl.t('tracking-page.page.today') ? day.toLowerCase() : day;
+    }
+
+    minutesUntil(value) {
+        return Math.round((new Date(value).getTime() - Date.now()) / 60000);
+    }
+}
diff --git a/addon/components/tracking-page/map.hbs b/addon/components/tracking-page/map.hbs
new file mode 100644
index 000000000..d892939d9
--- /dev/null
+++ b/addon/components/tracking-page/map.hbs
@@ -0,0 +1,32 @@
+<div class="tp-map" role="img" aria-label={{@label}}>
+    <LeafletMap class="tp-map-canvas" @lat={{get this.center 0}} @lng={{get this.center 1}} @zoom={{13}} @zoomControl={{false}} @onLoad={{this.setup}} as |layers|>
+        <layers.tile @url={{(leaflet-tile-url)}} />
+        {{#if this.hasRoute}}
+            <layers.polyline @locations={{this.route}} @color="var(--tp-accent)" @weight={{5}} @opacity={{0.9}} />
+        {{/if}}
+        {{#if this.hub}}
+            <layers.marker @location={{this.hub}} @icon={{this.hubIcon}} @keyboard={{false}} />
+        {{/if}}
+        {{#each this.stops as |stop|}}
+            <layers.marker @location={{stop.location}} @icon={{this.stopIcon}} @title={{stop.place.name}} />
+        {{/each}}
+        {{#if this.vehicle}}
+            <layers.marker @location={{this.vehicle}} @icon={{this.vehicleIcon}} @zIndexOffset={{1000}} />
+        {{/if}}
+    </LeafletMap>
+    <div class="tp-map-chip {{if @stale 'tp-map-chip-stale'}}">
+        {{#if @stale}}
+            {{@staleText}}
+        {{else if @live}}
+            <span class="tp-live-dot" aria-hidden="true"></span>{{t "tracking-page.page.live"}}
+        {{else}}
+            {{t "tracking-page.page.map"}}
+        {{/if}}
+    </div>
+    <div class="tp-map-controls">
+        {{#if this.vehicle}}
+            <button type="button" class="tp-map-button" aria-label={{t "tracking-page.page.recenter"}} {{on "click" this.recenter}}><FaIcon @icon="crosshairs" /></button>
+        {{/if}}
+        <button type="button" class="tp-map-button" aria-label={{t "tracking-page.page.fit-route"}} {{on "click" this.fitRoute}}><FaIcon @icon="expand" /></button>
+    </div>
+</div>
diff --git a/addon/components/tracking-page/map.js b/addon/components/tracking-page/map.js
new file mode 100644
index 000000000..1f235122a
--- /dev/null
+++ b/addon/components/tracking-page/map.js
@@ -0,0 +1,100 @@
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { decodePolyline } from '../../utils/tracking-live-source';
+
+/**
+ * The live map on the tracking page: the customer's stops, where the route starts, the
+ * route line when every stop is theirs, and the vehicle while it is on its way to them.
+ * It renders below the status text, so the page reads before the map loads.
+ */
+export default class TrackingPageMapComponent extends Component {
+    map = null;
+
+    get data() {
+        return this.args.data ?? {};
+    }
+
+    get vehicle() {
+        const location = this.data.location;
+
+        return location ? [location.latitude, location.longitude] : null;
+    }
+
+    get stops() {
+        const stops = [];
+        for (const stop of this.data.stops ?? []) {
+            if (stop.place?.latitude && stop.place?.longitude) {
+                stops.push({ ...stop, location: [stop.place.latitude, stop.place.longitude] });
+            }
+        }
+
+        return stops;
+    }
+
+    get hub() {
+        const hub = this.data.map?.hub;
+
+        return hub ? [hub.latitude, hub.longitude] : null;
+    }
+
+    get route() {
+        return decodePolyline(this.data.map?.polyline);
+    }
+
+    get hasRoute() {
+        return this.route.length > 1;
+    }
+
+    get points() {
+        const points = this.stops.map((stop) => stop.location);
+        if (this.vehicle) {
+            points.push(this.vehicle);
+        }
+
+        if (this.hub && points.length < 2) {
+            points.push(this.hub);
+        }
+
+        return points;
+    }
+
+    get center() {
+        return this.vehicle ?? this.points[0] ?? [0, 0];
+    }
+
+    get vehicleIcon() {
+        return L.divIcon({ className: this.args.stale ? 'tp-map-vehicle tp-map-vehicle-stale' : 'tp-map-vehicle', iconSize: [28, 28], iconAnchor: [14, 14] });
+    }
+
+    get stopIcon() {
+        return L.divIcon({ className: 'tp-map-stop', iconSize: [22, 22], iconAnchor: [11, 22] });
+    }
+
+    get hubIcon() {
+        return L.divIcon({ className: 'tp-map-hub', iconSize: [16, 16], iconAnchor: [8, 8] });
+    }
+
+    @action setup({ target }) {
+        this.map = target;
+        this.fitRoute();
+    }
+
+    @action fitRoute() {
+        if (!this.map || this.points.length === 0) {
+            return;
+        }
+
+        if (this.points.length === 1) {
+            this.map.setView(this.points[0], 14);
+            return;
+        }
+
+        this.map.fitBounds(L.latLngBounds(this.points), { padding: [36, 36], maxZoom: 15 });
+    }
+
+    @action recenter() {
+        if (this.map && this.vehicle) {
+            this.map.setView(this.vehicle, 15, { animate: !this.args.reducedMotion });
+        }
+    }
+}
diff --git a/addon/components/tracking-page/order-list.hbs b/addon/components/tracking-page/order-list.hbs
new file mode 100644
index 000000000..ca2010559
--- /dev/null
+++ b/addon/components/tracking-page/order-list.hbs
@@ -0,0 +1,35 @@
+<section class="tp-wide tp-stack" aria-labelledby="tp-orders-title">
+    <div class="tp-stack-xs">
+        <span class="tp-chip"><FaIcon @icon="user" /> {{t "tracking-page.page.chip-account"}}</span>
+        <h1 id="tp-orders-title" class="tp-h1">{{t "tracking-page.page.your-orders"}}</h1>
+    </div>
+    {{#if @isLoading}}
+        <div class="tp-stack-sm" aria-busy="true">
+            <div class="tp-skeleton tp-skeleton-row"></div>
+            <div class="tp-skeleton tp-skeleton-row"></div>
+            <div class="tp-skeleton tp-skeleton-row"></div>
+        </div>
+    {{else if @orders.length}}
+        <ul class="tp-list">
+            {{#each @orders as |order|}}
+                <li>
+                    <button type="button" class="tp-list-row" {{on "click" (fn @onOpen order)}}>
+                        <span class="tp-icon-badge tp-icon-badge-soft" aria-hidden="true"><FaIcon @icon="box" /></span>
+                        <span class="tp-stack-xs tp-grow">
+                            <span class="tp-strong">{{or order.title order.tracking_number}}</span>
+                            <span class="tp-small tp-accent-text">{{t (concat "tracking-page.page.stage-" order.stage)}}</span>
+                            <span class="tp-mono tp-small tp-muted">{{order.tracking_number}}</span>
+                        </span>
+                        <FaIcon @icon="chevron-right" class="tp-muted tp-flip" />
+                    </button>
+                </li>
+            {{/each}}
+        </ul>
+    {{else}}
+        <div class="tp-empty">
+            <FaIcon @icon="box" />
+            <div class="tp-strong">{{t "tracking-page.page.no-orders"}}</div>
+            <div class="tp-small tp-muted">{{t "tracking-page.page.no-orders-help"}}</div>
+        </div>
+    {{/if}}
+</section>
diff --git a/addon/components/tracking-page/public-view.hbs b/addon/components/tracking-page/public-view.hbs
new file mode 100644
index 000000000..1c09d0d51
--- /dev/null
+++ b/addon/components/tracking-page/public-view.hbs
@@ -0,0 +1,60 @@
+<div class="tp-narrow tp-stack">
+    <span class="tp-chip"><FaIcon @icon="lock" /> {{t "tracking-page.page.chip-limited"}}</span>
+
+    <section class="tp-card tp-stack" aria-labelledby="tp-public-status">
+        {{#if @data.stage}}
+            <div class="tp-stack-xs">
+                <div class="tp-eyebrow">{{t "tracking-page.page.status"}}</div>
+                <h1 id="tp-public-status" class="tp-h1">{{t (concat "tracking-page.page.stage-" @data.stage)}}</h1>
+                {{#if @data.last_update_on}}
+                    <div class="tp-muted">{{t "tracking-page.page.last-update" date=@data.last_update_on}}</div>
+                {{/if}}
+            </div>
+            <div class="tp-coarse" aria-hidden="true">
+                <span class="tp-coarse-bar tp-coarse-done"></span>
+                <span class="tp-coarse-bar {{if (or (eq @data.stage 'in_transit') (eq @data.stage 'dispatched') (eq @data.stage 'delivered')) 'tp-coarse-done'}}"></span>
+                <span class="tp-coarse-bar {{if (eq @data.stage 'delivered') 'tp-coarse-done'}}"></span>
+            </div>
+        {{else}}
+            <h1 id="tp-public-status" class="tp-h1">{{t "tracking-page.page.verify-to-see"}}</h1>
+        {{/if}}
+        <div class="tp-row-between tp-top-border">
+            <div class="tp-stack-xs">
+                <span class="tp-small tp-muted">{{t "tracking-page.page.tracking-number"}}</span>
+                <span class="tp-mono tp-strong">{{@data.tracking_number}}</span>
+            </div>
+            <ClickToCopy class="tp-button tp-button-small" @value={{@data.tracking_number}}>{{t "tracking-page.page.copy"}}</ClickToCopy>
+        </div>
+    </section>
+
+    <section class="tp-card tp-card-accent tp-stack" aria-labelledby="tp-verify-title">
+        <span class="tp-icon-badge" aria-hidden="true"><FaIcon @icon="shield-halved" /></span>
+        <div class="tp-stack-xs">
+            <h2 id="tp-verify-title" class="tp-h2">{{t "tracking-page.page.verify-title"}}</h2>
+            <p class="tp-muted">{{t "tracking-page.page.verify-help"}}</p>
+        </div>
+        <div class="tp-row-wrap">
+            <button type="button" class="tp-button tp-button-primary tp-grow" {{on "click" @onVerify}}>{{t "tracking-page.page.verify-button"}}</button>
+            {{#if @data.sign_in}}
+                <a class="tp-button tp-button-secondary tp-grow" href={{@signInUrl}}>{{t "tracking-page.page.sign-in-account"}}</a>
+            {{/if}}
+        </div>
+    </section>
+
+    <div class="tp-locked-grid">
+        {{#each (array "map" "arrival" "details") as |section|}}
+            <div class="tp-locked">
+                <div class="tp-locked-blur" aria-hidden="true">
+                    <div class="tp-skeleton tp-skeleton-title"></div>
+                    <div class="tp-skeleton tp-skeleton-line"></div>
+                    <div class="tp-skeleton tp-skeleton-line"></div>
+                </div>
+                <div class="tp-locked-overlay">
+                    <FaIcon @icon="lock" />
+                    <span class="tp-strong">{{t (concat "tracking-page.page.locked-" section)}}</span>
+                    <button type="button" class="tp-chip tp-chip-button" {{on "click" @onVerify}}>{{t "tracking-page.page.verify-unlock"}}</button>
+                </div>
+            </div>
+        {{/each}}
+    </div>
+</div>
diff --git a/addon/components/tracking-page/verify-panel.hbs b/addon/components/tracking-page/verify-panel.hbs
new file mode 100644
index 000000000..857dbc393
--- /dev/null
+++ b/addon/components/tracking-page/verify-panel.hbs
@@ -0,0 +1,109 @@
+<div class="tp-stack">
+    <span class="tp-icon-badge {{if (eq @step 'success') 'tp-icon-badge-solid'}} {{if (eq @step 'locked') 'tp-icon-badge-warn'}}" aria-hidden="true">
+        {{#if (eq @step "success")}}
+            <FaIcon @icon="check" />
+        {{else if (eq @step "locked")}}
+            <FaIcon @icon="lock" />
+        {{else if (eq @step "none")}}
+            <FaIcon @icon="phone" />
+        {{else}}
+            <FaIcon @icon="shield-halved" />
+        {{/if}}
+    </span>
+
+    {{#if (or (eq @step "choose") (eq @step "sending"))}}
+        <div class="tp-stack-xs">
+            <h1 class="tp-h1">{{t "tracking-page.page.verify-title-short"}}</h1>
+            <p class="tp-muted">{{t "tracking-page.page.verify-choose-help"}}</p>
+        </div>
+        <fieldset class="tp-stack-sm">
+            <legend class="tp-label">{{t "tracking-page.page.send-by"}}</legend>
+            {{#each @channels as |channel|}}
+                <label class="tp-option {{if (eq channel.type @selectedChannel) 'tp-option-selected'}}">
+                    <input type="radio" name="tp-channel" value={{channel.type}} checked={{eq channel.type @selectedChannel}} disabled={{eq @step "sending"}} {{on "change" (fn @onPick channel.type)}} />
+                    <span class="tp-stack-xs">
+                        <span class="tp-strong">{{t (concat "tracking-page.page.channel-" channel.type)}}</span>
+                        <span class="tp-mono tp-muted">{{channel.masked}}</span>
+                    </span>
+                </label>
+            {{/each}}
+        </fieldset>
+        {{#if (eq @message "failed")}}
+            <p class="tp-notice" role="alert">{{t "tracking-page.page.send-failed"}}</p>
+        {{/if}}
+        <button type="button" class="tp-button tp-button-primary" disabled={{eq @step "sending"}} {{on "click" @onSend}}>
+            {{#if (eq @step "sending")}}{{t "tracking-page.page.sending"}}{{else}}{{t "tracking-page.page.send-code"}}{{/if}}
+        </button>
+        <p class="tp-small tp-muted">{{t "tracking-page.page.masked-note"}}</p>
+    {{else if (eq @step "none")}}
+        <div class="tp-stack-xs">
+            <h1 class="tp-h1">{{t "tracking-page.page.no-contact-title"}}</h1>
+            <p class="tp-muted">{{t "tracking-page.page.no-contact-help" name=@company.name}}</p>
+        </div>
+        {{#if @company.support_phone}}
+            <a class="tp-button tp-button-primary" href="tel:{{@company.support_phone}}">{{t "tracking-page.page.call" phone=@company.support_phone}}</a>
+        {{/if}}
+        {{#if @company.support_email}}
+            <a class="tp-button tp-button-secondary" href="mailto:{{@company.support_email}}">{{@company.support_email}}</a>
+        {{/if}}
+    {{else if (eq @step "renew")}}
+        <div class="tp-stack-xs">
+            <h1 class="tp-h1">{{t "tracking-page.page.renew-title"}}</h1>
+            <p class="tp-notice">{{t (concat "tracking-page.page.renew-" (or @message "expired"))}}</p>
+        </div>
+        <button type="button" class="tp-button tp-button-primary" {{on "click" @onSend}}>{{t "tracking-page.page.send-new-code"}}</button>
+    {{else}}
+        <div class="tp-stack-xs">
+            <h1 class="tp-h1">
+                {{#if (eq @step "success")}}{{t "tracking-page.page.verified-title"}}{{else if (eq @step "locked")}}{{t "tracking-page.page.locked-title"}}{{else}}{{t "tracking-page.page.enter-code"}}{{/if}}
+            </h1>
+            <p class="tp-muted">{{t (concat "tracking-page.page.code-sent-" @selectedChannel) masked=@masked}}</p>
+        </div>
+        <div class="tp-otp">
+            <label for="tp-otp-input" class="tp-sr-only">{{t "tracking-page.page.code-label"}}</label>
+            <input
+                id="tp-otp-input"
+                class="tp-otp-input"
+                value={{@code}}
+                inputmode="numeric"
+                autocomplete="one-time-code"
+                pattern="[0-9]*"
+                maxlength="6"
+                disabled={{or (eq @step "locked") (eq @step "success")}}
+                aria-invalid={{if (eq @step "wrong") "true" "false"}}
+                aria-describedby="tp-otp-message"
+                {{on "input" @onCode}}
+            />
+            <div class="tp-otp-boxes" aria-hidden="true">
+                {{#each @boxes as |box|}}
+                    <span class="tp-otp-box {{if box.active 'tp-otp-box-active'}} {{if (eq @step 'wrong') 'tp-otp-box-wrong'}} {{if (eq @step 'success') 'tp-otp-box-success'}} {{if (eq @step 'locked') 'tp-otp-box-locked'}}">{{box.digit}}</span>
+                {{/each}}
+            </div>
+        </div>
+        <div id="tp-otp-message" aria-live="assertive">
+            {{#if (eq @step "sent")}}
+                <p class="tp-small tp-muted">{{t "tracking-page.page.code-expires"}}</p>
+            {{else if (eq @step "wrong")}}
+                <p class="tp-warn-text tp-strong">{{t "tracking-page.page.code-wrong" count=@attemptsLeft}}</p>
+            {{else if (eq @step "locked")}}
+                <p class="tp-notice tp-notice-warn">{{t "tracking-page.page.code-locked" time=@lockText}}</p>
+            {{else if (eq @step "success")}}
+                <p class="tp-accent-text tp-strong">{{t "tracking-page.page.code-success"}}</p>
+            {{/if}}
+        </div>
+        {{#if (or (eq @step "sent") (eq @step "wrong"))}}
+            <div class="tp-row-wrap">
+                {{#if @cooldown}}
+                    <span class="tp-muted tp-touch">{{t "tracking-page.page.resend-in" time=@cooldownText}}</span>
+                {{else}}
+                    <button type="button" class="tp-link-button" {{on "click" @onResend}}>{{t "tracking-page.page.resend"}}</button>
+                {{/if}}
+                {{#if @otherChannel}}
+                    <button type="button" class="tp-link-button" {{on "click" @onSwitch}}>{{t (concat "tracking-page.page.switch-to-" @otherChannel.type)}}</button>
+                {{/if}}
+            </div>
+        {{/if}}
+    {{/if}}
+
+    <p class="tp-small tp-muted">{{t "tracking-page.page.stay-verified" hours=(or @sessionHours 24)}}</p>
+</div>
diff --git a/addon/controllers/settings/tracking-page.js b/addon/controllers/settings/tracking-page.js
index 840b71779..9741e0720 100644
--- a/addon/controllers/settings/tracking-page.js
+++ b/addon/controllers/settings/tracking-page.js
@@ -97,15 +97,15 @@ export default class SettingsTrackingPageController extends Controller {
     }
 
     get orgPageBase() {
-        return `${window.location.origin}/t/`;
+        return `${window.location.origin}/~/track?org=`;
     }
 
     get orgPageUrl() {
-        return `${window.location.origin}/t/${this.config?.org_page?.slug ?? ''}`;
+        return `${window.location.origin}/~/track?org=${encodeURIComponent(this.config?.org_page?.slug ?? '')}`;
     }
 
     get genericPageUrl() {
-        return `${window.location.origin}/track`;
+        return `${window.location.origin}/~/track`;
     }
 
     get slugIsValid() {
diff --git a/addon/extension.js b/addon/extension.js
index 2cc2515a1..3ff47b77f 100644
--- a/addon/extension.js
+++ b/addon/extension.js
@@ -132,16 +132,18 @@ export default {
         // inside the console. Signed-out visitors are sent on to the public route after login;
         // registering the page in the console too shows it to signed-in staff instead of an
         // empty console page.
-        menuService.registerMenuItem(
-            'console',
-            new MenuItem({
-                title: 'Track Order',
-                slug: 'track-order',
-                section: null,
-                view: null,
-                component: new ExtensionComponent('@fleetbase/fleetops-engine', 'order-tracking-lookup'),
-            })
-        );
+        for (const slug of ['track', 'track-order']) {
+            menuService.registerMenuItem(
+                'console',
+                new MenuItem({
+                    title: 'Track Order',
+                    slug,
+                    section: null,
+                    view: null,
+                    component: new ExtensionComponent('@fleetbase/fleetops-engine', 'tracking-page'),
+                })
+            );
+        }
 
         // Register track order button
         menuService.registerMenuItem(
@@ -155,7 +157,23 @@ export default {
                 // btn-auth (ember-ui): the sign-in page's neutral button, matching the
                 // console's "Continue with ..." provider buttons, hover included.
                 wrapperClass: 'btn-block btn-auth',
-                component: new ExtensionComponent('@fleetbase/fleetops-engine', 'order-tracking-lookup'),
+                component: new ExtensionComponent('@fleetbase/fleetops-engine', 'tracking-page'),
+                onClick: (menuItem) => {
+                    universe.transitionMenuItem('virtual', menuItem);
+                },
+            })
+        );
+
+        // The customer tracking page at /~/track (the shared page, or ?org= for a company's own).
+        menuService.registerMenuItem(
+            'auth:login',
+            new MenuItem({
+                title: 'Track',
+                route: 'virtual',
+                slug: 'track',
+                type: 'link',
+                wrapperClass: 'hidden',
+                component: new ExtensionComponent('@fleetbase/fleetops-engine', 'tracking-page'),
                 onClick: (menuItem) => {
                     universe.transitionMenuItem('virtual', menuItem);
                 },
diff --git a/addon/styles/fleetops-engine.css b/addon/styles/fleetops-engine.css
index 1a4d23ee1..0e139a0b2 100644
--- a/addon/styles/fleetops-engine.css
+++ b/addon/styles/fleetops-engine.css
@@ -12526,3 +12526,1180 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     text-align: center;
     font-size: 0.6875rem;
 }
+
+/* Customer tracking page. Colours come from the --tp-* tokens the page sets from its company's branding. */
+.tp-root {
+    display: flex;
+    flex-direction: column;
+    min-height: 100vh;
+    background: var(--tp-bg);
+    color: var(--tp-text);
+    font-size: 1rem;
+    line-height: 1.5;
+}
+
+.tp-root a {
+    color: var(--tp-accent);
+    font-weight: 600;
+}
+
+.tp-root h1,
+.tp-root h2,
+.tp-root h3,
+.tp-root p,
+.tp-root dl,
+.tp-root dd,
+.tp-root figure,
+.tp-root fieldset {
+    margin: 0;
+}
+
+.tp-root fieldset {
+    border: 0;
+    padding: 0;
+}
+
+.tp-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 0.75rem;
+    padding: 0.75rem 1rem;
+    background: var(--tp-surface);
+    border-bottom: 1px solid var(--tp-border);
+}
+
+.tp-brand {
+    display: flex;
+    align-items: center;
+    gap: 0.625rem;
+    min-width: 0;
+}
+
+.tp-brand-logo {
+    height: 2rem;
+    max-width: 8rem;
+    object-fit: contain;
+}
+
+.tp-brand-monogram {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 2rem;
+    height: 2rem;
+    flex: none;
+    border-radius: 0.5rem;
+    background: var(--tp-accent);
+    color: var(--tp-ink);
+    font-size: 0.8125rem;
+    font-weight: 700;
+}
+
+.tp-brand-name {
+    overflow: hidden;
+    font-weight: 700;
+    white-space: nowrap;
+    text-overflow: ellipsis;
+}
+
+.tp-main {
+    flex: 1;
+    width: 100%;
+    max-width: 77.5rem;
+    margin: 0 auto;
+    box-sizing: border-box;
+    padding: 1.25rem 1rem;
+}
+
+.tp-narrow {
+    width: 100%;
+    max-width: 30rem;
+    margin: 0 auto;
+}
+
+.tp-wide {
+    width: 100%;
+    max-width: 55rem;
+    margin: 0 auto;
+}
+
+.tp-stack {
+    display: flex;
+    flex-direction: column;
+    gap: 1.25rem;
+}
+
+.tp-stack-sm {
+    display: flex;
+    flex-direction: column;
+    gap: 0.75rem;
+}
+
+.tp-stack-xs {
+    display: flex;
+    flex-direction: column;
+    gap: 0.25rem;
+    min-width: 0;
+}
+
+.tp-row {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+}
+
+.tp-row-wrap {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 0.5rem 1rem;
+}
+
+.tp-row-between {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 0.75rem;
+}
+
+.tp-row-end {
+    display: flex;
+    justify-content: flex-end;
+    gap: 0.5rem;
+}
+
+.tp-baseline {
+    align-items: baseline;
+}
+
+.tp-grow {
+    flex: 1 1 12rem;
+    min-width: 0;
+}
+
+.tp-self-start {
+    align-self: flex-start;
+}
+
+.tp-top-border {
+    padding-top: 0.75rem;
+    border-top: 1px solid var(--tp-border);
+}
+
+.tp-h1 {
+    font-size: 1.875rem;
+    font-weight: 700;
+    line-height: 1.15;
+    letter-spacing: -0.02em;
+    text-wrap: balance;
+}
+
+.tp-h2 {
+    font-size: 1.375rem;
+    font-weight: 700;
+    line-height: 1.2;
+}
+
+.tp-h3 {
+    font-size: 1.0625rem;
+    font-weight: 700;
+}
+
+.tp-headline {
+    font-size: 2rem;
+    font-weight: 700;
+    line-height: 1.08;
+    letter-spacing: -0.03em;
+    text-wrap: balance;
+}
+
+.tp-subline {
+    font-size: 1.0625rem;
+    font-weight: 500;
+}
+
+.tp-eyebrow {
+    color: var(--tp-muted);
+    font-size: 0.8125rem;
+    font-weight: 600;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+}
+
+.tp-label {
+    font-size: 0.875rem;
+    font-weight: 600;
+}
+
+.tp-small {
+    font-size: 0.875rem;
+}
+
+.tp-muted {
+    color: var(--tp-muted);
+}
+
+.tp-strong {
+    font-weight: 600;
+}
+
+.tp-mono {
+    font-family: ui-monospace, sfmono-regular, menlo, monospace;
+    letter-spacing: 0.02em;
+}
+
+.tp-accent-text {
+    color: var(--tp-accent);
+}
+
+.tp-warn-text {
+    color: var(--tp-warn);
+}
+
+.tp-sr-only {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    overflow: hidden;
+    clip-path: inset(50%);
+}
+
+.tp-touch {
+    display: inline-flex;
+    align-items: center;
+    min-height: 2.75rem;
+}
+
+.tp-card {
+    padding: 1.125rem;
+    border: 1px solid var(--tp-border);
+    border-radius: 1.125rem;
+    background: var(--tp-surface);
+}
+
+.tp-card-tight {
+    padding: 0.75rem 0.875rem;
+    border-radius: 0.875rem;
+}
+
+.tp-card-accent {
+    border: 2px solid var(--tp-accent);
+}
+
+.tp-card-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(min(15rem, 100%), 1fr));
+    gap: 0.75rem;
+}
+
+.tp-input {
+    width: 100%;
+    min-height: 3.25rem;
+    box-sizing: border-box;
+    padding: 0 0.875rem;
+    border: 1.5px solid var(--tp-border);
+    border-radius: 0.75rem;
+    background: var(--tp-surface);
+    color: var(--tp-text);
+    font-size: 1rem;
+}
+
+.tp-textarea {
+    padding: 0.75rem;
+    resize: vertical;
+}
+
+.tp-select {
+    min-height: 2.25rem;
+    padding: 0 0.5rem;
+    border: 1px solid var(--tp-border);
+    border-radius: 0.5rem;
+    background: var(--tp-surface);
+    color: var(--tp-text);
+}
+
+.tp-button {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.5rem;
+    min-height: 3rem;
+    box-sizing: border-box;
+    padding: 0 1rem;
+    border: 1.5px solid var(--tp-border);
+    border-radius: 0.75rem;
+    background: var(--tp-surface);
+    color: var(--tp-text);
+    font-size: 1rem;
+    font-weight: 600;
+    text-align: center;
+    text-decoration: none;
+    cursor: pointer;
+}
+
+.tp-root a.tp-button {
+    color: var(--tp-text);
+}
+
+.tp-button:disabled {
+    cursor: not-allowed;
+    opacity: 0.5;
+}
+
+.tp-button-primary,
+.tp-root a.tp-button-primary {
+    border-color: var(--tp-accent);
+    background: var(--tp-accent);
+    color: var(--tp-ink);
+}
+
+.tp-button-small {
+    min-height: 2.75rem;
+    padding: 0 0.75rem;
+    font-size: 0.875rem;
+}
+
+.tp-link-button {
+    min-height: 2.75rem;
+    padding: 0 0.25rem;
+    border: 0;
+    background: transparent;
+    color: var(--tp-accent);
+    font-size: 0.9375rem;
+    font-weight: 600;
+    cursor: pointer;
+}
+
+.tp-back {
+    display: inline-flex;
+    align-items: center;
+    align-self: flex-start;
+    gap: 0.375rem;
+    min-height: 2.75rem;
+    border: 0;
+    background: transparent;
+    color: var(--tp-text);
+    font-weight: 600;
+    cursor: pointer;
+}
+
+.tp-chip {
+    display: inline-flex;
+    align-items: center;
+    align-self: flex-start;
+    gap: 0.375rem;
+    min-height: 2rem;
+    padding: 0 0.75rem;
+    border: 0;
+    border-radius: 999px;
+    background: var(--tp-surface2);
+    color: var(--tp-text);
+    font-size: 0.8125rem;
+    font-weight: 600;
+}
+
+.tp-chip-accent,
+.tp-chip-button {
+    background: var(--tp-accent-soft);
+    color: var(--tp-accent);
+}
+
+.tp-chip-button {
+    align-self: center;
+    cursor: pointer;
+}
+
+.tp-chip-warn {
+    background: var(--tp-warn-soft);
+    color: var(--tp-warn);
+}
+
+.tp-notice {
+    display: flex;
+    gap: 0.625rem;
+    padding: 0.75rem 0.875rem;
+    border-radius: 0.75rem;
+    background: var(--tp-surface2);
+    font-size: 0.9375rem;
+}
+
+.tp-notice-warn {
+    background: var(--tp-warn-soft);
+}
+
+.tp-icon-badge {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 3rem;
+    height: 3rem;
+    flex: none;
+    border-radius: 0.875rem;
+    background: var(--tp-accent-soft);
+    color: var(--tp-accent);
+}
+
+.tp-icon-badge-solid {
+    background: var(--tp-accent);
+    color: var(--tp-ink);
+}
+
+.tp-icon-badge-warn {
+    background: var(--tp-warn-soft);
+    color: var(--tp-warn);
+}
+
+.tp-icon-badge-soft {
+    width: 2.5rem;
+    height: 2.5rem;
+    border-radius: 0.75rem;
+}
+
+.tp-divider {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    color: var(--tp-muted);
+    font-size: 0.8125rem;
+}
+
+.tp-divider::before,
+.tp-divider::after {
+    content: '';
+    flex: 1;
+    height: 1px;
+    background: var(--tp-border);
+}
+
+.tp-skeleton {
+    border-radius: 0.5rem;
+    background: var(--tp-surface2);
+}
+
+.tp-skeleton-title {
+    width: 55%;
+    height: 1.75rem;
+}
+
+.tp-skeleton-line {
+    width: 80%;
+    height: 0.75rem;
+    margin-top: 0.75rem;
+}
+
+.tp-skeleton-card {
+    height: 9rem;
+    margin-top: 1.25rem;
+    border-radius: 1.125rem;
+}
+
+.tp-skeleton-row {
+    height: 4.5rem;
+    border-radius: 0.875rem;
+}
+
+.tp-coarse {
+    display: grid;
+    grid-template-columns: repeat(3, minmax(0, 1fr));
+    gap: 0.375rem;
+}
+
+.tp-coarse-bar {
+    height: 0.375rem;
+    border-radius: 999px;
+    background: var(--tp-border);
+}
+
+.tp-coarse-done {
+    background: var(--tp-accent);
+}
+
+.tp-locked-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(min(13rem, 100%), 1fr));
+    gap: 0.75rem;
+}
+
+.tp-locked {
+    position: relative;
+    min-height: 9rem;
+    overflow: hidden;
+    border: 1px solid var(--tp-border);
+    border-radius: 1.125rem;
+    background: var(--tp-surface);
+}
+
+.tp-locked-blur {
+    position: absolute;
+    inset: 0;
+    padding: 1.25rem;
+    filter: blur(6px);
+}
+
+.tp-locked-overlay {
+    position: relative;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    gap: 0.5rem;
+    min-height: 9rem;
+    padding: 1rem;
+    text-align: center;
+}
+
+.tp-option {
+    display: flex;
+    align-items: center;
+    gap: 0.875rem;
+    min-height: 4rem;
+    box-sizing: border-box;
+    padding: 0.75rem 1rem;
+    border: 1.5px solid var(--tp-border);
+    border-radius: 0.875rem;
+    background: var(--tp-surface);
+    cursor: pointer;
+}
+
+.tp-option-selected {
+    border: 2px solid var(--tp-accent);
+    background: var(--tp-accent-soft);
+}
+
+.tp-option input {
+    width: 1.25rem;
+    height: 1.25rem;
+    margin: 0;
+    accent-color: var(--tp-accent);
+}
+
+.tp-otp {
+    position: relative;
+    max-width: 23.75rem;
+}
+
+.tp-otp-input {
+    position: absolute;
+    inset: 0;
+    z-index: 1;
+    width: 100%;
+    height: 100%;
+    font-size: 1rem;
+    opacity: 0;
+    cursor: text;
+}
+
+.tp-otp-boxes {
+    display: grid;
+    grid-template-columns: repeat(6, minmax(0, 1fr));
+    gap: 0.5rem;
+}
+
+.tp-otp-box {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 3.625rem;
+    box-sizing: border-box;
+    border: 1.5px solid var(--tp-border);
+    border-radius: 0.75rem;
+    background: var(--tp-surface);
+    font-family: ui-monospace, sfmono-regular, menlo, monospace;
+    font-size: 1.5rem;
+    font-weight: 600;
+}
+
+.tp-otp-box-active {
+    border: 2px solid var(--tp-accent);
+    box-shadow: 0 0 0 4px var(--tp-accent-soft);
+}
+
+.tp-otp-box-wrong {
+    border: 2px solid var(--tp-warn);
+}
+
+.tp-otp-box-success {
+    border-color: var(--tp-accent);
+    background: var(--tp-accent);
+    color: var(--tp-ink);
+}
+
+.tp-otp-box-locked {
+    background: var(--tp-surface2);
+    color: var(--tp-muted);
+}
+
+.tp-full {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr);
+    grid-template-areas: 'chips' 'head' 'map' 'body';
+    gap: 1.125rem;
+}
+
+.tp-full-chips {
+    grid-area: chips;
+}
+
+.tp-full-head {
+    display: flex;
+    flex-direction: column;
+    grid-area: head;
+    gap: 1.125rem;
+    min-width: 0;
+}
+
+.tp-full-map {
+    grid-area: map;
+    min-width: 0;
+}
+
+.tp-full-body {
+    display: flex;
+    flex-direction: column;
+    grid-area: body;
+    gap: 1rem;
+    min-width: 0;
+}
+
+.tp-segmented {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.25rem;
+    align-self: flex-start;
+    padding: 0.25rem;
+    border-radius: 0.75rem;
+    background: var(--tp-surface2);
+}
+
+.tp-segment {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.375rem;
+    min-height: 2.5rem;
+    padding: 0 1rem;
+    border: 0;
+    border-radius: 0.5625rem;
+    background: transparent;
+    color: var(--tp-muted);
+    font-weight: 600;
+    cursor: pointer;
+}
+
+.tp-segment-selected {
+    background: var(--tp-surface);
+    color: var(--tp-text);
+    box-shadow: 0 1px 2px rgba(0, 0, 0, 0.12);
+}
+
+.tp-live {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.375rem;
+    color: var(--tp-accent);
+    font-weight: 600;
+}
+
+.tp-live-dot {
+    width: 0.5rem;
+    height: 0.5rem;
+    border-radius: 999px;
+    background: var(--tp-accent);
+    animation: tp-live-pulse 2s ease-in-out infinite;
+}
+
+@keyframes tp-live-pulse {
+    50% {
+        opacity: 0.35;
+    }
+}
+
+.tp-steps {
+    display: flex;
+    margin: 0;
+    padding: 0;
+    list-style: none;
+}
+
+.tp-step {
+    display: flex;
+    flex: 1 1 0;
+    flex-direction: column;
+    gap: 0.5rem;
+    min-width: 0;
+}
+
+.tp-step-track {
+    display: flex;
+    align-items: center;
+}
+
+.tp-step-dot {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 1.625rem;
+    height: 1.625rem;
+    flex: none;
+    box-sizing: border-box;
+    border: 2px solid var(--tp-border);
+    border-radius: 999px;
+    background: var(--tp-surface);
+    font-size: 0.75rem;
+}
+
+.tp-step-line {
+    flex: 1;
+    height: 3px;
+    margin-inline: 0.25rem;
+    border-radius: 2px;
+    background: var(--tp-border);
+}
+
+.tp-step-done .tp-step-dot {
+    border-color: var(--tp-accent);
+    background: var(--tp-accent);
+    color: var(--tp-ink);
+}
+
+.tp-step-done .tp-step-line {
+    background: var(--tp-accent);
+}
+
+.tp-step-current .tp-step-dot {
+    border: 3px solid var(--tp-accent);
+}
+
+.tp-step-failed .tp-step-dot {
+    border-color: var(--tp-warn);
+    background: var(--tp-warn);
+    color: var(--tp-surface);
+}
+
+.tp-step-stop .tp-step-dot {
+    border-color: var(--tp-neutral);
+    background: var(--tp-neutral);
+    color: var(--tp-surface);
+}
+
+.tp-step-label {
+    padding-inline-end: 0.375rem;
+    font-size: 0.8125rem;
+    font-weight: 600;
+    line-height: 1.25;
+    overflow-wrap: anywhere;
+    hyphens: auto;
+}
+
+.tp-step-todo .tp-step-label {
+    color: var(--tp-muted);
+    font-weight: 500;
+}
+
+.tp-step-failed .tp-step-label {
+    color: var(--tp-warn);
+}
+
+.tp-map {
+    position: relative;
+    height: 17rem;
+    overflow: hidden;
+    border: 1px solid var(--tp-border);
+    border-radius: 1.25rem;
+}
+
+.tp-map-canvas {
+    width: 100%;
+    height: 100%;
+}
+
+.tp-map-chip {
+    position: absolute;
+    inset-block-start: 0.75rem;
+    inset-inline-start: 0.75rem;
+    z-index: 500;
+    display: flex;
+    align-items: center;
+    gap: 0.375rem;
+    min-height: 2rem;
+    padding: 0 0.75rem;
+    border-radius: 999px;
+    background: var(--tp-surface);
+    color: var(--tp-accent);
+    font-size: 0.8125rem;
+    font-weight: 600;
+    box-shadow: 0 1px 4px rgba(0, 0, 0, 0.16);
+}
+
+.tp-map-chip-stale {
+    color: var(--tp-muted);
+}
+
+.tp-map-controls {
+    position: absolute;
+    inset-block-start: 0.75rem;
+    inset-inline-end: 0.75rem;
+    z-index: 500;
+    display: flex;
+    flex-direction: column;
+    gap: 0.5rem;
+}
+
+.tp-map-button {
+    width: 2.75rem;
+    height: 2.75rem;
+    border: 0;
+    border-radius: 0.75rem;
+    background: var(--tp-surface);
+    color: var(--tp-text);
+    box-shadow: 0 1px 4px rgba(0, 0, 0, 0.16);
+    cursor: pointer;
+}
+
+.tp-map-vehicle {
+    border: 3px solid var(--tp-surface);
+    border-radius: 999px;
+    background: var(--tp-accent);
+    box-shadow: 0 0 0 6px var(--tp-accent-soft);
+    transition: transform 1s linear;
+}
+
+.tp-map-vehicle-stale {
+    background: var(--tp-neutral);
+    opacity: 0.5;
+}
+
+.tp-map-stop {
+    border: 3px solid var(--tp-surface);
+    border-radius: 999px 999px 999px 0;
+    background: var(--tp-text);
+    transform: rotate(-45deg);
+}
+
+.tp-map-hub {
+    border: 3px solid var(--tp-text);
+    border-radius: 999px;
+    background: var(--tp-surface);
+}
+
+.tp-eta-time {
+    font-size: 2.25rem;
+    font-weight: 700;
+    line-height: 1;
+    letter-spacing: -0.025em;
+}
+
+.tp-dl {
+    display: flex;
+    flex-direction: column;
+    gap: 0.5rem;
+    font-size: 0.9375rem;
+}
+
+.tp-dl div {
+    display: flex;
+    justify-content: space-between;
+    gap: 0.75rem;
+}
+
+.tp-dl dt {
+    color: var(--tp-muted);
+}
+
+.tp-dl dd {
+    font-weight: 600;
+    text-align: end;
+}
+
+.tp-avatar {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 3rem;
+    height: 3rem;
+    flex: none;
+    border-radius: 999px;
+    background: var(--tp-accent-soft);
+    color: var(--tp-accent);
+    font-size: 1.125rem;
+    font-weight: 700;
+}
+
+.tp-proof-grid {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 0.625rem;
+}
+
+.tp-proof {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    gap: 0.375rem;
+    height: 9.5rem;
+    overflow: hidden;
+    padding: 0;
+    border: 1px solid var(--tp-border);
+    border-radius: 0.875rem;
+    background: var(--tp-surface2);
+    color: var(--tp-muted);
+    cursor: zoom-in;
+}
+
+.tp-proof img {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+}
+
+.tp-proof-empty {
+    cursor: default;
+}
+
+.tp-timeline {
+    display: flex;
+    flex-direction: column;
+    margin: 0;
+    padding: 0;
+    list-style: none;
+}
+
+.tp-timeline-day {
+    padding: 0.375rem 0 0.25rem;
+}
+
+.tp-timeline-entry {
+    display: flex;
+    align-items: baseline;
+    gap: 0.75rem;
+    padding-bottom: 0.875rem;
+}
+
+.tp-timeline-dot {
+    width: 0.75rem;
+    height: 0.75rem;
+    flex: none;
+    box-sizing: border-box;
+    border: 2px solid var(--tp-border);
+    border-radius: 999px;
+}
+
+.tp-timeline-latest .tp-timeline-dot {
+    border-color: var(--tp-accent);
+    background: var(--tp-accent);
+}
+
+.tp-item {
+    display: flex;
+    align-items: center;
+    gap: 0.875rem;
+    padding: 0.75rem 0;
+    border-top: 1px solid var(--tp-border);
+}
+
+.tp-item:first-of-type {
+    border-top: 0;
+}
+
+.tp-item-photo {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 3.5rem;
+    height: 3.5rem;
+    flex: none;
+    overflow: hidden;
+    border-radius: 0.75rem;
+    background: var(--tp-surface2);
+    color: var(--tp-muted);
+}
+
+.tp-item-photo img {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+}
+
+.tp-actions {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(min(10rem, 100%), 1fr));
+    gap: 0.5rem;
+}
+
+.tp-list {
+    display: flex;
+    flex-direction: column;
+    gap: 0.625rem;
+    margin: 0;
+    padding: 0;
+    list-style: none;
+}
+
+.tp-list-row {
+    display: flex;
+    align-items: center;
+    gap: 0.875rem;
+    width: 100%;
+    min-height: 4.75rem;
+    box-sizing: border-box;
+    padding: 0.875rem 1rem;
+    border: 1px solid var(--tp-border);
+    border-radius: 0.875rem;
+    background: var(--tp-surface);
+    color: var(--tp-text);
+    text-align: start;
+    cursor: pointer;
+}
+
+.tp-empty {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 0.5rem;
+    padding: 2.5rem 1.25rem;
+    border: 1.5px dashed var(--tp-border);
+    border-radius: 1rem;
+    text-align: center;
+}
+
+.tp-footer {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 0.75rem;
+    padding: 1.5rem 1.25rem 2rem;
+    color: var(--tp-muted);
+    font-size: 0.8125rem;
+    text-align: center;
+}
+
+.tp-footer-language {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+}
+
+.tp-toast-region {
+    position: fixed;
+    inset-inline: 1rem;
+    bottom: 1.25rem;
+    z-index: 1000;
+    display: flex;
+    justify-content: center;
+    pointer-events: none;
+}
+
+.tp-toast {
+    display: flex;
+    align-items: flex-start;
+    gap: 0.75rem;
+    width: 100%;
+    max-width: 27.5rem;
+    padding: 0.875rem 1rem;
+    border-radius: 0.875rem;
+    background: var(--tp-text);
+    color: var(--tp-bg);
+    box-shadow: 0 10px 30px rgba(0, 0, 0, 0.22);
+    pointer-events: auto;
+}
+
+.tp-toast-title {
+    font-weight: 600;
+}
+
+.tp-toast-text {
+    font-size: 0.875rem;
+    opacity: 0.85;
+}
+
+.tp-toast-close {
+    margin-inline-start: auto;
+    border: 0;
+    background: transparent;
+    color: inherit;
+    cursor: pointer;
+}
+
+.tp-lightbox {
+    position: fixed;
+    inset: 0;
+    z-index: 1100;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 1.25rem;
+    background: rgba(8, 12, 13, 0.8);
+}
+
+.tp-lightbox-close {
+    position: absolute;
+    inset-block-start: 1rem;
+    inset-inline-end: 1rem;
+    width: 2.75rem;
+    height: 2.75rem;
+    border: 0;
+    border-radius: 999px;
+    background: var(--tp-surface);
+    color: var(--tp-text);
+    cursor: pointer;
+}
+
+.tp-lightbox-figure {
+    display: flex;
+    flex-direction: column;
+    gap: 0.75rem;
+    max-width: 40rem;
+    color: var(--tp-ink);
+    text-align: center;
+}
+
+.tp-lightbox-figure img {
+    max-width: 100%;
+    max-height: 75vh;
+    border-radius: 1rem;
+    background: var(--tp-surface);
+}
+
+.tp-root[dir='rtl'] .tp-flip {
+    transform: scaleX(-1);
+}
+
+@media (width >= 960px) {
+    .tp-main {
+        padding: 2rem;
+    }
+
+    .tp-headline {
+        font-size: 2.75rem;
+    }
+
+    .tp-full-with-map {
+        grid-template-columns: minmax(0, 1fr) minmax(0, 1.15fr);
+        grid-template-areas: 'chips chips' 'head map' 'body map';
+        gap: 1.25rem 2rem;
+        align-items: start;
+    }
+
+    .tp-full-with-map .tp-full-map {
+        position: sticky;
+        top: 1.5rem;
+    }
+
+    .tp-full-with-map .tp-map {
+        height: 40rem;
+    }
+
+    .tp-full:not(.tp-full-with-map) {
+        max-width: 47.5rem;
+        margin: 0 auto;
+    }
+}
+
+@media (prefers-reduced-motion: reduce) {
+    .tp-live-dot,
+    .tp-map-vehicle {
+        animation: none;
+        transition: none;
+    }
+}
diff --git a/addon/utils/tracking-live-source.js b/addon/utils/tracking-live-source.js
new file mode 100644
index 000000000..32c17d484
--- /dev/null
+++ b/addon/utils/tracking-live-source.js
@@ -0,0 +1,123 @@
+/**
+ * Keeps the public tracking page current.
+ *
+ * `start(onUpdate, onState)` calls `load()` on a schedule and hands each result to
+ * `onUpdate`; `onState` hears `live`, `reconnecting` or `paused`. It polls every 20
+ * seconds while the delivery is moving and every 60 otherwise, pauses while the tab is
+ * hidden, and backs off up to 2 minutes when requests fail. A socket source can replace
+ * it later with the same two callbacks.
+ */
+export const ACTIVE_INTERVAL = 20000;
+export const IDLE_INTERVAL = 60000;
+export const MAX_BACKOFF = 120000;
+
+export default class TrackingLiveSource {
+    constructor(load, { isActive = () => true, documentRef = typeof document === 'undefined' ? null : document } = {}) {
+        this.load = load;
+        this.isActive = isActive;
+        this.document = documentRef;
+        this.timer = null;
+        this.failures = 0;
+        this.running = false;
+        this.onVisibility = () => this.visibilityChanged();
+    }
+
+    start(onUpdate, onState = () => {}) {
+        this.onUpdate = onUpdate;
+        this.onState = onState;
+        this.running = true;
+        this.document?.addEventListener('visibilitychange', this.onVisibility);
+        this.schedule();
+    }
+
+    stop() {
+        this.running = false;
+        clearTimeout(this.timer);
+        this.timer = null;
+        this.document?.removeEventListener('visibilitychange', this.onVisibility);
+    }
+
+    get hidden() {
+        return this.document?.visibilityState === 'hidden';
+    }
+
+    get delay() {
+        if (this.failures > 0) {
+            return Math.min(MAX_BACKOFF, ACTIVE_INTERVAL * Math.pow(2, this.failures - 1));
+        }
+
+        return this.isActive() ? ACTIVE_INTERVAL : IDLE_INTERVAL;
+    }
+
+    schedule() {
+        clearTimeout(this.timer);
+        if (!this.running || this.hidden) {
+            return;
+        }
+
+        this.timer = setTimeout(() => this.tick(), this.delay);
+    }
+
+    async tick() {
+        if (!this.running) {
+            return;
+        }
+
+        try {
+            const result = await this.load();
+            this.failures = 0;
+            this.onState('live');
+            this.onUpdate(result);
+        } catch {
+            this.failures += 1;
+            this.onState('reconnecting');
+        }
+
+        this.schedule();
+    }
+
+    visibilityChanged() {
+        if (this.hidden) {
+            clearTimeout(this.timer);
+            this.onState?.('paused');
+            return;
+        }
+
+        this.tick();
+    }
+}
+
+/**
+ * An encoded polyline (precision 5, as Google Routes and OSRM return it) as [lat, lng] pairs.
+ */
+export function decodePolyline(encoded) {
+    if (typeof encoded !== 'string' || encoded === '') {
+        return [];
+    }
+
+    const points = [];
+    let index = 0;
+    let lat = 0;
+    let lng = 0;
+
+    while (index < encoded.length) {
+        const deltas = [];
+        for (let axis = 0; axis < 2; axis++) {
+            let result = 0;
+            let shift = 0;
+            let byte;
+            do {
+                byte = encoded.charCodeAt(index++) - 63;
+                result |= (byte & 0x1f) << shift;
+                shift += 5;
+            } while (byte >= 0x20 && index < encoded.length);
+            deltas.push(result & 1 ? ~(result >> 1) : result >> 1);
+        }
+
+        lat += deltas[0];
+        lng += deltas[1];
+        points.push([lat / 1e5, lng / 1e5]);
+    }
+
+    return points;
+}
diff --git a/app/components/tracking-page.js b/app/components/tracking-page.js
new file mode 100644
index 000000000..d8a4008bb
--- /dev/null
+++ b/app/components/tracking-page.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page';
diff --git a/app/components/tracking-page/full-view.js b/app/components/tracking-page/full-view.js
new file mode 100644
index 000000000..8d06863f6
--- /dev/null
+++ b/app/components/tracking-page/full-view.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/full-view';
diff --git a/app/components/tracking-page/map.js b/app/components/tracking-page/map.js
new file mode 100644
index 000000000..d896cf896
--- /dev/null
+++ b/app/components/tracking-page/map.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/map';
diff --git a/app/components/tracking-page/order-list.js b/app/components/tracking-page/order-list.js
new file mode 100644
index 000000000..ef5e5c7ef
--- /dev/null
+++ b/app/components/tracking-page/order-list.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/order-list';
diff --git a/app/components/tracking-page/public-view.js b/app/components/tracking-page/public-view.js
new file mode 100644
index 000000000..959bcb2c9
--- /dev/null
+++ b/app/components/tracking-page/public-view.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/public-view';
diff --git a/app/components/tracking-page/verify-panel.js b/app/components/tracking-page/verify-panel.js
new file mode 100644
index 000000000..3cbb4e749
--- /dev/null
+++ b/app/components/tracking-page/verify-panel.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/verify-panel';
diff --git a/app/utils/tracking-live-source.js b/app/utils/tracking-live-source.js
new file mode 100644
index 000000000..d29f911a8
--- /dev/null
+++ b/app/utils/tracking-live-source.js
@@ -0,0 +1 @@
+export { default, decodePolyline, ACTIVE_INTERVAL, IDLE_INTERVAL, MAX_BACKOFF } from '@fleetbase/fleetops-engine/utils/tracking-live-source';
diff --git a/server/config/fleetops.php b/server/config/fleetops.php
index 2ae3d6c09..798e4e351 100644
--- a/server/config/fleetops.php
+++ b/server/config/fleetops.php
@@ -88,6 +88,10 @@
         'route_cache_ttl_seconds'          => env('TRACKING_ROUTE_CACHE_TTL_SECONDS', 600),
         'stale_location_threshold_seconds' => env('TRACKING_STALE_LOCATION_THRESHOLD_SECONDS', 300),
         'default_vehicle_speed_kph'        => env('TRACKING_DEFAULT_VEHICLE_SPEED_KPH', 35),
+        // The public tracking page's device-session cookie. `lax` suits a console and API on
+        // the same site (console.example.com and api.example.com); use `none` (sent only over
+        // HTTPS) when they are on different domains.
+        'cookie_same_site'                 => env('TRACKING_COOKIE_SAME_SITE', 'lax'),
     ],
 
     /*
diff --git a/server/migrations/2026_10_08_000001_create_tracking_sessions_tables.php b/server/migrations/2026_10_08_000001_create_tracking_sessions_tables.php
new file mode 100644
index 000000000..66b36fa21
--- /dev/null
+++ b/server/migrations/2026_10_08_000001_create_tracking_sessions_tables.php
@@ -0,0 +1,51 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Device sessions for the public customer tracking page.
+ *
+ * A visitor who enters a correct one-time code gets a device session, carried in an
+ * httpOnly cookie whose value is never stored: `token_hash` is its SHA-256. Each session
+ * holds grants, one per customer within an order (the TrackingScope), so verifying for one
+ * delivery never unlocks another and one customer never sees another's stops.
+ */
+return new class extends Migration {
+    public function up(): void
+    {
+        Schema::create('tracking_sessions', function (Blueprint $table) {
+            $table->increments('id');
+            $table->uuid('uuid')->unique();
+            $table->string('token_hash', 64)->unique();
+            $table->string('ip', 64)->nullable();
+            $table->string('user_agent', 255)->nullable();
+            $table->timestamp('last_seen_at')->nullable();
+            $table->timestamp('expires_at')->nullable()->index();
+            $table->timestamp('revoked_at')->nullable();
+            $table->timestamps();
+        });
+
+        Schema::create('tracking_session_grants', function (Blueprint $table) {
+            $table->increments('id');
+            $table->uuid('uuid')->unique();
+            $table->uuid('tracking_session_uuid')->index();
+            $table->uuid('company_uuid')->nullable()->index();
+            $table->uuid('order_uuid');
+            $table->string('customer_type');
+            $table->uuid('customer_uuid');
+            $table->string('channel', 16)->nullable();
+            $table->timestamp('expires_at')->nullable()->index();
+            $table->timestamps();
+
+            $table->index(['tracking_session_uuid', 'order_uuid', 'customer_uuid'], 'tracking_session_grants_scope_index');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('tracking_session_grants');
+        Schema::dropIfExists('tracking_sessions');
+    }
+};
diff --git a/server/src/Http/Controllers/Public/TrackingController.php b/server/src/Http/Controllers/Public/TrackingController.php
new file mode 100644
index 000000000..eaba4c722
--- /dev/null
+++ b/server/src/Http/Controllers/Public/TrackingController.php
@@ -0,0 +1,517 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Controllers\Public;
+
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingChannel;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingAccess;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingRecipient;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingResolver;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingTarget;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingView;
+use Fleetbase\FleetOps\Support\TrackingPublisher;
+use Fleetbase\FleetOps\Support\TrackingScope;
+use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\Models\Company;
+use Fleetbase\Models\Setting;
+use Fleetbase\Models\VerificationCode;
+use Fleetbase\Services\SmsService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\Mail;
+use Symfony\Component\HttpFoundation\Cookie;
+
+/**
+ * The public customer tracking page's API.
+ *
+ * A tracking number alone gives level 0. A device that entered a correct one-time code
+ * gets level 1 for one customer within the order; a signed-in customer gets level 2;
+ * staff of the owning company see the customer's view. Unknown, malformed, opted-out,
+ * other-company and throttled lookups all get the same 404, so a caller can't tell
+ * which one they hit.
+ *
+ * `?org={slug}` on any route scopes it to that company's own page.
+ */
+class TrackingController extends Controller
+{
+    public const NOT_FOUND = 'We can\'t show tracking for that number. Check it matches your email or parcel label and try again.';
+
+    public function __construct(
+        protected ?TrackingResolver $resolver = null,
+        protected ?TrackingAccess $access = null,
+        protected ?TrackingView $view = null,
+    ) {
+        $this->resolver ??= new TrackingResolver();
+        $this->access ??= new TrackingAccess();
+        $this->view ??= new TrackingView();
+    }
+
+    /**
+     * The page's branding and what it offers, before any lookup.
+     */
+    public function config(Request $request): JsonResponse
+    {
+        $slug = $this->slug($request);
+        if ($slug !== null) {
+            $companyUuid = $this->resolver->companyForSlug($slug);
+            if ($companyUuid === null) {
+                return $this->json(['error' => 'page_not_found'], 404);
+            }
+
+            $config = $this->resolver->config($companyUuid);
+
+            return $this->json([
+                'company'       => $this->view->branding($config, $this->findCompany($companyUuid)),
+                'org'           => $slug,
+                'sign_in'       => $this->signInOffered($config),
+                'session_hours' => $config['access']['session_hours'],
+            ]);
+        }
+
+        $admin = $this->resolver->adminConfig();
+        if (!$admin['generic_page']['enabled']) {
+            return $this->json(['error' => 'page_not_found'], 404);
+        }
+
+        return $this->json([
+            'company'       => $this->view->branding(['branding' => $admin['branding']], null, $this->instanceLogo()),
+            'org'           => null,
+            'sign_in'       => $this->customerPortalInstalled(),
+            'session_hours' => 24,
+        ]);
+    }
+
+    public function show(Request $request, string $number): JsonResponse
+    {
+        if (!$this->access->allowLookup($request)) {
+            return $this->notFound();
+        }
+
+        $target = $this->resolve($request, $number);
+
+        return $target ? $this->json($this->payload($request, $target)) : $this->notFound();
+    }
+
+    public function sendCode(Request $request, string $number): JsonResponse
+    {
+        $target = $this->resolve($request, $number);
+        if (!$target) {
+            return $this->notFound();
+        }
+
+        $recipient = $this->recipientFor($target);
+        $channel   = (string) $request->input('channel');
+        $channels  = collect($recipient->channels($target->config, $this->smsAvailable()));
+        $selected  = $channels->firstWhere('type', $channel);
+        if (!$target->scope || !$selected) {
+            return $this->json(['error' => 'channel_unavailable'], 422);
+        }
+
+        $claim = $this->access->claimSend($target->scope, $request);
+        if ($claim['status'] !== TrackingAccess::SEND_SENT) {
+            return $this->json(['error' => $claim['status'], 'retry_after' => $claim['retry_after']], $claim['status'] === TrackingAccess::SEND_PAUSED ? 423 : 429);
+        }
+
+        $code = $this->access->issueCode($target->scope, $recipient->customer, $channel);
+        $this->deliver($channel, (string) $recipient->destination($channel), (string) $code->plainCode, $target);
+
+        return $this->json([
+            'channel'      => $channel,
+            'masked'       => $selected['masked'],
+            'expires_in'   => TrackingAccess::CODE_MINUTES * 60,
+            'resend_after' => $claim['retry_after'],
+        ], 202);
+    }
+
+    public function verifyCode(Request $request, string $number): JsonResponse
+    {
+        if (!$this->access->allowVerify($request)) {
+            return $this->json(['error' => 'limited', 'retry_after' => TrackingAccess::LOOKUP_WINDOW], 429);
+        }
+
+        $target = $this->resolve($request, $number);
+        if (!$target || !$target->scope) {
+            return $this->notFound();
+        }
+
+        if ($paused = $this->access->pausedFor($target->scope)) {
+            return $this->json(['error' => 'paused', 'retry_after' => $paused], 423);
+        }
+
+        $result = $this->access->checkCode($target->scope, preg_replace('/\D/', '', (string) $request->input('code')));
+
+        return match ($result['status']) {
+            VerificationCode::CHECK_VALID   => $this->verified($request, $target, $result['channel'] ?? null),
+            VerificationCode::CHECK_LOCKED  => $this->json(['error' => 'paused', 'retry_after' => TrackingAccess::PAUSE_SECONDS], 423),
+            VerificationCode::CHECK_EXPIRED => $this->json(['error' => 'expired'], 410),
+            default                         => $this->json(['error' => 'invalid', 'attempts_left' => $result['attempts_left']], 422),
+        };
+    }
+
+    /**
+     * Sign this device out: of one delivery with `?number=`, otherwise of every one.
+     */
+    public function signOut(Request $request): JsonResponse
+    {
+        $number = $request->input('number');
+        $target = $number ? $this->resolve($request, $number) : null;
+        $cookie = $this->access->revoke($request, $target?->scope);
+
+        return $this->json(['status' => 'signed_out'], 200, $cookie);
+    }
+
+    public function updateInstructions(Request $request, string $number): JsonResponse
+    {
+        $target = $this->resolve($request, $number);
+        $viewer = $target ? $this->viewerFor($request, $target) : null;
+        if (!$target || !$viewer || !$target->scope) {
+            return $this->notFound();
+        }
+
+        if (!data_get($target->config, 'visibility.instructions_edit', false)) {
+            return $this->json(['error' => 'not_allowed'], 403);
+        }
+
+        $text = trim(mb_substr((string) $request->input('text', ''), 0, 500));
+        $this->saveInstructions($target->order, $target->scope, $text);
+
+        return $this->json($this->payload($request, $target));
+    }
+
+    public function proof(Request $request, string $number, string $id): JsonResponse
+    {
+        $target = $this->resolve($request, $number);
+        if (!$target || !$this->viewerFor($request, $target)) {
+            return $this->notFound();
+        }
+
+        $proof = $this->view->proofFor($target, $id);
+        if (!$proof) {
+            return $this->json(['error' => 'not_found'], 404);
+        }
+
+        $url = data_get($proof, 'file.url') ?? (is_string($proof->raw_data) && $proof->raw_data !== '' ? $this->dataUrl($proof->raw_data) : null);
+
+        return $url ? $this->json(['url' => $url, 'type' => TrackingView::proofType($proof)]) : $this->json(['error' => 'not_found'], 404);
+    }
+
+    public function report(Request $request, string $number): JsonResponse
+    {
+        $target = $this->resolve($request, $number);
+        if (!$target || !$this->viewerFor($request, $target)) {
+            return $this->notFound();
+        }
+
+        $branding = $this->brandingFor($target);
+        $to       = $branding['support_email'];
+        $message  = trim(mb_substr((string) $request->input('message', ''), 0, 1000));
+        if (!data_get($target->config, 'visibility.report_problem', true) || !$to || $message === '') {
+            return $this->json(['error' => 'not_allowed'], 422);
+        }
+
+        if (!$this->access->allowReport($request, (string) $target->order->uuid)) {
+            return $this->json(['error' => 'limited'], 429);
+        }
+
+        $this->sendReport($to, $target, $message);
+
+        return $this->json(['status' => 'sent'], 202);
+    }
+
+    public function socketToken(Request $request, string $number): JsonResponse
+    {
+        $target = $this->resolve($request, $number);
+        if (!$target || !$target->scope || !$this->viewerFor($request, $target) || !$this->socketsEnabled()) {
+            return $this->notFound();
+        }
+
+        return $this->json($this->socketTokenFor($target->scope));
+    }
+
+    /**
+     * A signed-in customer's orders, newest first.
+     */
+    public function accountOrders(Request $request): JsonResponse
+    {
+        $contacts = $this->contactsFor($this->requestUser($request));
+        if ($contacts === []) {
+            return $this->json(['error' => 'unauthenticated'], 401);
+        }
+
+        return $this->json(['orders' => $this->ordersForContacts($contacts)]);
+    }
+
+    protected function payload(Request $request, TrackingTarget $target): array
+    {
+        $branding = $this->brandingFor($target);
+        $viewer   = $this->viewerFor($request, $target);
+
+        if ($viewer) {
+            $expiresAt = $viewer === TrackingView::VIEWER_VERIFIED ? $this->access->grantExpiresAt($request, $target->scope) : null;
+
+            return $this->view->fullView($target, $branding, $viewer, $expiresAt);
+        }
+
+        $channels = $target->scope ? $this->recipientFor($target)->channels($target->config, $this->smsAvailable()) : [];
+
+        return $this->view->publicView($target, $branding, $channels, $this->signInOffered($target->config));
+    }
+
+    protected function verified(Request $request, TrackingTarget $target, ?string $channel): JsonResponse
+    {
+        $hours  = (int) data_get($target->config, 'access.session_hours', 24);
+        $cookie = $this->access->grant($request, $target->scope, $channel, $hours);
+        $data   = $this->view->fullView($target, $this->brandingFor($target), TrackingView::VIEWER_VERIFIED, now()->addHours($hours)->toISOString());
+
+        return $this->json($data, 200, $cookie);
+    }
+
+    /**
+     * Who is looking: staff of the owning company, a signed-in customer of this delivery,
+     * or a device verified for it; null for a visitor with only the tracking number.
+     */
+    protected function viewerFor(Request $request, TrackingTarget $target): ?string
+    {
+        $user = $this->requestUser($request);
+        if ($user && data_get($user, 'type') !== 'customer' && data_get($user, 'company_uuid') === $target->companyUuid()) {
+            return TrackingView::VIEWER_STAFF;
+        }
+
+        if ($user && $target->scope && in_array($target->scope->customer_uuid, $this->contactsFor($user), true)) {
+            return TrackingView::VIEWER_ACCOUNT;
+        }
+
+        return $this->access->hasGrant($request, $target->scope) ? TrackingView::VIEWER_VERIFIED : null;
+    }
+
+    protected function resolve(Request $request, mixed $number): ?TrackingTarget
+    {
+        return $this->resolver->resolve($number, $this->slug($request));
+    }
+
+    protected function slug(Request $request): ?string
+    {
+        $slug = $request->input('org');
+
+        return is_string($slug) && trim($slug) !== '' ? strtolower(trim($slug)) : null;
+    }
+
+    protected function brandingFor(TrackingTarget $target): array
+    {
+        return $this->view->branding($target->config, $this->findCompany($target->companyUuid()));
+    }
+
+    protected function signInOffered(array $config): bool
+    {
+        return (bool) data_get($config, 'access.account_sign_in', true) && $this->customerPortalInstalled();
+    }
+
+    protected function recipientFor(TrackingTarget $target): TrackingRecipient
+    {
+        return TrackingRecipient::for($target->scope, $this->fallbackPhone($target));
+    }
+
+    protected function fallbackPhone(TrackingTarget $target): ?string
+    {
+        return data_get($target->waypoint, 'place.phone') ?? data_get($target->order, 'payload.dropoff.phone');
+    }
+
+    protected function deliver(string $channel, string $destination, string $code, TrackingTarget $target): void
+    {
+        $name    = $this->brandingFor($target)['name'] ?? 'Your delivery';
+        $message = $code . ' is your ' . $name . ' delivery code. It expires in ' . TrackingAccess::CODE_MINUTES . ' minutes.';
+
+        if ($channel === TrackingRecipient::CHANNEL_SMS) {
+            $this->sendSms($destination, $message, $target);
+
+            return;
+        }
+
+        $this->sendEmail($destination, $code . ' is your ' . $name . ' delivery code', $message);
+    }
+
+    protected function saveInstructions(Order $order, TrackingScope $scope, string $text): void
+    {
+        $instructions                      = (array) $order->getMeta('recipient_instructions', []);
+        $instructions[sha1($scope->key())] = $text;
+        $order->setMeta('recipient_instructions', $instructions);
+        $order->saveQuietly();
+    }
+
+    protected function dataUrl(string $raw): string
+    {
+        return str_starts_with($raw, 'data:') ? $raw : 'data:image/png;base64,' . $raw;
+    }
+
+    protected function notFound(): JsonResponse
+    {
+        return $this->json(['error' => self::NOT_FOUND, 'code' => 'not_found'], 404);
+    }
+
+    protected function json(array $data, int $status = 200, ?Cookie $cookie = null): JsonResponse
+    {
+        $response = new JsonResponse($data, $status);
+        if ($cookie) {
+            $response->headers->setCookie($cookie);
+        }
+
+        return $response;
+    }
+
+    /**
+     * Whether the instance can send SMS. Twilio is listed as always available, so it counts
+     * only with credentials; other providers report their own configuration.
+     */
+    protected function smsAvailable(): bool
+    {
+        if (filled(config('services.twilio.sid')) && filled(config('services.twilio.token'))) {
+            return true;
+        }
+
+        return collect($this->smsProviders())
+            ->except(SmsService::PROVIDER_TWILIO)
+            ->contains(fn ($provider) => (bool) data_get($provider, 'available'));
+    }
+
+    /**
+     * The contact uuids a signed-in customer user acts as.
+     *
+     * @return array<int, string>
+     */
+    protected function contactsFor(mixed $user): array
+    {
+        if (!$user || data_get($user, 'type') !== 'customer' || !data_get($user, 'uuid')) {
+            return [];
+        }
+
+        return $this->contactUuidsForUser((string) data_get($user, 'uuid'));
+    }
+
+    protected function contactUuidsForUser(string $userUuid): array
+    {
+        return Contact::withoutGlobalScopes()->where('user_uuid', $userUuid)->pluck('uuid')->all();
+    }
+
+    /**
+     * Each order a customer is on, with the tracking number that opens their part of it.
+     *
+     * @param array<int, string> $contacts
+     */
+    protected function ordersForContacts(array $contacts): array
+    {
+        $payloads = Waypoint::withoutGlobalScopes()->whereIn('customer_uuid', $contacts)->pluck('payload_uuid')->filter()->unique()->values()->all();
+        $orders   = Order::withoutGlobalScopes()
+            ->with(['trackingNumber'])
+            ->where(fn ($query) => $query->whereIn('customer_uuid', $contacts)->orWhereIn('payload_uuid', $payloads))
+            ->latest()
+            ->limit(50)
+            ->get();
+
+        return $orders->map(function (Order $order) use ($contacts) {
+            $waypoint = in_array($order->customer_uuid, $contacts, true) ? null : Waypoint::withoutGlobalScopes()->with('trackingNumber')->where('payload_uuid', $order->payload_uuid)->whereIn('customer_uuid', $contacts)->first();
+            $first    = Entity::withoutGlobalScopes()->where('payload_uuid', $order->payload_uuid)->value('name');
+
+            return [
+                'tracking_number' => $waypoint ? data_get($waypoint, 'trackingNumber.tracking_number') : data_get($order, 'trackingNumber.tracking_number'),
+                'title'           => $first,
+                'status'          => $order->status,
+                'stage'           => $this->view->stage($order, null),
+                'updated_at'      => $order->updated_at ? $order->updated_at->toISOString() : null,
+            ];
+        })->filter(fn ($row) => !empty($row['tracking_number']))->values()->all();
+    }
+
+    protected function findCompany(?string $companyUuid): mixed
+    {
+        return $companyUuid ? Company::where('uuid', $companyUuid)->first() : null;
+    }
+
+    protected function sendSms(string $phone, string $message, TrackingTarget $target): void
+    {
+        $company = $this->findCompany($target->companyUuid());
+        $options = [];
+        if (data_get($company, 'options.alpha_numeric_sender_id_enabled') && data_get($company, 'options.alpha_numeric_sender_id')) {
+            $options['twilioParams'] = ['from' => data_get($company, 'options.alpha_numeric_sender_id')];
+        }
+
+        $this->smsService()->send($phone, $message, $options);
+    }
+
+    protected function sendEmail(string $email, string $subject, string $message): void
+    {
+        $this->mail($email, $subject, $message);
+    }
+
+    protected function sendReport(string $to, TrackingTarget $target, string $message): void
+    {
+        $number = $target->trackingNumber->tracking_number;
+
+        $this->mail($to, 'Problem reported for ' . $number, 'A customer reported a problem with delivery ' . $number . ":\n\n" . $message);
+    }
+
+    protected function socketsEnabled(): bool
+    {
+        return TrackingPublisher::enabled();
+    }
+
+    // Environment seams: tests replace these.
+
+    protected function socketTokenFor(TrackingScope $scope): array
+    {
+        // @codeCoverageIgnoreStart
+        // Signs with the instance's socket auth key.
+        return TrackingChannel::token($scope);
+        // @codeCoverageIgnoreEnd
+    }
+
+    protected function mail(string $to, string $subject, string $body): void
+    {
+        // @codeCoverageIgnoreStart
+        Mail::raw($body, fn ($mail) => $mail->to($to)->subject($subject));
+        // @codeCoverageIgnoreEnd
+    }
+
+    protected function smsService(): SmsService
+    {
+        // @codeCoverageIgnoreStart
+        return app(SmsService::class);
+        // @codeCoverageIgnoreEnd
+    }
+
+    protected function smsProviders(): array
+    {
+        // @codeCoverageIgnoreStart
+        return (new SmsService())->getAvailableProviders();
+        // @codeCoverageIgnoreEnd
+    }
+
+    protected function requestUser(Request $request): mixed
+    {
+        // @codeCoverageIgnoreStart
+        // A signed-in console or customer-portal user, from the bearer token the page sends.
+        try {
+            return auth('sanctum')->user();
+        } catch (\Throwable) {
+            return null;
+        }
+        // @codeCoverageIgnoreEnd
+    }
+
+    protected function customerPortalInstalled(): bool
+    {
+        // @codeCoverageIgnoreStart
+        return collect(Utils::getInstalledFleetbaseExtensions())->contains(fn ($package) => data_get($package, 'name') === 'fleetbase/customer-portal-api');
+        // @codeCoverageIgnoreEnd
+    }
+
+    protected function instanceLogo(): ?string
+    {
+        // @codeCoverageIgnoreStart
+        return data_get(Setting::getBranding(), 'logo_url');
+        // @codeCoverageIgnoreEnd
+    }
+}
diff --git a/server/src/Http/Resources/v1/TrackingNumber.php b/server/src/Http/Resources/v1/TrackingNumber.php
index 2f5c62ef6..6522ecd7f 100644
--- a/server/src/Http/Resources/v1/TrackingNumber.php
+++ b/server/src/Http/Resources/v1/TrackingNumber.php
@@ -38,7 +38,7 @@ public function toArray($request)
             // Labels printed before it encode the owner uuid; resolvers accept both.
             'qr_code_content' => $this->when($this->tracking_number, fn () => TrackingCode::qrContent($this->tracking_number, Utils::get($this->owner, 'public_id'))),
             'barcode'         => $this->barcode,
-            'url'             => Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->tracking_number]),
+            'url'             => TrackingCode::pageUrl($this->tracking_number, $this->company_uuid),
             'type'            => Utils::getTypeFromClassName($this->owner_type),
             'updated_at'      => $this->updated_at,
             'created_at'      => $this->created_at,
diff --git a/server/src/Models/TrackingSession.php b/server/src/Models/TrackingSession.php
new file mode 100644
index 000000000..d1d50f29e
--- /dev/null
+++ b/server/src/Models/TrackingSession.php
@@ -0,0 +1,33 @@
+<?php
+
+namespace Fleetbase\FleetOps\Models;
+
+use Fleetbase\Models\Model;
+use Fleetbase\Traits\HasUuid;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+/**
+ * A device that has verified on the public tracking page. The cookie's value is never
+ * stored, only its SHA-256 in `token_hash`.
+ */
+class TrackingSession extends Model
+{
+    use HasUuid;
+
+    protected $table = 'tracking_sessions';
+
+    protected $fillable = ['token_hash', 'ip', 'user_agent', 'last_seen_at', 'expires_at', 'revoked_at'];
+
+    protected $casts = [
+        'last_seen_at' => 'datetime',
+        'expires_at'   => 'datetime',
+        'revoked_at'   => 'datetime',
+    ];
+
+    protected $hidden = ['token_hash'];
+
+    public function grants(): HasMany
+    {
+        return $this->hasMany(TrackingSessionGrant::class, 'tracking_session_uuid', 'uuid');
+    }
+}
diff --git a/server/src/Models/TrackingSessionGrant.php b/server/src/Models/TrackingSessionGrant.php
new file mode 100644
index 000000000..4f41f4390
--- /dev/null
+++ b/server/src/Models/TrackingSessionGrant.php
@@ -0,0 +1,22 @@
+<?php
+
+namespace Fleetbase\FleetOps\Models;
+
+use Fleetbase\Models\Model;
+use Fleetbase\Traits\HasUuid;
+
+/**
+ * What a verified device may see: one customer within one order, until `expires_at`.
+ */
+class TrackingSessionGrant extends Model
+{
+    use HasUuid;
+
+    protected $table = 'tracking_session_grants';
+
+    protected $fillable = ['tracking_session_uuid', 'company_uuid', 'order_uuid', 'customer_type', 'customer_uuid', 'channel', 'expires_at'];
+
+    protected $casts = [
+        'expires_at' => 'datetime',
+    ];
+}
diff --git a/server/src/Notifications/OrderAssigned.php b/server/src/Notifications/OrderAssigned.php
index d1648d93a..797b0fd28 100644
--- a/server/src/Notifications/OrderAssigned.php
+++ b/server/src/Notifications/OrderAssigned.php
@@ -129,7 +129,7 @@ public function toMail($notifiable)
             $message->line('Dispatch is scheduled for ' . $this->order->scheduled_at);
         }
 
-        $message->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->order->trackingNumber->tracking_number]));
+        $message->action('Track Order', TrackingCode::pageUrl($this->order->trackingNumber->tracking_number, data_get($this, 'order.company_uuid')));
 
         return $message;
     }
diff --git a/server/src/Notifications/OrderCanceled.php b/server/src/Notifications/OrderCanceled.php
index 05153856f..a1827295b 100644
--- a/server/src/Notifications/OrderCanceled.php
+++ b/server/src/Notifications/OrderCanceled.php
@@ -139,7 +139,7 @@ public function toMail($notifiable)
             ->line($this->message)
             ->line($this->reason)
             ->line('No further action is necessary.')
-            ->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->getTrackingNumber()]));
+            ->action('Track Order', TrackingCode::pageUrl($this->getTrackingNumber(), data_get($this, 'order.company_uuid')));
     }
 
     /**
diff --git a/server/src/Notifications/OrderCompleted.php b/server/src/Notifications/OrderCompleted.php
index b3fc1736a..59428b8e1 100644
--- a/server/src/Notifications/OrderCompleted.php
+++ b/server/src/Notifications/OrderCompleted.php
@@ -132,7 +132,7 @@ public function toMail($notifiable)
             ->subject($this->title)
             ->line($this->message)
             ->line('No further action is necessary.')
-            ->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->getTrackingNumber()]));
+            ->action('Track Order', TrackingCode::pageUrl($this->getTrackingNumber(), data_get($this, 'order.company_uuid')));
     }
 
     /**
diff --git a/server/src/Notifications/OrderDispatchFailed.php b/server/src/Notifications/OrderDispatchFailed.php
index 3ba38457d..eddcb86f0 100644
--- a/server/src/Notifications/OrderDispatchFailed.php
+++ b/server/src/Notifications/OrderDispatchFailed.php
@@ -128,6 +128,6 @@ public function toMail($notifiable)
         return (new MailMessage())
             ->subject($this->title)
             ->line($this->message)
-            ->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->order->trackingNumber->tracking_number]));
+            ->action('Track Order', TrackingCode::pageUrl($this->order->trackingNumber->tracking_number, data_get($this, 'order.company_uuid')));
     }
 }
diff --git a/server/src/Notifications/OrderDispatched.php b/server/src/Notifications/OrderDispatched.php
index c57eae2c8..c1db4717b 100644
--- a/server/src/Notifications/OrderDispatched.php
+++ b/server/src/Notifications/OrderDispatched.php
@@ -171,7 +171,7 @@ public function toMail($notifiable)
         return (new MailMessage())
             ->subject($this->title)
             ->line($this->message)
-            ->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->getTrackingNumber()]));
+            ->action('Track Order', TrackingCode::pageUrl($this->getTrackingNumber(), data_get($this, 'order.company_uuid')));
     }
 
     /**
diff --git a/server/src/Notifications/OrderFailed.php b/server/src/Notifications/OrderFailed.php
index 010ca0100..705a5bd1d 100644
--- a/server/src/Notifications/OrderFailed.php
+++ b/server/src/Notifications/OrderFailed.php
@@ -139,7 +139,7 @@ public function toMail($notifiable)
             ->line($this->message)
             ->line($this->reason)
             ->line('No further action is necessary.')
-            ->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->getTrackingNumber()]));
+            ->action('Track Order', TrackingCode::pageUrl($this->getTrackingNumber(), data_get($this, 'order.company_uuid')));
     }
 
     /**
diff --git a/server/src/Notifications/WaypointCompleted.php b/server/src/Notifications/WaypointCompleted.php
index 98555072a..d95d5fea8 100644
--- a/server/src/Notifications/WaypointCompleted.php
+++ b/server/src/Notifications/WaypointCompleted.php
@@ -133,7 +133,7 @@ public function toMail($notifiable)
             ->subject($this->title)
             ->line($this->message)
             ->line('No further action is necessary.')
-            ->action('Track Order', Utils::consoleUrl(TrackingCode::PATH, [TrackingCode::TRACKING_PARAM => $this->waypoint->trackingNumber->tracking_number]));
+            ->action('Track Order', TrackingCode::pageUrl($this->waypoint->trackingNumber->tracking_number, data_get($this, 'waypoint.company_uuid')));
     }
 
     /**
diff --git a/server/src/Support/TrackingCode.php b/server/src/Support/TrackingCode.php
index 53d5e7653..8fc6600b0 100644
--- a/server/src/Support/TrackingCode.php
+++ b/server/src/Support/TrackingCode.php
@@ -41,6 +41,27 @@ class TrackingCode
     public const PATH           = '~/track-order';
     public const TRACKING_PARAM = 'order';
 
+    /**
+     * The tracking page link for emails, notifications and the API: the company's own page
+     * when its settings send links there, otherwise the shared page.
+     */
+    public static function pageUrl(string $trackingNumber, ?string $companyUuid = null): string
+    {
+        $query = [static::TRACKING_PARAM => $trackingNumber];
+
+        try {
+            $slug = $companyUuid ? app(TrackingPage\TrackingResolver::class)->linkSlugFor($companyUuid) : null;
+        } catch (\Throwable) {
+            $slug = null;
+        }
+
+        if ($slug) {
+            $query['org'] = $slug;
+        }
+
+        return Utils::consoleUrl(static::PATH, $query);
+    }
+
     /**
      * The QR content for a tracking number.
      */
diff --git a/server/src/Support/TrackingPage/TrackingAccess.php b/server/src/Support/TrackingPage/TrackingAccess.php
new file mode 100644
index 000000000..f6872871a
--- /dev/null
+++ b/server/src/Support/TrackingPage/TrackingAccess.php
@@ -0,0 +1,344 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\TrackingPage;
+
+use Fleetbase\FleetOps\Models\TrackingSession;
+use Fleetbase\FleetOps\Models\TrackingSessionGrant;
+use Fleetbase\FleetOps\Support\TrackingScope;
+use Fleetbase\Models\VerificationCode;
+use Fleetbase\Scopes\ExpiryScope;
+use Illuminate\Cache\RateLimiter;
+use Illuminate\Http\Request;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Str;
+use Symfony\Component\HttpFoundation\Cookie;
+
+/**
+ * One-time codes and device sessions for the public tracking page.
+ *
+ * A code is sent to a scope's recipient and proves the visitor is that customer. A correct
+ * code gives the device a grant for that one customer within that one order. Codes are
+ * stored hashed (VerificationCode::issue()), three wrong codes pause the scope for every
+ * device, and sends are limited per scope and per address.
+ */
+class TrackingAccess
+{
+    public const COOKIE           = 'fb_track';
+    public const CODE_PURPOSE     = 'fleetops_tracking_access';
+    public const CODE_MINUTES     = 10;
+    public const MAX_ATTEMPTS     = 3;
+    public const PAUSE_SECONDS    = 300;
+    public const RESEND_SECONDS   = 30;
+    public const SENDS_PER_SCOPE  = 3;
+    public const SENDS_PER_IP     = 5;
+    public const SEND_WINDOW      = 900;
+    public const LOOKUPS_PER_IP   = 30;
+    public const LOOKUP_WINDOW    = 60;
+    public const VERIFIES_PER_IP  = 10;
+    public const REPORTS_PER_HOUR = 3;
+
+    public const SEND_SENT     = 'sent';
+    public const SEND_COOLDOWN = 'cooldown';
+    public const SEND_LIMITED  = 'limited';
+    public const SEND_PAUSED   = 'paused';
+
+    public function __construct(protected ?RateLimiter $limiter = null)
+    {
+    }
+
+    /**
+     * Whether this address may make another lookup, counting it.
+     */
+    public function allowLookup(Request $request): bool
+    {
+        return $this->attempt('trk-lookup:' . $request->ip(), self::LOOKUPS_PER_IP, self::LOOKUP_WINDOW);
+    }
+
+    /**
+     * Whether this address may check another code, counting it.
+     */
+    public function allowVerify(Request $request): bool
+    {
+        return $this->attempt('trk-verify:' . $request->ip(), self::VERIFIES_PER_IP, self::LOOKUP_WINDOW);
+    }
+
+    /**
+     * Whether this address may report another problem with this order, counting it.
+     */
+    public function allowReport(Request $request, string $orderUuid): bool
+    {
+        return $this->attempt('trk-report:' . $orderUuid . ':' . $request->ip(), self::REPORTS_PER_HOUR, 3600);
+    }
+
+    /**
+     * Whether a scope's codes are paused after too many wrong ones, and for how long.
+     */
+    public function pausedFor(TrackingScope $scope): int
+    {
+        $key = $this->pauseKey($scope);
+
+        return $this->limiter()->tooManyAttempts($key, 1) ? max(1, $this->limiter()->availableIn($key)) : 0;
+    }
+
+    /**
+     * Check the limits for sending a code and, when they allow it, count the send.
+     *
+     * @return array{status: string, retry_after: int}
+     */
+    public function claimSend(TrackingScope $scope, Request $request): array
+    {
+        if ($paused = $this->pausedFor($scope)) {
+            return ['status' => self::SEND_PAUSED, 'retry_after' => $paused];
+        }
+
+        $cooldown = 'trk-resend:' . $scope->key();
+        if ($this->limiter()->tooManyAttempts($cooldown, 1)) {
+            return ['status' => self::SEND_COOLDOWN, 'retry_after' => max(1, $this->limiter()->availableIn($cooldown))];
+        }
+
+        foreach (['trk-send-scope:' . $scope->key() => self::SENDS_PER_SCOPE, 'trk-send-ip:' . $request->ip() => self::SENDS_PER_IP] as $key => $max) {
+            if ($this->limiter()->tooManyAttempts($key, $max)) {
+                return ['status' => self::SEND_LIMITED, 'retry_after' => max(1, $this->limiter()->availableIn($key))];
+            }
+        }
+
+        $this->limiter()->hit($cooldown, self::RESEND_SECONDS);
+        $this->limiter()->hit('trk-send-scope:' . $scope->key(), self::SEND_WINDOW);
+        $this->limiter()->hit('trk-send-ip:' . $request->ip(), self::SEND_WINDOW);
+
+        return ['status' => self::SEND_SENT, 'retry_after' => self::RESEND_SECONDS];
+    }
+
+    /**
+     * A new code for a scope, voiding the scope's earlier unused ones. The plain code is on `plainCode`.
+     */
+    public function issueCode(TrackingScope $scope, mixed $recipient, string $channel): VerificationCode
+    {
+        $this->voidCodes($scope);
+
+        return $this->createCode($recipient, [
+            'expireAfter' => Carbon::now()->addMinutes(self::CODE_MINUTES),
+            'meta'        => [
+                'scope'        => $scope->key(),
+                'channel'      => $channel,
+                'company_uuid' => $scope->company_uuid,
+            ],
+        ]);
+    }
+
+    /**
+     * Check a code for a scope.
+     *
+     * @return array{status: string, attempts_left?: int, channel?: string|null}
+     */
+    public function checkCode(TrackingScope $scope, string $code): array
+    {
+        $verificationCode = $this->latestCode($scope);
+        if (!$verificationCode) {
+            return ['status' => VerificationCode::CHECK_EXPIRED];
+        }
+
+        $result = $verificationCode->check($code, self::MAX_ATTEMPTS);
+        if ($result === VerificationCode::CHECK_VALID) {
+            $channel = $verificationCode->getMeta('channel');
+            $this->deleteCode($verificationCode);
+
+            return ['status' => $result, 'channel' => $channel];
+        }
+
+        if ($result === VerificationCode::CHECK_LOCKED) {
+            $this->limiter()->hit($this->pauseKey($scope), self::PAUSE_SECONDS);
+        }
+
+        return ['status' => $result, 'attempts_left' => $verificationCode->attemptsLeft(self::MAX_ATTEMPTS)];
+    }
+
+    /**
+     * The device session the request's cookie names, when it is live.
+     */
+    public function session(Request $request): ?TrackingSession
+    {
+        $token = $request->cookie(self::COOKIE);
+        if (!is_string($token) || strlen($token) < 32) {
+            return null;
+        }
+
+        $session = $this->findSession(hash('sha256', $token));
+        if (!$session || $session->revoked_at || ($session->expires_at && $session->expires_at->isPast())) {
+            return null;
+        }
+
+        return $session;
+    }
+
+    /**
+     * Whether the request's device holds a live grant for this scope.
+     */
+    public function hasGrant(Request $request, ?TrackingScope $scope): bool
+    {
+        if (!$scope) {
+            return false;
+        }
+
+        $session = $this->session($request);
+
+        return $session !== null && $this->findGrant($session, $scope) !== null;
+    }
+
+    /**
+     * When the device's grant for this scope ends.
+     */
+    public function grantExpiresAt(Request $request, TrackingScope $scope): ?string
+    {
+        $session = $this->session($request);
+        $grant   = $session ? $this->findGrant($session, $scope) : null;
+
+        return $grant?->expires_at?->toISOString();
+    }
+
+    /**
+     * Give the device a grant for a scope, starting a session when it has none.
+     *
+     * @return Cookie|null the cookie to set when a new session was started
+     */
+    public function grant(Request $request, TrackingScope $scope, ?string $channel, int $hours): ?Cookie
+    {
+        $expiresAt = Carbon::now()->addHours($hours);
+        $session   = $this->session($request);
+        $cookie    = null;
+
+        if (!$session) {
+            $token   = Str::random(40);
+            $session = $this->createSession([
+                'token_hash'   => hash('sha256', $token),
+                'ip'           => $request->ip(),
+                'user_agent'   => Str::limit((string) $request->userAgent(), 250, ''),
+                'last_seen_at' => Carbon::now(),
+                'expires_at'   => $expiresAt,
+            ]);
+            $cookie = $this->cookie($token, $hours * 60);
+        } elseif (!$session->expires_at || $session->expires_at->lt($expiresAt)) {
+            $this->saveSession($session, ['expires_at' => $expiresAt, 'last_seen_at' => Carbon::now()]);
+            $cookie = $this->cookie((string) $request->cookie(self::COOKIE), $hours * 60);
+        }
+
+        $this->saveGrant($session, $scope, $channel, $expiresAt);
+
+        return $cookie;
+    }
+
+    /**
+     * Sign the device out: of one scope, or of every scope when none is given.
+     *
+     * @return Cookie|null an expired cookie when the whole session ended
+     */
+    public function revoke(Request $request, ?TrackingScope $scope = null): ?Cookie
+    {
+        $session = $this->session($request);
+        if (!$session) {
+            return $this->cookie('', -1);
+        }
+
+        if ($scope) {
+            $this->deleteGrant($session, $scope);
+
+            return null;
+        }
+
+        $this->saveSession($session, ['revoked_at' => Carbon::now()]);
+
+        return $this->cookie('', -1);
+    }
+
+    public function cookie(string $value, int $minutes): Cookie
+    {
+        $sameSite = strtolower((string) config('fleetops.tracking.cookie_same_site', 'lax'));
+        $sameSite = in_array($sameSite, ['lax', 'strict', 'none'], true) ? $sameSite : 'lax';
+        $secure   = $sameSite === 'none' || (bool) config('session.secure', false);
+
+        return Cookie::create(self::COOKIE, $value, $minutes < 0 ? 1 : Carbon::now()->addMinutes($minutes)->getTimestamp(), '/', config('session.domain'), $secure, true, false, $sameSite);
+    }
+
+    protected function attempt(string $key, int $max, int $decay): bool
+    {
+        if ($this->limiter()->tooManyAttempts($key, $max)) {
+            return false;
+        }
+
+        $this->limiter()->hit($key, $decay);
+
+        return true;
+    }
+
+    protected function pauseKey(TrackingScope $scope): string
+    {
+        return 'trk-pause:' . $scope->key();
+    }
+
+    protected function limiter(): RateLimiter
+    {
+        return $this->limiter ??= app(RateLimiter::class);
+    }
+
+    protected function voidCodes(TrackingScope $scope): void
+    {
+        VerificationCode::withoutGlobalScope(ExpiryScope::class)->where('for', self::CODE_PURPOSE)->where('meta->scope', $scope->key())->delete();
+    }
+
+    protected function createCode(mixed $recipient, array $options): VerificationCode
+    {
+        return VerificationCode::issue($recipient, self::CODE_PURPOSE, $options);
+    }
+
+    protected function latestCode(TrackingScope $scope): ?VerificationCode
+    {
+        return VerificationCode::withoutGlobalScope(ExpiryScope::class)->where('for', self::CODE_PURPOSE)->where('meta->scope', $scope->key())->latest()->first();
+    }
+
+    protected function deleteCode(VerificationCode $verificationCode): void
+    {
+        $verificationCode->delete();
+    }
+
+    protected function findSession(string $tokenHash): ?TrackingSession
+    {
+        return TrackingSession::where('token_hash', $tokenHash)->first();
+    }
+
+    protected function createSession(array $attributes): TrackingSession
+    {
+        return TrackingSession::create($attributes);
+    }
+
+    protected function saveSession(TrackingSession $session, array $attributes): void
+    {
+        $session->forceFill($attributes)->save();
+    }
+
+    protected function findGrant(TrackingSession $session, TrackingScope $scope): ?TrackingSessionGrant
+    {
+        return TrackingSessionGrant::where('tracking_session_uuid', $session->uuid)
+            ->where('order_uuid', $scope->order_uuid)
+            ->where('customer_type', $scope->customer_type)
+            ->where('customer_uuid', $scope->customer_uuid)
+            ->where('expires_at', '>', Carbon::now())
+            ->first();
+    }
+
+    protected function saveGrant(TrackingSession $session, TrackingScope $scope, ?string $channel, Carbon $expiresAt): void
+    {
+        TrackingSessionGrant::updateOrCreate(
+            ['tracking_session_uuid' => $session->uuid, 'order_uuid' => $scope->order_uuid, 'customer_type' => $scope->customer_type, 'customer_uuid' => $scope->customer_uuid],
+            ['company_uuid' => $scope->company_uuid, 'channel' => $channel, 'expires_at' => $expiresAt]
+        );
+    }
+
+    protected function deleteGrant(TrackingSession $session, TrackingScope $scope): void
+    {
+        TrackingSessionGrant::where('tracking_session_uuid', $session->uuid)
+            ->where('order_uuid', $scope->order_uuid)
+            ->where('customer_type', $scope->customer_type)
+            ->where('customer_uuid', $scope->customer_uuid)
+            ->delete();
+    }
+}
diff --git a/server/src/Support/TrackingPage/TrackingRecipient.php b/server/src/Support/TrackingPage/TrackingRecipient.php
new file mode 100644
index 000000000..b660f44aa
--- /dev/null
+++ b/server/src/Support/TrackingPage/TrackingRecipient.php
@@ -0,0 +1,111 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\TrackingPage;
+
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Support\TrackingScope;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * Who a one-time code goes to for a tracking scope, and how their contact details are
+ * shown on the page: masked, and never editable, so a code can only reach details the
+ * company already holds.
+ */
+class TrackingRecipient
+{
+    public const CHANNEL_SMS   = 'sms';
+    public const CHANNEL_EMAIL = 'email';
+
+    public function __construct(
+        public readonly ?Model $customer,
+        public readonly ?string $email,
+        public readonly ?string $phone,
+    ) {
+    }
+
+    /**
+     * The scope's customer (a Contact or a Vendor) and the contact details a code can use.
+     *
+     * @param string|null $fallbackPhone the stop place's phone, used when the customer has none
+     */
+    public static function for(?TrackingScope $scope, ?string $fallbackPhone = null, ?Model $customer = null): self
+    {
+        $customer ??= $scope ? static::loadCustomer($scope) : null;
+
+        $email = static::validEmail(data_get($customer, 'email'));
+        $phone = static::validPhone(data_get($customer, 'phone')) ?? static::validPhone($fallbackPhone);
+
+        return new self($customer, $email, $phone);
+    }
+
+    protected static function loadCustomer(TrackingScope $scope): ?Model
+    {
+        $class = match (true) {
+            is_a($scope->customer_type, Contact::class, true) => Contact::class,
+            is_a($scope->customer_type, Vendor::class, true)  => Vendor::class,
+            default                                          => null,
+        };
+
+        return $class ? $class::withoutGlobalScopes()->where('uuid', $scope->customer_uuid)->first() : null;
+    }
+
+    /**
+     * The channels a code can go out on, given the company's settings and the instance.
+     *
+     * @return array<int, array{type: string, masked: string}>
+     */
+    public function channels(array $config, bool $smsAvailable): array
+    {
+        $channels = [];
+        if ($this->phone && $smsAvailable && data_get($config, 'access.channels.sms', true)) {
+            $channels[] = ['type' => self::CHANNEL_SMS, 'masked' => static::maskPhone($this->phone)];
+        }
+
+        if ($this->email && data_get($config, 'access.channels.email', true)) {
+            $channels[] = ['type' => self::CHANNEL_EMAIL, 'masked' => static::maskEmail($this->email)];
+        }
+
+        return $channels;
+    }
+
+    public function destination(string $channel): ?string
+    {
+        return $channel === self::CHANNEL_SMS ? $this->phone : ($channel === self::CHANNEL_EMAIL ? $this->email : null);
+    }
+
+    /**
+     * `•••• •• 4821`: only the last four digits.
+     */
+    public static function maskPhone(string $phone): string
+    {
+        $digits = preg_replace('/\D/', '', $phone);
+
+        return '•••• •• ' . substr($digits, -4);
+    }
+
+    /**
+     * `m•••@g•••.com`: the first letter of each part and the top-level domain.
+     */
+    public static function maskEmail(string $email): string
+    {
+        [$local, $domain] = explode('@', $email, 2);
+        $tld              = str_contains($domain, '.') ? substr($domain, strrpos($domain, '.')) : '';
+
+        return mb_substr($local, 0, 1) . '•••@' . mb_substr($domain, 0, 1) . '•••' . $tld;
+    }
+
+    protected static function validEmail(mixed $value): ?string
+    {
+        $value = is_string($value) ? trim($value) : '';
+
+        return $value !== '' && filter_var($value, FILTER_VALIDATE_EMAIL) ? $value : null;
+    }
+
+    protected static function validPhone(mixed $value): ?string
+    {
+        $value = is_string($value) ? trim($value) : '';
+
+        return strlen(preg_replace('/\D/', '', $value)) >= 6 ? $value : null;
+    }
+}
diff --git a/server/src/Support/TrackingPage/TrackingResolver.php b/server/src/Support/TrackingPage/TrackingResolver.php
new file mode 100644
index 000000000..09b3091fd
--- /dev/null
+++ b/server/src/Support/TrackingPage/TrackingResolver.php
@@ -0,0 +1,201 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\TrackingPage;
+
+use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Payload;
+use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Models\TrackingNumber;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingScope;
+use Fleetbase\Models\Setting;
+
+/**
+ * Turns what a visitor typed into the order and customer it may open, or null.
+ *
+ * Null covers everything a visitor must not be able to tell apart: a malformed number, an
+ * unknown one, one from a company that opted out of the shared page, and, on a company's
+ * own page, one belonging to another company. The caller answers all of them the same way.
+ *
+ * Only the `tracking_number` column is matched, never a uuid or public id.
+ */
+class TrackingResolver
+{
+    public const NUMBER_PATTERN = '/^[A-Za-z0-9][A-Za-z0-9._\-]{0,99}$/';
+
+    /**
+     * The tracking number as typed, trimmed, or null when it can't be one.
+     */
+    public static function normalize(mixed $input): ?string
+    {
+        if (!is_string($input)) {
+            return null;
+        }
+
+        $input = trim($input);
+
+        return preg_match(static::NUMBER_PATTERN, $input) === 1 ? $input : null;
+    }
+
+    /**
+     * @param string|null $slug a company page's slug; null for the shared page
+     */
+    public function resolve(mixed $input, ?string $slug = null): ?TrackingTarget
+    {
+        $number = static::normalize($input);
+        if ($number === null) {
+            return null;
+        }
+
+        $companyUuid = null;
+        if ($slug !== null) {
+            $companyUuid = $this->companyForSlug($slug);
+            if ($companyUuid === null) {
+                return null;
+            }
+        }
+
+        $trackingNumber = $this->findTrackingNumber($number, $companyUuid);
+        $target         = $trackingNumber ? $this->targetFor($trackingNumber) : null;
+        if ($target === null) {
+            return null;
+        }
+
+        $config = $this->config($target->companyUuid());
+        if ($slug === null && (!$config['generic_page']['allowed'] || !$this->adminConfig()['generic_page']['enabled'])) {
+            return null;
+        }
+
+        if ($companyUuid !== null && $target->companyUuid() !== $companyUuid) {
+            return null;
+        }
+
+        return $target->withConfig($config);
+    }
+
+    /**
+     * The company whose enabled page lives at this slug.
+     */
+    public function companyForSlug(?string $slug): ?string
+    {
+        $slug = strtolower(trim((string) $slug));
+        if (TrackingPageConfig::slugError($slug) !== null) {
+            return null;
+        }
+
+        $companyUuid = $this->lookupSetting(TrackingPageConfig::SLUG_INDEX_PREFIX . $slug);
+        if (!is_string($companyUuid) || $companyUuid === '') {
+            return null;
+        }
+
+        $config = $this->config($companyUuid);
+
+        return $config['org_page']['enabled'] && $config['org_page']['slug'] === $slug ? $companyUuid : null;
+    }
+
+    /**
+     * The order and customer a tracking number opens, from whatever owns it.
+     */
+    public function targetFor(TrackingNumber $trackingNumber): ?TrackingTarget
+    {
+        $owner = $this->ownerOf($trackingNumber);
+
+        if ($owner instanceof Order) {
+            return new TrackingTarget($owner, TrackingScope::forOrder($owner), $trackingNumber);
+        }
+
+        if ($owner instanceof Waypoint) {
+            $order = $this->orderForPayload($owner->payload_uuid);
+
+            return $order ? new TrackingTarget($order, TrackingScope::forStop($order, $owner), $trackingNumber, TrackingTarget::KIND_STOP, $owner) : null;
+        }
+
+        if ($owner instanceof Entity) {
+            $order = $this->orderForPayload($owner->payload_uuid);
+            if (!$order) {
+                return null;
+            }
+
+            $waypoint = $this->waypointForEntity($owner);
+
+            return new TrackingTarget($order, TrackingScope::forStop($order, $waypoint), $trackingNumber, TrackingTarget::KIND_ITEM, $waypoint);
+        }
+
+        if ($owner instanceof Place) {
+            // A service stop's pickup or dropoff number: the stop belongs to the order's customer.
+            $order = $this->orderForPlaceTrackingNumber($trackingNumber->uuid);
+
+            return $order ? new TrackingTarget($order, TrackingScope::forOrder($order), $trackingNumber, TrackingTarget::KIND_STOP) : null;
+        }
+
+        return null;
+    }
+
+    /**
+     * The slug to put in a company's tracking links, or null to link the shared page.
+     */
+    public function linkSlugFor(string $companyUuid): ?string
+    {
+        $config = $this->config($companyUuid);
+
+        return $config['links']['target'] !== 'generic' && $config['org_page']['enabled'] ? $config['org_page']['slug'] : null;
+    }
+
+    public function config(?string $companyUuid): array
+    {
+        return TrackingPageConfig::sanitize(
+            (array) $this->lookupSetting('company.' . $companyUuid . '.' . TrackingPageConfig::SETTING_KEY, []),
+            $this->adminConfig()
+        );
+    }
+
+    public function adminConfig(): array
+    {
+        return TrackingPageConfig::sanitizeAdmin((array) $this->lookupSetting(TrackingPageConfig::ADMIN_SETTING_KEY, []));
+    }
+
+    protected function findTrackingNumber(string $number, ?string $companyUuid): ?TrackingNumber
+    {
+        $query = TrackingNumber::withoutGlobalScopes()->where('tracking_number', $number);
+        if ($companyUuid !== null) {
+            $query->where('company_uuid', $companyUuid);
+        }
+
+        return $query->first();
+    }
+
+    protected function ownerOf(TrackingNumber $trackingNumber): mixed
+    {
+        return $trackingNumber->owner;
+    }
+
+    protected function orderForPayload(?string $payloadUuid): ?Order
+    {
+        return $payloadUuid ? Order::withoutGlobalScopes()->where('payload_uuid', $payloadUuid)->first() : null;
+    }
+
+    protected function waypointForEntity(Entity $entity): ?Waypoint
+    {
+        if (!$entity->payload_uuid || !$entity->destination_uuid) {
+            return null;
+        }
+
+        return Waypoint::withoutGlobalScopes()->where('payload_uuid', $entity->payload_uuid)->where('place_uuid', $entity->destination_uuid)->first();
+    }
+
+    protected function orderForPlaceTrackingNumber(string $trackingNumberUuid): ?Order
+    {
+        $payloadUuid = Payload::withoutGlobalScopes()
+            ->where('pickup_tracking_number_uuid', $trackingNumberUuid)
+            ->orWhere('dropoff_tracking_number_uuid', $trackingNumberUuid)
+            ->value('uuid');
+
+        return $this->orderForPayload($payloadUuid);
+    }
+
+    protected function lookupSetting(string $key, mixed $default = null): mixed
+    {
+        return Setting::lookup($key, $default);
+    }
+}
diff --git a/server/src/Support/TrackingPage/TrackingTarget.php b/server/src/Support/TrackingPage/TrackingTarget.php
new file mode 100644
index 000000000..9effbe974
--- /dev/null
+++ b/server/src/Support/TrackingPage/TrackingTarget.php
@@ -0,0 +1,40 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\TrackingPage;
+
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\TrackingNumber;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingScope;
+
+/**
+ * What a tracking number opened on the public page: the order, the customer within it
+ * whose stops the visitor may see (null when the order names nobody), the stop the number
+ * belongs to when it is a stop's or an item's, and the owning company's page config.
+ */
+final class TrackingTarget
+{
+    public const KIND_ORDER = 'order';
+    public const KIND_STOP  = 'stop';
+    public const KIND_ITEM  = 'item';
+
+    public function __construct(
+        public readonly Order $order,
+        public readonly ?TrackingScope $scope,
+        public readonly TrackingNumber $trackingNumber,
+        public readonly string $kind = self::KIND_ORDER,
+        public readonly ?Waypoint $waypoint = null,
+        public readonly array $config = [],
+    ) {
+    }
+
+    public function withConfig(array $config): self
+    {
+        return new self($this->order, $this->scope, $this->trackingNumber, $this->kind, $this->waypoint, $config);
+    }
+
+    public function companyUuid(): ?string
+    {
+        return $this->order->company_uuid;
+    }
+}
diff --git a/server/src/Support/TrackingPage/TrackingView.php b/server/src/Support/TrackingPage/TrackingView.php
new file mode 100644
index 000000000..c2b9e4ea4
--- /dev/null
+++ b/server/src/Support/TrackingPage/TrackingView.php
@@ -0,0 +1,408 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\TrackingPage;
+
+use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Proof;
+use Fleetbase\FleetOps\Support\TrackingScope;
+use Fleetbase\FleetOps\Support\TrackingUpdate;
+use Fleetbase\FleetOps\Tracking\TrackingContextBuilder;
+use Fleetbase\FleetOps\Tracking\TrackingIntelligenceService;
+use Fleetbase\FleetOps\Tracking\TrackingOptions;
+use Fleetbase\FleetOps\Tracking\TrackingStop;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Collection;
+
+/**
+ * What the public tracking page receives, per access level.
+ *
+ * Level 0 (a tracking number alone) carries branding, a coarse stage and how to verify.
+ * Level 1 (a verified device) and level 2 (a signed-in customer) carry one customer's
+ * stops within the order, built on TrackingUpdate, which already filters stops, timelines,
+ * the driver and the vehicle position to the scope. Staff of the owning company see what
+ * the customer sees.
+ *
+ * Never sent at any level: internal uuids, notes, order meta, custom fields, files other
+ * than proof of delivery, rates or transactions, the sender's address, another
+ * customer's stops, items or people, and the driver's surname or phone.
+ */
+class TrackingView
+{
+    public const VIEWER_VERIFIED = 'verified';
+    public const VIEWER_ACCOUNT  = 'account';
+    public const VIEWER_STAFF    = 'staff';
+
+    /**
+     * Status codes that show as a problem with the delivery.
+     */
+    public const ISSUE_CODES = ['failed', 'attempt_failed', 'delivery_failed', 'returned', 'return_to_sender'];
+
+    /**
+     * Pickup coordinates are rounded to about a kilometre: enough to draw where the route starts, not an address.
+     */
+    public const HUB_PRECISION  = 2;
+    public const STOP_PRECISION = 5;
+
+    /**
+     * Branding as the page shows it, from the company's config with its own details as fallbacks.
+     */
+    public function branding(array $config, mixed $company = null, ?string $instanceLogo = null): array
+    {
+        $branding = (array) data_get($config, 'branding', []);
+        $accent   = $branding['accent'] ?? TrackingPageConfig::DEFAULT_ACCENT;
+
+        return [
+            'name'           => $branding['display_name'] ?? data_get($company, 'name'),
+            'logo_url'       => data_get($company, 'logo_uuid') ? data_get($company, 'logo_url') : $instanceLogo,
+            'accent'         => $accent,
+            'accent_dark'    => $branding['accent_dark'] ?? null,
+            'ink'            => TrackingPageConfig::inkFor($accent),
+            'support_phone'  => $branding['support_phone'] ?? data_get($company, 'phone'),
+            'support_email'  => $branding['support_email'] ?? null,
+            'website'        => $branding['website'] ?? data_get($company, 'website_url'),
+            'powered_by'     => (bool) ($branding['powered_by'] ?? true),
+            'theme'          => $branding['theme'] ?? 'system',
+            'default_locale' => $branding['default_locale'] ?? 'en-us',
+            'locales'        => $branding['locales'] ?? TrackingPageConfig::LOCALES,
+        ];
+    }
+
+    /**
+     * Level 0: what a tracking number alone shows.
+     *
+     * @param array $channels the masked channels a code can go out on
+     */
+    public function publicView(TrackingTarget $target, array $branding, array $channels, bool $signIn): array
+    {
+        $order  = $target->order;
+        $public = (bool) data_get($target->config, 'access.public_status', true);
+        $update = $target->scope ? new TrackingUpdate($order, $target->scope, $this->stopsFor($order)) : null;
+
+        return [
+            'level'           => 0,
+            'tracking_number' => $target->trackingNumber->tracking_number,
+            'company'         => $branding,
+            'stage'           => $public ? $this->stage($order, $update) : null,
+            'last_update_on'  => $public && $order->updated_at ? Carbon::parse($order->updated_at)->toDateString() : null,
+            'verify'          => ['channels' => $channels],
+            'sign_in'         => $signIn,
+        ];
+    }
+
+    /**
+     * Levels 1 and 2: one customer's view of the order.
+     */
+    public function fullView(TrackingTarget $target, array $branding, string $viewer, ?string $expiresAt = null): array
+    {
+        $order      = $target->order;
+        $config     = $target->config;
+        $scope      = $target->scope ?? new TrackingScope((string) $order->uuid, Order::class, (string) $order->uuid, $order);
+        $stops      = $this->stopsFor($order);
+        $tracker    = $this->trackerFor($order);
+        $update     = $this->updateFor($order, $scope, $stops, $tracker);
+        $data       = $update->toArray()['data'];
+        $own        = $update->ownStops();
+        $placeUuids = $own->map(fn (TrackingStop $stop) => $stop->place?->uuid)->filter()->values()->all();
+        $entities   = $this->entitiesFor($order, $placeUuids, $scope);
+        $showMap    = (bool) data_get($config, 'visibility.map', true);
+        $location   = $showMap ? $data['location'] : null;
+        $stopsView  = $this->stops($own, collect($data['stops']));
+
+        return [
+            'level'           => $viewer === self::VIEWER_ACCOUNT ? 2 : 1,
+            'viewer'          => $viewer,
+            'tracking_number' => $target->trackingNumber->tracking_number,
+            'company'         => $branding,
+            'stage'           => $this->stage($order, $update),
+            'status'          => [
+                'code'       => $data['order']['status'],
+                'delayed'    => (bool) data_get($tracker, 'insights.is_delayed', false),
+                'confidence' => data_get($tracker, 'confidence'),
+            ],
+            'scheduled_at'    => $this->iso($order->scheduled_at),
+            'time_window'     => ['start' => $this->iso($order->time_window_start), 'end' => $this->iso($order->time_window_end)],
+            'route'           => $data['route'],
+            'stops'           => $stopsView,
+            'focus_stop'      => $target->waypoint?->public_id,
+            'eta'             => $this->eta($stopsView, $tracker, $update),
+            'timeline'        => $this->timeline($data),
+            'driver'          => $this->driver($data['driver'], $config),
+            'location'        => $location,
+            'map'             => $showMap ? $this->map($stops, $own, $tracker, $location) : null,
+            'items'           => data_get($config, 'visibility.items', true) ? $this->items($entities, $viewer === self::VIEWER_ACCOUNT && data_get($config, 'visibility.item_prices', false) && $scope->isOrderCustomer($order)) : [],
+            'proofs'          => $this->proofs($order, $own, $entities, $scope, $config),
+            'instructions'    => [
+                'text'     => $this->instructionsFor($order, $scope),
+                'editable' => (bool) data_get($config, 'visibility.instructions_edit', false),
+            ],
+            'actions'         => [
+                'report'         => (bool) data_get($config, 'visibility.report_problem', true),
+                'driver_contact' => data_get($config, 'visibility.driver_contact', 'company'),
+            ],
+            'session'         => ['expires_at' => $expiresAt],
+            'stale_after'     => $this->staleAfter($order),
+        ];
+    }
+
+    /**
+     * The coarse stage: preparing, scheduled, dispatched, in_transit, delivered, issue or canceled.
+     */
+    public function stage(Order $order, ?TrackingUpdate $update): string
+    {
+        $status = strtolower((string) $order->status);
+        if ($status === 'canceled') {
+            return 'canceled';
+        }
+
+        if (in_array($status, self::ISSUE_CODES, true)) {
+            return 'issue';
+        }
+
+        $own = $update ? $update->ownStops()->filter(fn (TrackingStop $stop) => $stop->type !== 'pickup') : collect();
+        if ($status === 'completed' || ($own->isNotEmpty() && $own->every(fn (TrackingStop $stop) => $stop->completed))) {
+            return 'delivered';
+        }
+
+        if ($update?->isEnRoute() || $order->started) {
+            return 'in_transit';
+        }
+
+        if ($order->dispatched) {
+            return 'dispatched';
+        }
+
+        return $order->scheduled_at && Carbon::parse($order->scheduled_at)->isFuture() ? 'scheduled' : 'preparing';
+    }
+
+    /**
+     * The customer's stops: where, when and their own status, never the pickup's place.
+     */
+    protected function stops(Collection $own, Collection $data): array
+    {
+        $byId = $data->keyBy(fn ($stop) => $stop['sequence']);
+
+        return $own->filter(fn (TrackingStop $stop) => $stop->type !== 'pickup')->map(function (TrackingStop $stop) use ($byId) {
+            $point = $stop->point();
+            $entry = $byId->get($stop->sequence, []);
+
+            return [
+                'id'       => $stop->waypoint?->public_id ?? $stop->place?->public_id,
+                'type'     => $stop->type,
+                'sequence' => $stop->sequence,
+                'status'   => $stop->status,
+                'complete' => $stop->completed,
+                'eta'      => $entry['eta'] ?? null,
+                'timeline' => $entry['timeline'] ?? [],
+                'place'    => [
+                    'name'      => $stop->place?->name,
+                    'address'   => $stop->place?->address,
+                    'latitude'  => $point ? round($point->getLat(), self::STOP_PRECISION) : null,
+                    'longitude' => $point ? round($point->getLng(), self::STOP_PRECISION) : null,
+                ],
+                'window'   => [
+                    'start' => $this->iso($stop->waypoint?->time_window_start),
+                    'end'   => $this->iso($stop->waypoint?->time_window_end),
+                ],
+            ];
+        })->values()->all();
+    }
+
+    /**
+     * The arrival estimate for the customer's next stop.
+     */
+    protected function eta(array $stops, array $tracker, TrackingUpdate $update): ?array
+    {
+        if (!$update->showsVehicle()) {
+            return null;
+        }
+
+        foreach ($stops as $stop) {
+            if (!$stop['complete'] && !empty($stop['eta'])) {
+                return ['at' => $stop['eta']['at'], 'seconds' => $stop['eta']['seconds'], 'confidence' => data_get($tracker, 'confidence')];
+            }
+        }
+
+        $at = data_get($tracker, 'eta.completion_at');
+
+        return $at ? ['at' => $at, 'seconds' => data_get($tracker, 'eta.completion_seconds'), 'confidence' => data_get($tracker, 'confidence')] : null;
+    }
+
+    /**
+     * The order's and the customer's stops' status entries, newest first.
+     */
+    protected function timeline(array $data): array
+    {
+        $entries = collect($data['order']['timeline']);
+        foreach ($data['stops'] as $stop) {
+            $entries = $entries->merge($stop['timeline'] ?? []);
+        }
+
+        return $entries
+            ->unique(fn ($entry) => ($entry['code'] ?? '') . '|' . ($entry['created_at'] ?? '') . '|' . ($entry['status'] ?? ''))
+            ->sortByDesc(fn ($entry) => $entry['created_at'] ?? '')
+            ->values()
+            ->all();
+    }
+
+    protected function driver(?array $driver, array $config): ?array
+    {
+        if (!$driver) {
+            return null;
+        }
+
+        return [
+            'name'    => data_get($config, 'visibility.driver_name', true) ? $driver['name'] : null,
+            'vehicle' => data_get($config, 'visibility.vehicle', true) ? $driver['vehicle'] : null,
+            'online'  => $driver['online'],
+        ];
+    }
+
+    /**
+     * Where the route starts (to about a kilometre) and, when every stop is this
+     * customer's, the route line. On an order with other customers the line would trace
+     * their stops, so it is left out.
+     */
+    protected function map(Collection $stops, Collection $own, array $tracker, ?array $location): array
+    {
+        $pickup = $stops->first(fn (TrackingStop $stop) => $stop->type === 'pickup');
+        $point  = $pickup?->point();
+        $mine   = $stops->every(fn (TrackingStop $stop) => $stop->type === 'pickup' || $own->contains(fn (TrackingStop $owned) => $owned === $stop));
+
+        return [
+            'hub'      => $point ? ['latitude' => round($point->getLat(), self::HUB_PRECISION), 'longitude' => round($point->getLng(), self::HUB_PRECISION)] : null,
+            'polyline' => $mine && $location ? data_get($tracker, 'route.polyline') : null,
+        ];
+    }
+
+    /**
+     * The customer's items: those going to their stops, and on an order with no stop
+     * customers, the order customer's.
+     */
+    protected function items(Collection $entities, bool $prices): array
+    {
+        return $entities->map(fn (Entity $entity) => array_filter([
+            'id'          => $entity->public_id,
+            'name'        => $entity->name,
+            'description' => $entity->description,
+            'quantity'    => data_get($entity, 'meta.quantity'),
+            'photo_url'   => $entity->photo_uuid ? $entity->photo_url : null,
+            'tracking'    => data_get($entity, 'tracking'),
+            'price'       => $prices ? $entity->price : null,
+            'currency'    => $prices ? $entity->currency : null,
+        ], fn ($value) => $value !== null))->values()->all();
+    }
+
+    /**
+     * Proof of delivery for the customer's completed stops and items.
+     */
+    protected function proofs(Order $order, Collection $own, Collection $entities, TrackingScope $scope, array $config): array
+    {
+        $subjects = $own->filter(fn (TrackingStop $stop) => $stop->completed)->map(fn (TrackingStop $stop) => $stop->waypoint?->uuid)->filter()->values()->all();
+        $subjects = array_merge($subjects, $entities->map(fn (Entity $entity) => $entity->uuid)->all());
+        if ($scope->isOrderCustomer($order) && strtolower((string) $order->status) === 'completed') {
+            $subjects[] = $order->uuid;
+        }
+
+        return $this->proofsFor($subjects)
+            ->map(fn (Proof $proof) => ['id' => $proof->public_id, 'type' => static::proofType($proof), 'created_at' => $this->iso($proof->created_at)])
+            ->filter(fn ($proof) => ($proof['type'] !== 'photo' || data_get($config, 'visibility.pod_photo', true)) && ($proof['type'] !== 'signature' || data_get($config, 'visibility.pod_signature', true)))
+            ->values()
+            ->all();
+    }
+
+    /**
+     * signature, photo or scan.
+     */
+    public static function proofType(Proof $proof): string
+    {
+        $fileType = strtolower((string) data_get($proof, 'file.type'));
+        if ($fileType === 'signature' || (!empty($proof->raw_data) && $fileType === '')) {
+            return 'signature';
+        }
+
+        return $fileType === 'photo' || $proof->file_uuid ? 'photo' : 'scan';
+    }
+
+    /**
+     * Proofs the scope may open, by public id.
+     */
+    public function proofFor(TrackingTarget $target, string $publicId): ?Proof
+    {
+        $view = $this->fullView($target, [], self::VIEWER_VERIFIED);
+
+        if (!collect($view['proofs'])->contains(fn ($proof) => $proof['id'] === $publicId)) {
+            return null;
+        }
+
+        return $this->findProof($publicId);
+    }
+
+    protected function iso(mixed $value): ?string
+    {
+        return $value ? Carbon::parse($value)->toISOString() : null;
+    }
+
+    protected function stopsFor(Order $order): Collection
+    {
+        return app(TrackingContextBuilder::class)->build($order, TrackingOptions::fromArray([], $order->company_uuid))->stops;
+    }
+
+    protected function trackerFor(Order $order): array
+    {
+        if (in_array(strtolower((string) $order->status), TrackingUpdate::TERMINAL_STATUSES, true)) {
+            return [];
+        }
+
+        try {
+            return app(TrackingIntelligenceService::class)->track($order);
+        } catch (\Throwable) {
+            return [];
+        }
+    }
+
+    protected function updateFor(Order $order, TrackingScope $scope, Collection $stops, array $tracker): TrackingUpdate
+    {
+        return TrackingUpdate::for($order, $scope, $stops, $tracker);
+    }
+
+    protected function staleAfter(Order $order): int
+    {
+        return TrackingOptions::fromArray([], $order->company_uuid)->staleLocationThresholdSeconds;
+    }
+
+    /**
+     * @param array<int, string> $placeUuids the customer's stop places
+     */
+    protected function entitiesFor(Order $order, array $placeUuids, TrackingScope $scope): Collection
+    {
+        if (!$order->payload_uuid) {
+            return collect();
+        }
+
+        $orderCustomer = $scope->isOrderCustomer($order);
+
+        return Entity::withoutGlobalScopes()
+            ->where('payload_uuid', $order->payload_uuid)
+            ->get()
+            ->filter(fn (Entity $entity) => $entity->destination_uuid ? in_array($entity->destination_uuid, $placeUuids, true) : $orderCustomer)
+            ->values();
+    }
+
+    protected function proofsFor(array $subjectUuids): Collection
+    {
+        return $subjectUuids === [] ? collect() : Proof::withoutGlobalScopes()->with('file')->whereIn('subject_uuid', $subjectUuids)->orderBy('created_at')->get();
+    }
+
+    protected function findProof(string $publicId): ?Proof
+    {
+        return Proof::withoutGlobalScopes()->with('file')->where('public_id', $publicId)->first();
+    }
+
+    protected function instructionsFor(Order $order, TrackingScope $scope): ?string
+    {
+        $instructions = data_get($order->getMeta('recipient_instructions', []), sha1($scope->key()));
+
+        return is_string($instructions) && $instructions !== '' ? $instructions : null;
+    }
+}
diff --git a/server/src/routes.php b/server/src/routes.php
index 7dcb3821c..9ee007feb 100644
--- a/server/src/routes.php
+++ b/server/src/routes.php
@@ -20,6 +20,23 @@ function ($router) {
         // limiter has its own prefix so the two do not share one counter.
         // Every answer is JSON, so a refused submission reaches the page with
         // its reasons instead of as a redirect back to it.
+        // The public customer tracking page. A tracking number alone gives a coarse status;
+        // a one-time code to the customer's own contact details unlocks their stops. Lookups
+        // are rate limited inside the controller, so a throttled lookup answers exactly like
+        // an unknown number; code sends and checks have limits of their own there too.
+        $router->prefix('public/track')->namespace('Public')->middleware([Fleetbase\FleetOps\Http\Middleware\ForceJsonResponse::class])->group(function ($router) {
+            $router->get('config', 'TrackingController@config');
+            $router->get('account/orders', 'TrackingController@accountOrders');
+            $router->delete('session', 'TrackingController@signOut');
+            $router->get('{number}', 'TrackingController@show');
+            $router->post('{number}/codes', 'TrackingController@sendCode');
+            $router->post('{number}/codes/verify', 'TrackingController@verifyCode');
+            $router->put('{number}/instructions', 'TrackingController@updateInstructions');
+            $router->get('{number}/proofs/{id}', 'TrackingController@proof');
+            $router->post('{number}/report', 'TrackingController@report');
+            $router->get('{number}/socket-token', 'TrackingController@socketToken');
+        });
+
         $router->prefix('public')->namespace('Public')->middleware([Fleetbase\FleetOps\Http\Middleware\ForceJsonResponse::class, 'throttle:60,1,inspection-public'])->group(function ($router) {
             $router->get('inspections/forms/{id}', 'PublicInspectionController@show');
             $router->post('inspections/forms/{id}/submit', 'PublicInspectionController@submit');
diff --git a/server/tests/Feature/Http/Public/TrackingControllerTest.php b/server/tests/Feature/Http/Public/TrackingControllerTest.php
new file mode 100644
index 000000000..623549f09
--- /dev/null
+++ b/server/tests/Feature/Http/Public/TrackingControllerTest.php
@@ -0,0 +1,495 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Public\TrackingController;
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Models\Proof;
+use Fleetbase\FleetOps\Models\TrackingNumber;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingAccess;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingPageConfig;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingResolver;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingTarget;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingView;
+use Fleetbase\FleetOps\Support\TrackingScope;
+use Fleetbase\Models\VerificationCode;
+use Fleetbase\Tests\Support\TrackingPageDatabase;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Cookie;
+
+class TrackingControllerResolverFake extends TrackingResolver
+{
+    public ?TrackingTarget $target = null;
+    public ?string $slugCompany   = null;
+    public array $company         = [];
+    public array $admin           = [];
+    public array $resolved        = [];
+
+    public function resolve(mixed $input, ?string $slug = null): ?TrackingTarget
+    {
+        $this->resolved[] = [$input, $slug];
+
+        return $this->target;
+    }
+
+    public function companyForSlug(?string $slug): ?string
+    {
+        return $this->slugCompany;
+    }
+
+    public function config(?string $companyUuid): array
+    {
+        return TrackingPageConfig::sanitize($this->company);
+    }
+
+    public function adminConfig(): array
+    {
+        return TrackingPageConfig::sanitizeAdmin($this->admin);
+    }
+}
+
+class TrackingControllerAccessFake extends TrackingAccess
+{
+    public bool $lookup      = true;
+    public bool $verify      = true;
+    public bool $reportOk    = true;
+    public int $paused       = 0;
+    public array $claim      = ['status' => self::SEND_SENT, 'retry_after' => 30];
+    public array $check      = ['status' => VerificationCode::CHECK_VALID, 'channel' => 'sms'];
+    public bool $granted     = false;
+    public array $issued     = [];
+    public array $grants     = [];
+    public array $revoked    = [];
+
+    public function allowLookup(Request $request): bool
+    {
+        return $this->lookup;
+    }
+
+    public function allowVerify(Request $request): bool
+    {
+        return $this->verify;
+    }
+
+    public function allowReport(Request $request, string $orderUuid): bool
+    {
+        return $this->reportOk;
+    }
+
+    public function pausedFor(TrackingScope $scope): int
+    {
+        return $this->paused;
+    }
+
+    public function claimSend(TrackingScope $scope, Request $request): array
+    {
+        return $this->claim;
+    }
+
+    public function issueCode(TrackingScope $scope, mixed $recipient, string $channel): VerificationCode
+    {
+        $this->issued[]   = [$scope->key(), $recipient?->uuid, $channel];
+        $code             = new VerificationCode();
+        $code->plainCode  = '482193';
+
+        return $code;
+    }
+
+    public function checkCode(TrackingScope $scope, string $code): array
+    {
+        return $this->check + ['code' => $code];
+    }
+
+    public function hasGrant(Request $request, ?TrackingScope $scope): bool
+    {
+        return $this->granted && $scope !== null;
+    }
+
+    public function grantExpiresAt(Request $request, TrackingScope $scope): ?string
+    {
+        return '2026-10-09T09:00:00.000000Z';
+    }
+
+    public function grant(Request $request, TrackingScope $scope, ?string $channel, int $hours): ?Cookie
+    {
+        $this->grants[] = [$scope->key(), $channel, $hours];
+
+        return $this->cookie('token-value-token-value-token-value-xx', $hours * 60);
+    }
+
+    public function revoke(Request $request, ?TrackingScope $scope = null): ?Cookie
+    {
+        $this->revoked[] = $scope?->key();
+
+        return $scope ? null : $this->cookie('', -1);
+    }
+}
+
+class TrackingControllerViewFake extends TrackingView
+{
+    public ?Proof $proof = null;
+    public array $calls  = [];
+
+    public function publicView(TrackingTarget $target, array $branding, array $channels, bool $signIn): array
+    {
+        return ['level' => 0, 'branding' => $branding, 'channels' => $channels, 'sign_in' => $signIn];
+    }
+
+    public function fullView(TrackingTarget $target, array $branding, string $viewer, ?string $expiresAt = null): array
+    {
+        $this->calls[] = $viewer;
+
+        return ['level' => $viewer === self::VIEWER_ACCOUNT ? 2 : 1, 'viewer' => $viewer, 'expires_at' => $expiresAt, 'company' => $branding];
+    }
+
+    public function proofFor(TrackingTarget $target, string $publicId): ?Proof
+    {
+        return $this->proof;
+    }
+}
+
+class TrackingControllerProbe extends TrackingController
+{
+    public mixed $user           = null;
+    public array $sms            = [];
+    public array $mails          = [];
+    public array $providers      = [];
+    public bool $portal          = true;
+    public bool $sockets         = false;
+    public ?array $contactsOver  = null;
+
+    public function __construct(public TrackingControllerResolverFake $fakeResolver, public TrackingControllerAccessFake $fakeAccess, public TrackingControllerViewFake $fakeView)
+    {
+        parent::__construct($fakeResolver, $fakeAccess, $fakeView);
+    }
+
+    protected function requestUser(Request $request): mixed
+    {
+        return $this->user;
+    }
+
+    protected function smsProviders(): array
+    {
+        return $this->providers;
+    }
+
+    protected function customerPortalInstalled(): bool
+    {
+        return $this->portal;
+    }
+
+    protected function instanceLogo(): ?string
+    {
+        return 'https://instance.example/logo.png';
+    }
+
+    protected function smsService(): Fleetbase\Services\SmsService
+    {
+        $probe = $this;
+
+        return new class($probe) extends Fleetbase\Services\SmsService {
+            public function __construct(private $probe)
+            {
+            }
+
+            public function send(string $to, string $text, array $options = [], ?string $provider = null): array
+            {
+                $this->probe->sms[] = [$to, $text, $options];
+
+                return ['success' => true];
+            }
+        };
+    }
+
+    protected function mail(string $to, string $subject, string $body): void
+    {
+        $this->mails[] = [$to, $subject, $body];
+    }
+
+    protected function socketsEnabled(): bool
+    {
+        return $this->sockets && parent::socketsEnabled() === false;
+    }
+
+    protected function socketTokenFor(TrackingScope $scope): array
+    {
+        return ['token' => 'jwt', 'expires_in' => 1800, 'expires_at' => '2026-10-08T09:30:00Z'];
+    }
+}
+
+class TrackingControllerOrder extends Order
+{
+    public bool $saved = false;
+
+    public function saveQuietly(array $options = [])
+    {
+        $this->saved = true;
+
+        return true;
+    }
+}
+
+afterEach(function () {
+    EloquentModel::unsetConnectionResolver();
+    config(['services.twilio.sid' => null, 'services.twilio.token' => null]);
+});
+
+function trackingController(): TrackingControllerProbe
+{
+    TrackingPageDatabase::boot();
+
+    return new TrackingControllerProbe(new TrackingControllerResolverFake(), new TrackingControllerAccessFake(), new TrackingControllerViewFake());
+}
+
+function trackingControllerTarget(array $config = [], bool $scoped = true, ?Waypoint $waypoint = null): TrackingTarget
+{
+    $order = new TrackingControllerOrder();
+    $order->setRawAttributes(['uuid' => 'order-1', 'company_uuid' => 'co-1', 'customer_uuid' => 'contact-1', 'customer_type' => Contact::class, 'meta' => json_encode([])], true);
+
+    $trackingNumber = new TrackingNumber();
+    $trackingNumber->setRawAttributes(['uuid' => 'tn-1', 'tracking_number' => 'NOR1000000001US'], true);
+
+    $scope = $scoped ? new TrackingScope('order-1', Contact::class, 'contact-1', $order) : null;
+
+    return new TrackingTarget($order, $scope, $trackingNumber, TrackingTarget::KIND_ORDER, $waypoint, TrackingPageConfig::sanitize($config));
+}
+
+function trackingControllerRequest(array $input = []): Request
+{
+    return Request::create('/public/track/NOR1000000001US', 'GET', $input, [], [], ['REMOTE_ADDR' => '203.0.113.7']);
+}
+
+test('the page config shows a company page or the shared page, and nothing for a page that is off', function () {
+    $controller = trackingController();
+    TrackingPageDatabase::insert(Illuminate\Database\Eloquent\Model::getConnectionResolver()->connection(), 'companies', ['uuid' => 'co-1', 'name' => 'Northwind Couriers', 'phone' => '+15105550142']);
+
+    expect($controller->config(trackingControllerRequest(['org' => 'northwind']))->getStatusCode())->toBe(404);
+
+    $controller->fakeResolver->slugCompany = 'co-1';
+    $controller->fakeResolver->company     = ['access' => ['session_hours' => 12]];
+    $page                                  = $controller->config(trackingControllerRequest(['org' => ' Northwind ']))->getData(true);
+    expect($page['company']['name'])->toBe('Northwind Couriers')
+        ->and($page['org'])->toBe('northwind')
+        ->and($page['sign_in'])->toBeTrue()
+        ->and($page['session_hours'])->toBe(12);
+
+    $shared = $controller->config(trackingControllerRequest(['org' => '  ']))->getData(true);
+    expect($shared['org'])->toBeNull()
+        ->and($shared['company']['logo_url'])->toBe('https://instance.example/logo.png')
+        ->and($shared['session_hours'])->toBe(24);
+
+    $controller->fakeResolver->admin = ['generic_page' => ['enabled' => false]];
+    expect($controller->config(trackingControllerRequest())->getStatusCode())->toBe(404);
+});
+
+test('lookups answer unknown and throttled numbers alike, and show what the viewer may see', function () {
+    $controller = trackingController();
+
+    $notFound = $controller->show(trackingControllerRequest(), 'NOR1000000001US');
+    expect($notFound->getStatusCode())->toBe(404)
+        ->and($notFound->getData(true))->toBe(['error' => TrackingController::NOT_FOUND, 'code' => 'not_found']);
+
+    $controller->fakeResolver->target = trackingControllerTarget();
+    $controller->fakeAccess->lookup   = false;
+    expect($controller->show(trackingControllerRequest(), 'NOR1000000001US')->getData(true))->toBe($notFound->getData(true));
+
+    // A tracking number alone: the public view, with the channels a code can use.
+    $controller->fakeAccess->lookup = true;
+    $controller->providers          = ['vonage' => ['available' => true]];
+    TrackingPageDatabase::insert(Illuminate\Database\Eloquent\Model::getConnectionResolver()->connection(), 'contacts', ['uuid' => 'contact-1', 'email' => 'maya@example.com', 'phone' => '+15105554821']);
+    $public = $controller->show(trackingControllerRequest(['org' => 'Northwind']), 'NOR1000000001US')->getData(true);
+    expect($public['level'])->toBe(0)
+        ->and(array_column($public['channels'], 'type'))->toBe(['sms', 'email'])
+        ->and($public['sign_in'])->toBeTrue()
+        ->and($controller->fakeResolver->resolved[1])->toBe(['NOR1000000001US', 'northwind']);
+
+    $controller->fakeResolver->target = trackingControllerTarget(['access' => ['account_sign_in' => false]], false);
+    $unscoped                         = $controller->show(trackingControllerRequest(), 'NOR1000000001US')->getData(true);
+    expect($unscoped['channels'])->toBe([])->and($unscoped['sign_in'])->toBeFalse();
+
+    // A verified device, a signed-in customer and staff of the owning company see the full view.
+    $controller->fakeResolver->target = trackingControllerTarget();
+    $controller->fakeAccess->granted  = true;
+    expect($controller->show(trackingControllerRequest(), 'NOR1000000001US')->getData(true))->toMatchArray(['viewer' => 'verified', 'expires_at' => '2026-10-09T09:00:00.000000Z']);
+
+    $controller->fakeAccess->granted = false;
+    $controller->user                = (object) ['uuid' => 'user-1', 'type' => 'customer', 'company_uuid' => 'co-1'];
+    TrackingPageDatabase::insert(Illuminate\Database\Eloquent\Model::getConnectionResolver()->connection(), 'contacts', ['uuid' => 'contact-x', 'user_uuid' => 'user-1']);
+    expect($controller->show(trackingControllerRequest(), 'NOR1000000001US')->getData(true)['level'])->toBe(0);
+
+    Illuminate\Database\Eloquent\Model::getConnectionResolver()->connection()->table('contacts')->where('uuid', 'contact-1')->update(['user_uuid' => 'user-1']);
+    expect($controller->show(trackingControllerRequest(), 'NOR1000000001US')->getData(true))->toMatchArray(['viewer' => 'account', 'level' => 2, 'expires_at' => null]);
+
+    $controller->user = (object) ['uuid' => 'user-2', 'type' => 'user', 'company_uuid' => 'co-1'];
+    expect($controller->show(trackingControllerRequest(), 'NOR1000000001US')->getData(true)['viewer'])->toBe('staff');
+
+    // Staff of another company, or a user with no id, get the public view.
+    $controller->user = (object) ['uuid' => 'user-3', 'type' => 'user', 'company_uuid' => 'co-2'];
+    expect($controller->show(trackingControllerRequest(), 'NOR1000000001US')->getData(true)['level'])->toBe(0);
+    $controller->user = (object) ['type' => 'customer'];
+    expect($controller->show(trackingControllerRequest(), 'NOR1000000001US')->getData(true)['level'])->toBe(0);
+});
+
+test('codes go out on an available channel, within the limits', function () {
+    $controller = trackingController();
+    $db         = Illuminate\Database\Eloquent\Model::getConnectionResolver()->connection();
+    TrackingPageDatabase::insert($db, 'contacts', ['uuid' => 'contact-1', 'email' => 'maya@example.com']);
+    TrackingPageDatabase::insert($db, 'companies', ['uuid' => 'co-1', 'name' => 'Northwind', 'options' => json_encode(['alpha_numeric_sender_id_enabled' => true, 'alpha_numeric_sender_id' => 'NORTHWIND'])]);
+
+    expect($controller->sendCode(trackingControllerRequest(['channel' => 'email']), 'X')->getStatusCode())->toBe(404);
+
+    $place = new Place();
+    $place->setRawAttributes(['uuid' => 'place-1', 'phone' => '+15105554821'], true);
+    $waypoint = new Waypoint();
+    $waypoint->setRelation('place', $place);
+    $controller->fakeResolver->target = trackingControllerTarget([], true, $waypoint);
+
+    // SMS needs a provider; the stop's place phone stands in for the contact's missing one.
+    expect($controller->sendCode(trackingControllerRequest(['channel' => 'sms']), 'NOR1')->getData(true))->toBe(['error' => 'channel_unavailable']);
+
+    config(['services.twilio.sid' => 'AC1', 'services.twilio.token' => 'secret']);
+    $sent = $controller->sendCode(trackingControllerRequest(['channel' => 'sms']), 'NOR1');
+    expect($sent->getStatusCode())->toBe(202)
+        ->and($sent->getData(true))->toBe(['channel' => 'sms', 'masked' => '•••• •• 4821', 'expires_in' => 600, 'resend_after' => 30])
+        ->and($controller->fakeAccess->issued[0])->toBe(['order-1:' . Contact::class . ':contact-1', 'contact-1', 'sms'])
+        ->and($controller->sms[0][0])->toBe('+15105554821')
+        ->and($controller->sms[0][1])->toBe('482193 is your Northwind delivery code. It expires in 10 minutes.')
+        ->and($controller->sms[0][2])->toBe(['twilioParams' => ['from' => 'NORTHWIND']]);
+
+    $controller->sendCode(trackingControllerRequest(['channel' => 'email']), 'NOR1');
+    expect($controller->mails[0])->toBe(['maya@example.com', '482193 is your Northwind delivery code', '482193 is your Northwind delivery code. It expires in 10 minutes.']);
+
+    $controller->fakeAccess->claim = ['status' => TrackingAccess::SEND_COOLDOWN, 'retry_after' => 12];
+    expect($controller->sendCode(trackingControllerRequest(['channel' => 'email']), 'NOR1')->getStatusCode())->toBe(429);
+    $controller->fakeAccess->claim = ['status' => TrackingAccess::SEND_PAUSED, 'retry_after' => 200];
+    expect($controller->sendCode(trackingControllerRequest(['channel' => 'email']), 'NOR1')->getData(true))->toBe(['error' => 'paused', 'retry_after' => 200]);
+
+    // A company with no name of its own falls back to a generic sender name, and no alphanumeric sender.
+    $db->table('companies')->delete();
+    $controller->fakeAccess->claim = ['status' => TrackingAccess::SEND_SENT, 'retry_after' => 30];
+    $controller->sendCode(trackingControllerRequest(['channel' => 'sms']), 'NOR1');
+    expect($controller->sms[1][1])->toStartWith('482193 is your Your delivery delivery code')
+        ->and($controller->sms[1][2])->toBe([]);
+
+    $controller->fakeResolver->target = trackingControllerTarget([], false);
+    expect($controller->sendCode(trackingControllerRequest(['channel' => 'email']), 'NOR1')->getStatusCode())->toBe(422);
+});
+
+test('checking a code verifies the device or says why it can’t', function () {
+    $controller = trackingController();
+
+    $controller->fakeAccess->verify = false;
+    expect($controller->verifyCode(trackingControllerRequest(['code' => '482193']), 'NOR1')->getStatusCode())->toBe(429);
+
+    $controller->fakeAccess->verify = true;
+    expect($controller->verifyCode(trackingControllerRequest(['code' => '482193']), 'NOR1')->getStatusCode())->toBe(404);
+
+    $controller->fakeResolver->target = trackingControllerTarget(['access' => ['session_hours' => 6]]);
+    $verified                         = $controller->verifyCode(trackingControllerRequest(['code' => '48 21 93']), 'NOR1');
+    expect($verified->getStatusCode())->toBe(200)
+        ->and($verified->getData(true)['viewer'])->toBe('verified')
+        ->and($verified->headers->getCookies()[0]->getName())->toBe(TrackingAccess::COOKIE)
+        ->and($controller->fakeAccess->grants[0])->toBe(['order-1:' . Contact::class . ':contact-1', 'sms', 6]);
+
+    $controller->fakeAccess->check = ['status' => VerificationCode::CHECK_INVALID, 'attempts_left' => 2];
+    expect($controller->verifyCode(trackingControllerRequest(['code' => '111111']), 'NOR1')->getData(true))->toBe(['error' => 'invalid', 'attempts_left' => 2]);
+
+    $controller->fakeAccess->check = ['status' => VerificationCode::CHECK_LOCKED];
+    expect($controller->verifyCode(trackingControllerRequest(['code' => '111111']), 'NOR1')->getData(true))->toBe(['error' => 'paused', 'retry_after' => TrackingAccess::PAUSE_SECONDS]);
+
+    $controller->fakeAccess->check = ['status' => VerificationCode::CHECK_EXPIRED];
+    expect($controller->verifyCode(trackingControllerRequest(['code' => '111111']), 'NOR1')->getStatusCode())->toBe(410);
+
+    $controller->fakeAccess->paused = 120;
+    expect($controller->verifyCode(trackingControllerRequest(['code' => '111111']), 'NOR1')->getData(true))->toBe(['error' => 'paused', 'retry_after' => 120]);
+});
+
+test('signing out drops one delivery or the whole device', function () {
+    $controller                       = trackingController();
+    $controller->fakeResolver->target = trackingControllerTarget();
+
+    $one = $controller->signOut(trackingControllerRequest(['number' => 'NOR1']));
+    expect($one->getData(true))->toBe(['status' => 'signed_out'])
+        ->and($one->headers->getCookies())->toBe([])
+        ->and($controller->fakeAccess->revoked[0])->toBe('order-1:' . Contact::class . ':contact-1');
+
+    $all = $controller->signOut(trackingControllerRequest());
+    expect($all->headers->getCookies()[0]->getExpiresTime())->toBe(1)
+        ->and($controller->fakeAccess->revoked[1])->toBeNull();
+});
+
+test('delivery instructions, proofs, reports and socket tokens need a verified viewer', function () {
+    $controller = trackingController();
+
+    foreach (['updateInstructions', 'report', 'socketToken'] as $method) {
+        expect($controller->{$method}(trackingControllerRequest(), 'NOR1')->getStatusCode())->toBe(404);
+    }
+    expect($controller->proof(trackingControllerRequest(), 'NOR1', 'proof_1')->getStatusCode())->toBe(404);
+
+    $controller->fakeResolver->target = trackingControllerTarget();
+    expect($controller->updateInstructions(trackingControllerRequest(), 'NOR1')->getStatusCode())->toBe(404);
+
+    $controller->fakeAccess->granted = true;
+
+    // Instructions
+    expect($controller->updateInstructions(trackingControllerRequest(['text' => 'Gate 4']), 'NOR1')->getStatusCode())->toBe(403);
+    $controller->fakeResolver->target = trackingControllerTarget(['visibility' => ['instructions_edit' => true]]);
+    $controller->updateInstructions(trackingControllerRequest(['text' => '  Leave with concierge  ']), 'NOR1');
+    $order = $controller->fakeResolver->target->order;
+    expect($order->saved)->toBeTrue()
+        ->and($order->getMeta('recipient_instructions'))->toBe([sha1('order-1:' . Contact::class . ':contact-1') => 'Leave with concierge']);
+
+    // Proofs
+    expect($controller->proof(trackingControllerRequest(), 'NOR1', 'proof_1')->getStatusCode())->toBe(404);
+    $controller->fakeView->proof = new Proof();
+    $controller->fakeView->proof->setRawAttributes(['raw_data' => 'iVBOR'], true);
+    $controller->fakeView->proof->setRelation('file', null);
+    expect($controller->proof(trackingControllerRequest(), 'NOR1', 'proof_1')->getData(true))->toBe(['url' => 'data:image/png;base64,iVBOR', 'type' => 'signature']);
+    $controller->fakeView->proof->setRawAttributes(['raw_data' => 'data:image/svg+xml;base64,PHN2Zz4='], true);
+    expect($controller->proof(trackingControllerRequest(), 'NOR1', 'proof_1')->getData(true)['url'])->toBe('data:image/svg+xml;base64,PHN2Zz4=');
+    $controller->fakeView->proof->setRawAttributes([], true);
+    expect($controller->proof(trackingControllerRequest(), 'NOR1', 'proof_1')->getStatusCode())->toBe(404);
+    $controller->fakeView->proof->setRelation('file', (object) ['url' => 'https://bucket.example/signed']);
+    expect($controller->proof(trackingControllerRequest(), 'NOR1', 'proof_1')->getData(true)['url'])->toBe('https://bucket.example/signed');
+
+    // Reports
+    expect($controller->report(trackingControllerRequest(['message' => 'Box damaged']), 'NOR1')->getStatusCode())->toBe(422);
+    $controller->fakeResolver->target = trackingControllerTarget(['branding' => ['support_email' => 'help@northwind.example']]);
+    expect($controller->report(trackingControllerRequest(['message' => '   ']), 'NOR1')->getStatusCode())->toBe(422);
+    $controller->fakeAccess->reportOk = false;
+    expect($controller->report(trackingControllerRequest(['message' => 'Box damaged']), 'NOR1')->getStatusCode())->toBe(429);
+    $controller->fakeAccess->reportOk = true;
+    expect($controller->report(trackingControllerRequest(['message' => 'Box damaged']), 'NOR1')->getStatusCode())->toBe(202)
+        ->and($controller->mails[0])->toBe(['help@northwind.example', 'Problem reported for NOR1000000001US', "A customer reported a problem with delivery NOR1000000001US:\n\nBox damaged"]);
+
+    // Socket tokens, only when the instance publishes tracking channels.
+    expect($controller->socketToken(trackingControllerRequest(), 'NOR1')->getStatusCode())->toBe(404);
+    $controller->sockets = true;
+    expect($controller->socketToken(trackingControllerRequest(), 'NOR1')->getData(true))->toBe(['token' => 'jwt', 'expires_in' => 1800, 'expires_at' => '2026-10-08T09:30:00Z']);
+});
+
+test('a signed-in customer lists their orders with the number that opens their part', function () {
+    $controller = trackingController();
+    $db         = Illuminate\Database\Eloquent\Model::getConnectionResolver()->connection();
+
+    expect($controller->accountOrders(trackingControllerRequest())->getStatusCode())->toBe(401);
+
+    $controller->user = (object) ['uuid' => 'user-1', 'type' => 'customer'];
+    TrackingPageDatabase::insert($db, 'contacts', ['uuid' => 'contact-1', 'user_uuid' => 'user-1']);
+    TrackingPageDatabase::insert($db, 'tracking_numbers', ['uuid' => 'tn-own', 'tracking_number' => 'NOR1']);
+    TrackingPageDatabase::insert($db, 'tracking_numbers', ['uuid' => 'tn-stop', 'tracking_number' => 'NOR2-STOP']);
+    TrackingPageDatabase::insert($db, 'orders', ['uuid' => 'order-own', 'customer_uuid' => 'contact-1', 'customer_type' => Contact::class, 'tracking_number_uuid' => 'tn-own', 'payload_uuid' => 'p-own', 'status' => 'completed', 'created_at' => '2026-10-07 09:00:00', 'updated_at' => '2026-10-07 10:00:00']);
+    TrackingPageDatabase::insert($db, 'orders', ['uuid' => 'order-stop', 'customer_uuid' => 'shipper', 'customer_type' => Contact::class, 'payload_uuid' => 'p-stop', 'status' => 'created', 'created_at' => '2026-10-08 09:00:00']);
+    TrackingPageDatabase::insert($db, 'orders', ['uuid' => 'order-none', 'customer_uuid' => 'contact-1', 'customer_type' => Contact::class, 'payload_uuid' => 'p-none', 'created_at' => '2026-10-06 09:00:00']);
+    TrackingPageDatabase::insert($db, 'waypoints', ['uuid' => 'wp-1', 'payload_uuid' => 'p-stop', 'customer_uuid' => 'contact-1', 'customer_type' => Contact::class, 'tracking_number_uuid' => 'tn-stop']);
+    TrackingPageDatabase::insert($db, 'entities', ['uuid' => 'e-1', 'payload_uuid' => 'p-own', 'name' => 'Ceramic lamp']);
+
+    $orders = $controller->accountOrders(trackingControllerRequest())->getData(true)['orders'];
+    expect($orders)->toBe([
+        ['tracking_number' => 'NOR2-STOP', 'title' => null, 'status' => 'created', 'stage' => 'preparing', 'updated_at' => null],
+        ['tracking_number' => 'NOR1', 'title' => 'Ceramic lamp', 'status' => 'completed', 'stage' => 'delivered', 'updated_at' => '2026-10-07T10:00:00.000000Z'],
+    ]);
+});
diff --git a/server/tests/RouteRegistrationExecutionTest.php b/server/tests/RouteRegistrationExecutionTest.php
index 491558d9e..11b6eda98 100644
--- a/server/tests/RouteRegistrationExecutionTest.php
+++ b/server/tests/RouteRegistrationExecutionTest.php
@@ -229,6 +229,26 @@ function fleetOpsRecordedRoutes(): FleetOpsRouteRecorder
     $lookup = collect($recorder->routes)->first(fn (array $route) => $route['action'] === 'OrderController@lookup');
     expect($lookup)->not->toBeNull()
         ->and($lookup['middleware'] ?? [])->toBe(['throttle:30,1,tracking-lookup']);
+
+    // The customer tracking page's public API answers in JSON and throttles inside the
+    // controller, so a throttled lookup looks exactly like an unknown number.
+    $tracking = collect($recorder->routes)->filter(fn (array $route) => str_starts_with($route['uri'], 'public/track/'));
+    expect($tracking->pluck('action', 'uri')->all())->toMatchArray([
+        'public/track/config'                    => 'TrackingController@config',
+        'public/track/account/orders'            => 'TrackingController@accountOrders',
+        'public/track/session'                   => 'TrackingController@signOut',
+        'public/track/{number}'                  => 'TrackingController@show',
+        'public/track/{number}/codes'            => 'TrackingController@sendCode',
+        'public/track/{number}/codes/verify'     => 'TrackingController@verifyCode',
+        'public/track/{number}/instructions'     => 'TrackingController@updateInstructions',
+        'public/track/{number}/proofs/{id}'      => 'TrackingController@proof',
+        'public/track/{number}/report'           => 'TrackingController@report',
+        'public/track/{number}/socket-token'     => 'TrackingController@socketToken',
+    ]);
+    foreach ($tracking as $route) {
+        expect($inGroup($route))->toBeTrue()
+            ->and($route['middleware'] ?? [])->toBe([]);
+    }
 });
 
 test('fleetops route file wires route groups with expected middleware and namespaces', function () {
diff --git a/server/tests/Support/TrackingPageDatabase.php b/server/tests/Support/TrackingPageDatabase.php
new file mode 100644
index 000000000..7dcb25704
--- /dev/null
+++ b/server/tests/Support/TrackingPageDatabase.php
@@ -0,0 +1,197 @@
+<?php
+
+namespace Fleetbase\Tests\Support;
+
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+
+/**
+ * An in-memory database holding the tables the public tracking page reads and writes,
+ * so its queries run for real in tests.
+ */
+final class TrackingPageDatabase
+{
+    public static function boot(): SQLiteConnection
+    {
+        $connection = new SQLiteConnection(new \PDO('sqlite::memory:'));
+        $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection, 'testing' => $connection]);
+        $resolver->setDefaultConnection('mysql');
+        EloquentModel::setConnectionResolver($resolver);
+        EloquentModel::clearBootedModels();
+
+        $schema = $connection->getSchemaBuilder();
+        $common = function ($table) {
+            $table->increments('id');
+            $table->string('_key')->nullable();
+            $table->string('uuid')->nullable();
+            $table->string('public_id')->nullable();
+            $table->string('company_uuid')->nullable();
+            $table->text('meta')->nullable();
+            $table->timestamp('created_at')->nullable();
+            $table->timestamp('updated_at')->nullable();
+            $table->timestamp('deleted_at')->nullable();
+        };
+
+        $schema->create('settings', function ($table) {
+            $table->increments('id');
+            $table->string('key')->nullable();
+            $table->text('value')->nullable();
+            $table->timestamp('created_at')->nullable();
+            $table->timestamp('updated_at')->nullable();
+        });
+        $schema->create('tracking_numbers', function ($table) use ($common) {
+            $common($table);
+            $table->string('tracking_number')->nullable();
+            $table->string('owner_uuid')->nullable();
+            $table->string('owner_type')->nullable();
+            $table->string('region')->nullable();
+            $table->string('status_uuid')->nullable();
+            $table->text('qr_code')->nullable();
+            $table->text('barcode')->nullable();
+        });
+        $schema->create('orders', function ($table) use ($common) {
+            $common($table);
+            $table->string('payload_uuid')->nullable();
+            $table->string('customer_uuid')->nullable();
+            $table->string('customer_type')->nullable();
+            $table->string('tracking_number_uuid')->nullable();
+            $table->string('driver_assigned_uuid')->nullable();
+            $table->string('vehicle_assigned_uuid')->nullable();
+            $table->string('status')->nullable();
+            $table->boolean('dispatched')->nullable();
+            $table->boolean('started')->nullable();
+            $table->timestamp('scheduled_at')->nullable();
+            $table->timestamp('started_at')->nullable();
+        });
+        $schema->create('payloads', function ($table) use ($common) {
+            $common($table);
+            $table->string('pickup_uuid')->nullable();
+            $table->string('dropoff_uuid')->nullable();
+            $table->string('pickup_tracking_number_uuid')->nullable();
+            $table->string('dropoff_tracking_number_uuid')->nullable();
+        });
+        $schema->create('waypoints', function ($table) use ($common) {
+            $common($table);
+            $table->string('payload_uuid')->nullable();
+            $table->string('place_uuid')->nullable();
+            $table->string('customer_uuid')->nullable();
+            $table->string('customer_type')->nullable();
+            $table->string('tracking_number_uuid')->nullable();
+            $table->integer('order')->nullable();
+        });
+        $schema->create('entities', function ($table) use ($common) {
+            $common($table);
+            $table->string('payload_uuid')->nullable();
+            $table->string('destination_uuid')->nullable();
+            $table->string('tracking_number_uuid')->nullable();
+            $table->string('customer_uuid')->nullable();
+            $table->string('customer_type')->nullable();
+            $table->string('photo_uuid')->nullable();
+            $table->string('name')->nullable();
+            $table->string('description')->nullable();
+            $table->string('price')->nullable();
+            $table->string('currency')->nullable();
+        });
+        $schema->create('proofs', function ($table) use ($common) {
+            $common($table);
+            $table->string('order_uuid')->nullable();
+            $table->string('subject_uuid')->nullable();
+            $table->string('subject_type')->nullable();
+            $table->string('file_uuid')->nullable();
+            $table->text('raw_data')->nullable();
+            $table->string('remarks')->nullable();
+            $table->text('data')->nullable();
+        });
+        $schema->create('companies', function ($table) use ($common) {
+            $common($table);
+            $table->string('name')->nullable();
+            $table->string('logo_uuid')->nullable();
+            $table->string('phone')->nullable();
+            $table->string('website_url')->nullable();
+            $table->text('options')->nullable();
+        });
+        $schema->create('places', function ($table) use ($common) {
+            $common($table);
+            $table->string('name')->nullable();
+            $table->string('street1')->nullable();
+            $table->string('city')->nullable();
+            $table->string('phone')->nullable();
+            $table->text('location')->nullable();
+        });
+        $schema->create('files', function ($table) use ($common) {
+            $common($table);
+            $table->string('type')->nullable();
+            $table->string('path')->nullable();
+            $table->string('disk')->nullable();
+        });
+        $schema->create('contacts', function ($table) use ($common) {
+            $common($table);
+            $table->string('user_uuid')->nullable();
+            $table->string('name')->nullable();
+            $table->string('email')->nullable();
+            $table->string('phone')->nullable();
+            $table->string('type')->nullable();
+        });
+        $schema->create('vendors', function ($table) use ($common) {
+            $common($table);
+            $table->string('name')->nullable();
+            $table->string('email')->nullable();
+            $table->string('phone')->nullable();
+        });
+        $schema->create('tracking_statuses', function ($table) use ($common) {
+            $common($table);
+            $table->string('tracking_number_uuid')->nullable();
+            $table->string('status')->nullable();
+            $table->string('details')->nullable();
+            $table->string('code')->nullable();
+            $table->boolean('complete')->nullable();
+        });
+        $schema->create('verification_codes', function ($table) {
+            $table->increments('id');
+            $table->string('uuid')->nullable();
+            $table->string('subject_uuid')->nullable();
+            $table->string('subject_type')->nullable();
+            $table->string('code')->nullable();
+            $table->string('for')->nullable();
+            $table->text('meta')->nullable();
+            $table->string('status')->nullable();
+            $table->timestamp('expires_at')->nullable();
+            $table->timestamp('created_at')->nullable();
+            $table->timestamp('updated_at')->nullable();
+            $table->timestamp('deleted_at')->nullable();
+        });
+        $schema->create('tracking_sessions', function ($table) {
+            $table->increments('id');
+            $table->string('uuid')->nullable();
+            $table->string('token_hash')->nullable();
+            $table->string('ip')->nullable();
+            $table->string('user_agent')->nullable();
+            $table->timestamp('last_seen_at')->nullable();
+            $table->timestamp('expires_at')->nullable();
+            $table->timestamp('revoked_at')->nullable();
+            $table->timestamp('created_at')->nullable();
+            $table->timestamp('updated_at')->nullable();
+        });
+        $schema->create('tracking_session_grants', function ($table) {
+            $table->increments('id');
+            $table->string('uuid')->nullable();
+            $table->string('tracking_session_uuid')->nullable();
+            $table->string('company_uuid')->nullable();
+            $table->string('order_uuid')->nullable();
+            $table->string('customer_type')->nullable();
+            $table->string('customer_uuid')->nullable();
+            $table->string('channel')->nullable();
+            $table->timestamp('expires_at')->nullable();
+            $table->timestamp('created_at')->nullable();
+            $table->timestamp('updated_at')->nullable();
+        });
+
+        return $connection;
+    }
+
+    public static function insert(SQLiteConnection $connection, string $table, array $row): void
+    {
+        $connection->table($table)->insert($row);
+    }
+}
diff --git a/server/tests/Unit/Support/TrackingCodeTest.php b/server/tests/Unit/Support/TrackingCodeTest.php
index 9057892a3..45e499165 100644
--- a/server/tests/Unit/Support/TrackingCodeTest.php
+++ b/server/tests/Unit/Support/TrackingCodeTest.php
@@ -144,3 +144,25 @@
             'version'         => 1,
         ]);
 });
+
+test('tracking page links name the company page when its settings send links there', function () {
+    app()->instance(Fleetbase\FleetOps\Support\TrackingPage\TrackingResolver::class, new class extends Fleetbase\FleetOps\Support\TrackingPage\TrackingResolver {
+        public function linkSlugFor(string $companyUuid): ?string
+        {
+            if ($companyUuid === 'broken') {
+                throw new RuntimeException('settings unavailable');
+            }
+
+            return $companyUuid === 'co-1' ? 'northwind' : null;
+        }
+    });
+
+    try {
+        expect(TrackingCode::pageUrl('NOR1', 'co-1'))->toEndWith('/~/track-order?order=NOR1&org=northwind')
+            ->and(TrackingCode::pageUrl('NOR1', 'co-2'))->toEndWith('/~/track-order?order=NOR1')
+            ->and(TrackingCode::pageUrl('NOR1', 'broken'))->toEndWith('/~/track-order?order=NOR1')
+            ->and(TrackingCode::pageUrl('NOR1'))->toEndWith('/~/track-order?order=NOR1');
+    } finally {
+        app()->forgetInstance(Fleetbase\FleetOps\Support\TrackingPage\TrackingResolver::class);
+    }
+});
diff --git a/server/tests/Unit/Support/TrackingPage/TrackingAccessTest.php b/server/tests/Unit/Support/TrackingPage/TrackingAccessTest.php
new file mode 100644
index 000000000..9efa27b2b
--- /dev/null
+++ b/server/tests/Unit/Support/TrackingPage/TrackingAccessTest.php
@@ -0,0 +1,177 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\TrackingSession;
+use Fleetbase\FleetOps\Models\TrackingSessionGrant;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingAccess;
+use Fleetbase\FleetOps\Support\TrackingScope;
+use Fleetbase\Models\VerificationCode;
+use Fleetbase\Tests\Support\TrackingPageDatabase;
+use Illuminate\Cache\ArrayStore;
+use Illuminate\Cache\RateLimiter;
+use Illuminate\Cache\Repository;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Http\Request;
+use Illuminate\Support\Carbon;
+
+beforeEach(function () {
+    config(['app.key' => 'base64:tracking-test-key', 'fleetops.tracking.cookie_same_site' => 'lax', 'session.secure' => false, 'session.domain' => null]);
+});
+
+afterEach(function () {
+    Carbon::setTestNow();
+    EloquentModel::unsetConnectionResolver();
+});
+
+function trackingAccess(): TrackingAccess
+{
+    return new TrackingAccess(new RateLimiter(new Repository(new ArrayStore())));
+}
+
+function trackingScope(string $customer = 'contact-1'): TrackingScope
+{
+    return new TrackingScope('order-1', Contact::class, $customer);
+}
+
+function trackingRequest(array $cookies = [], string $ip = '203.0.113.7'): Request
+{
+    return Request::create('/public/track/NOR1', 'GET', [], $cookies, [], ['REMOTE_ADDR' => $ip, 'HTTP_USER_AGENT' => 'PestBrowser']);
+}
+
+test('lookups, code checks and reports are limited per address', function () {
+    $access  = trackingAccess();
+    $request = trackingRequest();
+
+    foreach (range(1, TrackingAccess::LOOKUPS_PER_IP) as $attempt) {
+        expect($access->allowLookup($request))->toBeTrue();
+    }
+
+    expect($access->allowLookup($request))->toBeFalse()
+        ->and($access->allowLookup(trackingRequest([], '198.51.100.1')))->toBeTrue();
+
+    foreach (range(1, TrackingAccess::VERIFIES_PER_IP) as $attempt) {
+        $access->allowVerify($request);
+    }
+    expect($access->allowVerify($request))->toBeFalse();
+
+    foreach (range(1, TrackingAccess::REPORTS_PER_HOUR) as $attempt) {
+        expect($access->allowReport($request, 'order-1'))->toBeTrue();
+    }
+    expect($access->allowReport($request, 'order-1'))->toBeFalse()
+        ->and($access->allowReport($request, 'order-2'))->toBeTrue();
+});
+
+test('sending codes is limited by cooldown, per scope and per address', function () {
+    $access  = trackingAccess();
+    $request = trackingRequest();
+
+    expect($access->claimSend(trackingScope(), $request))->toBe(['status' => TrackingAccess::SEND_SENT, 'retry_after' => TrackingAccess::RESEND_SECONDS])
+        ->and($access->claimSend(trackingScope(), $request)['status'])->toBe(TrackingAccess::SEND_COOLDOWN);
+
+    // Three sends per scope in the window, even after each cooldown.
+    $limiter = new RateLimiter(new Repository(new ArrayStore()));
+    $access  = new TrackingAccess($limiter);
+    foreach (range(1, TrackingAccess::SENDS_PER_SCOPE) as $send) {
+        $limiter->clear('trk-resend:' . trackingScope()->key());
+        expect($access->claimSend(trackingScope(), trackingRequest([], '198.51.100.' . $send))['status'])->toBe(TrackingAccess::SEND_SENT);
+    }
+    $limiter->clear('trk-resend:' . trackingScope()->key());
+    expect($access->claimSend(trackingScope(), $request)['status'])->toBe(TrackingAccess::SEND_LIMITED);
+
+    // Five sends per address across scopes.
+    $access = trackingAccess();
+    foreach (range(1, TrackingAccess::SENDS_PER_IP) as $send) {
+        $access->claimSend(trackingScope('contact-' . $send), $request);
+    }
+    expect($access->claimSend(trackingScope('contact-9'), $request)['status'])->toBe(TrackingAccess::SEND_LIMITED);
+});
+
+test('codes are issued hashed, checked, and pause the scope after three wrong ones', function () {
+    TrackingPageDatabase::boot();
+    $access = trackingAccess();
+    $scope  = trackingScope();
+
+    $first  = $access->issueCode($scope, null, 'sms');
+    $second = $access->issueCode($scope, null, 'email');
+
+    expect(VerificationCode::withoutGlobalScopes()->count())->toBe(1)
+        ->and($second->plainCode)->toMatch('/^\d{6}$/')
+        ->and($second->code)->not->toBe($second->plainCode)
+        ->and($second->getMeta('scope'))->toBe($scope->key())
+        ->and($second->getMeta('channel'))->toBe('email')
+        ->and($first->plainCode)->not->toBeNull();
+
+    $wrong = $second->plainCode === '111111' ? '222222' : '111111';
+    expect($access->checkCode($scope, $wrong))->toBe(['status' => VerificationCode::CHECK_INVALID, 'attempts_left' => 2])
+        ->and($access->pausedFor($scope))->toBe(0);
+
+    expect($access->checkCode($scope, $second->plainCode))->toBe(['status' => VerificationCode::CHECK_VALID, 'channel' => 'email'])
+        ->and(VerificationCode::withoutGlobalScopes()->count())->toBe(0)
+        ->and($access->checkCode($scope, $second->plainCode))->toBe(['status' => VerificationCode::CHECK_EXPIRED]);
+
+    $third = $access->issueCode($scope, null, 'sms');
+    $wrong = $third->plainCode === '111111' ? '222222' : '111111';
+    $access->checkCode($scope, $wrong);
+    $access->checkCode($scope, $wrong);
+    expect($access->checkCode($scope, $wrong))->toBe(['status' => VerificationCode::CHECK_LOCKED, 'attempts_left' => 0])
+        ->and($access->pausedFor($scope))->toBeGreaterThan(0)
+        ->and($access->claimSend($scope, trackingRequest())['status'])->toBe(TrackingAccess::SEND_PAUSED);
+});
+
+test('a correct code gives the device a session and a grant for that customer only', function () {
+    TrackingPageDatabase::boot();
+    Carbon::setTestNow(Carbon::parse('2026-10-08 09:00:00'));
+    $access = trackingAccess();
+    $scope  = trackingScope();
+
+    expect($access->session(trackingRequest()))->toBeNull()
+        ->and($access->session(trackingRequest([TrackingAccess::COOKIE => 'short'])))->toBeNull()
+        ->and($access->hasGrant(trackingRequest(), null))->toBeFalse();
+
+    $cookie = $access->grant(trackingRequest(), $scope, 'sms', 24);
+    $token  = $cookie->getValue();
+    $device = trackingRequest([TrackingAccess::COOKIE => $token]);
+
+    expect($cookie->getName())->toBe(TrackingAccess::COOKIE)
+        ->and($cookie->isHttpOnly())->toBeTrue()
+        ->and($cookie->getSameSite())->toBe('lax')
+        ->and(TrackingSession::query()->value('token_hash'))->toBe(hash('sha256', $token))
+        ->and(TrackingSession::query()->first()->grants()->count())->toBe(1)
+        ->and($access->hasGrant($device, $scope))->toBeTrue()
+        ->and($access->hasGrant($device, trackingScope('contact-2')))->toBeFalse()
+        ->and($access->grantExpiresAt($device, $scope))->toBe('2026-10-09T09:00:00.000000Z')
+        ->and($access->grantExpiresAt(trackingRequest(), $scope))->toBeNull();
+
+    // A second customer on the same device; a longer session extends the cookie, a shorter one doesn't.
+    expect($access->grant($device, trackingScope('contact-2'), 'email', 12))->toBeNull()
+        ->and($access->grant($device, trackingScope('contact-2'), 'email', 48)?->getValue())->toBe($token)
+        ->and(TrackingSessionGrant::query()->count())->toBe(2);
+
+    // Signing out of one delivery keeps the others.
+    expect($access->revoke($device, $scope))->toBeNull()
+        ->and($access->hasGrant($device, $scope))->toBeFalse()
+        ->and($access->hasGrant($device, trackingScope('contact-2')))->toBeTrue();
+
+    $expired = $access->revoke($device);
+    expect($expired->getValue())->toBe('')
+        ->and($expired->getExpiresTime())->toBe(1)
+        ->and($access->session($device))->toBeNull()
+        ->and($access->revoke($device)->getExpiresTime())->toBe(1);
+
+    // Expired sessions don't count.
+    $fresh = $access->grant(trackingRequest(), $scope, 'sms', 1);
+    Carbon::setTestNow(Carbon::parse('2026-10-08 11:00:00'));
+    expect($access->session(trackingRequest([TrackingAccess::COOKIE => $fresh->getValue()])))->toBeNull();
+});
+
+test('the session cookie follows the same-site setting', function () {
+    $access = trackingAccess();
+
+    config(['fleetops.tracking.cookie_same_site' => 'none']);
+    $none = $access->cookie('value', 60);
+    expect($none->getSameSite())->toBe('none')->and($none->isSecure())->toBeTrue();
+
+    config(['fleetops.tracking.cookie_same_site' => 'bogus', 'session.secure' => true]);
+    $fallback = $access->cookie('value', 60);
+    expect($fallback->getSameSite())->toBe('lax')->and($fallback->isSecure())->toBeTrue();
+});
diff --git a/server/tests/Unit/Support/TrackingPage/TrackingRecipientTest.php b/server/tests/Unit/Support/TrackingPage/TrackingRecipientTest.php
new file mode 100644
index 000000000..87ea6de36
--- /dev/null
+++ b/server/tests/Unit/Support/TrackingPage/TrackingRecipientTest.php
@@ -0,0 +1,51 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingRecipient;
+use Fleetbase\FleetOps\Support\TrackingScope;
+use Fleetbase\Tests\Support\TrackingPageDatabase;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+
+afterEach(function () {
+    EloquentModel::unsetConnectionResolver();
+});
+
+test('a scope finds its contact or vendor and the details a code can use', function () {
+    $db = TrackingPageDatabase::boot();
+    TrackingPageDatabase::insert($db, 'contacts', ['uuid' => 'contact-1', 'email' => 'maya@example.com', 'phone' => '+1 (510) 555-4821']);
+    TrackingPageDatabase::insert($db, 'vendors', ['uuid' => 'vendor-1', 'email' => 'not-an-email', 'phone' => '12']);
+
+    $contact = TrackingRecipient::for(new TrackingScope('order-1', Contact::class, 'contact-1'));
+    expect($contact->customer?->uuid)->toBe('contact-1')
+        ->and($contact->email)->toBe('maya@example.com')
+        ->and($contact->phone)->toBe('+1 (510) 555-4821')
+        ->and($contact->destination(TrackingRecipient::CHANNEL_SMS))->toBe('+1 (510) 555-4821')
+        ->and($contact->destination(TrackingRecipient::CHANNEL_EMAIL))->toBe('maya@example.com')
+        ->and($contact->destination('fax'))->toBeNull();
+
+    // Unusable details are dropped, and the stop's place phone stands in for a missing one.
+    $vendor = TrackingRecipient::for(new TrackingScope('order-1', Vendor::class, 'vendor-1'), '+65 6555 1234');
+    expect($vendor->customer?->uuid)->toBe('vendor-1')
+        ->and($vendor->email)->toBeNull()
+        ->and($vendor->phone)->toBe('+65 6555 1234');
+
+    $unknown = TrackingRecipient::for(new TrackingScope('order-1', Place::class, 'place-1'));
+    expect($unknown->customer)->toBeNull()
+        ->and($unknown->email)->toBeNull()
+        ->and($unknown->phone)->toBeNull()
+        ->and(TrackingRecipient::for(null)->customer)->toBeNull();
+});
+
+test('channels follow the settings and the instance, with masked destinations', function () {
+    $recipient = new TrackingRecipient(null, 'maya.chen@gmail.com', '+15105554821');
+
+    expect($recipient->channels([], true))->toBe([
+        ['type' => 'sms', 'masked' => '•••• •• 4821'],
+        ['type' => 'email', 'masked' => 'm•••@g•••.com'],
+    ])
+        ->and($recipient->channels([], false))->toBe([['type' => 'email', 'masked' => 'm•••@g•••.com']])
+        ->and($recipient->channels(['access' => ['channels' => ['sms' => false, 'email' => false]]], true))->toBe([])
+        ->and(TrackingRecipient::maskEmail('ops@localhost'))->toBe('o•••@l•••');
+});
diff --git a/server/tests/Unit/Support/TrackingPage/TrackingResolverTest.php b/server/tests/Unit/Support/TrackingPage/TrackingResolverTest.php
new file mode 100644
index 000000000..40f2ee855
--- /dev/null
+++ b/server/tests/Unit/Support/TrackingPage/TrackingResolverTest.php
@@ -0,0 +1,181 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Models\TrackingNumber;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingPageConfig;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingResolver;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingTarget;
+use Fleetbase\Tests\Support\TrackingPageDatabase;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+
+afterEach(function () {
+    EloquentModel::unsetConnectionResolver();
+});
+
+function trackingResolverFixture(): Illuminate\Database\SQLiteConnection
+{
+    $db = TrackingPageDatabase::boot();
+
+    $rows = [
+        'tracking_numbers' => [
+            ['uuid' => 'tn-order', 'company_uuid' => 'co-1', 'tracking_number' => 'NOR1000000001US', 'owner_uuid' => 'order-1', 'owner_type' => Order::class],
+            ['uuid' => 'tn-stop', 'company_uuid' => 'co-1', 'tracking_number' => 'NOR1000000002US', 'owner_uuid' => 'wp-1', 'owner_type' => Waypoint::class],
+            ['uuid' => 'tn-item', 'company_uuid' => 'co-1', 'tracking_number' => 'NOR1000000003US', 'owner_uuid' => 'entity-1', 'owner_type' => Entity::class],
+            ['uuid' => 'tn-loose-item', 'company_uuid' => 'co-1', 'tracking_number' => 'NOR1000000004US', 'owner_uuid' => 'entity-2', 'owner_type' => Entity::class],
+            ['uuid' => 'tn-dropoff', 'company_uuid' => 'co-1', 'tracking_number' => 'NOR1000000005US', 'owner_uuid' => 'place-dropoff', 'owner_type' => Place::class],
+            ['uuid' => 'tn-orphan-stop', 'company_uuid' => 'co-1', 'tracking_number' => 'NOR1000000006US', 'owner_uuid' => 'wp-orphan', 'owner_type' => Waypoint::class],
+            ['uuid' => 'tn-orphan-item', 'company_uuid' => 'co-1', 'tracking_number' => 'NOR1000000007US', 'owner_uuid' => 'entity-orphan', 'owner_type' => Entity::class],
+            ['uuid' => 'tn-orphan-place', 'company_uuid' => 'co-1', 'tracking_number' => 'NOR1000000008US', 'owner_uuid' => 'place-loose', 'owner_type' => Place::class],
+            ['uuid' => 'tn-missing', 'company_uuid' => 'co-1', 'tracking_number' => 'NOR1000000009US', 'owner_uuid' => 'gone', 'owner_type' => Order::class],
+            ['uuid' => 'tn-other', 'company_uuid' => 'co-2', 'tracking_number' => 'HAR2000000001US', 'owner_uuid' => 'order-2', 'owner_type' => Order::class],
+        ],
+        'orders' => [
+            ['uuid' => 'order-1', 'public_id' => 'order_one', 'company_uuid' => 'co-1', 'payload_uuid' => 'payload-1', 'customer_uuid' => 'contact-shipper', 'customer_type' => Contact::class, 'tracking_number_uuid' => 'tn-order'],
+            ['uuid' => 'order-2', 'public_id' => 'order_two', 'company_uuid' => 'co-2', 'payload_uuid' => 'payload-2', 'customer_uuid' => 'contact-other', 'customer_type' => Contact::class],
+        ],
+        'places' => [
+            ['uuid' => 'place-dropoff', 'name' => 'Front desk'],
+            ['uuid' => 'place-loose', 'name' => 'Loose'],
+        ],
+        'payloads' => [
+            ['uuid' => 'payload-1', 'dropoff_tracking_number_uuid' => 'tn-dropoff'],
+        ],
+        'waypoints' => [
+            ['uuid' => 'wp-1', 'public_id' => 'waypoint_one', 'payload_uuid' => 'payload-1', 'place_uuid' => 'place-a', 'customer_uuid' => 'contact-a', 'customer_type' => Contact::class],
+            ['uuid' => 'wp-orphan', 'payload_uuid' => 'payload-none', 'place_uuid' => 'place-x'],
+        ],
+        'entities' => [
+            ['uuid' => 'entity-1', 'payload_uuid' => 'payload-1', 'destination_uuid' => 'place-a'],
+            ['uuid' => 'entity-2', 'payload_uuid' => 'payload-1'],
+            ['uuid' => 'entity-orphan', 'payload_uuid' => 'payload-none'],
+        ],
+    ];
+
+    foreach ($rows as $table => $records) {
+        foreach ($records as $record) {
+            TrackingPageDatabase::insert($db, $table, $record);
+        }
+    }
+
+    return $db;
+}
+
+function trackingResolverSetting($db, string $key, mixed $value): void
+{
+    TrackingPageDatabase::insert($db, 'settings', ['key' => $key, 'value' => json_encode($value)]);
+}
+
+test('tracking numbers are normalized and anything else is refused', function () {
+    expect(TrackingResolver::normalize('  NOR1000000001US '))->toBe('NOR1000000001US')
+        ->and(TrackingResolver::normalize('a.b_c-1'))->toBe('a.b_c-1')
+        ->and(TrackingResolver::normalize(['NOR1']))->toBeNull()
+        ->and(TrackingResolver::normalize(''))->toBeNull()
+        ->and(TrackingResolver::normalize('-NOR'))->toBeNull()
+        ->and(TrackingResolver::normalize("NOR1' OR 1=1"))->toBeNull()
+        ->and(TrackingResolver::normalize(str_repeat('A', 101)))->toBeNull()
+        ->and((new TrackingResolver())->resolve('../etc'))->toBeNull();
+});
+
+test('each kind of tracking number opens its order for the right customer', function () {
+    trackingResolverFixture();
+    $resolver = new TrackingResolver();
+
+    $order = $resolver->resolve('NOR1000000001US');
+    expect($order)->toBeInstanceOf(TrackingTarget::class)
+        ->and($order->kind)->toBe(TrackingTarget::KIND_ORDER)
+        ->and($order->order->uuid)->toBe('order-1')
+        ->and($order->scope->customer_uuid)->toBe('contact-shipper')
+        ->and($order->companyUuid())->toBe('co-1')
+        ->and($order->config['generic_page']['allowed'])->toBeTrue();
+
+    $stop = $resolver->resolve('NOR1000000002US');
+    expect($stop->kind)->toBe(TrackingTarget::KIND_STOP)
+        ->and($stop->waypoint->uuid)->toBe('wp-1')
+        ->and($stop->scope->customer_uuid)->toBe('contact-a');
+
+    $item = $resolver->resolve('NOR1000000003US');
+    expect($item->kind)->toBe(TrackingTarget::KIND_ITEM)
+        ->and($item->waypoint->uuid)->toBe('wp-1')
+        ->and($item->scope->customer_uuid)->toBe('contact-a');
+
+    // An item with no destination stop belongs to the order's customer.
+    $loose = $resolver->resolve('NOR1000000004US');
+    expect($loose->waypoint)->toBeNull()
+        ->and($loose->scope->customer_uuid)->toBe('contact-shipper');
+
+    $dropoff = $resolver->resolve('NOR1000000005US');
+    expect($dropoff->kind)->toBe(TrackingTarget::KIND_STOP)
+        ->and($dropoff->scope->customer_uuid)->toBe('contact-shipper');
+
+    foreach (['NOR1000000006US', 'NOR1000000007US', 'NOR1000000008US', 'NOR1000000009US', 'UNKNOWN1'] as $number) {
+        expect($resolver->resolve($number))->toBeNull();
+    }
+});
+
+test('companies that opted out of the shared page, or a disabled shared page, resolve to nothing', function () {
+    $db       = trackingResolverFixture();
+    $resolver = new TrackingResolver();
+
+    trackingResolverSetting($db, 'company.co-1.' . TrackingPageConfig::SETTING_KEY, ['generic_page' => ['allowed' => false]]);
+    expect($resolver->resolve('NOR1000000001US'))->toBeNull()
+        ->and($resolver->resolve('HAR2000000001US'))->not->toBeNull();
+
+    trackingResolverSetting($db, TrackingPageConfig::ADMIN_SETTING_KEY, ['generic_page' => ['enabled' => false]]);
+    expect($resolver->resolve('HAR2000000001US'))->toBeNull()
+        ->and($resolver->adminConfig()['generic_page']['enabled'])->toBeFalse();
+});
+
+test('a company page finds only its own numbers, at its own enabled slug', function () {
+    $db       = trackingResolverFixture();
+    $resolver = new TrackingResolver();
+
+    expect($resolver->companyForSlug('NOT A SLUG'))->toBeNull()
+        ->and($resolver->companyForSlug('northwind'))->toBeNull();
+
+    trackingResolverSetting($db, TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind', ['company' => 'not-a-string']);
+    expect($resolver->companyForSlug('northwind'))->toBeNull();
+
+    $db->table('settings')->where('key', TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind')->update(['value' => json_encode('co-1')]);
+    // Indexed, but the page is off.
+    expect($resolver->companyForSlug('northwind'))->toBeNull()
+        ->and($resolver->linkSlugFor('co-1'))->toBeNull();
+
+    trackingResolverSetting($db, 'company.co-1.' . TrackingPageConfig::SETTING_KEY, ['org_page' => ['enabled' => true, 'slug' => 'northwind'], 'generic_page' => ['allowed' => false]]);
+    expect($resolver->companyForSlug(' Northwind '))->toBe('co-1')
+        ->and($resolver->linkSlugFor('co-1'))->toBe('northwind');
+
+    // The company page works even with the shared page turned off, and only for its numbers.
+    expect($resolver->resolve('NOR1000000001US', 'northwind')?->order->uuid)->toBe('order-1')
+        ->and($resolver->resolve('HAR2000000001US', 'northwind'))->toBeNull()
+        ->and($resolver->resolve('NOR1000000001US', 'harbor'))->toBeNull();
+
+    // An index entry left behind by a slug the company changed no longer resolves.
+    trackingResolverSetting($db, TrackingPageConfig::SLUG_INDEX_PREFIX . 'old-name', 'co-1');
+    expect($resolver->companyForSlug('old-name'))->toBeNull();
+
+    $db->table('settings')->where('key', 'company.co-1.' . TrackingPageConfig::SETTING_KEY)->update(['value' => json_encode(['org_page' => ['enabled' => true, 'slug' => 'northwind'], 'links' => ['target' => 'generic']])]);
+    expect($resolver->linkSlugFor('co-1'))->toBeNull();
+});
+
+test('a target owned by another company is refused on a company page', function () {
+    trackingResolverFixture();
+
+    $resolver = new class extends TrackingResolver {
+        public function companyForSlug(?string $slug): ?string
+        {
+            return 'co-2';
+        }
+
+        protected function findTrackingNumber(string $number, ?string $companyUuid): ?TrackingNumber
+        {
+            return parent::findTrackingNumber($number, null);
+        }
+    };
+
+    expect($resolver->resolve('NOR1000000001US', 'harbor'))->toBeNull()
+        ->and($resolver->targetFor(new TrackingNumber()))->toBeNull();
+});
diff --git a/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php b/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php
new file mode 100644
index 000000000..cce239c75
--- /dev/null
+++ b/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php
@@ -0,0 +1,417 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Models\Proof;
+use Fleetbase\FleetOps\Models\TrackingNumber;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingPageConfig;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingTarget;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingView;
+use Fleetbase\FleetOps\Support\TrackingScope;
+use Fleetbase\FleetOps\Tracking\TrackingContextBuilder;
+use Fleetbase\FleetOps\Tracking\TrackingIntelligenceService;
+use Fleetbase\FleetOps\Tracking\TrackingStop;
+use Fleetbase\LaravelMysqlSpatial\Types\Point;
+use Fleetbase\Tests\Support\TrackingPageDatabase;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Collection;
+
+class TrackingViewPlace extends Place
+{
+    protected $casts   = [];
+    protected $appends = [];
+
+    public function getAddressAttribute()
+    {
+        return $this->attributes['street1'] ?? null;
+    }
+}
+
+class TrackingViewDriver extends Driver
+{
+    protected $casts   = [];
+    protected $appends = [];
+}
+
+/**
+ * A TrackingView whose stops, tracker, items, proofs and instructions come from the test.
+ */
+class TrackingViewProbe extends TrackingView
+{
+    public Collection $stops;
+    public array $tracker       = [];
+    public ?Collection $entities = null;
+    public ?Collection $proofRows = null;
+    public array $proofQueries  = [];
+
+    protected function stopsFor(Order $order): Collection
+    {
+        return $this->stops;
+    }
+
+    protected function trackerFor(Order $order): array
+    {
+        return $this->tracker;
+    }
+
+    protected function entitiesFor(Order $order, array $placeUuids, TrackingScope $scope): Collection
+    {
+        return $this->entities ?? parent::entitiesFor($order, $placeUuids, $scope);
+    }
+
+    protected function proofsFor(array $subjectUuids): Collection
+    {
+        $this->proofQueries[] = $subjectUuids;
+
+        return $this->proofRows ?? parent::proofsFor($subjectUuids);
+    }
+}
+
+afterEach(function () {
+    Carbon::setTestNow();
+    EloquentModel::unsetConnectionResolver();
+});
+
+function trackingViewPlace(string $uuid, string $name, float $lat, float $lng): TrackingViewPlace
+{
+    $place = new TrackingViewPlace();
+    $place->setRawAttributes(['uuid' => $uuid, 'public_id' => 'place_' . $uuid, 'name' => $name, 'street1' => $name . ' street', 'location' => new Point($lat, $lng)], true);
+
+    return $place;
+}
+
+function trackingViewWaypoint(string $uuid, ?string $customer, array $extra = []): Waypoint
+{
+    $waypoint = new Waypoint();
+    $waypoint->setRawAttributes(array_merge(['uuid' => $uuid, 'public_id' => 'waypoint_' . $uuid, 'customer_uuid' => $customer, 'customer_type' => $customer ? Contact::class : null], $extra), true);
+
+    return $waypoint;
+}
+
+/**
+ * An order with a pickup and two stops: stop A for contact-a, stop B for contact-b.
+ */
+function trackingViewOrder(array $attributes = []): Order
+{
+    $order = new Order();
+    $order->setRawAttributes(array_merge([
+        'uuid'                 => 'order-1',
+        'company_uuid'         => 'co-1',
+        'payload_uuid'         => 'payload-1',
+        'customer_uuid'        => 'contact-shipper',
+        'customer_type'        => Contact::class,
+        'tracking_number_uuid' => 'tn-order',
+        'status'               => 'started',
+        'started'              => true,
+        'dispatched'           => true,
+        'notes'                => 'Gate code 1234',
+        'meta'                 => json_encode(['secret' => 'internal']),
+        'updated_at'           => '2026-10-08 08:30:00',
+    ], $attributes), true);
+
+    $driver = new TrackingViewDriver();
+    $driver->setRawAttributes(['uuid' => 'driver-1', 'name' => 'Daniel Okafor', 'phone' => '+15550001111', 'online' => 1, 'heading' => 92, 'location' => new Point(1.30123456, 103.80123456), 'updated_at' => '2026-10-08 08:59:00'], true);
+    $order->setRelation('driverAssigned', $driver);
+    $order->setRelation('vehicleAssigned', null);
+
+    return $order;
+}
+
+function trackingViewStops(bool $aComplete = false): Collection
+{
+    return collect([
+        new TrackingStop('place-pickup', 'place_pickup', 'pickup', 'completed', trackingViewPlace('pickup', 'Sender Warehouse', 1.2876, 103.8456), null, true, 0, null),
+        new TrackingStop('place-a', 'place_a', 'waypoint', $aComplete ? 'completed' : 'pending', trackingViewPlace('place-a', 'Maya Flat', 1.3333333, 103.7777777), trackingViewWaypoint('wp-a', 'contact-a', ['time_window_start' => '2026-10-08 14:10:00', 'time_window_end' => '2026-10-08 14:40:00']), $aComplete, 1, 'tn-a'),
+        new TrackingStop('place-b', 'place_b', 'waypoint', 'pending', trackingViewPlace('place-b', 'Other Customer House', 1.4, 103.9), trackingViewWaypoint('wp-b', 'contact-b'), false, 2, 'tn-b'),
+    ]);
+}
+
+function trackingViewTarget(Order $order, ?TrackingScope $scope, array $config = [], ?Waypoint $waypoint = null): TrackingTarget
+{
+    $trackingNumber = new TrackingNumber();
+    $trackingNumber->setRawAttributes(['uuid' => 'tn-a', 'tracking_number' => 'NOR1000000002US'], true);
+
+    return new TrackingTarget($order, $scope, $trackingNumber, TrackingTarget::KIND_STOP, $waypoint, TrackingPageConfig::sanitize($config));
+}
+
+function trackingViewTracker(): array
+{
+    return [
+        'confidence' => 'high',
+        'insights'   => ['is_delayed' => true],
+        'route'      => [
+            'polyline' => '_p~iF~ps|U_ulLnnqC',
+            'legs'     => [
+                ['stop' => ['sequence' => 1], 'eta_seconds' => 1500, 'eta_at' => '2026-10-08T14:24:00.000000Z'],
+                ['stop' => ['sequence' => 2], 'eta_seconds' => 2400, 'eta_at' => '2026-10-08T14:40:00.000000Z'],
+            ],
+        ],
+        'eta'        => ['completion_at' => '2026-10-08T15:00:00.000000Z', 'completion_seconds' => 3600],
+    ];
+}
+
+function trackingViewEntity(string $uuid, ?string $destination, array $extra = []): Entity
+{
+    $entity = new Entity();
+    $entity->setRawAttributes(array_merge(['uuid' => $uuid, 'public_id' => 'entity_' . $uuid, 'name' => 'Item ' . $uuid, 'description' => 'Boxed', 'destination_uuid' => $destination, 'price' => '1500', 'currency' => 'SGD', 'meta' => json_encode(['quantity' => 2, 'secret' => 'x'])], $extra), true);
+    $entity->setRelation('trackingNumber', null);
+
+    return $entity;
+}
+
+test('branding falls back to the company, then the instance', function () {
+    $view    = new TrackingView();
+    $company = (object) ['name' => 'Northwind Couriers', 'logo_uuid' => 'logo-1', 'logo_url' => 'https://cdn.example/logo.png', 'phone' => '+15105550142', 'website_url' => 'https://northwind.example'];
+
+    $branding = $view->branding(TrackingPageConfig::sanitize(['branding' => ['accent' => '#5CC9BE', 'support_email' => 'help@northwind.example']]), $company);
+    expect($branding)->toMatchArray([
+        'name'          => 'Northwind Couriers',
+        'logo_url'      => 'https://cdn.example/logo.png',
+        'accent'        => '#5CC9BE',
+        'ink'           => '#14191A',
+        'support_phone' => '+15105550142',
+        'support_email' => 'help@northwind.example',
+        'website'       => 'https://northwind.example',
+        'powered_by'    => true,
+    ]);
+
+    $instance = $view->branding(['branding' => ['display_name' => 'Fleetbase']], null, 'https://instance.example/logo.png');
+    expect($instance['name'])->toBe('Fleetbase')
+        ->and($instance['logo_url'])->toBe('https://instance.example/logo.png')
+        ->and($instance['accent'])->toBe(TrackingPageConfig::DEFAULT_ACCENT)
+        ->and($instance['locales'])->toBe(TrackingPageConfig::LOCALES);
+});
+
+test('the coarse stage follows the order and the customer stops', function () {
+    $view   = new TrackingViewProbe();
+    $scopeA = new TrackingScope('order-1', Contact::class, 'contact-a');
+    $update = fn (Order $order, bool $complete = false) => new Fleetbase\FleetOps\Support\TrackingUpdate($order, $scopeA, trackingViewStops($complete));
+
+    expect($view->stage(trackingViewOrder(['status' => 'canceled']), null))->toBe('canceled')
+        ->and($view->stage(trackingViewOrder(['status' => 'attempt_failed']), null))->toBe('issue')
+        ->and($view->stage(trackingViewOrder(['status' => 'completed']), null))->toBe('delivered')
+        ->and($view->stage(trackingViewOrder(), $update(trackingViewOrder(), true)))->toBe('delivered')
+        ->and($view->stage(trackingViewOrder(), $update(trackingViewOrder())))->toBe('in_transit')
+        ->and($view->stage(trackingViewOrder(['started' => false, 'status' => 'dispatched']), null))->toBe('dispatched')
+        ->and($view->stage(trackingViewOrder(['started' => false, 'dispatched' => false, 'status' => 'created', 'scheduled_at' => '2099-01-01 09:00:00']), null))->toBe('scheduled')
+        ->and($view->stage(trackingViewOrder(['started' => false, 'dispatched' => false, 'status' => 'created']), null))->toBe('preparing');
+});
+
+test('a tracking number alone shows the stage, the last update and how to verify', function () {
+    $view        = new TrackingViewProbe();
+    $view->stops = trackingViewStops();
+    $scopeA      = new TrackingScope('order-1', Contact::class, 'contact-a');
+
+    $public = $view->publicView(trackingViewTarget(trackingViewOrder(), $scopeA), ['name' => 'Northwind'], [['type' => 'sms', 'masked' => '•••• •• 4821']], true);
+    expect($public)->toBe([
+        'level'           => 0,
+        'tracking_number' => 'NOR1000000002US',
+        'company'         => ['name' => 'Northwind'],
+        'stage'           => 'in_transit',
+        'last_update_on'  => '2026-10-08',
+        'verify'          => ['channels' => [['type' => 'sms', 'masked' => '•••• •• 4821']]],
+        'sign_in'         => true,
+    ]);
+
+    $hidden = $view->publicView(trackingViewTarget(trackingViewOrder(), null, ['access' => ['public_status' => false]]), [], [], false);
+    expect($hidden['stage'])->toBeNull()->and($hidden['last_update_on'])->toBeNull();
+});
+
+test('a verified customer sees only their own stop on an order with several customers', function () {
+    Carbon::setTestNow(Carbon::parse('2026-10-08 09:00:00'));
+    TrackingPageDatabase::boot();
+
+    $view           = new TrackingViewProbe();
+    $view->stops    = trackingViewStops();
+    $view->tracker  = trackingViewTracker();
+    $view->entities = collect([trackingViewEntity('a1', 'place-a')]);
+    $order          = trackingViewOrder(['meta' => json_encode(['recipient_instructions' => [sha1('order-1:' . Contact::class . ':contact-a') => 'Leave with concierge']])]);
+    $scopeA         = new TrackingScope('order-1', Contact::class, 'contact-a', $order);
+
+    $data = $view->fullView(trackingViewTarget($order, $scopeA, ['visibility' => ['instructions_edit' => true]], $view->stops[1]->waypoint), ['name' => 'Northwind'], TrackingView::VIEWER_VERIFIED, '2026-10-09T09:00:00.000000Z');
+
+    expect($data['level'])->toBe(1)
+        ->and($data['viewer'])->toBe('verified')
+        ->and($data['stage'])->toBe('in_transit')
+        ->and($data['status'])->toBe(['code' => 'started', 'delayed' => true, 'confidence' => 'high'])
+        ->and($data['focus_stop'])->toBe('waypoint_wp-a')
+        ->and($data['route'])->toBe(['total_stops' => 3, 'completed_stops' => 1, 'stops_before' => 0])
+        ->and($data['stops'])->toHaveCount(1)
+        ->and($data['stops'][0])->toMatchArray([
+            'id'       => 'waypoint_wp-a',
+            'sequence' => 1,
+            'complete' => false,
+            'place'    => ['name' => 'Maya Flat', 'address' => 'Maya Flat street', 'latitude' => 1.33333, 'longitude' => 103.77778],
+        ])
+        ->and($data['stops'][0]['eta']['at'])->toBe('2026-10-08T14:24:00.000000Z')
+        ->and($data['stops'][0]['window']['start'])->toBe('2026-10-08T14:10:00.000000Z')
+        ->and($data['eta'])->toBe(['at' => '2026-10-08T14:24:00.000000Z', 'seconds' => 1500, 'confidence' => 'high'])
+        ->and($data['driver'])->toBe(['name' => 'Daniel', 'vehicle' => null, 'online' => true])
+        ->and($data['location']['latitude'])->toBe(1.3012)
+        ->and($data['map'])->toBe(['hub' => ['latitude' => 1.29, 'longitude' => 103.85], 'polyline' => null])
+        ->and($data['items'])->toBe([['id' => 'entity_a1', 'name' => 'Item a1', 'description' => 'Boxed', 'quantity' => 2]])
+        ->and($data['instructions'])->toBe(['text' => 'Leave with concierge', 'editable' => true])
+        ->and($data['actions'])->toBe(['report' => true, 'driver_contact' => 'company'])
+        ->and($data['session'])->toBe(['expires_at' => '2026-10-09T09:00:00.000000Z'])
+        ->and($data['stale_after'])->toBe(300)
+        ->and($data['proofs'])->toBe([]);
+
+    // Nothing of the other customer, the sender, the driver or the order internals.
+    $json = json_encode($data);
+    foreach (['Other Customer House', 'waypoint_wp-b', 'Sender Warehouse', 'Okafor', '+15550001111', 'Gate code', 'internal', 'order-1', 'contact-a', 'co-1', 'SGD'] as $leak) {
+        expect($json)->not->toContain($leak);
+    }
+});
+
+test('the route line, prices and proofs appear only when the customer may see them', function () {
+    Carbon::setTestNow(Carbon::parse('2026-10-08 09:00:00'));
+    TrackingPageDatabase::boot();
+
+    // Every stop belongs to the order customer: the route line is theirs to see.
+    $order       = trackingViewOrder(['status' => 'completed']);
+    $scope       = new TrackingScope('order-1', Contact::class, 'contact-shipper', $order);
+    $view        = new TrackingViewProbe();
+    $view->stops = collect([
+        new TrackingStop('place-pickup', 'place_pickup', 'pickup', 'completed', trackingViewPlace('pickup', 'Sender', 1.28, 103.84), null, true, 0, null),
+        new TrackingStop('place-d', 'place_d', 'dropoff', 'completed', trackingViewPlace('place-d', 'Home', 1.35, 103.85), null, true, 1, null),
+    ]);
+    $view->tracker   = trackingViewTracker();
+    $view->entities  = collect([trackingViewEntity('d1', null, ['photo_uuid' => 'photo-1'])]);
+    $signature       = new Proof();
+    $signature->setRawAttributes(['public_id' => 'proof_sig', 'raw_data' => 'iVBOR', 'created_at' => '2026-10-08 08:50:00'], true);
+    $photo           = new Proof();
+    $photo->setRawAttributes(['public_id' => 'proof_photo', 'file_uuid' => 'file-1', 'created_at' => '2026-10-08 08:51:00'], true);
+    $scan            = new Proof();
+    $scan->setRawAttributes(['public_id' => 'proof_scan', 'remarks' => 'Verified by QR Code Scan'], true);
+    $view->proofRows = collect([$signature, $photo, $scan]);
+
+    $data = $view->fullView(trackingViewTarget($order, $scope, ['visibility' => ['item_prices' => true, 'pod_photo' => false]]), [], TrackingView::VIEWER_ACCOUNT);
+
+    expect($data['level'])->toBe(2)
+        ->and($data['stage'])->toBe('delivered')
+        ->and($data['driver'])->toBeNull()
+        ->and($data['location'])->toBeNull()
+        ->and($data['eta'])->toBeNull()
+        ->and($data['map']['polyline'])->toBeNull()
+        ->and($data['items'][0])->toMatchArray(['price' => '1500', 'currency' => 'SGD'])
+        ->and($data['items'][0]['photo_url'])->toBeString()
+        ->and(collect($data['proofs'])->pluck('type')->all())->toBe(['signature', 'scan'])
+        ->and($view->proofQueries[0])->toBe(['d1', 'order-1']);
+
+    // While under way, with nothing but this customer's stops, the line is drawn.
+    $order       = trackingViewOrder();
+    $view->stops = collect([
+        new TrackingStop('place-pickup', 'place_pickup', 'pickup', 'completed', trackingViewPlace('pickup', 'Sender', 1.28, 103.84), null, true, 0, null),
+        new TrackingStop('place-d', 'place_d', 'dropoff', 'pending', trackingViewPlace('place-d', 'Home', 1.35, 103.85), null, false, 1, null),
+    ]);
+    $view->tracker = ['eta' => ['completion_at' => '2026-10-08T10:00:00.000000Z', 'completion_seconds' => 3600], 'route' => ['polyline' => 'abc']];
+    $data          = $view->fullView(trackingViewTarget($order, new TrackingScope('order-1', Contact::class, 'contact-shipper', $order)), [], TrackingView::VIEWER_STAFF);
+
+    expect($data['map']['polyline'])->toBe('abc')
+        ->and($data['eta'])->toBe(['at' => '2026-10-08T10:00:00.000000Z', 'seconds' => 3600, 'confidence' => null])
+        ->and($data['items'][0])->not->toHaveKey('price');
+
+    // The company can hide the map, the driver's name, the vehicle and the items.
+    $view->tracker = [];
+    $hidden        = $view->fullView(trackingViewTarget($order, new TrackingScope('order-1', Contact::class, 'contact-shipper', $order), ['visibility' => ['map' => false, 'driver_name' => false, 'vehicle' => false, 'items' => false]]), [], TrackingView::VIEWER_VERIFIED);
+    expect($hidden['map'])->toBeNull()
+        ->and($hidden['location'])->toBeNull()
+        ->and($hidden['driver'])->toBe(['name' => null, 'vehicle' => null, 'online' => true])
+        ->and($hidden['items'])->toBe([])
+        ->and($hidden['eta'])->toBeNull();
+
+    // An order that names no customer still renders for staff, with no stops of anyone's.
+    $none = $view->fullView(trackingViewTarget(trackingViewOrder(['customer_uuid' => null, 'customer_type' => null]), null), [], TrackingView::VIEWER_STAFF);
+    expect($none['stops'])->toBe([])->and($none['instructions']['text'])->toBeNull();
+});
+
+test('proof types and proofs a scope may open', function () {
+    TrackingPageDatabase::boot();
+    $file = new Fleetbase\Models\File();
+    $file->setRawAttributes(['type' => 'signature'], true);
+    $signed = new Proof();
+    $signed->setRelation('file', $file);
+
+    $view        = new class extends TrackingViewProbe {
+        public ?Proof $found = null;
+
+        protected function findProof(string $publicId): ?Proof
+        {
+            return $this->found;
+        }
+    };
+    $view->stops = trackingViewStops(true);
+    $view->entities = collect();
+    $proof = new Proof();
+    $proof->setRawAttributes(['public_id' => 'proof_a', 'file_uuid' => 'file-a'], true);
+    $view->proofRows = collect([$proof]);
+    $view->found     = $proof;
+
+    $target = trackingViewTarget(trackingViewOrder(), new TrackingScope('order-1', Contact::class, 'contact-a'));
+
+    expect(TrackingView::proofType($signed))->toBe('signature')
+        ->and($view->proofFor($target, 'proof_a'))->toBe($proof)
+        ->and($view->proofFor($target, 'proof_other'))->toBeNull()
+        ->and($view->proofQueries[0])->toBe(['wp-a']);
+});
+
+test('stops, the tracker, items and proofs come from their real sources', function () {
+    $db = TrackingPageDatabase::boot();
+    TrackingPageDatabase::insert($db, 'entities', ['uuid' => 'e-a', 'payload_uuid' => 'payload-1', 'destination_uuid' => 'place-a', 'name' => 'Lamp']);
+    TrackingPageDatabase::insert($db, 'entities', ['uuid' => 'e-none', 'payload_uuid' => 'payload-1', 'name' => 'Shade']);
+    TrackingPageDatabase::insert($db, 'entities', ['uuid' => 'e-b', 'payload_uuid' => 'payload-1', 'destination_uuid' => 'place-b', 'name' => 'Chair']);
+    TrackingPageDatabase::insert($db, 'proofs', ['uuid' => 'p-1', 'public_id' => 'proof_one', 'subject_uuid' => 'wp-a', 'created_at' => '2026-10-08 09:00:00']);
+
+    $context = new Fleetbase\FleetOps\Tracking\TrackingContext(trackingViewOrder(), null, null, null, null, collect(['stop']), collect(), collect(), null, null, null);
+    app()->instance(TrackingContextBuilder::class, new class($context) extends TrackingContextBuilder {
+        public function __construct(private $context)
+        {
+        }
+
+        public function build(Order $order, Fleetbase\FleetOps\Tracking\TrackingOptions $options): Fleetbase\FleetOps\Tracking\TrackingContext
+        {
+            return $this->context;
+        }
+    });
+    app()->instance(TrackingIntelligenceService::class, new class extends TrackingIntelligenceService {
+        public bool $fail = false;
+
+        public function __construct()
+        {
+        }
+
+        public function track(Order $order, array|Fleetbase\FleetOps\Tracking\TrackingOptions $options = []): array
+        {
+            if ($this->fail) {
+                throw new RuntimeException('provider down');
+            }
+
+            return ['provider' => 'fake'];
+        }
+    });
+
+    $view    = new TrackingView();
+    $call    = fn (string $method, ...$args) => (fn () => $this->{$method}(...$args))->call($view);
+    $order   = trackingViewOrder();
+    $scopeA  = new TrackingScope('order-1', Contact::class, 'contact-a', $order);
+    $shipper = new TrackingScope('order-1', Contact::class, 'contact-shipper', $order);
+
+    expect($call('stopsFor', $order)->all())->toBe(['stop'])
+        ->and($call('trackerFor', $order))->toBe(['provider' => 'fake'])
+        ->and($call('trackerFor', trackingViewOrder(['status' => 'completed'])))->toBe([]);
+
+    app(TrackingIntelligenceService::class)->fail = true;
+    expect($call('trackerFor', $order))->toBe([])
+        ->and($call('entitiesFor', $order, ['place-a'], $scopeA)->pluck('uuid')->all())->toBe(['e-a'])
+        ->and($call('entitiesFor', $order, [], $shipper)->pluck('uuid')->all())->toBe(['e-none'])
+        ->and($call('entitiesFor', trackingViewOrder(['payload_uuid' => null]), [], $shipper)->all())->toBe([])
+        ->and($call('proofsFor', ['wp-a'])->pluck('public_id')->all())->toBe(['proof_one'])
+        ->and($call('proofsFor', [])->all())->toBe([])
+        ->and($call('findProof', 'proof_one')?->uuid)->toBe('p-1')
+        ->and($call('updateFor', $order, $scopeA, trackingViewStops(), [])->ownStops()->count())->toBe(1);
+});
diff --git a/translations/ar-ae.yml b/translations/ar-ae.yml
index 67da921fb..386903b9f 100644
--- a/translations/ar-ae.yml
+++ b/translations/ar-ae.yml
@@ -2120,3 +2120,176 @@ tracking-page:
     preview-sub: "2:10 to 2:40 pm"
     preview-button: "Verify it's you"
     preview-powered-by: "Powered by Fleetbase"
+  page:
+    track-another: "Track another"
+    unavailable-title: "Tracking isn't available here"
+    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
+    lookup-title: "Track your delivery"
+    lookup-sub: "See where your parcel is and when it will arrive."
+    tracking-number: "Tracking number"
+    tracking-number-placeholder: "e.g. NOR4829301736US"
+    tracking-number-help: "Find it in your confirmation email or on the parcel label."
+    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
+    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
+    looking-up: "Looking it up..."
+    track: "Track"
+    or: "or"
+    your-orders: "Your orders"
+    sign-in: "Sign in to see all your orders"
+    sign-in-account: "Sign in to your account"
+    back: "Back"
+    help: "Need help?"
+    language: "Language"
+    powered-by: "Powered by Fleetbase"
+    dismiss: "Dismiss"
+    chip-limited: "Limited view · Verify to see details"
+    chip-verified: "Verified on this device"
+    chip-account: "Signed in"
+    chip-staff: "Staff preview: what this customer sees"
+    status: "Status"
+    verify-to-see: "Verify to see your delivery"
+    last-update: "Last update: {date}"
+    copy: "Copy"
+    verify-title: "See your full delivery details"
+    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
+    verify-button: "Verify it's you"
+    verify-unlock: "Verify to unlock"
+    locked-map: "Live map"
+    locked-arrival: "Arrival time and driver"
+    locked-details: "Updates, items and proof of delivery"
+    stage-preparing: "Being prepared"
+    stage-scheduled: "Scheduled"
+    stage-dispatched: "Driver assigned"
+    stage-in_transit: "In transit"
+    stage-delivered: "Delivered"
+    stage-issue: "Needs attention"
+    stage-canceled: "Canceled"
+    stage-toast-preparing: "Your order is being prepared"
+    stage-toast-scheduled: "Your delivery is scheduled"
+    stage-toast-dispatched: "A driver has been assigned"
+    stage-toast-in_transit: "Your order is on its way"
+    stage-toast-delivered: "Your order has been delivered"
+    stage-toast-issue: "There's an update on your delivery"
+    stage-toast-canceled: "Your order was canceled"
+    verify-title-short: "Verify it's you"
+    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
+    send-by: "Send the code by"
+    channel-sms: "Text message"
+    channel-email: "Email"
+    send-failed: "We couldn't send a code just now. Please try again."
+    sending: "Sending code..."
+    send-code: "Send code"
+    masked-note: "We only ever show part of your number or email here."
+    no-contact-title: "We can't verify you here"
+    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
+    call: "Call {phone}"
+    renew-title: "Get a new code"
+    renew-expired: "That code has expired. Codes last 10 minutes."
+    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
+    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
+    renew-failed: "Something went wrong. Request a new code to try again."
+    send-new-code: "Send a new code"
+    verified-title: "You're verified"
+    locked-title: "Codes paused"
+    enter-code: "Enter your code"
+    code-sent-sms: "We texted a 6-digit code to {masked}."
+    code-sent-email: "We emailed a 6-digit code to {masked}."
+    code-label: "6-digit code"
+    code-expires: "The code expires in 10 minutes."
+    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
+    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
+    code-success: "Verified. Opening your delivery..."
+    resend-in: "Resend code in {time}"
+    resend: "Resend code"
+    switch-to-sms: "Send by text instead"
+    switch-to-email: "Send by email instead"
+    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
+    verified-toast: "You're verified"
+    verified-toast-help: "This device stays verified for this delivery."
+    signed-out-toast: "Signed out on this device"
+    instructions-saved: "Delivery instructions saved"
+    action-failed: "That didn't work. Please try again."
+    report-sent: "Message sent"
+    report-sent-help: "{name} will get back to you."
+    share-copied: "Link copied"
+    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
+    your-stop: "Stop {number}"
+    your-stops: "Your stops"
+    sign-out: "Not you? Sign out"
+    live: "Live"
+    reconnecting: "Reconnecting... live updates paused"
+    timezone: "Times in your time zone ({zone})"
+    progress: "Delivery progress"
+    step-created: "Created"
+    step-dispatched: "Dispatched"
+    step-started: "Picked up"
+    step-enroute: "En route"
+    step-delivered: "Delivered"
+    step-issue: "Attempt missed"
+    step-canceled: "Canceled"
+    headline-preparing: "Getting your order ready"
+    headline-scheduled: "Scheduled for {date}"
+    headline-dispatched: "A driver has been assigned"
+    headline-delayed: "Running a little late"
+    headline-arriving: "Arriving {day}"
+    headline-in-transit: "On its way"
+    headline-delivered: "Delivered"
+    headline-issue: "There's a problem with your delivery"
+    headline-canceled: "This order was canceled"
+    sub-arriving: "{window} · in about {minutes} min"
+    sub-window: "Delivery window {window}"
+    sub-delivered: "{when}"
+    sub-dispatched: "Live tracking starts as soon as they're on the way."
+    sub-preparing: "We'll let you know when it's on its way."
+    delayed-title: "Running late."
+    delayed-help: "We'll keep your arrival time up to date."
+    stop-of: "Your delivery is stop {position} of {total}"
+    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
+    map: "Map"
+    map-label: "Map of your delivery: the van on its way to your address."
+    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
+    last-seen: "Last seen {minutes} min ago"
+    recenter: "Center the map on the van"
+    fit-route: "Show the whole route"
+    eta: "Estimated arrival"
+    in-minutes: "in about {minutes} min"
+    window: "Delivery window"
+    before-yours: "Before yours"
+    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
+    estimate-may-change: "Estimate may change"
+    driver: "Your driver"
+    online: "Online"
+    location-paused: "Location paused"
+    call-short: "Call"
+    message: "Message"
+    contact-note: "Calls and messages go to the {name} support team."
+    proof: "Proof of delivery"
+    open-photo: "Open the delivery photo"
+    open-signature: "Open the signature"
+    open-scan: "Open the scan"
+    proof-photo: "Delivery photo"
+    proof-signature: "Signature"
+    proof-scan: "Scanned at the door"
+    instructions: "Delivery instructions"
+    edit: "Edit"
+    instructions-help: "Gate codes, where to leave it, or who can sign"
+    cancel: "Cancel"
+    save: "Save"
+    no-instructions: "No instructions yet."
+    updates: "Updates"
+    no-updates: "No updates yet."
+    show-fewer: "Show fewer updates"
+    show-earlier: "Show earlier updates ({count})"
+    today: "Today"
+    yesterday: "Yesterday"
+    items: "In this delivery"
+    item: "Item"
+    quantity: "Qty {count}"
+    share: "Share tracking"
+    report: "Report a problem"
+    contact: "Contact {name}"
+    report-label: "What's wrong with your delivery?"
+    send: "Send"
+    close: "Close"
+    no-orders: "No orders yet"
+    no-orders-help: "Deliveries for your account will show up here."
diff --git a/translations/bg-bg.yaml b/translations/bg-bg.yaml
index bc47638da..5f4d10ce0 100644
--- a/translations/bg-bg.yaml
+++ b/translations/bg-bg.yaml
@@ -2435,3 +2435,176 @@ tracking-page:
     preview-sub: "2:10 to 2:40 pm"
     preview-button: "Verify it's you"
     preview-powered-by: "Powered by Fleetbase"
+  page:
+    track-another: "Track another"
+    unavailable-title: "Tracking isn't available here"
+    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
+    lookup-title: "Track your delivery"
+    lookup-sub: "See where your parcel is and when it will arrive."
+    tracking-number: "Tracking number"
+    tracking-number-placeholder: "e.g. NOR4829301736US"
+    tracking-number-help: "Find it in your confirmation email or on the parcel label."
+    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
+    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
+    looking-up: "Looking it up..."
+    track: "Track"
+    or: "or"
+    your-orders: "Your orders"
+    sign-in: "Sign in to see all your orders"
+    sign-in-account: "Sign in to your account"
+    back: "Back"
+    help: "Need help?"
+    language: "Language"
+    powered-by: "Powered by Fleetbase"
+    dismiss: "Dismiss"
+    chip-limited: "Limited view · Verify to see details"
+    chip-verified: "Verified on this device"
+    chip-account: "Signed in"
+    chip-staff: "Staff preview: what this customer sees"
+    status: "Status"
+    verify-to-see: "Verify to see your delivery"
+    last-update: "Last update: {date}"
+    copy: "Copy"
+    verify-title: "See your full delivery details"
+    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
+    verify-button: "Verify it's you"
+    verify-unlock: "Verify to unlock"
+    locked-map: "Live map"
+    locked-arrival: "Arrival time and driver"
+    locked-details: "Updates, items and proof of delivery"
+    stage-preparing: "Being prepared"
+    stage-scheduled: "Scheduled"
+    stage-dispatched: "Driver assigned"
+    stage-in_transit: "In transit"
+    stage-delivered: "Delivered"
+    stage-issue: "Needs attention"
+    stage-canceled: "Canceled"
+    stage-toast-preparing: "Your order is being prepared"
+    stage-toast-scheduled: "Your delivery is scheduled"
+    stage-toast-dispatched: "A driver has been assigned"
+    stage-toast-in_transit: "Your order is on its way"
+    stage-toast-delivered: "Your order has been delivered"
+    stage-toast-issue: "There's an update on your delivery"
+    stage-toast-canceled: "Your order was canceled"
+    verify-title-short: "Verify it's you"
+    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
+    send-by: "Send the code by"
+    channel-sms: "Text message"
+    channel-email: "Email"
+    send-failed: "We couldn't send a code just now. Please try again."
+    sending: "Sending code..."
+    send-code: "Send code"
+    masked-note: "We only ever show part of your number or email here."
+    no-contact-title: "We can't verify you here"
+    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
+    call: "Call {phone}"
+    renew-title: "Get a new code"
+    renew-expired: "That code has expired. Codes last 10 minutes."
+    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
+    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
+    renew-failed: "Something went wrong. Request a new code to try again."
+    send-new-code: "Send a new code"
+    verified-title: "You're verified"
+    locked-title: "Codes paused"
+    enter-code: "Enter your code"
+    code-sent-sms: "We texted a 6-digit code to {masked}."
+    code-sent-email: "We emailed a 6-digit code to {masked}."
+    code-label: "6-digit code"
+    code-expires: "The code expires in 10 minutes."
+    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
+    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
+    code-success: "Verified. Opening your delivery..."
+    resend-in: "Resend code in {time}"
+    resend: "Resend code"
+    switch-to-sms: "Send by text instead"
+    switch-to-email: "Send by email instead"
+    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
+    verified-toast: "You're verified"
+    verified-toast-help: "This device stays verified for this delivery."
+    signed-out-toast: "Signed out on this device"
+    instructions-saved: "Delivery instructions saved"
+    action-failed: "That didn't work. Please try again."
+    report-sent: "Message sent"
+    report-sent-help: "{name} will get back to you."
+    share-copied: "Link copied"
+    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
+    your-stop: "Stop {number}"
+    your-stops: "Your stops"
+    sign-out: "Not you? Sign out"
+    live: "Live"
+    reconnecting: "Reconnecting... live updates paused"
+    timezone: "Times in your time zone ({zone})"
+    progress: "Delivery progress"
+    step-created: "Created"
+    step-dispatched: "Dispatched"
+    step-started: "Picked up"
+    step-enroute: "En route"
+    step-delivered: "Delivered"
+    step-issue: "Attempt missed"
+    step-canceled: "Canceled"
+    headline-preparing: "Getting your order ready"
+    headline-scheduled: "Scheduled for {date}"
+    headline-dispatched: "A driver has been assigned"
+    headline-delayed: "Running a little late"
+    headline-arriving: "Arriving {day}"
+    headline-in-transit: "On its way"
+    headline-delivered: "Delivered"
+    headline-issue: "There's a problem with your delivery"
+    headline-canceled: "This order was canceled"
+    sub-arriving: "{window} · in about {minutes} min"
+    sub-window: "Delivery window {window}"
+    sub-delivered: "{when}"
+    sub-dispatched: "Live tracking starts as soon as they're on the way."
+    sub-preparing: "We'll let you know when it's on its way."
+    delayed-title: "Running late."
+    delayed-help: "We'll keep your arrival time up to date."
+    stop-of: "Your delivery is stop {position} of {total}"
+    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
+    map: "Map"
+    map-label: "Map of your delivery: the van on its way to your address."
+    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
+    last-seen: "Last seen {minutes} min ago"
+    recenter: "Center the map on the van"
+    fit-route: "Show the whole route"
+    eta: "Estimated arrival"
+    in-minutes: "in about {minutes} min"
+    window: "Delivery window"
+    before-yours: "Before yours"
+    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
+    estimate-may-change: "Estimate may change"
+    driver: "Your driver"
+    online: "Online"
+    location-paused: "Location paused"
+    call-short: "Call"
+    message: "Message"
+    contact-note: "Calls and messages go to the {name} support team."
+    proof: "Proof of delivery"
+    open-photo: "Open the delivery photo"
+    open-signature: "Open the signature"
+    open-scan: "Open the scan"
+    proof-photo: "Delivery photo"
+    proof-signature: "Signature"
+    proof-scan: "Scanned at the door"
+    instructions: "Delivery instructions"
+    edit: "Edit"
+    instructions-help: "Gate codes, where to leave it, or who can sign"
+    cancel: "Cancel"
+    save: "Save"
+    no-instructions: "No instructions yet."
+    updates: "Updates"
+    no-updates: "No updates yet."
+    show-fewer: "Show fewer updates"
+    show-earlier: "Show earlier updates ({count})"
+    today: "Today"
+    yesterday: "Yesterday"
+    items: "In this delivery"
+    item: "Item"
+    quantity: "Qty {count}"
+    share: "Share tracking"
+    report: "Report a problem"
+    contact: "Contact {name}"
+    report-label: "What's wrong with your delivery?"
+    send: "Send"
+    close: "Close"
+    no-orders: "No orders yet"
+    no-orders-help: "Deliveries for your account will show up here."
diff --git a/translations/en-us.yaml b/translations/en-us.yaml
index 0a4b1b6bc..cf1043c0b 100644
--- a/translations/en-us.yaml
+++ b/translations/en-us.yaml
@@ -3700,3 +3700,176 @@ tracking-page:
     preview-sub: "2:10 to 2:40 pm"
     preview-button: "Verify it's you"
     preview-powered-by: "Powered by Fleetbase"
+  page:
+    track-another: "Track another"
+    unavailable-title: "Tracking isn't available here"
+    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
+    lookup-title: "Track your delivery"
+    lookup-sub: "See where your parcel is and when it will arrive."
+    tracking-number: "Tracking number"
+    tracking-number-placeholder: "e.g. NOR4829301736US"
+    tracking-number-help: "Find it in your confirmation email or on the parcel label."
+    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
+    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
+    looking-up: "Looking it up..."
+    track: "Track"
+    or: "or"
+    your-orders: "Your orders"
+    sign-in: "Sign in to see all your orders"
+    sign-in-account: "Sign in to your account"
+    back: "Back"
+    help: "Need help?"
+    language: "Language"
+    powered-by: "Powered by Fleetbase"
+    dismiss: "Dismiss"
+    chip-limited: "Limited view · Verify to see details"
+    chip-verified: "Verified on this device"
+    chip-account: "Signed in"
+    chip-staff: "Staff preview: what this customer sees"
+    status: "Status"
+    verify-to-see: "Verify to see your delivery"
+    last-update: "Last update: {date}"
+    copy: "Copy"
+    verify-title: "See your full delivery details"
+    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
+    verify-button: "Verify it's you"
+    verify-unlock: "Verify to unlock"
+    locked-map: "Live map"
+    locked-arrival: "Arrival time and driver"
+    locked-details: "Updates, items and proof of delivery"
+    stage-preparing: "Being prepared"
+    stage-scheduled: "Scheduled"
+    stage-dispatched: "Driver assigned"
+    stage-in_transit: "In transit"
+    stage-delivered: "Delivered"
+    stage-issue: "Needs attention"
+    stage-canceled: "Canceled"
+    stage-toast-preparing: "Your order is being prepared"
+    stage-toast-scheduled: "Your delivery is scheduled"
+    stage-toast-dispatched: "A driver has been assigned"
+    stage-toast-in_transit: "Your order is on its way"
+    stage-toast-delivered: "Your order has been delivered"
+    stage-toast-issue: "There's an update on your delivery"
+    stage-toast-canceled: "Your order was canceled"
+    verify-title-short: "Verify it's you"
+    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
+    send-by: "Send the code by"
+    channel-sms: "Text message"
+    channel-email: "Email"
+    send-failed: "We couldn't send a code just now. Please try again."
+    sending: "Sending code..."
+    send-code: "Send code"
+    masked-note: "We only ever show part of your number or email here."
+    no-contact-title: "We can't verify you here"
+    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
+    call: "Call {phone}"
+    renew-title: "Get a new code"
+    renew-expired: "That code has expired. Codes last 10 minutes."
+    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
+    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
+    renew-failed: "Something went wrong. Request a new code to try again."
+    send-new-code: "Send a new code"
+    verified-title: "You're verified"
+    locked-title: "Codes paused"
+    enter-code: "Enter your code"
+    code-sent-sms: "We texted a 6-digit code to {masked}."
+    code-sent-email: "We emailed a 6-digit code to {masked}."
+    code-label: "6-digit code"
+    code-expires: "The code expires in 10 minutes."
+    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
+    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
+    code-success: "Verified. Opening your delivery..."
+    resend-in: "Resend code in {time}"
+    resend: "Resend code"
+    switch-to-sms: "Send by text instead"
+    switch-to-email: "Send by email instead"
+    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
+    verified-toast: "You're verified"
+    verified-toast-help: "This device stays verified for this delivery."
+    signed-out-toast: "Signed out on this device"
+    instructions-saved: "Delivery instructions saved"
+    action-failed: "That didn't work. Please try again."
+    report-sent: "Message sent"
+    report-sent-help: "{name} will get back to you."
+    share-copied: "Link copied"
+    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
+    your-stop: "Stop {number}"
+    your-stops: "Your stops"
+    sign-out: "Not you? Sign out"
+    live: "Live"
+    reconnecting: "Reconnecting... live updates paused"
+    timezone: "Times in your time zone ({zone})"
+    progress: "Delivery progress"
+    step-created: "Created"
+    step-dispatched: "Dispatched"
+    step-started: "Picked up"
+    step-enroute: "En route"
+    step-delivered: "Delivered"
+    step-issue: "Attempt missed"
+    step-canceled: "Canceled"
+    headline-preparing: "Getting your order ready"
+    headline-scheduled: "Scheduled for {date}"
+    headline-dispatched: "A driver has been assigned"
+    headline-delayed: "Running a little late"
+    headline-arriving: "Arriving {day}"
+    headline-in-transit: "On its way"
+    headline-delivered: "Delivered"
+    headline-issue: "There's a problem with your delivery"
+    headline-canceled: "This order was canceled"
+    sub-arriving: "{window} · in about {minutes} min"
+    sub-window: "Delivery window {window}"
+    sub-delivered: "{when}"
+    sub-dispatched: "Live tracking starts as soon as they're on the way."
+    sub-preparing: "We'll let you know when it's on its way."
+    delayed-title: "Running late."
+    delayed-help: "We'll keep your arrival time up to date."
+    stop-of: "Your delivery is stop {position} of {total}"
+    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
+    map: "Map"
+    map-label: "Map of your delivery: the van on its way to your address."
+    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
+    last-seen: "Last seen {minutes} min ago"
+    recenter: "Center the map on the van"
+    fit-route: "Show the whole route"
+    eta: "Estimated arrival"
+    in-minutes: "in about {minutes} min"
+    window: "Delivery window"
+    before-yours: "Before yours"
+    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
+    estimate-may-change: "Estimate may change"
+    driver: "Your driver"
+    online: "Online"
+    location-paused: "Location paused"
+    call-short: "Call"
+    message: "Message"
+    contact-note: "Calls and messages go to the {name} support team."
+    proof: "Proof of delivery"
+    open-photo: "Open the delivery photo"
+    open-signature: "Open the signature"
+    open-scan: "Open the scan"
+    proof-photo: "Delivery photo"
+    proof-signature: "Signature"
+    proof-scan: "Scanned at the door"
+    instructions: "Delivery instructions"
+    edit: "Edit"
+    instructions-help: "Gate codes, where to leave it, or who can sign"
+    cancel: "Cancel"
+    save: "Save"
+    no-instructions: "No instructions yet."
+    updates: "Updates"
+    no-updates: "No updates yet."
+    show-fewer: "Show fewer updates"
+    show-earlier: "Show earlier updates ({count})"
+    today: "Today"
+    yesterday: "Yesterday"
+    items: "In this delivery"
+    item: "Item"
+    quantity: "Qty {count}"
+    share: "Share tracking"
+    report: "Report a problem"
+    contact: "Contact {name}"
+    report-label: "What's wrong with your delivery?"
+    send: "Send"
+    close: "Close"
+    no-orders: "No orders yet"
+    no-orders-help: "Deliveries for your account will show up here."
diff --git a/translations/es-pa.yaml b/translations/es-pa.yaml
index 82ae796e4..d61e99616 100644
--- a/translations/es-pa.yaml
+++ b/translations/es-pa.yaml
@@ -2314,3 +2314,176 @@ tracking-page:
     preview-sub: "2:10 to 2:40 pm"
     preview-button: "Verify it's you"
     preview-powered-by: "Powered by Fleetbase"
+  page:
+    track-another: "Track another"
+    unavailable-title: "Tracking isn't available here"
+    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
+    lookup-title: "Track your delivery"
+    lookup-sub: "See where your parcel is and when it will arrive."
+    tracking-number: "Tracking number"
+    tracking-number-placeholder: "e.g. NOR4829301736US"
+    tracking-number-help: "Find it in your confirmation email or on the parcel label."
+    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
+    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
+    looking-up: "Looking it up..."
+    track: "Track"
+    or: "or"
+    your-orders: "Your orders"
+    sign-in: "Sign in to see all your orders"
+    sign-in-account: "Sign in to your account"
+    back: "Back"
+    help: "Need help?"
+    language: "Language"
+    powered-by: "Powered by Fleetbase"
+    dismiss: "Dismiss"
+    chip-limited: "Limited view · Verify to see details"
+    chip-verified: "Verified on this device"
+    chip-account: "Signed in"
+    chip-staff: "Staff preview: what this customer sees"
+    status: "Status"
+    verify-to-see: "Verify to see your delivery"
+    last-update: "Last update: {date}"
+    copy: "Copy"
+    verify-title: "See your full delivery details"
+    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
+    verify-button: "Verify it's you"
+    verify-unlock: "Verify to unlock"
+    locked-map: "Live map"
+    locked-arrival: "Arrival time and driver"
+    locked-details: "Updates, items and proof of delivery"
+    stage-preparing: "Being prepared"
+    stage-scheduled: "Scheduled"
+    stage-dispatched: "Driver assigned"
+    stage-in_transit: "In transit"
+    stage-delivered: "Delivered"
+    stage-issue: "Needs attention"
+    stage-canceled: "Canceled"
+    stage-toast-preparing: "Your order is being prepared"
+    stage-toast-scheduled: "Your delivery is scheduled"
+    stage-toast-dispatched: "A driver has been assigned"
+    stage-toast-in_transit: "Your order is on its way"
+    stage-toast-delivered: "Your order has been delivered"
+    stage-toast-issue: "There's an update on your delivery"
+    stage-toast-canceled: "Your order was canceled"
+    verify-title-short: "Verify it's you"
+    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
+    send-by: "Send the code by"
+    channel-sms: "Text message"
+    channel-email: "Email"
+    send-failed: "We couldn't send a code just now. Please try again."
+    sending: "Sending code..."
+    send-code: "Send code"
+    masked-note: "We only ever show part of your number or email here."
+    no-contact-title: "We can't verify you here"
+    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
+    call: "Call {phone}"
+    renew-title: "Get a new code"
+    renew-expired: "That code has expired. Codes last 10 minutes."
+    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
+    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
+    renew-failed: "Something went wrong. Request a new code to try again."
+    send-new-code: "Send a new code"
+    verified-title: "You're verified"
+    locked-title: "Codes paused"
+    enter-code: "Enter your code"
+    code-sent-sms: "We texted a 6-digit code to {masked}."
+    code-sent-email: "We emailed a 6-digit code to {masked}."
+    code-label: "6-digit code"
+    code-expires: "The code expires in 10 minutes."
+    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
+    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
+    code-success: "Verified. Opening your delivery..."
+    resend-in: "Resend code in {time}"
+    resend: "Resend code"
+    switch-to-sms: "Send by text instead"
+    switch-to-email: "Send by email instead"
+    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
+    verified-toast: "You're verified"
+    verified-toast-help: "This device stays verified for this delivery."
+    signed-out-toast: "Signed out on this device"
+    instructions-saved: "Delivery instructions saved"
+    action-failed: "That didn't work. Please try again."
+    report-sent: "Message sent"
+    report-sent-help: "{name} will get back to you."
+    share-copied: "Link copied"
+    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
+    your-stop: "Stop {number}"
+    your-stops: "Your stops"
+    sign-out: "Not you? Sign out"
+    live: "Live"
+    reconnecting: "Reconnecting... live updates paused"
+    timezone: "Times in your time zone ({zone})"
+    progress: "Delivery progress"
+    step-created: "Created"
+    step-dispatched: "Dispatched"
+    step-started: "Picked up"
+    step-enroute: "En route"
+    step-delivered: "Delivered"
+    step-issue: "Attempt missed"
+    step-canceled: "Canceled"
+    headline-preparing: "Getting your order ready"
+    headline-scheduled: "Scheduled for {date}"
+    headline-dispatched: "A driver has been assigned"
+    headline-delayed: "Running a little late"
+    headline-arriving: "Arriving {day}"
+    headline-in-transit: "On its way"
+    headline-delivered: "Delivered"
+    headline-issue: "There's a problem with your delivery"
+    headline-canceled: "This order was canceled"
+    sub-arriving: "{window} · in about {minutes} min"
+    sub-window: "Delivery window {window}"
+    sub-delivered: "{when}"
+    sub-dispatched: "Live tracking starts as soon as they're on the way."
+    sub-preparing: "We'll let you know when it's on its way."
+    delayed-title: "Running late."
+    delayed-help: "We'll keep your arrival time up to date."
+    stop-of: "Your delivery is stop {position} of {total}"
+    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
+    map: "Map"
+    map-label: "Map of your delivery: the van on its way to your address."
+    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
+    last-seen: "Last seen {minutes} min ago"
+    recenter: "Center the map on the van"
+    fit-route: "Show the whole route"
+    eta: "Estimated arrival"
+    in-minutes: "in about {minutes} min"
+    window: "Delivery window"
+    before-yours: "Before yours"
+    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
+    estimate-may-change: "Estimate may change"
+    driver: "Your driver"
+    online: "Online"
+    location-paused: "Location paused"
+    call-short: "Call"
+    message: "Message"
+    contact-note: "Calls and messages go to the {name} support team."
+    proof: "Proof of delivery"
+    open-photo: "Open the delivery photo"
+    open-signature: "Open the signature"
+    open-scan: "Open the scan"
+    proof-photo: "Delivery photo"
+    proof-signature: "Signature"
+    proof-scan: "Scanned at the door"
+    instructions: "Delivery instructions"
+    edit: "Edit"
+    instructions-help: "Gate codes, where to leave it, or who can sign"
+    cancel: "Cancel"
+    save: "Save"
+    no-instructions: "No instructions yet."
+    updates: "Updates"
+    no-updates: "No updates yet."
+    show-fewer: "Show fewer updates"
+    show-earlier: "Show earlier updates ({count})"
+    today: "Today"
+    yesterday: "Yesterday"
+    items: "In this delivery"
+    item: "Item"
+    quantity: "Qty {count}"
+    share: "Share tracking"
+    report: "Report a problem"
+    contact: "Contact {name}"
+    report-label: "What's wrong with your delivery?"
+    send: "Send"
+    close: "Close"
+    no-orders: "No orders yet"
+    no-orders-help: "Deliveries for your account will show up here."
diff --git a/translations/fr-fr.yaml b/translations/fr-fr.yaml
index 23806d26d..897aa7ee6 100644
--- a/translations/fr-fr.yaml
+++ b/translations/fr-fr.yaml
@@ -2460,3 +2460,176 @@ tracking-page:
     preview-sub: "2:10 to 2:40 pm"
     preview-button: "Verify it's you"
     preview-powered-by: "Powered by Fleetbase"
+  page:
+    track-another: "Track another"
+    unavailable-title: "Tracking isn't available here"
+    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
+    lookup-title: "Track your delivery"
+    lookup-sub: "See where your parcel is and when it will arrive."
+    tracking-number: "Tracking number"
+    tracking-number-placeholder: "e.g. NOR4829301736US"
+    tracking-number-help: "Find it in your confirmation email or on the parcel label."
+    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
+    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
+    looking-up: "Looking it up..."
+    track: "Track"
+    or: "or"
+    your-orders: "Your orders"
+    sign-in: "Sign in to see all your orders"
+    sign-in-account: "Sign in to your account"
+    back: "Back"
+    help: "Need help?"
+    language: "Language"
+    powered-by: "Powered by Fleetbase"
+    dismiss: "Dismiss"
+    chip-limited: "Limited view · Verify to see details"
+    chip-verified: "Verified on this device"
+    chip-account: "Signed in"
+    chip-staff: "Staff preview: what this customer sees"
+    status: "Status"
+    verify-to-see: "Verify to see your delivery"
+    last-update: "Last update: {date}"
+    copy: "Copy"
+    verify-title: "See your full delivery details"
+    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
+    verify-button: "Verify it's you"
+    verify-unlock: "Verify to unlock"
+    locked-map: "Live map"
+    locked-arrival: "Arrival time and driver"
+    locked-details: "Updates, items and proof of delivery"
+    stage-preparing: "Being prepared"
+    stage-scheduled: "Scheduled"
+    stage-dispatched: "Driver assigned"
+    stage-in_transit: "In transit"
+    stage-delivered: "Delivered"
+    stage-issue: "Needs attention"
+    stage-canceled: "Canceled"
+    stage-toast-preparing: "Your order is being prepared"
+    stage-toast-scheduled: "Your delivery is scheduled"
+    stage-toast-dispatched: "A driver has been assigned"
+    stage-toast-in_transit: "Your order is on its way"
+    stage-toast-delivered: "Your order has been delivered"
+    stage-toast-issue: "There's an update on your delivery"
+    stage-toast-canceled: "Your order was canceled"
+    verify-title-short: "Verify it's you"
+    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
+    send-by: "Send the code by"
+    channel-sms: "Text message"
+    channel-email: "Email"
+    send-failed: "We couldn't send a code just now. Please try again."
+    sending: "Sending code..."
+    send-code: "Send code"
+    masked-note: "We only ever show part of your number or email here."
+    no-contact-title: "We can't verify you here"
+    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
+    call: "Call {phone}"
+    renew-title: "Get a new code"
+    renew-expired: "That code has expired. Codes last 10 minutes."
+    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
+    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
+    renew-failed: "Something went wrong. Request a new code to try again."
+    send-new-code: "Send a new code"
+    verified-title: "You're verified"
+    locked-title: "Codes paused"
+    enter-code: "Enter your code"
+    code-sent-sms: "We texted a 6-digit code to {masked}."
+    code-sent-email: "We emailed a 6-digit code to {masked}."
+    code-label: "6-digit code"
+    code-expires: "The code expires in 10 minutes."
+    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
+    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
+    code-success: "Verified. Opening your delivery..."
+    resend-in: "Resend code in {time}"
+    resend: "Resend code"
+    switch-to-sms: "Send by text instead"
+    switch-to-email: "Send by email instead"
+    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
+    verified-toast: "You're verified"
+    verified-toast-help: "This device stays verified for this delivery."
+    signed-out-toast: "Signed out on this device"
+    instructions-saved: "Delivery instructions saved"
+    action-failed: "That didn't work. Please try again."
+    report-sent: "Message sent"
+    report-sent-help: "{name} will get back to you."
+    share-copied: "Link copied"
+    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
+    your-stop: "Stop {number}"
+    your-stops: "Your stops"
+    sign-out: "Not you? Sign out"
+    live: "Live"
+    reconnecting: "Reconnecting... live updates paused"
+    timezone: "Times in your time zone ({zone})"
+    progress: "Delivery progress"
+    step-created: "Created"
+    step-dispatched: "Dispatched"
+    step-started: "Picked up"
+    step-enroute: "En route"
+    step-delivered: "Delivered"
+    step-issue: "Attempt missed"
+    step-canceled: "Canceled"
+    headline-preparing: "Getting your order ready"
+    headline-scheduled: "Scheduled for {date}"
+    headline-dispatched: "A driver has been assigned"
+    headline-delayed: "Running a little late"
+    headline-arriving: "Arriving {day}"
+    headline-in-transit: "On its way"
+    headline-delivered: "Delivered"
+    headline-issue: "There's a problem with your delivery"
+    headline-canceled: "This order was canceled"
+    sub-arriving: "{window} · in about {minutes} min"
+    sub-window: "Delivery window {window}"
+    sub-delivered: "{when}"
+    sub-dispatched: "Live tracking starts as soon as they're on the way."
+    sub-preparing: "We'll let you know when it's on its way."
+    delayed-title: "Running late."
+    delayed-help: "We'll keep your arrival time up to date."
+    stop-of: "Your delivery is stop {position} of {total}"
+    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
+    map: "Map"
+    map-label: "Map of your delivery: the van on its way to your address."
+    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
+    last-seen: "Last seen {minutes} min ago"
+    recenter: "Center the map on the van"
+    fit-route: "Show the whole route"
+    eta: "Estimated arrival"
+    in-minutes: "in about {minutes} min"
+    window: "Delivery window"
+    before-yours: "Before yours"
+    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
+    estimate-may-change: "Estimate may change"
+    driver: "Your driver"
+    online: "Online"
+    location-paused: "Location paused"
+    call-short: "Call"
+    message: "Message"
+    contact-note: "Calls and messages go to the {name} support team."
+    proof: "Proof of delivery"
+    open-photo: "Open the delivery photo"
+    open-signature: "Open the signature"
+    open-scan: "Open the scan"
+    proof-photo: "Delivery photo"
+    proof-signature: "Signature"
+    proof-scan: "Scanned at the door"
+    instructions: "Delivery instructions"
+    edit: "Edit"
+    instructions-help: "Gate codes, where to leave it, or who can sign"
+    cancel: "Cancel"
+    save: "Save"
+    no-instructions: "No instructions yet."
+    updates: "Updates"
+    no-updates: "No updates yet."
+    show-fewer: "Show fewer updates"
+    show-earlier: "Show earlier updates ({count})"
+    today: "Today"
+    yesterday: "Yesterday"
+    items: "In this delivery"
+    item: "Item"
+    quantity: "Qty {count}"
+    share: "Share tracking"
+    report: "Report a problem"
+    contact: "Contact {name}"
+    report-label: "What's wrong with your delivery?"
+    send: "Send"
+    close: "Close"
+    no-orders: "No orders yet"
+    no-orders-help: "Deliveries for your account will show up here."
diff --git a/translations/mn-mn.yaml b/translations/mn-mn.yaml
index c48782398..33136c5a4 100644
--- a/translations/mn-mn.yaml
+++ b/translations/mn-mn.yaml
@@ -2404,3 +2404,176 @@ tracking-page:
     preview-sub: "2:10 to 2:40 pm"
     preview-button: "Verify it's you"
     preview-powered-by: "Powered by Fleetbase"
+  page:
+    track-another: "Track another"
+    unavailable-title: "Tracking isn't available here"
+    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
+    lookup-title: "Track your delivery"
+    lookup-sub: "See where your parcel is and when it will arrive."
+    tracking-number: "Tracking number"
+    tracking-number-placeholder: "e.g. NOR4829301736US"
+    tracking-number-help: "Find it in your confirmation email or on the parcel label."
+    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
+    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
+    looking-up: "Looking it up..."
+    track: "Track"
+    or: "or"
+    your-orders: "Your orders"
+    sign-in: "Sign in to see all your orders"
+    sign-in-account: "Sign in to your account"
+    back: "Back"
+    help: "Need help?"
+    language: "Language"
+    powered-by: "Powered by Fleetbase"
+    dismiss: "Dismiss"
+    chip-limited: "Limited view · Verify to see details"
+    chip-verified: "Verified on this device"
+    chip-account: "Signed in"
+    chip-staff: "Staff preview: what this customer sees"
+    status: "Status"
+    verify-to-see: "Verify to see your delivery"
+    last-update: "Last update: {date}"
+    copy: "Copy"
+    verify-title: "See your full delivery details"
+    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
+    verify-button: "Verify it's you"
+    verify-unlock: "Verify to unlock"
+    locked-map: "Live map"
+    locked-arrival: "Arrival time and driver"
+    locked-details: "Updates, items and proof of delivery"
+    stage-preparing: "Being prepared"
+    stage-scheduled: "Scheduled"
+    stage-dispatched: "Driver assigned"
+    stage-in_transit: "In transit"
+    stage-delivered: "Delivered"
+    stage-issue: "Needs attention"
+    stage-canceled: "Canceled"
+    stage-toast-preparing: "Your order is being prepared"
+    stage-toast-scheduled: "Your delivery is scheduled"
+    stage-toast-dispatched: "A driver has been assigned"
+    stage-toast-in_transit: "Your order is on its way"
+    stage-toast-delivered: "Your order has been delivered"
+    stage-toast-issue: "There's an update on your delivery"
+    stage-toast-canceled: "Your order was canceled"
+    verify-title-short: "Verify it's you"
+    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
+    send-by: "Send the code by"
+    channel-sms: "Text message"
+    channel-email: "Email"
+    send-failed: "We couldn't send a code just now. Please try again."
+    sending: "Sending code..."
+    send-code: "Send code"
+    masked-note: "We only ever show part of your number or email here."
+    no-contact-title: "We can't verify you here"
+    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
+    call: "Call {phone}"
+    renew-title: "Get a new code"
+    renew-expired: "That code has expired. Codes last 10 minutes."
+    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
+    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
+    renew-failed: "Something went wrong. Request a new code to try again."
+    send-new-code: "Send a new code"
+    verified-title: "You're verified"
+    locked-title: "Codes paused"
+    enter-code: "Enter your code"
+    code-sent-sms: "We texted a 6-digit code to {masked}."
+    code-sent-email: "We emailed a 6-digit code to {masked}."
+    code-label: "6-digit code"
+    code-expires: "The code expires in 10 minutes."
+    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
+    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
+    code-success: "Verified. Opening your delivery..."
+    resend-in: "Resend code in {time}"
+    resend: "Resend code"
+    switch-to-sms: "Send by text instead"
+    switch-to-email: "Send by email instead"
+    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
+    verified-toast: "You're verified"
+    verified-toast-help: "This device stays verified for this delivery."
+    signed-out-toast: "Signed out on this device"
+    instructions-saved: "Delivery instructions saved"
+    action-failed: "That didn't work. Please try again."
+    report-sent: "Message sent"
+    report-sent-help: "{name} will get back to you."
+    share-copied: "Link copied"
+    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
+    your-stop: "Stop {number}"
+    your-stops: "Your stops"
+    sign-out: "Not you? Sign out"
+    live: "Live"
+    reconnecting: "Reconnecting... live updates paused"
+    timezone: "Times in your time zone ({zone})"
+    progress: "Delivery progress"
+    step-created: "Created"
+    step-dispatched: "Dispatched"
+    step-started: "Picked up"
+    step-enroute: "En route"
+    step-delivered: "Delivered"
+    step-issue: "Attempt missed"
+    step-canceled: "Canceled"
+    headline-preparing: "Getting your order ready"
+    headline-scheduled: "Scheduled for {date}"
+    headline-dispatched: "A driver has been assigned"
+    headline-delayed: "Running a little late"
+    headline-arriving: "Arriving {day}"
+    headline-in-transit: "On its way"
+    headline-delivered: "Delivered"
+    headline-issue: "There's a problem with your delivery"
+    headline-canceled: "This order was canceled"
+    sub-arriving: "{window} · in about {minutes} min"
+    sub-window: "Delivery window {window}"
+    sub-delivered: "{when}"
+    sub-dispatched: "Live tracking starts as soon as they're on the way."
+    sub-preparing: "We'll let you know when it's on its way."
+    delayed-title: "Running late."
+    delayed-help: "We'll keep your arrival time up to date."
+    stop-of: "Your delivery is stop {position} of {total}"
+    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
+    map: "Map"
+    map-label: "Map of your delivery: the van on its way to your address."
+    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
+    last-seen: "Last seen {minutes} min ago"
+    recenter: "Center the map on the van"
+    fit-route: "Show the whole route"
+    eta: "Estimated arrival"
+    in-minutes: "in about {minutes} min"
+    window: "Delivery window"
+    before-yours: "Before yours"
+    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
+    estimate-may-change: "Estimate may change"
+    driver: "Your driver"
+    online: "Online"
+    location-paused: "Location paused"
+    call-short: "Call"
+    message: "Message"
+    contact-note: "Calls and messages go to the {name} support team."
+    proof: "Proof of delivery"
+    open-photo: "Open the delivery photo"
+    open-signature: "Open the signature"
+    open-scan: "Open the scan"
+    proof-photo: "Delivery photo"
+    proof-signature: "Signature"
+    proof-scan: "Scanned at the door"
+    instructions: "Delivery instructions"
+    edit: "Edit"
+    instructions-help: "Gate codes, where to leave it, or who can sign"
+    cancel: "Cancel"
+    save: "Save"
+    no-instructions: "No instructions yet."
+    updates: "Updates"
+    no-updates: "No updates yet."
+    show-fewer: "Show fewer updates"
+    show-earlier: "Show earlier updates ({count})"
+    today: "Today"
+    yesterday: "Yesterday"
+    items: "In this delivery"
+    item: "Item"
+    quantity: "Qty {count}"
+    share: "Share tracking"
+    report: "Report a problem"
+    contact: "Contact {name}"
+    report-label: "What's wrong with your delivery?"
+    send: "Send"
+    close: "Close"
+    no-orders: "No orders yet"
+    no-orders-help: "Deliveries for your account will show up here."
diff --git a/translations/pt-br.yaml b/translations/pt-br.yaml
index ffedae57b..635d58296 100644
--- a/translations/pt-br.yaml
+++ b/translations/pt-br.yaml
@@ -2425,3 +2425,176 @@ tracking-page:
     preview-sub: "2:10 to 2:40 pm"
     preview-button: "Verify it's you"
     preview-powered-by: "Powered by Fleetbase"
+  page:
+    track-another: "Track another"
+    unavailable-title: "Tracking isn't available here"
+    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
+    lookup-title: "Track your delivery"
+    lookup-sub: "See where your parcel is and when it will arrive."
+    tracking-number: "Tracking number"
+    tracking-number-placeholder: "e.g. NOR4829301736US"
+    tracking-number-help: "Find it in your confirmation email or on the parcel label."
+    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
+    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
+    looking-up: "Looking it up..."
+    track: "Track"
+    or: "or"
+    your-orders: "Your orders"
+    sign-in: "Sign in to see all your orders"
+    sign-in-account: "Sign in to your account"
+    back: "Back"
+    help: "Need help?"
+    language: "Language"
+    powered-by: "Powered by Fleetbase"
+    dismiss: "Dismiss"
+    chip-limited: "Limited view · Verify to see details"
+    chip-verified: "Verified on this device"
+    chip-account: "Signed in"
+    chip-staff: "Staff preview: what this customer sees"
+    status: "Status"
+    verify-to-see: "Verify to see your delivery"
+    last-update: "Last update: {date}"
+    copy: "Copy"
+    verify-title: "See your full delivery details"
+    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
+    verify-button: "Verify it's you"
+    verify-unlock: "Verify to unlock"
+    locked-map: "Live map"
+    locked-arrival: "Arrival time and driver"
+    locked-details: "Updates, items and proof of delivery"
+    stage-preparing: "Being prepared"
+    stage-scheduled: "Scheduled"
+    stage-dispatched: "Driver assigned"
+    stage-in_transit: "In transit"
+    stage-delivered: "Delivered"
+    stage-issue: "Needs attention"
+    stage-canceled: "Canceled"
+    stage-toast-preparing: "Your order is being prepared"
+    stage-toast-scheduled: "Your delivery is scheduled"
+    stage-toast-dispatched: "A driver has been assigned"
+    stage-toast-in_transit: "Your order is on its way"
+    stage-toast-delivered: "Your order has been delivered"
+    stage-toast-issue: "There's an update on your delivery"
+    stage-toast-canceled: "Your order was canceled"
+    verify-title-short: "Verify it's you"
+    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
+    send-by: "Send the code by"
+    channel-sms: "Text message"
+    channel-email: "Email"
+    send-failed: "We couldn't send a code just now. Please try again."
+    sending: "Sending code..."
+    send-code: "Send code"
+    masked-note: "We only ever show part of your number or email here."
+    no-contact-title: "We can't verify you here"
+    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
+    call: "Call {phone}"
+    renew-title: "Get a new code"
+    renew-expired: "That code has expired. Codes last 10 minutes."
+    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
+    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
+    renew-failed: "Something went wrong. Request a new code to try again."
+    send-new-code: "Send a new code"
+    verified-title: "You're verified"
+    locked-title: "Codes paused"
+    enter-code: "Enter your code"
+    code-sent-sms: "We texted a 6-digit code to {masked}."
+    code-sent-email: "We emailed a 6-digit code to {masked}."
+    code-label: "6-digit code"
+    code-expires: "The code expires in 10 minutes."
+    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
+    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
+    code-success: "Verified. Opening your delivery..."
+    resend-in: "Resend code in {time}"
+    resend: "Resend code"
+    switch-to-sms: "Send by text instead"
+    switch-to-email: "Send by email instead"
+    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
+    verified-toast: "You're verified"
+    verified-toast-help: "This device stays verified for this delivery."
+    signed-out-toast: "Signed out on this device"
+    instructions-saved: "Delivery instructions saved"
+    action-failed: "That didn't work. Please try again."
+    report-sent: "Message sent"
+    report-sent-help: "{name} will get back to you."
+    share-copied: "Link copied"
+    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
+    your-stop: "Stop {number}"
+    your-stops: "Your stops"
+    sign-out: "Not you? Sign out"
+    live: "Live"
+    reconnecting: "Reconnecting... live updates paused"
+    timezone: "Times in your time zone ({zone})"
+    progress: "Delivery progress"
+    step-created: "Created"
+    step-dispatched: "Dispatched"
+    step-started: "Picked up"
+    step-enroute: "En route"
+    step-delivered: "Delivered"
+    step-issue: "Attempt missed"
+    step-canceled: "Canceled"
+    headline-preparing: "Getting your order ready"
+    headline-scheduled: "Scheduled for {date}"
+    headline-dispatched: "A driver has been assigned"
+    headline-delayed: "Running a little late"
+    headline-arriving: "Arriving {day}"
+    headline-in-transit: "On its way"
+    headline-delivered: "Delivered"
+    headline-issue: "There's a problem with your delivery"
+    headline-canceled: "This order was canceled"
+    sub-arriving: "{window} · in about {minutes} min"
+    sub-window: "Delivery window {window}"
+    sub-delivered: "{when}"
+    sub-dispatched: "Live tracking starts as soon as they're on the way."
+    sub-preparing: "We'll let you know when it's on its way."
+    delayed-title: "Running late."
+    delayed-help: "We'll keep your arrival time up to date."
+    stop-of: "Your delivery is stop {position} of {total}"
+    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
+    map: "Map"
+    map-label: "Map of your delivery: the van on its way to your address."
+    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
+    last-seen: "Last seen {minutes} min ago"
+    recenter: "Center the map on the van"
+    fit-route: "Show the whole route"
+    eta: "Estimated arrival"
+    in-minutes: "in about {minutes} min"
+    window: "Delivery window"
+    before-yours: "Before yours"
+    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
+    estimate-may-change: "Estimate may change"
+    driver: "Your driver"
+    online: "Online"
+    location-paused: "Location paused"
+    call-short: "Call"
+    message: "Message"
+    contact-note: "Calls and messages go to the {name} support team."
+    proof: "Proof of delivery"
+    open-photo: "Open the delivery photo"
+    open-signature: "Open the signature"
+    open-scan: "Open the scan"
+    proof-photo: "Delivery photo"
+    proof-signature: "Signature"
+    proof-scan: "Scanned at the door"
+    instructions: "Delivery instructions"
+    edit: "Edit"
+    instructions-help: "Gate codes, where to leave it, or who can sign"
+    cancel: "Cancel"
+    save: "Save"
+    no-instructions: "No instructions yet."
+    updates: "Updates"
+    no-updates: "No updates yet."
+    show-fewer: "Show fewer updates"
+    show-earlier: "Show earlier updates ({count})"
+    today: "Today"
+    yesterday: "Yesterday"
+    items: "In this delivery"
+    item: "Item"
+    quantity: "Qty {count}"
+    share: "Share tracking"
+    report: "Report a problem"
+    contact: "Contact {name}"
+    report-label: "What's wrong with your delivery?"
+    send: "Send"
+    close: "Close"
+    no-orders: "No orders yet"
+    no-orders-help: "Deliveries for your account will show up here."
diff --git a/translations/ru-ru.yaml b/translations/ru-ru.yaml
index 089e1773c..1edc015ff 100644
--- a/translations/ru-ru.yaml
+++ b/translations/ru-ru.yaml
@@ -2418,3 +2418,176 @@ tracking-page:
     preview-sub: "2:10 to 2:40 pm"
     preview-button: "Verify it's you"
     preview-powered-by: "Powered by Fleetbase"
+  page:
+    track-another: "Track another"
+    unavailable-title: "Tracking isn't available here"
+    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
+    lookup-title: "Track your delivery"
+    lookup-sub: "See where your parcel is and when it will arrive."
+    tracking-number: "Tracking number"
+    tracking-number-placeholder: "e.g. NOR4829301736US"
+    tracking-number-help: "Find it in your confirmation email or on the parcel label."
+    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
+    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
+    looking-up: "Looking it up..."
+    track: "Track"
+    or: "or"
+    your-orders: "Your orders"
+    sign-in: "Sign in to see all your orders"
+    sign-in-account: "Sign in to your account"
+    back: "Back"
+    help: "Need help?"
+    language: "Language"
+    powered-by: "Powered by Fleetbase"
+    dismiss: "Dismiss"
+    chip-limited: "Limited view · Verify to see details"
+    chip-verified: "Verified on this device"
+    chip-account: "Signed in"
+    chip-staff: "Staff preview: what this customer sees"
+    status: "Status"
+    verify-to-see: "Verify to see your delivery"
+    last-update: "Last update: {date}"
+    copy: "Copy"
+    verify-title: "See your full delivery details"
+    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
+    verify-button: "Verify it's you"
+    verify-unlock: "Verify to unlock"
+    locked-map: "Live map"
+    locked-arrival: "Arrival time and driver"
+    locked-details: "Updates, items and proof of delivery"
+    stage-preparing: "Being prepared"
+    stage-scheduled: "Scheduled"
+    stage-dispatched: "Driver assigned"
+    stage-in_transit: "In transit"
+    stage-delivered: "Delivered"
+    stage-issue: "Needs attention"
+    stage-canceled: "Canceled"
+    stage-toast-preparing: "Your order is being prepared"
+    stage-toast-scheduled: "Your delivery is scheduled"
+    stage-toast-dispatched: "A driver has been assigned"
+    stage-toast-in_transit: "Your order is on its way"
+    stage-toast-delivered: "Your order has been delivered"
+    stage-toast-issue: "There's an update on your delivery"
+    stage-toast-canceled: "Your order was canceled"
+    verify-title-short: "Verify it's you"
+    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
+    send-by: "Send the code by"
+    channel-sms: "Text message"
+    channel-email: "Email"
+    send-failed: "We couldn't send a code just now. Please try again."
+    sending: "Sending code..."
+    send-code: "Send code"
+    masked-note: "We only ever show part of your number or email here."
+    no-contact-title: "We can't verify you here"
+    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
+    call: "Call {phone}"
+    renew-title: "Get a new code"
+    renew-expired: "That code has expired. Codes last 10 minutes."
+    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
+    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
+    renew-failed: "Something went wrong. Request a new code to try again."
+    send-new-code: "Send a new code"
+    verified-title: "You're verified"
+    locked-title: "Codes paused"
+    enter-code: "Enter your code"
+    code-sent-sms: "We texted a 6-digit code to {masked}."
+    code-sent-email: "We emailed a 6-digit code to {masked}."
+    code-label: "6-digit code"
+    code-expires: "The code expires in 10 minutes."
+    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
+    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
+    code-success: "Verified. Opening your delivery..."
+    resend-in: "Resend code in {time}"
+    resend: "Resend code"
+    switch-to-sms: "Send by text instead"
+    switch-to-email: "Send by email instead"
+    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
+    verified-toast: "You're verified"
+    verified-toast-help: "This device stays verified for this delivery."
+    signed-out-toast: "Signed out on this device"
+    instructions-saved: "Delivery instructions saved"
+    action-failed: "That didn't work. Please try again."
+    report-sent: "Message sent"
+    report-sent-help: "{name} will get back to you."
+    share-copied: "Link copied"
+    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
+    your-stop: "Stop {number}"
+    your-stops: "Your stops"
+    sign-out: "Not you? Sign out"
+    live: "Live"
+    reconnecting: "Reconnecting... live updates paused"
+    timezone: "Times in your time zone ({zone})"
+    progress: "Delivery progress"
+    step-created: "Created"
+    step-dispatched: "Dispatched"
+    step-started: "Picked up"
+    step-enroute: "En route"
+    step-delivered: "Delivered"
+    step-issue: "Attempt missed"
+    step-canceled: "Canceled"
+    headline-preparing: "Getting your order ready"
+    headline-scheduled: "Scheduled for {date}"
+    headline-dispatched: "A driver has been assigned"
+    headline-delayed: "Running a little late"
+    headline-arriving: "Arriving {day}"
+    headline-in-transit: "On its way"
+    headline-delivered: "Delivered"
+    headline-issue: "There's a problem with your delivery"
+    headline-canceled: "This order was canceled"
+    sub-arriving: "{window} · in about {minutes} min"
+    sub-window: "Delivery window {window}"
+    sub-delivered: "{when}"
+    sub-dispatched: "Live tracking starts as soon as they're on the way."
+    sub-preparing: "We'll let you know when it's on its way."
+    delayed-title: "Running late."
+    delayed-help: "We'll keep your arrival time up to date."
+    stop-of: "Your delivery is stop {position} of {total}"
+    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
+    map: "Map"
+    map-label: "Map of your delivery: the van on its way to your address."
+    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
+    last-seen: "Last seen {minutes} min ago"
+    recenter: "Center the map on the van"
+    fit-route: "Show the whole route"
+    eta: "Estimated arrival"
+    in-minutes: "in about {minutes} min"
+    window: "Delivery window"
+    before-yours: "Before yours"
+    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
+    estimate-may-change: "Estimate may change"
+    driver: "Your driver"
+    online: "Online"
+    location-paused: "Location paused"
+    call-short: "Call"
+    message: "Message"
+    contact-note: "Calls and messages go to the {name} support team."
+    proof: "Proof of delivery"
+    open-photo: "Open the delivery photo"
+    open-signature: "Open the signature"
+    open-scan: "Open the scan"
+    proof-photo: "Delivery photo"
+    proof-signature: "Signature"
+    proof-scan: "Scanned at the door"
+    instructions: "Delivery instructions"
+    edit: "Edit"
+    instructions-help: "Gate codes, where to leave it, or who can sign"
+    cancel: "Cancel"
+    save: "Save"
+    no-instructions: "No instructions yet."
+    updates: "Updates"
+    no-updates: "No updates yet."
+    show-fewer: "Show fewer updates"
+    show-earlier: "Show earlier updates ({count})"
+    today: "Today"
+    yesterday: "Yesterday"
+    items: "In this delivery"
+    item: "Item"
+    quantity: "Qty {count}"
+    share: "Share tracking"
+    report: "Report a problem"
+    contact: "Contact {name}"
+    report-label: "What's wrong with your delivery?"
+    send: "Send"
+    close: "Close"
+    no-orders: "No orders yet"
+    no-orders-help: "Deliveries for your account will show up here."
diff --git a/translations/uk-ua.yaml b/translations/uk-ua.yaml
index e3985830d..bdf5bb4da 100644
--- a/translations/uk-ua.yaml
+++ b/translations/uk-ua.yaml
@@ -3561,3 +3561,176 @@ tracking-page:
     preview-sub: "2:10 to 2:40 pm"
     preview-button: "Verify it's you"
     preview-powered-by: "Powered by Fleetbase"
+  page:
+    track-another: "Track another"
+    unavailable-title: "Tracking isn't available here"
+    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
+    lookup-title: "Track your delivery"
+    lookup-sub: "See where your parcel is and when it will arrive."
+    tracking-number: "Tracking number"
+    tracking-number-placeholder: "e.g. NOR4829301736US"
+    tracking-number-help: "Find it in your confirmation email or on the parcel label."
+    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
+    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
+    looking-up: "Looking it up..."
+    track: "Track"
+    or: "or"
+    your-orders: "Your orders"
+    sign-in: "Sign in to see all your orders"
+    sign-in-account: "Sign in to your account"
+    back: "Back"
+    help: "Need help?"
+    language: "Language"
+    powered-by: "Powered by Fleetbase"
+    dismiss: "Dismiss"
+    chip-limited: "Limited view · Verify to see details"
+    chip-verified: "Verified on this device"
+    chip-account: "Signed in"
+    chip-staff: "Staff preview: what this customer sees"
+    status: "Status"
+    verify-to-see: "Verify to see your delivery"
+    last-update: "Last update: {date}"
+    copy: "Copy"
+    verify-title: "See your full delivery details"
+    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
+    verify-button: "Verify it's you"
+    verify-unlock: "Verify to unlock"
+    locked-map: "Live map"
+    locked-arrival: "Arrival time and driver"
+    locked-details: "Updates, items and proof of delivery"
+    stage-preparing: "Being prepared"
+    stage-scheduled: "Scheduled"
+    stage-dispatched: "Driver assigned"
+    stage-in_transit: "In transit"
+    stage-delivered: "Delivered"
+    stage-issue: "Needs attention"
+    stage-canceled: "Canceled"
+    stage-toast-preparing: "Your order is being prepared"
+    stage-toast-scheduled: "Your delivery is scheduled"
+    stage-toast-dispatched: "A driver has been assigned"
+    stage-toast-in_transit: "Your order is on its way"
+    stage-toast-delivered: "Your order has been delivered"
+    stage-toast-issue: "There's an update on your delivery"
+    stage-toast-canceled: "Your order was canceled"
+    verify-title-short: "Verify it's you"
+    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
+    send-by: "Send the code by"
+    channel-sms: "Text message"
+    channel-email: "Email"
+    send-failed: "We couldn't send a code just now. Please try again."
+    sending: "Sending code..."
+    send-code: "Send code"
+    masked-note: "We only ever show part of your number or email here."
+    no-contact-title: "We can't verify you here"
+    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
+    call: "Call {phone}"
+    renew-title: "Get a new code"
+    renew-expired: "That code has expired. Codes last 10 minutes."
+    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
+    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
+    renew-failed: "Something went wrong. Request a new code to try again."
+    send-new-code: "Send a new code"
+    verified-title: "You're verified"
+    locked-title: "Codes paused"
+    enter-code: "Enter your code"
+    code-sent-sms: "We texted a 6-digit code to {masked}."
+    code-sent-email: "We emailed a 6-digit code to {masked}."
+    code-label: "6-digit code"
+    code-expires: "The code expires in 10 minutes."
+    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
+    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
+    code-success: "Verified. Opening your delivery..."
+    resend-in: "Resend code in {time}"
+    resend: "Resend code"
+    switch-to-sms: "Send by text instead"
+    switch-to-email: "Send by email instead"
+    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
+    verified-toast: "You're verified"
+    verified-toast-help: "This device stays verified for this delivery."
+    signed-out-toast: "Signed out on this device"
+    instructions-saved: "Delivery instructions saved"
+    action-failed: "That didn't work. Please try again."
+    report-sent: "Message sent"
+    report-sent-help: "{name} will get back to you."
+    share-copied: "Link copied"
+    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
+    your-stop: "Stop {number}"
+    your-stops: "Your stops"
+    sign-out: "Not you? Sign out"
+    live: "Live"
+    reconnecting: "Reconnecting... live updates paused"
+    timezone: "Times in your time zone ({zone})"
+    progress: "Delivery progress"
+    step-created: "Created"
+    step-dispatched: "Dispatched"
+    step-started: "Picked up"
+    step-enroute: "En route"
+    step-delivered: "Delivered"
+    step-issue: "Attempt missed"
+    step-canceled: "Canceled"
+    headline-preparing: "Getting your order ready"
+    headline-scheduled: "Scheduled for {date}"
+    headline-dispatched: "A driver has been assigned"
+    headline-delayed: "Running a little late"
+    headline-arriving: "Arriving {day}"
+    headline-in-transit: "On its way"
+    headline-delivered: "Delivered"
+    headline-issue: "There's a problem with your delivery"
+    headline-canceled: "This order was canceled"
+    sub-arriving: "{window} · in about {minutes} min"
+    sub-window: "Delivery window {window}"
+    sub-delivered: "{when}"
+    sub-dispatched: "Live tracking starts as soon as they're on the way."
+    sub-preparing: "We'll let you know when it's on its way."
+    delayed-title: "Running late."
+    delayed-help: "We'll keep your arrival time up to date."
+    stop-of: "Your delivery is stop {position} of {total}"
+    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
+    map: "Map"
+    map-label: "Map of your delivery: the van on its way to your address."
+    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
+    last-seen: "Last seen {minutes} min ago"
+    recenter: "Center the map on the van"
+    fit-route: "Show the whole route"
+    eta: "Estimated arrival"
+    in-minutes: "in about {minutes} min"
+    window: "Delivery window"
+    before-yours: "Before yours"
+    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
+    estimate-may-change: "Estimate may change"
+    driver: "Your driver"
+    online: "Online"
+    location-paused: "Location paused"
+    call-short: "Call"
+    message: "Message"
+    contact-note: "Calls and messages go to the {name} support team."
+    proof: "Proof of delivery"
+    open-photo: "Open the delivery photo"
+    open-signature: "Open the signature"
+    open-scan: "Open the scan"
+    proof-photo: "Delivery photo"
+    proof-signature: "Signature"
+    proof-scan: "Scanned at the door"
+    instructions: "Delivery instructions"
+    edit: "Edit"
+    instructions-help: "Gate codes, where to leave it, or who can sign"
+    cancel: "Cancel"
+    save: "Save"
+    no-instructions: "No instructions yet."
+    updates: "Updates"
+    no-updates: "No updates yet."
+    show-fewer: "Show fewer updates"
+    show-earlier: "Show earlier updates ({count})"
+    today: "Today"
+    yesterday: "Yesterday"
+    items: "In this delivery"
+    item: "Item"
+    quantity: "Qty {count}"
+    share: "Share tracking"
+    report: "Report a problem"
+    contact: "Contact {name}"
+    report-label: "What's wrong with your delivery?"
+    send: "Send"
+    close: "Close"
+    no-orders: "No orders yet"
+    no-orders-help: "Deliveries for your account will show up here."
diff --git a/translations/vi-vn.yaml b/translations/vi-vn.yaml
index 16c0f1496..40c64a0ce 100644
--- a/translations/vi-vn.yaml
+++ b/translations/vi-vn.yaml
@@ -2234,3 +2234,176 @@ tracking-page:
     preview-sub: "2:10 to 2:40 pm"
     preview-button: "Verify it's you"
     preview-powered-by: "Powered by Fleetbase"
+  page:
+    track-another: "Track another"
+    unavailable-title: "Tracking isn't available here"
+    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
+    lookup-title: "Track your delivery"
+    lookup-sub: "See where your parcel is and when it will arrive."
+    tracking-number: "Tracking number"
+    tracking-number-placeholder: "e.g. NOR4829301736US"
+    tracking-number-help: "Find it in your confirmation email or on the parcel label."
+    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
+    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
+    looking-up: "Looking it up..."
+    track: "Track"
+    or: "or"
+    your-orders: "Your orders"
+    sign-in: "Sign in to see all your orders"
+    sign-in-account: "Sign in to your account"
+    back: "Back"
+    help: "Need help?"
+    language: "Language"
+    powered-by: "Powered by Fleetbase"
+    dismiss: "Dismiss"
+    chip-limited: "Limited view · Verify to see details"
+    chip-verified: "Verified on this device"
+    chip-account: "Signed in"
+    chip-staff: "Staff preview: what this customer sees"
+    status: "Status"
+    verify-to-see: "Verify to see your delivery"
+    last-update: "Last update: {date}"
+    copy: "Copy"
+    verify-title: "See your full delivery details"
+    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
+    verify-button: "Verify it's you"
+    verify-unlock: "Verify to unlock"
+    locked-map: "Live map"
+    locked-arrival: "Arrival time and driver"
+    locked-details: "Updates, items and proof of delivery"
+    stage-preparing: "Being prepared"
+    stage-scheduled: "Scheduled"
+    stage-dispatched: "Driver assigned"
+    stage-in_transit: "In transit"
+    stage-delivered: "Delivered"
+    stage-issue: "Needs attention"
+    stage-canceled: "Canceled"
+    stage-toast-preparing: "Your order is being prepared"
+    stage-toast-scheduled: "Your delivery is scheduled"
+    stage-toast-dispatched: "A driver has been assigned"
+    stage-toast-in_transit: "Your order is on its way"
+    stage-toast-delivered: "Your order has been delivered"
+    stage-toast-issue: "There's an update on your delivery"
+    stage-toast-canceled: "Your order was canceled"
+    verify-title-short: "Verify it's you"
+    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
+    send-by: "Send the code by"
+    channel-sms: "Text message"
+    channel-email: "Email"
+    send-failed: "We couldn't send a code just now. Please try again."
+    sending: "Sending code..."
+    send-code: "Send code"
+    masked-note: "We only ever show part of your number or email here."
+    no-contact-title: "We can't verify you here"
+    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
+    call: "Call {phone}"
+    renew-title: "Get a new code"
+    renew-expired: "That code has expired. Codes last 10 minutes."
+    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
+    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
+    renew-failed: "Something went wrong. Request a new code to try again."
+    send-new-code: "Send a new code"
+    verified-title: "You're verified"
+    locked-title: "Codes paused"
+    enter-code: "Enter your code"
+    code-sent-sms: "We texted a 6-digit code to {masked}."
+    code-sent-email: "We emailed a 6-digit code to {masked}."
+    code-label: "6-digit code"
+    code-expires: "The code expires in 10 minutes."
+    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
+    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
+    code-success: "Verified. Opening your delivery..."
+    resend-in: "Resend code in {time}"
+    resend: "Resend code"
+    switch-to-sms: "Send by text instead"
+    switch-to-email: "Send by email instead"
+    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
+    verified-toast: "You're verified"
+    verified-toast-help: "This device stays verified for this delivery."
+    signed-out-toast: "Signed out on this device"
+    instructions-saved: "Delivery instructions saved"
+    action-failed: "That didn't work. Please try again."
+    report-sent: "Message sent"
+    report-sent-help: "{name} will get back to you."
+    share-copied: "Link copied"
+    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
+    your-stop: "Stop {number}"
+    your-stops: "Your stops"
+    sign-out: "Not you? Sign out"
+    live: "Live"
+    reconnecting: "Reconnecting... live updates paused"
+    timezone: "Times in your time zone ({zone})"
+    progress: "Delivery progress"
+    step-created: "Created"
+    step-dispatched: "Dispatched"
+    step-started: "Picked up"
+    step-enroute: "En route"
+    step-delivered: "Delivered"
+    step-issue: "Attempt missed"
+    step-canceled: "Canceled"
+    headline-preparing: "Getting your order ready"
+    headline-scheduled: "Scheduled for {date}"
+    headline-dispatched: "A driver has been assigned"
+    headline-delayed: "Running a little late"
+    headline-arriving: "Arriving {day}"
+    headline-in-transit: "On its way"
+    headline-delivered: "Delivered"
+    headline-issue: "There's a problem with your delivery"
+    headline-canceled: "This order was canceled"
+    sub-arriving: "{window} · in about {minutes} min"
+    sub-window: "Delivery window {window}"
+    sub-delivered: "{when}"
+    sub-dispatched: "Live tracking starts as soon as they're on the way."
+    sub-preparing: "We'll let you know when it's on its way."
+    delayed-title: "Running late."
+    delayed-help: "We'll keep your arrival time up to date."
+    stop-of: "Your delivery is stop {position} of {total}"
+    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
+    map: "Map"
+    map-label: "Map of your delivery: the van on its way to your address."
+    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
+    last-seen: "Last seen {minutes} min ago"
+    recenter: "Center the map on the van"
+    fit-route: "Show the whole route"
+    eta: "Estimated arrival"
+    in-minutes: "in about {minutes} min"
+    window: "Delivery window"
+    before-yours: "Before yours"
+    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
+    estimate-may-change: "Estimate may change"
+    driver: "Your driver"
+    online: "Online"
+    location-paused: "Location paused"
+    call-short: "Call"
+    message: "Message"
+    contact-note: "Calls and messages go to the {name} support team."
+    proof: "Proof of delivery"
+    open-photo: "Open the delivery photo"
+    open-signature: "Open the signature"
+    open-scan: "Open the scan"
+    proof-photo: "Delivery photo"
+    proof-signature: "Signature"
+    proof-scan: "Scanned at the door"
+    instructions: "Delivery instructions"
+    edit: "Edit"
+    instructions-help: "Gate codes, where to leave it, or who can sign"
+    cancel: "Cancel"
+    save: "Save"
+    no-instructions: "No instructions yet."
+    updates: "Updates"
+    no-updates: "No updates yet."
+    show-fewer: "Show fewer updates"
+    show-earlier: "Show earlier updates ({count})"
+    today: "Today"
+    yesterday: "Yesterday"
+    items: "In this delivery"
+    item: "Item"
+    quantity: "Qty {count}"
+    share: "Share tracking"
+    report: "Report a problem"
+    contact: "Contact {name}"
+    report-label: "What's wrong with your delivery?"
+    send: "Send"
+    close: "Close"
+    no-orders: "No orders yet"
+    no-orders-help: "Deliveries for your account will show up here."

From 1b87d8bad3045232d3d27565a16279877991c036 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Thu, 8 Oct 2026 14:39:05 +0800
Subject: [PATCH 19/87] fix(tracking-page): lint fixes for the tracking page

- Wrap the code input's normalizing chain the way prettier wants.
- Rename the locale loop's block param so it no longer shadows <option>.
- Describe the map with screen-reader text instead of role=img, which
  can't contain the map's interactive controls.
---
 addon/components/tracking-page.hbs     | 4 ++--
 addon/components/tracking-page.js      | 4 +++-
 addon/components/tracking-page/map.hbs | 3 ++-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/addon/components/tracking-page.hbs b/addon/components/tracking-page.hbs
index 6bee0d56a..c0470d4c7 100644
--- a/addon/components/tracking-page.hbs
+++ b/addon/components/tracking-page.hbs
@@ -122,8 +122,8 @@
         <label class="tp-footer-language">
             <span>{{t "tracking-page.page.language"}}</span>
             <select class="tp-select" {{on "change" this.changeLocale}}>
-                {{#each this.localeOptions as |option|}}
-                    <option value={{option.code}} selected={{option.selected}}>{{option.label}}</option>
+                {{#each this.localeOptions as |locale|}}
+                    <option value={{locale.code}} selected={{locale.selected}}>{{locale.label}}</option>
                 {{/each}}
             </select>
         </label>
diff --git a/addon/components/tracking-page.js b/addon/components/tracking-page.js
index a17635f9d..fb7565f8c 100644
--- a/addon/components/tracking-page.js
+++ b/addon/components/tracking-page.js
@@ -364,7 +364,9 @@ export default class TrackingPageComponent extends Component {
             return;
         }
 
-        this.code = String(event.target.value ?? '').replace(/\D/g, '').slice(0, CODE_LENGTH);
+        this.code = String(event.target.value ?? '')
+            .replace(/\D/g, '')
+            .slice(0, CODE_LENGTH);
         if (this.verifyStep === 'wrong') {
             this.verifyStep = 'sent';
         }
diff --git a/addon/components/tracking-page/map.hbs b/addon/components/tracking-page/map.hbs
index d892939d9..58bc960e2 100644
--- a/addon/components/tracking-page/map.hbs
+++ b/addon/components/tracking-page/map.hbs
@@ -1,4 +1,5 @@
-<div class="tp-map" role="img" aria-label={{@label}}>
+<div class="tp-map">
+    <span class="tp-sr-only">{{@label}}</span>
     <LeafletMap class="tp-map-canvas" @lat={{get this.center 0}} @lng={{get this.center 1}} @zoom={{13}} @zoomControl={{false}} @onLoad={{this.setup}} as |layers|>
         <layers.tile @url={{(leaflet-tile-url)}} />
         {{#if this.hasRoute}}

From 8c10d6fb9a9b8d5af329fe96c01d6e4f66f27aec Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Thu, 8 Oct 2026 15:31:03 +0800
Subject: [PATCH 20/87] feat(tracking-page): path links, /~/t/{slug}/{number}
 and /~/track/{number}

The company page was /~/track?org={slug}. Links now carry the company and
tracking number in the path; the page still opens ?org= and ?order= links.
QR codes keep /~/track-order?order=, which printed labels carry.

Needs the console's /~/:slug/*path route (fleetbase/fleetbase).
---
 addon/components/tracking-page.js             | 71 ++++++++++++++++---
 addon/controllers/settings/tracking-page.js   |  4 +-
 addon/extension.js                            | 18 ++++-
 server/src/Support/TrackingCode.php           | 11 ++-
 .../CompactResourceSerializationTest.php      |  2 +-
 .../tests/Unit/Support/TrackingCodeTest.php   |  9 +--
 6 files changed, 90 insertions(+), 25 deletions(-)

diff --git a/addon/components/tracking-page.js b/addon/components/tracking-page.js
index fb7565f8c..a3e470ee1 100644
--- a/addon/components/tracking-page.js
+++ b/addon/components/tracking-page.js
@@ -36,10 +36,10 @@ const LOCALE_LABELS = {
 /**
  * The customer tracking page.
  *
- * Registered in the `auth:login` registry as `track` and `track-order`, so the console's
- * public `virtual` route serves it at `/~/track` and `/~/track-order`: outside the console,
- * signed in or not. `?order=` (or `?number=`) opens a tracking number and `?org=` a
- * company's own page.
+ * Registered in the `auth:login` registry as `t`, `track` and `track-order`, so the
+ * console's public `virtual` routes serve it outside the console, signed in or not:
+ * `/~/track/{number}` on the shared page and `/~/t/{slug}/{number}` on a company's own.
+ * The older `?order=` (or `?number=`) and `?org=` query links still open.
  *
  * A tracking number alone shows a coarse status. A one-time code to the customer's own
  * contact details unlocks their stops on this device; a signed-in customer, or staff of
@@ -77,8 +77,9 @@ export default class TrackingPageComponent extends Component {
 
     constructor() {
         super(...arguments);
-        this.org = this.urlSearchParams.get('org') || null;
-        this.trackingInput = this.urlSearchParams.get('order') || this.urlSearchParams.get('number') || '';
+        const fromPath = parseTrackingPath(window.location.pathname);
+        this.org = fromPath.org || this.urlSearchParams.get('org') || null;
+        this.trackingInput = fromPath.number || this.urlSearchParams.get('order') || this.urlSearchParams.get('number') || '';
         this.watchColorScheme();
         this.ticker = setInterval(() => this.tick(), 1000);
         this.boot.perform();
@@ -216,7 +217,7 @@ export default class TrackingPageComponent extends Component {
             const data = yield this.fetch.get(`track/${encodeURIComponent(value)}`, this.query(), REQUEST_OPTIONS);
             this.misses = 0;
             this.show(data);
-            this.urlSearchParams.addParamToCurrentUrl('order', data.tracking_number);
+            this.replaceUrl(data.tracking_number);
         } catch (error) {
             this.misses += 1;
             this.lookupError = this.rateLimited ? 'rate' : 'neutral';
@@ -296,7 +297,7 @@ export default class TrackingPageComponent extends Component {
         this.data = null;
         this.trackingInput = '';
         this.lookupError = null;
-        this.urlSearchParams.removeParamFromCurrentUrl('order');
+        this.replaceUrl(null);
         this.screen = 'lookup';
     }
 
@@ -308,7 +309,7 @@ export default class TrackingPageComponent extends Component {
     @action backToOrders() {
         this.live?.stop();
         this.data = null;
-        this.urlSearchParams.removeParamFromCurrentUrl('order');
+        this.replaceUrl(null);
         this.screen = 'list';
     }
 
@@ -452,7 +453,7 @@ export default class TrackingPageComponent extends Component {
     }
 
     @action share() {
-        const url = `${window.location.origin}/~/track?order=${encodeURIComponent(this.number)}${this.org ? `&org=${encodeURIComponent(this.org)}` : ''}`;
+        const url = `${window.location.origin}${trackingPath(this.org, this.number)}`;
         try {
             if (navigator.share) {
                 navigator.share({ url }).catch(() => {});
@@ -523,6 +524,18 @@ export default class TrackingPageComponent extends Component {
         this.colorScheme.addEventListener?.('change', this.onColorScheme);
     }
 
+    /**
+     * Keep the address bar on the page's own link, so a reload or a copied link opens the
+     * same order. The console router never sees it: the page stays on the same route.
+     */
+    replaceUrl(number) {
+        try {
+            window.history.replaceState(window.history.state, '', trackingPath(this.org, number));
+        } catch {
+            // The address bar is a convenience; the page already shows the order.
+        }
+    }
+
     query() {
         return this.org ? { org: this.org } : {};
     }
@@ -532,6 +545,44 @@ export default class TrackingPageComponent extends Component {
     }
 }
 
+/**
+ * The page's link: `/~/t/{slug}/{number}` on a company's own page, `/~/track/{number}`
+ * on the shared one; without a number, the page's lookup screen.
+ */
+export function trackingPath(org, number) {
+    const base = org ? `/~/t/${encodeURIComponent(org)}` : '/~/track';
+
+    return number ? `${base}/${encodeURIComponent(number)}` : base;
+}
+
+/**
+ * The company slug and tracking number in a page link's path, when it carries them.
+ */
+export function parseTrackingPath(pathname) {
+    const segments = String(pathname ?? '')
+        .split('/')
+        .filter(Boolean)
+        .map((segment) => {
+            try {
+                return decodeURIComponent(segment);
+            } catch {
+                return segment;
+            }
+        });
+    const start = segments.indexOf('~');
+    const [page, ...rest] = start === -1 ? [] : segments.slice(start + 1);
+
+    if (page === 't') {
+        return { org: rest[0] || null, number: rest[1] || null };
+    }
+
+    if (page === 'track' || page === 'track-order') {
+        return { org: null, number: rest[0] || null };
+    }
+
+    return { org: null, number: null };
+}
+
 export function formatCountdown(seconds) {
     const value = Math.max(0, Math.floor(seconds ?? 0));
     const minutes = Math.floor(value / 60);
diff --git a/addon/controllers/settings/tracking-page.js b/addon/controllers/settings/tracking-page.js
index 9741e0720..abe5cc072 100644
--- a/addon/controllers/settings/tracking-page.js
+++ b/addon/controllers/settings/tracking-page.js
@@ -97,11 +97,11 @@ export default class SettingsTrackingPageController extends Controller {
     }
 
     get orgPageBase() {
-        return `${window.location.origin}/~/track?org=`;
+        return `${window.location.origin}/~/t/`;
     }
 
     get orgPageUrl() {
-        return `${window.location.origin}/~/track?org=${encodeURIComponent(this.config?.org_page?.slug ?? '')}`;
+        return `${window.location.origin}/~/t/${encodeURIComponent(this.config?.org_page?.slug ?? '')}`;
     }
 
     get genericPageUrl() {
diff --git a/addon/extension.js b/addon/extension.js
index 3ff47b77f..ee1f1e52e 100644
--- a/addon/extension.js
+++ b/addon/extension.js
@@ -164,7 +164,7 @@ export default {
             })
         );
 
-        // The customer tracking page at /~/track (the shared page, or ?org= for a company's own).
+        // The customer tracking page: /~/track/{number} is the shared page.
         menuService.registerMenuItem(
             'auth:login',
             new MenuItem({
@@ -180,6 +180,22 @@ export default {
             })
         );
 
+        // A company's own tracking page: /~/t/{slug}/{number}.
+        menuService.registerMenuItem(
+            'auth:login',
+            new MenuItem({
+                title: 'Company tracking',
+                route: 'virtual',
+                slug: 't',
+                type: 'link',
+                wrapperClass: 'hidden',
+                component: new ExtensionComponent('@fleetbase/fleetops-engine', 'tracking-page'),
+                onClick: (menuItem) => {
+                    universe.transitionMenuItem('virtual', menuItem);
+                },
+            })
+        );
+
         menuService.registerMenuItem(
             'auth:login',
             new MenuItem({
diff --git a/server/src/Support/TrackingCode.php b/server/src/Support/TrackingCode.php
index 8fc6600b0..84be3c83e 100644
--- a/server/src/Support/TrackingCode.php
+++ b/server/src/Support/TrackingCode.php
@@ -43,23 +43,20 @@ class TrackingCode
 
     /**
      * The tracking page link for emails, notifications and the API: the company's own page
-     * when its settings send links there, otherwise the shared page.
+     * (`~/t/{slug}/{number}`) when its settings send links there, otherwise the shared page
+     * (`~/track/{number}`). QR codes keep {@see PATH}, which labels already printed carry.
      */
     public static function pageUrl(string $trackingNumber, ?string $companyUuid = null): string
     {
-        $query = [static::TRACKING_PARAM => $trackingNumber];
-
         try {
             $slug = $companyUuid ? app(TrackingPage\TrackingResolver::class)->linkSlugFor($companyUuid) : null;
         } catch (\Throwable) {
             $slug = null;
         }
 
-        if ($slug) {
-            $query['org'] = $slug;
-        }
+        $base = $slug ? '~/t/' . rawurlencode($slug) : '~/track';
 
-        return Utils::consoleUrl(static::PATH, $query);
+        return Utils::consoleUrl($base . '/' . rawurlencode($trackingNumber), []);
     }
 
     /**
diff --git a/server/tests/CompactResourceSerializationTest.php b/server/tests/CompactResourceSerializationTest.php
index 97e5c664c..a11e10d51 100644
--- a/server/tests/CompactResourceSerializationTest.php
+++ b/server/tests/CompactResourceSerializationTest.php
@@ -2835,7 +2835,7 @@ public function environment(...$environments)
 
     expect($payload['qr_code_content'])->toBe('https://console.fleetbase.test/~/track-order?order=TN-SCAN&r=order_public&v=1')
         ->and($payload['qr_code_content'])->not->toContain('owner-uuid')
-        ->and($payload['url'])->toBe('https://console.fleetbase.test/~/track-order?order=TN-SCAN')
+        ->and($payload['url'])->toBe('https://console.fleetbase.test/~/track/TN-SCAN')
         ->and($payload['qr_code'])->toBe('qr-data')
         // Nothing to scan without a tracking number: the key is absent, not null.
         ->and(array_key_exists('qr_code_content', $withoutNumber))->toBeFalse();
diff --git a/server/tests/Unit/Support/TrackingCodeTest.php b/server/tests/Unit/Support/TrackingCodeTest.php
index 45e499165..3da49f92e 100644
--- a/server/tests/Unit/Support/TrackingCodeTest.php
+++ b/server/tests/Unit/Support/TrackingCodeTest.php
@@ -158,10 +158,11 @@ public function linkSlugFor(string $companyUuid): ?string
     });
 
     try {
-        expect(TrackingCode::pageUrl('NOR1', 'co-1'))->toEndWith('/~/track-order?order=NOR1&org=northwind')
-            ->and(TrackingCode::pageUrl('NOR1', 'co-2'))->toEndWith('/~/track-order?order=NOR1')
-            ->and(TrackingCode::pageUrl('NOR1', 'broken'))->toEndWith('/~/track-order?order=NOR1')
-            ->and(TrackingCode::pageUrl('NOR1'))->toEndWith('/~/track-order?order=NOR1');
+        expect(TrackingCode::pageUrl('NOR1', 'co-1'))->toEndWith('/~/t/northwind/NOR1')
+            ->and(TrackingCode::pageUrl('NOR1', 'co-2'))->toEndWith('/~/track/NOR1')
+            ->and(TrackingCode::pageUrl('NOR1', 'broken'))->toEndWith('/~/track/NOR1')
+            ->and(TrackingCode::pageUrl('NOR1'))->toEndWith('/~/track/NOR1')
+            ->and(TrackingCode::pageUrl('A B/1'))->toEndWith('/~/track/A%20B%2F1');
     } finally {
         app()->forgetInstance(Fleetbase\FleetOps\Support\TrackingPage\TrackingResolver::class);
     }

From 750c26b8da94a945e88759ca5fc891ba45f3b4ad Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Fri, 9 Oct 2026 13:54:53 +0800
Subject: [PATCH 21/87] fix(orders): keep order details from breaking
 navigation away

The Overview tab linked to the details route without a model, so its href
was generated from whatever transition was in flight. Leaving for a
shallower route (e.g. Telematics) made router_js read shouldSupersede of
undefined during render, which killed the transition.

Socket status events also called hostRouter.refresh() with no pivot,
re-running every route from the application down and leaving unhandled
TransitionAborted rejections when a navigation superseded them. Refresh
only the order details route and treat an aborted refresh as expected.
---
 .../operations/orders/index/details.js        | 22 ++++++--
 .../operations/orders/index/details-test.js   | 54 ++++++++++++++++++-
 2 files changed, 72 insertions(+), 4 deletions(-)

diff --git a/addon/controllers/operations/orders/index/details.js b/addon/controllers/operations/orders/index/details.js
index 327623dfe..306f02af2 100644
--- a/addon/controllers/operations/orders/index/details.js
+++ b/addon/controllers/operations/orders/index/details.js
@@ -1,4 +1,5 @@
 import Controller, { inject as controller } from '@ember/controller';
+import { getOwner } from '@ember/application';
 import { tracked } from '@glimmer/tracking';
 import { action } from '@ember/object';
 import { inject as service } from '@ember/service';
@@ -78,6 +79,9 @@ export default class OperationsOrdersIndexDetailsController extends Controller {
         return [
             {
                 route: 'operations.orders.index.details.index',
+                // Pass the order explicitly: without it the link's href is generated from whatever
+                // transition is in flight, and leaving for a shallower route throws in the router.
+                model: this.model?.public_id,
                 label: 'Overview',
                 icon: 'folder-open',
             },
@@ -219,10 +223,22 @@ export default class OperationsOrdersIndexDetailsController extends Controller {
     }
 
     @task *refresh() {
+        yield this.refreshDetails();
+    }
+
+    /**
+     * Reload only the order details route. A bare `hostRouter.refresh()` re-runs every route
+     * from the application down (console, the engine's application `beforeModel`, the orders
+     * list), so a socket event during navigation leaves a slow refresh in flight.
+     */
+    async refreshDetails() {
         try {
-            yield this.hostRouter.refresh();
+            await getOwner(this).lookup('route:operations.orders.index.details').refresh();
         } catch (error) {
-            return error;
+            // A refresh superseded by a newer transition is expected, not an error.
+            if (error?.name !== 'TransitionAborted') {
+                throw error;
+            }
         }
     }
 
@@ -246,7 +262,7 @@ export default class OperationsOrdersIndexDetailsController extends Controller {
             this.model,
             async (_msg, { reloadable }) => {
                 if (reloadable) {
-                    await this.hostRouter.refresh();
+                    await this.refreshDetails();
                 }
             },
             { debounceMs: 250 }
diff --git a/tests/unit/controllers/operations/orders/index/details-test.js b/tests/unit/controllers/operations/orders/index/details-test.js
index 0704cd16d..261929f43 100644
--- a/tests/unit/controllers/operations/orders/index/details-test.js
+++ b/tests/unit/controllers/operations/orders/index/details-test.js
@@ -1,12 +1,64 @@
 import { module, test } from 'qunit';
 import { setupTest } from 'dummy/tests/helpers';
+import Controller from '@ember/controller';
+import Service from '@ember/service';
 
 module('Unit | Controller | operations/orders/index/details', function (hooks) {
     setupTest(hooks);
 
-    // TODO: Replace this with your real tests.
+    hooks.beforeEach(function () {
+        // The engine host provides these; the dummy app does not.
+        this.owner.register('service:hostRouter', class extends Service {});
+        this.owner.register('controller:operations.orders.index', class extends Controller {});
+    });
+
     test('it exists', function (assert) {
         let controller = this.owner.lookup('controller:operations/orders/index/details');
         assert.ok(controller);
     });
+
+    test('the overview tab links to the current order explicitly', function (assert) {
+        const controller = this.owner.lookup('controller:operations/orders/index/details');
+        controller.model = { public_id: 'order_abc123' };
+
+        const [overview] = controller.tabs;
+
+        assert.strictEqual(overview.route, 'operations.orders.index.details.index');
+        assert.strictEqual(overview.model, 'order_abc123');
+    });
+
+    test('refreshDetails refreshes only the order details route', async function (assert) {
+        const controller = this.owner.lookup('controller:operations/orders/index/details');
+        const route = this.owner.lookup('route:operations/orders/index/details');
+        let refreshed = 0;
+        route.refresh = () => {
+            refreshed++;
+            return Promise.resolve();
+        };
+        controller.hostRouter.refresh = () => assert.ok(false, 'the whole route tree is not refreshed');
+
+        await controller.refreshDetails();
+
+        assert.strictEqual(refreshed, 1);
+    });
+
+    test('refreshDetails ignores a refresh superseded by another transition', async function (assert) {
+        const controller = this.owner.lookup('controller:operations/orders/index/details');
+        const route = this.owner.lookup('route:operations/orders/index/details');
+        const aborted = new Error('TransitionAborted');
+        aborted.name = 'TransitionAborted';
+        route.refresh = () => Promise.reject(aborted);
+
+        await controller.refreshDetails();
+
+        assert.ok(true, 'the aborted transition does not reject');
+    });
+
+    test('refreshDetails rethrows other errors', async function (assert) {
+        const controller = this.owner.lookup('controller:operations/orders/index/details');
+        const route = this.owner.lookup('route:operations/orders/index/details');
+        route.refresh = () => Promise.reject(new Error('boom'));
+
+        await assert.rejects(controller.refreshDetails(), /boom/);
+    });
 });

From 7c3e551dda0d7f1940ad6df8cef5a1deeed10a24 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Fri, 9 Oct 2026 14:00:20 +0800
Subject: [PATCH 22/87] fix(places): return 404 when a place isn't found

GET, PUT and DELETE /v1/places/{id} answered 400 for an unknown or
foreign place, unlike orders, vehicles, drivers and fleets.

Fixes #361
---
 server/src/Http/Controllers/Api/v1/PlaceController.php | 6 +++---
 server/tests/ApiPlaceControllerContractsTest.php       | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/server/src/Http/Controllers/Api/v1/PlaceController.php b/server/src/Http/Controllers/Api/v1/PlaceController.php
index dffb82b51..43c19bb6a 100644
--- a/server/src/Http/Controllers/Api/v1/PlaceController.php
+++ b/server/src/Http/Controllers/Api/v1/PlaceController.php
@@ -146,7 +146,7 @@ public function update($id, UpdatePlaceRequest $request)
         try {
             $place = $this->findPlaceOrFail($id);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return $this->apiError('Place resource not found.');
+            return $this->apiError('Place resource not found.', 404);
         }
 
         // get request input
@@ -253,7 +253,7 @@ public function find($id, Request $request)
         try {
             $place = $this->findPlaceOrFail($id);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return $this->apiError('Place resource not found.');
+            return $this->apiError('Place resource not found.', 404);
         }
 
         return $this->placeResource($place);
@@ -269,7 +269,7 @@ public function delete($id, Request $request)
         try {
             $place = $this->findPlaceOrFail($id);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return $this->apiError('Place resource not found.');
+            return $this->apiError('Place resource not found.', 404);
         }
 
         $place->delete();
diff --git a/server/tests/ApiPlaceControllerContractsTest.php b/server/tests/ApiPlaceControllerContractsTest.php
index 876329d9e..24f565876 100644
--- a/server/tests/ApiPlaceControllerContractsTest.php
+++ b/server/tests/ApiPlaceControllerContractsTest.php
@@ -537,5 +537,5 @@ function fleetopsApiPlace(array $attributes = []): FleetOpsApiPlaceEndpointFake
         ? $controller->update('missing-place', fleetopsUpdatePlaceRequest([]))
         : $controller->{$method}('missing-place', new Request());
 
-    expect($response)->toBe(['apiError' => 'Place resource not found.', 'status' => 400]);
+    expect($response)->toBe(['apiError' => 'Place resource not found.', 'status' => 404]);
 })->with(['update', 'find', 'delete']);

From a4b5e3a135347f50a6d37b5c3745d0ae47e0ee1f Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Fri, 9 Oct 2026 14:10:42 +0800
Subject: [PATCH 23/87] fix(geo): build radius circles at the requested size

coordsToCircle() multiplied metres by 1000 before dividing by the earth's
radius in metres, so a 15 km service area or zone came out 15,000 km
wide. Also wrap negative longitudes so circles that cross the
antimeridian stay within -180..180.

Fixes #360
---
 server/src/Support/Utils.php                  |  7 +++---
 .../Support/UtilsGeoMatrixAndVendorTest.php   | 25 +++++++++++++++++++
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/server/src/Support/Utils.php b/server/src/Support/Utils.php
index b7037d3ab..19167d790 100644
--- a/server/src/Support/Utils.php
+++ b/server/src/Support/Utils.php
@@ -1220,8 +1220,8 @@ public static function coordsToCircle($latitude, $longitude, $meters)
     {
         $latitude  = deg2rad($latitude);
         $longitude = deg2rad($longitude);
-        // convert meters to km
-        $radius = ($meters * 1000) / 6378137;
+        // angular radius: metres over the earth's equatorial radius in metres
+        $radius = $meters / 6378137;
         // create circle coordinates
         $coords = collect();
         // loop through the array and write path linestrings — stop short of 360
@@ -1231,7 +1231,8 @@ public static function coordsToCircle($latitude, $longitude, $meters)
             $radial   = deg2rad($i);
             $lat_rad  = asin(sin($latitude) * cos($radius) + cos($latitude) * sin($radius) * cos($radial));
             $dlon_rad = atan2(sin($radial) * sin($radius) * cos($latitude), cos($radius) - sin($latitude) * sin($lat_rad));
-            $lon_rad  = fmod($longitude + $dlon_rad + M_PI, 2 * M_PI) - M_PI;
+            // shift by 3π, not π: fmod keeps the dividend's sign, so a negative sum would not wrap
+            $lon_rad  = fmod($longitude + $dlon_rad + 3 * M_PI, 2 * M_PI) - M_PI;
             $coords->push([rad2deg($lat_rad), rad2deg($lon_rad)]);
         }
 
diff --git a/server/tests/Unit/Support/UtilsGeoMatrixAndVendorTest.php b/server/tests/Unit/Support/UtilsGeoMatrixAndVendorTest.php
index 619e79cb6..f6acbf63b 100644
--- a/server/tests/Unit/Support/UtilsGeoMatrixAndVendorTest.php
+++ b/server/tests/Unit/Support/UtilsGeoMatrixAndVendorTest.php
@@ -380,3 +380,28 @@ public function centroid(Brick\Geo\Geometry $g): Brick\Geo\Point
     expect(Utils::getCentroidFromGeosPolygon($brickPolygon)->x())->toBe(103.81)
         ->and(Utils::getCentroidFromGeosMultiPolygon(Brick\Geo\MultiPolygon::of($brickPolygon))->y())->toBe(1.31);
 });
+
+test('coordsToCircle keeps every vertex on the requested radius', function () {
+    $haversine = function (float $lat1, float $lng1, float $lat2, float $lng2): float {
+        $dLat = deg2rad($lat2 - $lat1);
+        $dLng = deg2rad($lng2 - $lng1);
+        $a    = sin($dLat / 2) ** 2 + cos(deg2rad($lat1)) * cos(deg2rad($lat2)) * sin($dLng / 2) ** 2;
+
+        return 6378137 * 2 * atan2(sqrt($a), sqrt(1 - $a));
+    };
+
+    // 15 km around Seattle, the case from fleetbase/fleetops#360
+    foreach (Utils::coordsToCircle(47.6062, -122.3321, 15000) as [$lat, $lng]) {
+        expect($haversine(47.6062, -122.3321, $lat, $lng))->toEqualWithDelta(15000, 1);
+    }
+});
+
+test('coordsToCircle wraps longitudes across the antimeridian', function () {
+    $longitudes = array_column(Utils::coordsToCircle(0, -179.99, 5000), 1);
+
+    expect(min($longitudes))->toBeGreaterThanOrEqual(-180)
+        ->and(max($longitudes))->toBeLessThanOrEqual(180)
+        // the eastern half of the ring crosses to the far side of the antimeridian
+        ->and(max($longitudes))->toBeGreaterThan(179.9)
+        ->and(min($longitudes))->toBeLessThan(-179.99);
+});

From 620d07d995e16c17fb421a7b35d9378758f8d2cb Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Fri, 9 Oct 2026 14:16:03 +0800
Subject: [PATCH 24/87] fix(orders): keep the new order draft when a place is
 edited

Resetting in willTransition wiped the draft on any transition, including
the refresh that follows saving a place, customer or facilitator from a
modal. Reset in resetController only when exiting, and edit places from
the route form without a refresh; re-preview the route and quote instead.

Fixes fleetbase/fleetbase#651
---
 addon/components/order/form/route.hbs         |  2 +-
 addon/components/order/form/route.js          | 14 +++++-
 addon/routes/operations/orders/index/new.js   |  9 ++--
 .../components/order/form/route-test.js       | 47 +++++++++++++++++++
 .../operations/orders/index/new-test.js       | 30 ++++++++++++
 5 files changed, 96 insertions(+), 6 deletions(-)
 create mode 100644 tests/unit/routes/operations/orders/index/new-test.js

diff --git a/addon/components/order/form/route.hbs b/addon/components/order/form/route.hbs
index 9fe9d95d8..643fcad3d 100644
--- a/addon/components/order/form/route.hbs
+++ b/addon/components/order/form/route.hbs
@@ -151,7 +151,7 @@
                 <div class="flex items-center justify-end">
                     <div class="flex-row space-x-1 pr-0.5">
                         {{#if @resource.payload.pickup}}
-                            <a href="javascript:;" {{on "click" (fn this.editPlace @resource.payload.pickup)}}>
+                            <a href="javascript:;" data-test-edit-place="pickup" {{on "click" (fn this.editPlace @resource.payload.pickup)}}>
                                 <FaIcon @icon="edit" />
                             </a>
                             <a href="javascript:;" {{on "click" (fn this.setPayloadPlace "pickup" null)}}>
diff --git a/addon/components/order/form/route.js b/addon/components/order/form/route.js
index 9666fe988..1238fe1d5 100644
--- a/addon/components/order/form/route.js
+++ b/addon/components/order/form/route.js
@@ -206,7 +206,19 @@ export default class OrderFormRouteComponent extends Component {
     }
 
     @action editPlace(place) {
-        this.placeActions.modal.edit(place);
+        // The place is edited in place, so the form already shows the change; there is no list
+        // to refresh, only the route preview and quote that depend on its location.
+        this.placeActions.modal.edit(
+            place,
+            {},
+            {
+                refresh: false,
+                callback: () => {
+                    this.previewRoute();
+                    this.requestServiceQuoteRefresh('route.place.updated');
+                },
+            }
+        );
     }
 
     @action async previewRoute() {
diff --git a/addon/routes/operations/orders/index/new.js b/addon/routes/operations/orders/index/new.js
index e8302b75e..91cdb3d9c 100644
--- a/addon/routes/operations/orders/index/new.js
+++ b/addon/routes/operations/orders/index/new.js
@@ -1,6 +1,5 @@
 import Route from '@ember/routing/route';
 import { inject as service } from '@ember/service';
-import { action } from '@ember/object';
 
 export default class OperationsOrdersIndexNewRoute extends Route {
     @service notifications;
@@ -9,9 +8,11 @@ export default class OperationsOrdersIndexNewRoute extends Route {
     @service intl;
     @service sidebar;
 
-    @action willTransition() {
-        if (this.controller) {
-            this.controller.reset();
+    // Reset the draft only when leaving the route. A refresh of this route (e.g. after saving
+    // a place or customer from a modal) also transitions, and must keep what was entered.
+    resetController(controller, isExiting) {
+        if (isExiting) {
+            controller.reset();
         }
     }
 
diff --git a/tests/integration/components/order/form/route-test.js b/tests/integration/components/order/form/route-test.js
index e68b1980a..d7b2367db 100644
--- a/tests/integration/components/order/form/route-test.js
+++ b/tests/integration/components/order/form/route-test.js
@@ -104,4 +104,51 @@ module('Integration | Component | order/form/route', function (hooks) {
             'requests refresh for the current order'
         );
     });
+    test('editing a place saves it without refreshing the route', async function (assert) {
+        const edits = [];
+        const requests = [];
+
+        class PlaceActionsStub extends Service {
+            modal = {
+                edit: (place, options, saveOptions) => edits.push({ place, options, saveOptions }),
+            };
+        }
+
+        class OrderCreationStub extends Service {
+            requestServiceQuoteRefresh(reason) {
+                requests.push(reason);
+            }
+        }
+
+        this.owner.register('service:place-actions', PlaceActionsStub);
+        this.owner.register('service:order-creation', OrderCreationStub);
+        const pickup = { id: 'place_pickup', address: '1 Pickup Street' };
+        this.set('resource', {
+            customer: null,
+            driver_assigned: null,
+            id: 'test-order',
+            facilitator: {
+                isIntegratedVendor: false,
+            },
+            payload: {
+                pickup,
+                dropoff: null,
+                return: null,
+                waypoints: A([]),
+            },
+        });
+
+        await render(hbs`<Order::Form::Route @resource={{this.resource}} />`);
+        await click('[data-test-edit-place="pickup"]');
+
+        assert.strictEqual(edits.length, 1);
+        assert.strictEqual(edits[0].place, pickup);
+        // A refresh would re-enter the new order route and wipe the draft (fleetbase/fleetbase#651).
+        assert.false(edits[0].saveOptions.refresh);
+
+        edits[0].saveOptions.callback(pickup);
+        await settled();
+
+        assert.true(requests.includes('route.place.updated'), 'requests a new quote for the saved place');
+    });
 });
diff --git a/tests/unit/routes/operations/orders/index/new-test.js b/tests/unit/routes/operations/orders/index/new-test.js
new file mode 100644
index 000000000..6eee45497
--- /dev/null
+++ b/tests/unit/routes/operations/orders/index/new-test.js
@@ -0,0 +1,30 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'dummy/tests/helpers';
+import Service from '@ember/service';
+
+module('Unit | Route | operations/orders/index/new', function (hooks) {
+    setupTest(hooks);
+
+    hooks.beforeEach(function () {
+        // The engine host provides this; the dummy app does not.
+        this.owner.register('service:hostRouter', class extends Service {});
+    });
+
+    test('it keeps the draft order when the route refreshes', function (assert) {
+        const route = this.owner.lookup('route:operations/orders/index/new');
+        let resets = 0;
+
+        route.resetController({ reset: () => resets++ }, false);
+
+        assert.strictEqual(resets, 0);
+    });
+
+    test('it resets the draft order when leaving the route', function (assert) {
+        const route = this.owner.lookup('route:operations/orders/index/new');
+        let resets = 0;
+
+        route.resetController({ reset: () => resets++ }, true);
+
+        assert.strictEqual(resets, 1);
+    });
+});

From e5c0c2638a8d221d8139897948667ae88f4cff6b Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Fri, 9 Oct 2026 14:24:44 +0800
Subject: [PATCH 25/87] fix(orders): soft-delete an order's payload, entities
 and tracking data with it

Deleting an order left its payload, entities, waypoints, tracking numbers
and tracking statuses live. OrderObserver now cascades the soft delete,
stamping children with the order's deleted_at, and skips the payload tree
when another live order shares the payload. Restoring the order restores
the children carrying that same timestamp.

Order::bulkRemove deletes matched orders one at a time so the observer
runs for the console bulk delete, keeping core-api's tenant constraint
and return count.

Fixes #368
---
 server/src/Models/Order.php                   |  25 ++
 server/src/Observers/OrderObserver.php        | 112 +++++++++
 server/tests/ObserverContractsTest.php        |   4 +
 .../Unit/Observers/OrderDeleteCascadeTest.php | 213 ++++++++++++++++++
 4 files changed, 354 insertions(+)
 create mode 100644 server/tests/Unit/Observers/OrderDeleteCascadeTest.php

diff --git a/server/src/Models/Order.php b/server/src/Models/Order.php
index 3ff12ef87..b523689ad 100644
--- a/server/src/Models/Order.php
+++ b/server/src/Models/Order.php
@@ -263,6 +263,31 @@ public static function boot(): void
         );
     }
 
+    /**
+     * Bulk removal deletes the matched orders one at a time instead of with a single
+     * query, so the "deleted" event fires for each and OrderObserver cascades the soft
+     * delete to the order's payload, entities and tracking data. Matching, the tenant
+     * constraint (GHSA-3wj9-hh56-7fw7) and the returned count follow core-api's version.
+     */
+    public function bulkRemove($ids = [])
+    {
+        $orders = static::where(function ($query) use ($ids) {
+            $query->whereIn($this->getQualifiedKeyName(), $ids)->orWhereIn($this->getQualifiedPublicId(), $ids);
+        });
+
+        // Tenant constraint: never delete another company's orders.
+        $companyUuid = session('company');
+        if ($companyUuid) {
+            $orders->where($this->qualifyColumn('company_uuid'), $companyUuid);
+        }
+
+        $orders = $orders->get();
+        $orders->each->delete();
+        $this->invalidateApiCacheOnChange();
+
+        return $orders->count();
+    }
+
     /**
      * Get the activity log options for the model.
      */
diff --git a/server/src/Observers/OrderObserver.php b/server/src/Observers/OrderObserver.php
index 83c8f4ead..a5b8a8496 100644
--- a/server/src/Observers/OrderObserver.php
+++ b/server/src/Observers/OrderObserver.php
@@ -2,13 +2,27 @@
 
 namespace Fleetbase\FleetOps\Observers;
 
+use Fleetbase\FleetOps\Models\Entity;
 use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Payload;
+use Fleetbase\FleetOps\Models\TrackingNumber;
+use Fleetbase\FleetOps\Models\TrackingStatus;
+use Fleetbase\FleetOps\Models\Waypoint;
 use Fleetbase\FleetOps\Support\LiveCacheService;
 use Fleetbase\FleetOps\Support\TrackingPublisher;
 use Illuminate\Support\Facades\Cache;
 
 class OrderObserver
 {
+    /**
+     * Deletion timestamps captured while an order is being restored, keyed by order uuid.
+     * Restoring clears the order's deleted_at before "restored" fires, so the timestamp the
+     * children were deleted with is read in "restoring" and used once the restore succeeds.
+     *
+     * @var array<string, string>
+     */
+    protected static array $restoringFrom = [];
+
     /**
      * Handle the Order "created" event.
      *
@@ -63,9 +77,107 @@ public function deleted(Order $order)
             $order->facilitator->provider()->callback('onDeleted', $order);
         }
 
+        $this->cascadeDelete($order);
+        $this->invalidateCache($order);
+    }
+
+    /**
+     * Handle the Order "restoring" event: remember when the order was deleted.
+     */
+    public function restoring(Order $order): void
+    {
+        if ($order->uuid && $order->deleted_at) {
+            static::$restoringFrom[$order->uuid] = $order->fromDateTime($order->deleted_at);
+        }
+    }
+
+    /**
+     * Handle the Order "restored" event: bring back the children deleted with the order.
+     */
+    public function restored(Order $order): void
+    {
+        $deletedAt = static::$restoringFrom[$order->uuid] ?? null;
+        unset(static::$restoringFrom[$order->uuid]);
+
+        if ($deletedAt) {
+            $this->cascadeRestore($order, $deletedAt);
+        }
+
         $this->invalidateCache($order);
     }
 
+    /**
+     * Soft-deletes what belongs to the order: its tracking number and, unless another live
+     * order shares it, its payload with the payload's entities and waypoints and their
+     * tracking numbers, plus every one of those tracking numbers' statuses. Children are
+     * stamped with the order's own deleted_at so a restore can find exactly those rows.
+     */
+    protected function cascadeDelete(Order $order): void
+    {
+        $deletedAt = $order->fromDateTime($order->deleted_at ?? $order->freshTimestamp());
+        $tree      = $this->childTree($order, Payload::query(), Entity::query(), Waypoint::query());
+
+        if ($tree['payload']) {
+            Payload::where('uuid', $tree['payload'])->update(['deleted_at' => $deletedAt]);
+            Entity::whereIn('uuid', $tree['entities'])->update(['deleted_at' => $deletedAt]);
+            Waypoint::whereIn('uuid', $tree['waypoints'])->update(['deleted_at' => $deletedAt]);
+        }
+
+        $trackingNumbers = TrackingNumber::where(fn ($query) => $query->whereIn('uuid', $tree['tracking_numbers'])->orWhereIn('owner_uuid', $tree['owners']))->pluck('uuid')->all();
+        TrackingStatus::whereIn('tracking_number_uuid', $trackingNumbers)->update(['deleted_at' => $deletedAt]);
+        TrackingNumber::whereIn('uuid', $trackingNumbers)->update(['deleted_at' => $deletedAt]);
+    }
+
+    /**
+     * Restores the children cascadeDelete() removed: the rows of the same tree whose
+     * deleted_at matches the order's. Children deleted on their own beforehand carry
+     * a different timestamp and stay deleted.
+     */
+    protected function cascadeRestore(Order $order, string $deletedAt): void
+    {
+        $trashed = fn (string $model) => $model::onlyTrashed()->where('deleted_at', $deletedAt);
+        $tree    = $this->childTree($order, $trashed(Payload::class), $trashed(Entity::class), $trashed(Waypoint::class));
+
+        $trackingNumbers = $trashed(TrackingNumber::class)->where(fn ($query) => $query->whereIn('uuid', $tree['tracking_numbers'])->orWhereIn('owner_uuid', $tree['owners']))->pluck('uuid')->all();
+        $trashed(TrackingNumber::class)->whereIn('uuid', $trackingNumbers)->update(['deleted_at' => null]);
+        $trashed(TrackingStatus::class)->whereIn('tracking_number_uuid', $trackingNumbers)->update(['deleted_at' => null]);
+
+        if ($tree['payload']) {
+            $trashed(Payload::class)->where('uuid', $tree['payload'])->update(['deleted_at' => null]);
+            $trashed(Entity::class)->whereIn('uuid', $tree['entities'])->update(['deleted_at' => null]);
+            $trashed(Waypoint::class)->whereIn('uuid', $tree['waypoints'])->update(['deleted_at' => null]);
+        }
+    }
+
+    /**
+     * Collects the uuids under an order from the given payload, entity and waypoint
+     * queries. The payload is left out when another live order still references it.
+     *
+     * @return array{payload: ?string, entities: array, waypoints: array, tracking_numbers: array, owners: array}
+     */
+    protected function childTree(Order $order, $payloads, $entities, $waypoints): array
+    {
+        $tree = ['payload' => null, 'entities' => [], 'waypoints' => [], 'tracking_numbers' => [$order->tracking_number_uuid], 'owners' => [$order->uuid]];
+
+        $shared  = $order->payload_uuid && Order::where('payload_uuid', $order->payload_uuid)->where('uuid', '!=', $order->uuid)->exists();
+        $payload = $order->payload_uuid && !$shared ? $payloads->where('uuid', $order->payload_uuid)->first() : null;
+
+        if ($payload) {
+            $children = $entities->where('payload_uuid', $payload->uuid)->get(['uuid', 'tracking_number_uuid'])
+                ->concat($waypoints->where('payload_uuid', $payload->uuid)->get(['uuid', 'tracking_number_uuid']));
+
+            $tree['payload']          = $payload->uuid;
+            $tree['entities']         = $children->whereInstanceOf(Entity::class)->pluck('uuid')->all();
+            $tree['waypoints']        = $children->whereInstanceOf(Waypoint::class)->pluck('uuid')->all();
+            $tree['tracking_numbers'] = array_merge($tree['tracking_numbers'], [$payload->pickup_tracking_number_uuid, $payload->dropoff_tracking_number_uuid, $payload->return_tracking_number_uuid], $children->pluck('tracking_number_uuid')->all());
+            $tree['owners']           = array_merge($tree['owners'], $children->pluck('uuid')->all());
+        }
+
+        $tree['tracking_numbers'] = array_values(array_filter($tree['tracking_numbers']));
+
+        return $tree;
+    }
+
     /**
      * Invalidate relevant cache tags for live endpoints.
      *
diff --git a/server/tests/ObserverContractsTest.php b/server/tests/ObserverContractsTest.php
index 3893c2b05..d4e4f98c5 100644
--- a/server/tests/ObserverContractsTest.php
+++ b/server/tests/ObserverContractsTest.php
@@ -1082,6 +1082,8 @@ protected function resolveOrder(PurchaseRate $purchaseRate): ?Order
 test('order observer invalidates cache on delete and forwards to integrated vendors', function () {
     Cache::swap(new Repository(new ArrayStore()));
     session(['company' => 'company-uuid']);
+    // Deleting cascades to the order's children, so the queries need a database.
+    Fleetbase\Tests\Support\TrackingPageDatabase::boot();
 
     $order       = new FleetOpsOrderObserverOrderFake();
     $order->uuid = 'order-deleted-uuid';
@@ -1100,6 +1102,8 @@ protected function resolveOrder(PurchaseRate $purchaseRate): ?Order
     $integrated->integratedVendor = true;
 
     expect(fn () => (new OrderObserver())->deleted($integrated))->toThrow(Error::class);
+
+    Illuminate\Database\Eloquent\Model::unsetConnectionResolver();
 });
 
 test('contact observer creates syncs normalizes and deletes associated users', function () {
diff --git a/server/tests/Unit/Observers/OrderDeleteCascadeTest.php b/server/tests/Unit/Observers/OrderDeleteCascadeTest.php
new file mode 100644
index 000000000..f1aa86a18
--- /dev/null
+++ b/server/tests/Unit/Observers/OrderDeleteCascadeTest.php
@@ -0,0 +1,213 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Observers\OrderObserver;
+use Fleetbase\Tests\Support\TrackingPageDatabase;
+use Illuminate\Cache\ArrayStore;
+use Illuminate\Cache\Repository;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Cache;
+
+class OrderDeleteCascadeBulkProbe extends Order
+{
+    protected $table = 'orders';
+
+    public static array $deleted = [];
+
+    public function delete()
+    {
+        static::$deleted[] = $this->uuid;
+
+        return parent::delete();
+    }
+}
+
+beforeEach(function () {
+    Cache::swap(new Repository(new ArrayStore()));
+    session(['company' => 'co-1']);
+    OrderDeleteCascadeBulkProbe::$deleted = [];
+});
+
+afterEach(function () {
+    Carbon::setTestNow();
+    EloquentModel::unsetConnectionResolver();
+});
+
+function orderDeleteCascadeFixture(): SQLiteConnection
+{
+    $db = TrackingPageDatabase::boot();
+
+    $rows = [
+        'orders' => [
+            ['uuid' => 'order-1', 'public_id' => 'order_one', 'company_uuid' => 'co-1', 'payload_uuid' => 'payload-1', 'tracking_number_uuid' => 'tn-order'],
+            ['uuid' => 'order-shared-a', 'public_id' => 'order_shared_a', 'company_uuid' => 'co-1', 'payload_uuid' => 'payload-shared', 'tracking_number_uuid' => 'tn-shared-a'],
+            ['uuid' => 'order-shared-b', 'public_id' => 'order_shared_b', 'company_uuid' => 'co-1', 'payload_uuid' => 'payload-shared'],
+            ['uuid' => 'order-bare', 'public_id' => 'order_bare', 'company_uuid' => 'co-1'],
+            ['uuid' => 'order-other', 'public_id' => 'order_other', 'company_uuid' => 'co-2', 'payload_uuid' => 'payload-other'],
+        ],
+        'payloads' => [
+            ['uuid' => 'payload-1', 'dropoff_tracking_number_uuid' => 'tn-dropoff'],
+            ['uuid' => 'payload-shared'],
+            ['uuid' => 'payload-other'],
+        ],
+        'entities' => [
+            ['uuid' => 'entity-1', 'payload_uuid' => 'payload-1', 'tracking_number_uuid' => 'tn-entity'],
+            ['uuid' => 'entity-owned', 'payload_uuid' => 'payload-1'],
+            ['uuid' => 'entity-gone', 'payload_uuid' => 'payload-1', 'deleted_at' => '2026-01-01 00:00:00'],
+            ['uuid' => 'entity-shared', 'payload_uuid' => 'payload-shared'],
+        ],
+        'waypoints' => [
+            ['uuid' => 'wp-1', 'payload_uuid' => 'payload-1', 'tracking_number_uuid' => 'tn-waypoint'],
+        ],
+        'tracking_numbers' => [
+            ['uuid' => 'tn-order', 'owner_uuid' => 'order-1', 'owner_type' => Order::class],
+            ['uuid' => 'tn-entity', 'owner_uuid' => 'entity-1', 'owner_type' => Entity::class],
+            ['uuid' => 'tn-entity-owned', 'owner_uuid' => 'entity-owned', 'owner_type' => Entity::class],
+            ['uuid' => 'tn-waypoint', 'owner_uuid' => 'wp-1', 'owner_type' => Waypoint::class],
+            ['uuid' => 'tn-dropoff', 'owner_uuid' => 'place-dropoff'],
+            ['uuid' => 'tn-shared-a', 'owner_uuid' => 'order-shared-a', 'owner_type' => Order::class],
+            ['uuid' => 'tn-unrelated', 'owner_uuid' => 'order-other', 'owner_type' => Order::class],
+        ],
+        'tracking_statuses' => [
+            ['uuid' => 'ts-order', 'tracking_number_uuid' => 'tn-order'],
+            ['uuid' => 'ts-entity', 'tracking_number_uuid' => 'tn-entity-owned'],
+            ['uuid' => 'ts-shared-a', 'tracking_number_uuid' => 'tn-shared-a'],
+            ['uuid' => 'ts-unrelated', 'tracking_number_uuid' => 'tn-unrelated'],
+        ],
+    ];
+
+    foreach ($rows as $table => $records) {
+        foreach ($records as $record) {
+            TrackingPageDatabase::insert($db, $table, $record);
+        }
+    }
+
+    return $db;
+}
+
+function orderDeleteCascadeDeletedAt(SQLiteConnection $db, string $table, string $uuid): ?string
+{
+    return $db->table($table)->where('uuid', $uuid)->value('deleted_at');
+}
+
+function orderDeleteCascadeSoftDelete(SQLiteConnection $db, string $uuid): Order
+{
+    $db->table('orders')->where('uuid', $uuid)->update(['deleted_at' => now()->toDateTimeString()]);
+
+    return Order::withTrashed()->where('uuid', $uuid)->first();
+}
+
+test('deleting an order soft-deletes its payload tree and tracking data with the order timestamp', function () {
+    Carbon::setTestNow('2026-10-09 12:00:00');
+    $db    = orderDeleteCascadeFixture();
+    $order = orderDeleteCascadeSoftDelete($db, 'order-1');
+
+    (new OrderObserver())->deleted($order);
+
+    $stamp = '2026-10-09 12:00:00';
+    foreach ([
+        ['payloads', 'payload-1'],
+        ['entities', 'entity-1'],
+        ['entities', 'entity-owned'],
+        ['waypoints', 'wp-1'],
+        ['tracking_numbers', 'tn-order'],
+        ['tracking_numbers', 'tn-entity'],
+        ['tracking_numbers', 'tn-entity-owned'],
+        ['tracking_numbers', 'tn-waypoint'],
+        ['tracking_numbers', 'tn-dropoff'],
+        ['tracking_statuses', 'ts-order'],
+        ['tracking_statuses', 'ts-entity'],
+    ] as [$table, $uuid]) {
+        expect(orderDeleteCascadeDeletedAt($db, $table, $uuid))->toBe($stamp, "{$table}.{$uuid}");
+    }
+
+    // Rows outside the order, and children deleted earlier, keep their state.
+    expect(orderDeleteCascadeDeletedAt($db, 'entities', 'entity-gone'))->toBe('2026-01-01 00:00:00')
+        ->and(orderDeleteCascadeDeletedAt($db, 'tracking_numbers', 'tn-unrelated'))->toBeNull()
+        ->and(orderDeleteCascadeDeletedAt($db, 'tracking_statuses', 'ts-unrelated'))->toBeNull()
+        ->and(orderDeleteCascadeDeletedAt($db, 'payloads', 'payload-other'))->toBeNull()
+        ->and(Cache::get('live:co-1:orders:version'))->toBe(1);
+});
+
+test('restoring an order brings back only the children deleted with it', function () {
+    Carbon::setTestNow('2026-10-09 12:00:00');
+    $db       = orderDeleteCascadeFixture();
+    $order    = orderDeleteCascadeSoftDelete($db, 'order-1');
+    $observer = new OrderObserver();
+    $observer->deleted($order);
+
+    // An entity deleted on its own after the order keeps its own timestamp.
+    $db->table('entities')->insert(['uuid' => 'entity-later', 'payload_uuid' => 'payload-1', 'deleted_at' => '2026-10-10 08:00:00']);
+
+    $observer->restoring($order);
+    $db->table('orders')->where('uuid', 'order-1')->update(['deleted_at' => null]);
+    $order->deleted_at = null;
+    $observer->restored($order);
+
+    foreach ([
+        ['payloads', 'payload-1'],
+        ['entities', 'entity-1'],
+        ['entities', 'entity-owned'],
+        ['waypoints', 'wp-1'],
+        ['tracking_numbers', 'tn-order'],
+        ['tracking_numbers', 'tn-entity'],
+        ['tracking_numbers', 'tn-entity-owned'],
+        ['tracking_numbers', 'tn-waypoint'],
+        ['tracking_numbers', 'tn-dropoff'],
+        ['tracking_statuses', 'ts-order'],
+        ['tracking_statuses', 'ts-entity'],
+    ] as [$table, $uuid]) {
+        expect(orderDeleteCascadeDeletedAt($db, $table, $uuid))->toBeNull("{$table}.{$uuid}");
+    }
+
+    expect(orderDeleteCascadeDeletedAt($db, 'entities', 'entity-gone'))->toBe('2026-01-01 00:00:00')
+        ->and(orderDeleteCascadeDeletedAt($db, 'entities', 'entity-later'))->toBe('2026-10-10 08:00:00');
+
+    // A second "restored" without a matching "restoring" has nothing to restore.
+    $db->table('tracking_numbers')->where('uuid', 'tn-order')->update(['deleted_at' => '2026-10-09 12:00:00']);
+    $observer->restored($order);
+    $observer->restoring($order);
+
+    expect(orderDeleteCascadeDeletedAt($db, 'tracking_numbers', 'tn-order'))->toBe('2026-10-09 12:00:00');
+});
+
+test('a payload shared with another live order is left alone', function () {
+    Carbon::setTestNow('2026-10-09 12:00:00');
+    $db    = orderDeleteCascadeFixture();
+    $order = orderDeleteCascadeSoftDelete($db, 'order-shared-a');
+
+    (new OrderObserver())->deleted($order);
+
+    expect(orderDeleteCascadeDeletedAt($db, 'payloads', 'payload-shared'))->toBeNull()
+        ->and(orderDeleteCascadeDeletedAt($db, 'entities', 'entity-shared'))->toBeNull()
+        ->and(orderDeleteCascadeDeletedAt($db, 'tracking_numbers', 'tn-shared-a'))->toBe('2026-10-09 12:00:00')
+        ->and(orderDeleteCascadeDeletedAt($db, 'tracking_statuses', 'ts-shared-a'))->toBe('2026-10-09 12:00:00');
+
+    // An order without a payload or deletion timestamp (force delete) still cascades cleanly.
+    $bare = Order::where('uuid', 'order-bare')->first();
+    (new OrderObserver())->deleted($bare);
+
+    expect(orderDeleteCascadeDeletedAt($db, 'payloads', 'payload-other'))->toBeNull();
+});
+
+test('bulk removal deletes each matched order of the session company one by one', function () {
+    $db = orderDeleteCascadeFixture();
+
+    $count = (new OrderDeleteCascadeBulkProbe())->bulkRemove(['order-1', 'order_bare', 'order-other']);
+
+    expect($count)->toBe(2)
+        ->and(OrderDeleteCascadeBulkProbe::$deleted)->toBe(['order-1', 'order-bare'])
+        ->and(orderDeleteCascadeDeletedAt($db, 'orders', 'order-1'))->not->toBeNull()
+        ->and(orderDeleteCascadeDeletedAt($db, 'orders', 'order-other'))->toBeNull();
+
+    // Without a session company the lookup is not tenant constrained, like core-api's.
+    session(['company' => null]);
+    OrderDeleteCascadeBulkProbe::$deleted = [];
+
+    expect((new OrderDeleteCascadeBulkProbe())->bulkRemove(['order-other']))->toBe(1)
+        ->and(OrderDeleteCascadeBulkProbe::$deleted)->toBe(['order-other']);
+});

From 1adfc43d1d798011b3cec447f619cf0c43f807f6 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Fri, 9 Oct 2026 14:22:30 +0800
Subject: [PATCH 26/87] fix(orders): resolve public ids in facilitator and
 customer filters

GET /v1/orders?facilitator=vendor_xxx and ?customer=contact_xxx returned
nothing. OrderFilter compared the public id straight against
facilitator_uuid / customer_uuid, and the API controller added whereHas
conditions on the facilitator and customer morphTo relations whose morph
class (the morph map alias) never equals the stored type, so the clause
was always false.

The filter now resolves the id across every model the relation can point
at (facilitator: vendor, integrated vendor, contact; customer: contact,
vendor) within the session company. Console uuids still pass through, an
id that resolves to nothing matches no order, and the customer portal's
user uuid match is kept. The broken whereHas blocks are removed.

Fixes fleetbase/fleetops#363
---
 .../Controllers/Api/v1/OrderController.php    |  18 --
 server/src/Http/Filter/OrderFilter.php        |  39 +++-
 .../Api/OrderControllerNearbyFiltersTest.php  |  32 ++--
 .../Api/OrderControllerQueryFiltersTest.php   |  55 ++++--
 server/tests/OrderFilterExecutionTest.php     | 169 +++++++++++++++++-
 5 files changed, 260 insertions(+), 53 deletions(-)

diff --git a/server/src/Http/Controllers/Api/v1/OrderController.php b/server/src/Http/Controllers/Api/v1/OrderController.php
index bd99b72a2..8337cd0b3 100644
--- a/server/src/Http/Controllers/Api/v1/OrderController.php
+++ b/server/src/Http/Controllers/Api/v1/OrderController.php
@@ -632,24 +632,6 @@ public function query(Request $request)
                 });
             }
 
-            if ($request->has('facilitator')) {
-                $query->whereHas('facilitator', function ($q) use ($request) {
-                    $q->where(function ($q) use ($request) {
-                        $q->where('public_id', $request->input('facilitator'));
-                        $q->orWhere('internal_id', $request->input('facilitator'));
-                    });
-                });
-            }
-
-            if ($request->has('customer')) {
-                $query->whereHas('customer', function ($q) use ($request) {
-                    $q->where(function ($q) use ($request) {
-                        $q->where('public_id', $request->input('customer'));
-                        $q->orWhere('internal_id', $request->input('customer'));
-                    });
-                });
-            }
-
             if ($request->has('entity')) {
                 $query->whereHas('payload.entities', function ($q) use ($request) {
                     $q->where(function ($q) use ($request) {
diff --git a/server/src/Http/Filter/OrderFilter.php b/server/src/Http/Filter/OrderFilter.php
index 89d96f48f..11c202a82 100644
--- a/server/src/Http/Filter/OrderFilter.php
+++ b/server/src/Http/Filter/OrderFilter.php
@@ -2,6 +2,10 @@
 
 namespace Fleetbase\FleetOps\Http\Filter;
 
+use Fleetbase\FleetOps\Http\Filter\Concerns\ResolvesPublicRelationUuids;
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\IntegratedVendor;
+use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Filter\Filter;
 use Fleetbase\Support\Http;
@@ -10,6 +14,8 @@
 
 class OrderFilter extends Filter
 {
+    use ResolvesPublicRelationUuids;
+
     public function queryForInternal()
     {
         $companyUuid = $this->request->session()->get('company');
@@ -141,10 +147,17 @@ public function status(string|array $status)
         }
     }
 
+    /**
+     * A customer is a contact or a vendor. The public API names it by public id,
+     * so the id is resolved to the uuid `customer_uuid` stores. The customer
+     * portal names its own user, which the authenticatable branch still matches.
+     */
     public function customer(string $customer)
     {
-        $this->builder->where(function ($query) use ($customer) {
-            $query->where('customer_uuid', $customer);
+        $customerUuids = $this->resolvePublicRelationUuidsAcross([Contact::class, Vendor::class], $customer);
+
+        $this->builder->where(function ($query) use ($customer, $customerUuids) {
+            $query->whereIn('customer_uuid', $customerUuids);
             $query->orWhereHas('authenticatableCustomer', function ($query) use ($customer) {
                 $query->where('user_uuid', $customer);
             });
@@ -158,9 +171,29 @@ public function authenticatedCustomer(string $authenticatedCustomer)
         });
     }
 
+    /**
+     * A facilitator is a vendor, an integrated vendor or a contact. An id that
+     * resolves to none of them leaves an empty list, which matches no order.
+     */
     public function facilitator(string $facilitator)
     {
-        $this->builder->where('facilitator_uuid', $facilitator);
+        $this->builder->whereIn('facilitator_uuid', $this->resolvePublicRelationUuidsAcross([Vendor::class, IntegratedVendor::class, Contact::class], $facilitator));
+    }
+
+    /**
+     * Resolve an identifier against every model a polymorphic relation can point at.
+     *
+     * @param array<int, class-string> $modelClasses
+     *
+     * @return array<int, string>
+     */
+    protected function resolvePublicRelationUuidsAcross(array $modelClasses, string $identifier): array
+    {
+        return collect($modelClasses)
+            ->flatMap(fn (string $modelClass) => $this->resolvePublicRelationUuids($modelClass, $identifier))
+            ->unique()
+            ->values()
+            ->all();
     }
 
     public function type(string $type)
diff --git a/server/tests/Feature/Http/Api/OrderControllerNearbyFiltersTest.php b/server/tests/Feature/Http/Api/OrderControllerNearbyFiltersTest.php
index ebf5e2139..49e5ccd02 100644
--- a/server/tests/Feature/Http/Api/OrderControllerNearbyFiltersTest.php
+++ b/server/tests/Feature/Http/Api/OrderControllerNearbyFiltersTest.php
@@ -135,19 +135,20 @@ public function __call($method, $arguments)
 
     $schema = $connection->getSchemaBuilder();
     $tables = [
-        'orders'            => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'driver_assigned_uuid', 'customer_uuid', 'customer_type', 'facilitator_uuid', 'facilitator_type', 'tracking_number_uuid', 'status', 'pod_required', 'dispatched', 'scheduled_at', 'type'],
-        'payloads'          => ['uuid', 'public_id', 'company_uuid', 'pickup_uuid', 'dropoff_uuid', 'return_uuid', 'current_waypoint_uuid', 'type'],
-        'places'            => ['uuid', 'public_id', 'company_uuid', 'name', 'street1', 'city', 'country', 'location', 'meta'],
-        'waypoints'         => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'place_uuid'],
-        'entities'          => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'name'],
-        'drivers'           => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'location'],
-        'users'             => ['uuid', 'public_id', 'company_uuid', 'type'],
-        'contacts'          => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
-        'vendors'           => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
-        'companies'         => ['uuid', 'public_id', 'name', 'options'],
-        'tracking_numbers'  => ['uuid', 'public_id', 'company_uuid', 'tracking_number', 'owner_uuid', 'owner_type', 'status_uuid', '_key'],
-        'tracking_statuses' => ['uuid', 'public_id', 'company_uuid', 'tracking_number_uuid', 'code', 'status', 'details'],
-        'directives'        => ['uuid', 'company_uuid', 'permission_uuid', 'subject_type', 'subject_uuid', 'key', 'rules'],
+        'orders'             => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'driver_assigned_uuid', 'customer_uuid', 'customer_type', 'facilitator_uuid', 'facilitator_type', 'tracking_number_uuid', 'status', 'pod_required', 'dispatched', 'scheduled_at', 'type'],
+        'payloads'           => ['uuid', 'public_id', 'company_uuid', 'pickup_uuid', 'dropoff_uuid', 'return_uuid', 'current_waypoint_uuid', 'type'],
+        'places'             => ['uuid', 'public_id', 'company_uuid', 'name', 'street1', 'city', 'country', 'location', 'meta'],
+        'waypoints'          => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'place_uuid'],
+        'entities'           => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'name'],
+        'drivers'            => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'location'],
+        'users'              => ['uuid', 'public_id', 'company_uuid', 'type'],
+        'contacts'           => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
+        'vendors'            => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
+        'integrated_vendors' => ['uuid', 'public_id', 'company_uuid', 'provider'],
+        'companies'          => ['uuid', 'public_id', 'name', 'options'],
+        'tracking_numbers'   => ['uuid', 'public_id', 'company_uuid', 'tracking_number', 'owner_uuid', 'owner_type', 'status_uuid', '_key'],
+        'tracking_statuses'  => ['uuid', 'public_id', 'company_uuid', 'tracking_number_uuid', 'code', 'status', 'details'],
+        'directives'         => ['uuid', 'company_uuid', 'permission_uuid', 'subject_type', 'subject_uuid', 'key', 'rules'],
     ];
     foreach ($tables as $table => $columns) {
         $schema->create($table, function ($blueprint) use ($columns) {
@@ -276,7 +277,6 @@ function fleetopsOrderNearbySeed(SQLiteConnection $connection): void
         'facilitator' => 'vendor_nearby1',
         'customer'    => 'contact_nearby1',
     ]));
-    // MorphTo whereHas subqueries build and constrain without matching in
-    // the harness morph map
-    expect($result->count())->toBeGreaterThanOrEqual(0);
+    // Both ids resolve to the uuids the order stores, so exactly that order matches.
+    expect($result->pluck('uuid')->all())->toBe(['order-1']);
 });
diff --git a/server/tests/Feature/Http/Api/OrderControllerQueryFiltersTest.php b/server/tests/Feature/Http/Api/OrderControllerQueryFiltersTest.php
index f35c2f0fe..695690043 100644
--- a/server/tests/Feature/Http/Api/OrderControllerQueryFiltersTest.php
+++ b/server/tests/Feature/Http/Api/OrderControllerQueryFiltersTest.php
@@ -73,20 +73,21 @@ public function __call($method, $arguments)
 
     $schema = $connection->getSchemaBuilder();
     $tables = [
-        'orders'            => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'driver_assigned_uuid', 'vehicle_assigned_uuid', 'customer_uuid', 'customer_type', 'facilitator_uuid', 'facilitator_type', 'tracking_number_uuid', 'status', 'pod_required', 'dispatched', 'scheduled_at', 'type'],
-        'payloads'          => ['uuid', 'public_id', 'company_uuid', 'pickup_uuid', 'dropoff_uuid', 'return_uuid', 'current_waypoint_uuid', 'type'],
-        'places'            => ['uuid', 'public_id', 'company_uuid', 'name', 'location'],
-        'waypoints'         => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'place_uuid', 'location'],
-        'entities'          => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'tracking_number_uuid', 'name'],
-        'tracking_numbers'  => ['uuid', 'public_id', 'company_uuid', 'tracking_number', 'owner_uuid', 'status_uuid'],
-        'tracking_statuses' => ['uuid', 'public_id', 'company_uuid', 'tracking_number_uuid', 'code', 'status'],
-        'drivers'           => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'location'],
-        'users'             => ['uuid', 'public_id', 'company_uuid'],
-        'vehicles'          => ['uuid', 'public_id', 'company_uuid'],
-        'contacts'          => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
-        'vendors'           => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
-        'companies'         => ['uuid', 'public_id', 'name', 'options'],
-        'directives'        => ['uuid', 'company_uuid', 'permission_uuid', 'subject_type', 'subject_uuid', 'key', 'rules'],
+        'orders'             => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'driver_assigned_uuid', 'vehicle_assigned_uuid', 'customer_uuid', 'customer_type', 'facilitator_uuid', 'facilitator_type', 'tracking_number_uuid', 'status', 'pod_required', 'dispatched', 'scheduled_at', 'type'],
+        'payloads'           => ['uuid', 'public_id', 'company_uuid', 'pickup_uuid', 'dropoff_uuid', 'return_uuid', 'current_waypoint_uuid', 'type'],
+        'places'             => ['uuid', 'public_id', 'company_uuid', 'name', 'location'],
+        'waypoints'          => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'place_uuid', 'location'],
+        'entities'           => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'tracking_number_uuid', 'name'],
+        'tracking_numbers'   => ['uuid', 'public_id', 'company_uuid', 'tracking_number', 'owner_uuid', 'status_uuid'],
+        'tracking_statuses'  => ['uuid', 'public_id', 'company_uuid', 'tracking_number_uuid', 'code', 'status'],
+        'drivers'            => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'location'],
+        'users'              => ['uuid', 'public_id', 'company_uuid'],
+        'vehicles'           => ['uuid', 'public_id', 'company_uuid'],
+        'contacts'           => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
+        'vendors'            => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
+        'integrated_vendors' => ['uuid', 'public_id', 'company_uuid', 'provider'],
+        'companies'          => ['uuid', 'public_id', 'name', 'options'],
+        'directives'         => ['uuid', 'company_uuid', 'permission_uuid', 'subject_type', 'subject_uuid', 'key', 'rules'],
     ];
     foreach ($tables as $table => $columns) {
         $schema->create($table, function ($blueprint) use ($columns) {
@@ -182,3 +183,29 @@ public function parameters()
 
     expect($result->count())->toBe(0);
 });
+
+test('query finds orders by facilitator and customer public ids', function () {
+    $connection = fleetopsOrderQueryFiltersBoot();
+    $connection->table('payloads')->insert(['uuid' => 'payload-1', 'public_id' => 'payload_test', 'company_uuid' => 'company-1']);
+    $connection->table('vendors')->insert(['uuid' => 'vendor-1', 'public_id' => 'vendor_facil', 'internal_id' => 'VND-1', 'company_uuid' => 'company-1']);
+    $connection->table('integrated_vendors')->insert(['uuid' => 'integrated-vendor-1', 'public_id' => 'integrated_vendor_facil', 'company_uuid' => 'company-1']);
+    $connection->table('contacts')->insert(['uuid' => 'contact-1', 'public_id' => 'contact_cust', 'company_uuid' => 'company-1']);
+    // The stored type is the class name, which is not the morph class the
+    // morph map gives these models — the mismatch that emptied every result.
+    $connection->table('orders')->insert([
+        ['uuid' => 'order-1', 'public_id' => 'order_a', 'company_uuid' => 'company-1', 'payload_uuid' => 'payload-1', 'facilitator_uuid' => 'vendor-1', 'facilitator_type' => 'Fleetbase\FleetOps\Models\Vendor', 'customer_uuid' => 'contact-1', 'customer_type' => 'Fleetbase\FleetOps\Models\Contact'],
+        ['uuid' => 'order-2', 'public_id' => 'order_b', 'company_uuid' => 'company-1', 'payload_uuid' => 'payload-1', 'facilitator_uuid' => 'integrated-vendor-1', 'facilitator_type' => 'Fleetbase\FleetOps\Models\IntegratedVendor', 'customer_uuid' => 'vendor-1', 'customer_type' => 'Fleetbase\FleetOps\Models\Vendor'],
+        ['uuid' => 'order-3', 'public_id' => 'order_c', 'company_uuid' => 'company-1', 'payload_uuid' => 'payload-1', 'facilitator_uuid' => null, 'facilitator_type' => null, 'customer_uuid' => null, 'customer_type' => null],
+    ]);
+
+    $publicIds = fn (array $input) => (new OrderController())->query(fleetopsOrderQueryFiltersRequest($input))->pluck('public_id')->sort()->values()->all();
+
+    expect($publicIds(['facilitator' => 'vendor_facil']))->toBe(['order_a'])
+        ->and($publicIds(['facilitator' => 'VND-1']))->toBe(['order_a'])
+        ->and($publicIds(['facilitator' => 'integrated_vendor_facil']))->toBe(['order_b'])
+        ->and($publicIds(['customer' => 'contact_cust']))->toBe(['order_a'])
+        ->and($publicIds(['customer' => 'vendor_facil']))->toBe(['order_b'])
+        // An unknown id matches nothing, never every order.
+        ->and($publicIds(['facilitator' => 'vendor_missing']))->toBe([])
+        ->and($publicIds(['customer' => 'contact_missing']))->toBe([]);
+});
diff --git a/server/tests/OrderFilterExecutionTest.php b/server/tests/OrderFilterExecutionTest.php
index ac80a6c59..e7b5038f6 100644
--- a/server/tests/OrderFilterExecutionTest.php
+++ b/server/tests/OrderFilterExecutionTest.php
@@ -124,6 +124,173 @@ function fleetopsOrderFilter(FleetOpsRecordingOrderFilterBuilder $builder, array
     return $filter;
 }
 
+/**
+ * A filter whose request resolves to an internal console route.
+ *
+ * `Http::isInternalRequest()` reads the resolved route's uri, so the console's
+ * uuid pass-through is only reachable through a route resolver.
+ */
+function fleetopsInternalOrderFilter(FleetOpsRecordingOrderFilterBuilder $builder): OrderFilter
+{
+    $uri     = 'int/v1/fleet-ops/orders';
+    $request = Request::create('/' . $uri, 'GET');
+    $session = app('session.store');
+    $session->put('company', 'company_test');
+    $request->setLaravelSession($session);
+    $request->setRouteResolver(fn () => new class($uri) {
+        public array $action = [];
+
+        public function __construct(private string $uri)
+        {
+        }
+
+        public function uri(): string
+        {
+            return $this->uri;
+        }
+    });
+
+    $filter     = new OrderFilter($request);
+    $reflection = new ReflectionClass($filter);
+    $property   = $reflection->getParentClass()->getProperty('builder');
+    $property->setAccessible(true);
+    $property->setValue($filter, $builder);
+
+    return $filter;
+}
+
+/**
+ * Customer and facilitator filters resolve public ids to uuids, which is a real query.
+ *
+ * @return array<string, array<string, string>>
+ */
+function fleetopsOrderFilterRelationDatabase(): array
+{
+    $connection = new Illuminate\Database\SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new Illuminate\Database\ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    Illuminate\Database\Eloquent\Model::setConnectionResolver($resolver);
+    app()->instance('db', new class($connection) {
+        public function __construct(public Illuminate\Database\SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null)
+        {
+            return $this->c;
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+
+    $schema = $connection->getSchemaBuilder();
+    foreach (['vendors', 'integrated_vendors', 'contacts'] as $table) {
+        $schema->create($table, function ($blueprint) {
+            $blueprint->increments('id');
+            foreach (['uuid', 'public_id', 'internal_id', 'company_uuid', 'name', '_key'] as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    $rows = [
+        'vendors'            => ['uuid' => '77777777-7777-4777-8777-777777777701', 'public_id' => 'vendor_ofilterone', 'internal_id' => 'VND-1'],
+        'integrated_vendors' => ['uuid' => '77777777-7777-4777-8777-777777777702', 'public_id' => 'integrated_vendor_ofilter'],
+        'contacts'           => ['uuid' => '77777777-7777-4777-8777-777777777703', 'public_id' => 'contact_ofilterone'],
+    ];
+
+    foreach ($rows as $table => $row) {
+        $connection->table($table)->insert($row + ['company_uuid' => 'company_test']);
+    }
+
+    // Another tenant's vendor is never reachable by its public id.
+    $connection->table('vendors')->insert(['uuid' => '77777777-7777-4777-8777-777777777709', 'public_id' => 'vendor_otherco', 'company_uuid' => 'another-company']);
+
+    return $rows;
+}
+
+/**
+ * @return array<int, array<int, string>>
+ */
+function fleetopsOrderFilterWhereInValues(FleetOpsRecordingOrderFilterBuilder $builder, string $column): array
+{
+    return collect($builder->methodCalls('whereIn'))
+        ->filter(fn ($call) => $call[1] === $column)
+        ->map(fn ($call) => $call[2])
+        ->values()
+        ->all();
+}
+
+test('order filter resolves facilitator public ids across vendors integrated vendors and contacts', function () {
+    $rows    = fleetopsOrderFilterRelationDatabase();
+    $builder = new FleetOpsRecordingOrderFilterBuilder();
+    $filter  = fleetopsOrderFilter($builder);
+
+    $filter->facilitator($rows['vendors']['public_id']);
+    $filter->facilitator($rows['vendors']['internal_id']);
+    $filter->facilitator($rows['integrated_vendors']['public_id']);
+    $filter->facilitator($rows['contacts']['public_id']);
+    // The public API never accepts a raw uuid, an unknown id, or another tenant's id.
+    $filter->facilitator($rows['vendors']['uuid']);
+    $filter->facilitator('vendor_missing');
+    $filter->facilitator('vendor_otherco');
+
+    // The filter used to compare the public id against `facilitator_uuid`
+    // directly, which could never match. An id that resolves to nothing now
+    // yields an empty list, so it matches no order rather than every order.
+    expect(fleetopsOrderFilterWhereInValues($builder, 'facilitator_uuid'))->toBe([
+        [$rows['vendors']['uuid']],
+        [$rows['vendors']['uuid']],
+        [$rows['integrated_vendors']['uuid']],
+        [$rows['contacts']['uuid']],
+        [],
+        [],
+        [],
+    ]);
+});
+
+test('order filter resolves customer public ids and keeps the customer portal user match', function () {
+    $rows    = fleetopsOrderFilterRelationDatabase();
+    $builder = new FleetOpsRecordingOrderFilterBuilder();
+    $filter  = fleetopsOrderFilter($builder);
+
+    $filter->customer($rows['contacts']['public_id']);
+    $filter->customer($rows['vendors']['public_id']);
+    $filter->customer('portal-user-uuid');
+
+    $userMatches = collect($builder->methodCalls('orWhereHas'))
+        ->filter(fn ($call) => $call[1] === 'authenticatableCustomer')
+        ->map(fn ($call) => $call[2]->calls)
+        ->values()
+        ->all();
+
+    expect(fleetopsOrderFilterWhereInValues($builder, 'customer_uuid'))->toBe([
+        [$rows['contacts']['uuid']],
+        [$rows['vendors']['uuid']],
+        [],
+    ])
+        // A customer portal user still reaches their orders by user uuid.
+        ->and($userMatches[2])->toBe([['where', 'user_uuid', ['portal-user-uuid']]]);
+});
+
+test('order filter keeps console uuids working for customer and facilitator', function () {
+    $rows    = fleetopsOrderFilterRelationDatabase();
+    $builder = new FleetOpsRecordingOrderFilterBuilder();
+    $filter  = fleetopsInternalOrderFilter($builder);
+
+    $filter->customer($rows['contacts']['uuid']);
+    $filter->facilitator($rows['integrated_vendors']['uuid']);
+
+    expect(fleetopsOrderFilterWhereInValues($builder, 'customer_uuid'))->toBe([[$rows['contacts']['uuid']]])
+        ->and(fleetopsOrderFilterWhereInValues($builder, 'facilitator_uuid'))->toBe([[$rows['integrated_vendors']['uuid']]]);
+});
+
 test('order filter applies internal and public base scopes with eager loading', function () {
     $builder = new FleetOpsRecordingOrderFilterBuilder();
     $filter  = fleetopsOrderFilter($builder);
@@ -161,9 +328,7 @@ function fleetopsOrderFilter(FleetOpsRecordingOrderFilterBuilder $builder, array
 
     $filter->status('active');
     $filter->status(['created', 'started']);
-    $filter->customer('customer_uuid');
     $filter->authenticatedCustomer('user_uuid');
-    $filter->facilitator('facilitator_uuid');
     $filter->type('transport');
     $filter->orderConfig('transport');
     $filter->payload($uuid);

From 6ed2b851b7093c53161156205f8bf26f343edd3a Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Fri, 9 Oct 2026 14:33:05 +0800
Subject: [PATCH 27/87] fix(accounts): create managed users in the sandbox
 database for test keys

Users and companies are pinned to the live connection while company_users
follows a test key onto the sandbox connection, so POST /v1/drivers and
/v1/contacts failed on company_users_user_uuid_foreign and left an orphan
live user. Copy the account (and its company) into the sandbox before
adding the membership, and delete a newly created account if adding the
membership fails.

Fixes #359
---
 server/src/Models/Contact.php                 |   2 +
 server/src/Support/ProfileAccountManager.php  |  55 ++++++-
 .../DriverControllerCreateRecordTest.php      |  32 ++--
 .../Support/ProfileAccountManagerTest.php     | 141 ++++++++++++++++++
 4 files changed, 220 insertions(+), 10 deletions(-)

diff --git a/server/src/Models/Contact.php b/server/src/Models/Contact.php
index b0b25a143..28decd7e6 100644
--- a/server/src/Models/Contact.php
+++ b/server/src/Models/Contact.php
@@ -645,6 +645,8 @@ private static function assignUserToContactCompany(Contact $contact, User $user)
             return null;
         }
 
+        ProfileAccountManager::copyAccountToSandbox($user, $contact->company->uuid);
+
         $role        = $contact->isCustomer() ? 'Fleet-Ops Customer' : 'Fleet-Ops Contact';
         $companyUser = $contact->company->addUser($user, $role);
 
diff --git a/server/src/Support/ProfileAccountManager.php b/server/src/Support/ProfileAccountManager.php
index 521ea4157..b1311dfaa 100644
--- a/server/src/Support/ProfileAccountManager.php
+++ b/server/src/Support/ProfileAccountManager.php
@@ -11,7 +11,9 @@
 use Fleetbase\Models\CompanyUser;
 use Fleetbase\Models\User;
 use Fleetbase\Services\SmsService;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\Str;
 
 /**
@@ -174,7 +176,15 @@ public static function createManagedAccount(string $companyUuid, string $type, ?
         $user->save();
         $user->setType($type);
 
-        static::attachToCompany($user, $companyUuid, $type);
+        try {
+            static::attachToCompany($user, $companyUuid, $type);
+        } catch (\Throwable $e) {
+            // Leave no account behind for a profile that was never created
+            static::removeSandboxCopy($user);
+            $user->forceDelete();
+
+            throw $e;
+        }
 
         return $user;
     }
@@ -355,6 +365,8 @@ public static function attachToCompany(User $user, string $companyUuid, string $
             return null;
         }
 
+        static::copyAccountToSandbox($user, $companyUuid);
+
         $role        = static::ROLES[$type] ?? static::ROLES['contact'];
         $companyUser = CompanyUser::where(['company_uuid' => $companyUuid, 'user_uuid' => $user->uuid])->first();
         if (!$companyUser) {
@@ -372,6 +384,47 @@ public static function attachToCompany(User $user, string $companyUuid, string $
         return $companyUser;
     }
 
+    /**
+     * Copy the account and its organization into the sandbox database for a
+     * test-key request. Users and companies always live in the live database,
+     * but memberships follow the request into the sandbox, whose foreign keys
+     * need both rows there too.
+     */
+    public static function copyAccountToSandbox(User $user, ?string $companyUuid = null): void
+    {
+        if (!session('is_sandbox')) {
+            return;
+        }
+
+        $live    = DB::connection($user->getConnectionName());
+        $sandbox = DB::connection('sandbox');
+        $account = (array) $live->table($user->getTable())->where('uuid', $user->uuid)->first();
+        $company = $companyUuid ? (array) $live->table('companies')->where('uuid', $companyUuid)->first() : [];
+
+        Schema::connection('sandbox')->disableForeignKeyConstraints();
+
+        try {
+            if ($company) {
+                $sandbox->table('companies')->updateOrInsert(['uuid' => $company['uuid']], array_diff_key($company, ['id' => true]));
+            }
+
+            $account['company_uuid'] = ($account['company_uuid'] ?? null) ?: $companyUuid;
+            $sandbox->table($user->getTable())->updateOrInsert(['uuid' => $user->uuid], array_diff_key($account, ['id' => true]));
+        } finally {
+            Schema::connection('sandbox')->enableForeignKeyConstraints();
+        }
+    }
+
+    /**
+     * Remove the sandbox copy of an account that is being discarded.
+     */
+    public static function removeSandboxCopy(User $user): void
+    {
+        if (session('is_sandbox')) {
+            DB::connection('sandbox')->table($user->getTable())->where('uuid', $user->uuid)->delete();
+        }
+    }
+
     public static function normalizeEmail(?string $email): ?string
     {
         $email = is_string($email) ? strtolower(trim($email)) : null;
diff --git a/server/tests/Feature/Http/Internal/DriverControllerCreateRecordTest.php b/server/tests/Feature/Http/Internal/DriverControllerCreateRecordTest.php
index f527fe0fb..325926377 100644
--- a/server/tests/Feature/Http/Internal/DriverControllerCreateRecordTest.php
+++ b/server/tests/Feature/Http/Internal/DriverControllerCreateRecordTest.php
@@ -14,7 +14,7 @@
  * through ProfileAccountManager, and the exception-to-error-response
  * branches. Role assignment requires the full spatie permission boot, which
  * this fixture leaves out, so flows settle in the documented error branch
- * after the user record is persisted (see
+ * and the account created for the failed driver is removed again (see
  * DriverControllerExistingUserAdoptionTest for the full flow).
  */
 if (!function_exists('Fleetbase\Support\session')) {
@@ -157,6 +157,17 @@ public function needsRehash($hashedValue, array $options = []): bool
     return $connection;
 }
 
+/**
+ * Keep a copy of every removed user row so a test can inspect the account
+ * that was created and then cleaned up when the driver failed.
+ */
+function fleetopsInternalDriverCreateTrackRemovedUsers(SQLiteConnection $connection): void
+{
+    $columns = $connection->getSchemaBuilder()->getColumnListing('users');
+    $connection->statement('create table removed_users as select * from users where 0');
+    $connection->statement('create trigger keep_removed_users after delete on users begin insert into removed_users (' . implode(', ', $columns) . ') values (' . implode(', ', array_map(fn ($column) => 'old.' . $column, $columns)) . '); end');
+}
+
 function fleetopsInternalDriverCreateRequest(array $driver): Request
 {
     return Request::create('/int/v1/drivers', 'POST', ['driver' => $driver]);
@@ -164,6 +175,7 @@ function fleetopsInternalDriverCreateRequest(array $driver): Request
 
 test('create record provisions a driver-typed user before role assignment', function () {
     $connection = fleetopsInternalDriverCreateBoot();
+    fleetopsInternalDriverCreateTrackRemovedUsers($connection);
 
     $result = (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
         'name'  => 'New Driver',
@@ -172,17 +184,18 @@ function fleetopsInternalDriverCreateRequest(array $driver): Request
     ]));
 
     // The user record is created and typed before role assignment fails in
-    // the harness; the exception surfaces through the error response branch.
+    // the harness; the exception surfaces through the error response branch
+    // and the account is removed so no orphan login is left behind.
     expect($result)->toBeInstanceOf(JsonResponse::class)
         ->and($result->getData(true))->toHaveKey('error')
-        ->and($connection->table('users')->count())->toBe(1)
-        ->and($connection->table('users')->value('type'))->toBe('driver')
-        ->and($connection->table('users')->value('email'))->toBe('newdriver@example.com')
-        ->and($connection->table('company_users')->count())->toBeGreaterThanOrEqual(0);
+        ->and($connection->table('users')->count())->toBe(0)
+        ->and($connection->table('removed_users')->value('type'))->toBe('driver')
+        ->and($connection->table('removed_users')->value('email'))->toBe('newdriver@example.com');
 });
 
 test('create record ignores a picked user account and resolves the login from the email', function () {
     $connection = fleetopsInternalDriverCreateBoot();
+    fleetopsInternalDriverCreateTrackRemovedUsers($connection);
     $connection->table('users')->insert(['uuid' => '11111111-1111-4111-8111-111111111111', 'company_uuid' => 'company-1', 'name' => 'Existing', 'email' => 'existing@example.com', 'type' => 'driver']);
 
     (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
@@ -193,13 +206,14 @@ function fleetopsInternalDriverCreateRequest(array $driver): Request
 
     // The login account is managed by the profile: a new driver account is
     // created for the email rather than the picked account being taken over
-    expect($connection->table('users')->count())->toBe(2)
-        ->and($connection->table('users')->where('email', 'someone@example.com')->value('type'))->toBe('driver')
+    expect($connection->table('users')->count())->toBe(1)
+        ->and($connection->table('removed_users')->where('email', 'someone@example.com')->value('type'))->toBe('driver')
         ->and($connection->table('users')->where('uuid', '11111111-1111-4111-8111-111111111111')->value('name'))->toBe('Existing');
 });
 
 test('create record applies photo avatars to the new driver account', function () {
     $connection = fleetopsInternalDriverCreateBoot();
+    fleetopsInternalDriverCreateTrackRemovedUsers($connection);
 
     $result = (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
         'name'       => 'Photo Driver',
@@ -208,7 +222,7 @@ function fleetopsInternalDriverCreateRequest(array $driver): Request
 
     // Avatar is set when the account is created, before the harness
     // role-assignment limitation.
-    expect($connection->table('users')->value('avatar_uuid'))->toBe('22222222-2222-4222-8222-222222222222')
+    expect($connection->table('removed_users')->value('avatar_uuid'))->toBe('22222222-2222-4222-8222-222222222222')
         ->and($result)->toBeInstanceOf(JsonResponse::class)
         ->and($result->getData(true))->toHaveKey('error');
 });
diff --git a/server/tests/Unit/Support/ProfileAccountManagerTest.php b/server/tests/Unit/Support/ProfileAccountManagerTest.php
index 9c1828f49..a1d6d5944 100644
--- a/server/tests/Unit/Support/ProfileAccountManagerTest.php
+++ b/server/tests/Unit/Support/ProfileAccountManagerTest.php
@@ -641,3 +641,144 @@ function fleetopsProfileAccountUser(array $attributes): User
         ->toContain('{{ $plaintextPassword }}')
         ->toContain('{{ $companyName }}');
 });
+
+/**
+ * Point the request at a separate sandbox database the way a test API key
+ * does: users and companies stay on `mysql`, memberships follow
+ * `fleetbase.connection.db`. The sandbox enforces its foreign keys so a
+ * membership for a user missing there fails like it does on MySQL.
+ */
+function fleetopsProfileAccountSandbox(SQLiteConnection $live): SQLiteConnection
+{
+    $sandbox = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $schema  = $sandbox->getSchemaBuilder();
+    $schema->create('companies', function ($blueprint) {
+        $blueprint->increments('id');
+        foreach (['uuid', 'public_id', 'name', 'owner_uuid', 'timezone'] as $column) {
+            $blueprint->string($column)->nullable();
+        }
+        $blueprint->unique('uuid');
+        $blueprint->timestamps();
+        $blueprint->timestamp('deleted_at')->nullable();
+    });
+    $schema->create('users', function ($blueprint) {
+        $blueprint->increments('id');
+        foreach (['uuid', 'public_id', 'company_uuid', 'name', 'email', 'phone', 'password', 'status', 'type', 'username', 'avatar_uuid', 'slug', 'timezone', 'country', 'ip_address', 'meta', 'last_login', '_key'] as $column) {
+            $blueprint->string($column)->nullable();
+        }
+        $blueprint->unique('uuid');
+        $blueprint->foreign('company_uuid')->references('uuid')->on('companies');
+        $blueprint->timestamps();
+        $blueprint->timestamp('deleted_at')->nullable();
+    });
+    $schema->create('company_users', function ($blueprint) {
+        $blueprint->increments('id');
+        foreach (['uuid', 'public_id', 'company_uuid', 'user_uuid', 'status', '_key'] as $column) {
+            $blueprint->string($column)->nullable();
+        }
+        $blueprint->foreign('user_uuid')->references('uuid')->on('users');
+        $blueprint->foreign('company_uuid')->references('uuid')->on('companies');
+        $blueprint->timestamps();
+        $blueprint->timestamp('deleted_at')->nullable();
+    });
+    $schema->create('model_has_roles', function ($blueprint) {
+        foreach (['role_id', 'model_type', 'model_uuid'] as $column) {
+            $blueprint->string($column)->nullable();
+        }
+    });
+    $schema->enableForeignKeyConstraints();
+
+    $resolver = new ConnectionResolver(['default' => $live, 'mysql' => $live, 'sandbox' => $sandbox]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+    app()->instance('db', new class($live, $sandbox) {
+        public function __construct(public SQLiteConnection $live, public SQLiteConnection $sandbox)
+        {
+        }
+
+        public function connection($name = null): SQLiteConnection
+        {
+            return $name === 'sandbox' ? $this->sandbox : $this->live;
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->live->{$method}(...$arguments);
+        }
+    });
+    Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+    config()->set('fleetbase.connection.db', 'sandbox');
+    session(['is_sandbox' => true]);
+
+    return $sandbox;
+}
+
+function fleetopsProfileAccountLeaveSandbox(): void
+{
+    config()->set('fleetbase.connection.db', 'mysql');
+    session(['is_sandbox' => false]);
+}
+
+test('test key requests copy new and linked managed accounts into the sandbox before adding them', function () {
+    $live    = fleetopsProfileAccountBoot();
+    $sandbox = fleetopsProfileAccountSandbox($live);
+
+    try {
+        $driver = ProfileAccountManager::resolveForProfile('company-1', 'driver', 'Sandy Driver', 'sandy@example.com', null, ['password' => 'secret']);
+        $copy   = $sandbox->table('users')->where('uuid', $driver->uuid)->first();
+
+        expect($live->table('users')->where('uuid', $driver->uuid)->value('type'))->toBe('driver')
+            ->and($copy->type)->toBe('driver')
+            ->and($copy->email)->toBe('sandy@example.com')
+            ->and($copy->password)->toBe('hashed:secret')
+            ->and($copy->company_uuid)->toBe('company-1')
+            ->and($sandbox->table('companies')->where('uuid', 'company-1')->value('name'))->toBe('Acme')
+            ->and($sandbox->table('company_users')->where('user_uuid', $driver->uuid)->value('company_uuid'))->toBe('company-1')
+            ->and($live->table('company_users')->count())->toBe(0);
+
+        // A live managed account without an organization is linked; its copy
+        // carries the organization and repeat links stay a single row
+        $existing = fleetopsProfileAccountUser(['uuid' => 'existing-1', 'type' => 'contact', 'email' => 'existing@example.com']);
+        ProfileAccountManager::attachToCompany($existing, 'company-2', 'contact');
+        ProfileAccountManager::attachToCompany($existing, 'company-2', 'contact');
+
+        expect($sandbox->table('users')->where('uuid', 'existing-1')->count())->toBe(1)
+            ->and($sandbox->table('users')->where('uuid', 'existing-1')->value('company_uuid'))->toBe('company-2')
+            ->and($sandbox->table('company_users')->where('user_uuid', 'existing-1')->count())->toBe(1)
+            ->and($live->table('users')->where('uuid', 'existing-1')->value('company_uuid'))->toBe('company-2');
+
+        // Copying without an organization only copies the account
+        $loner = fleetopsProfileAccountUser(['uuid' => 'loner-1', 'type' => 'customer']);
+        ProfileAccountManager::copyAccountToSandbox($loner);
+
+        expect($sandbox->table('users')->where('uuid', 'loner-1')->value('company_uuid'))->toBeNull()
+            ->and($sandbox->table('companies')->count())->toBe(2);
+    } finally {
+        fleetopsProfileAccountLeaveSandbox();
+    }
+});
+
+test('a managed account whose membership fails is removed from both databases', function () {
+    $live    = fleetopsProfileAccountBoot();
+    $sandbox = fleetopsProfileAccountSandbox($live);
+    $sandbox->getSchemaBuilder()->drop('company_users');
+
+    try {
+        expect(fn () => ProfileAccountManager::createManagedAccount('company-1', 'driver', 'Failing Driver', 'failing@example.com', null))
+            ->toThrow(Illuminate\Database\QueryException::class);
+
+        expect($live->table('users')->where('email', 'failing@example.com')->count())->toBe(0)
+            ->and($sandbox->table('users')->where('email', 'failing@example.com')->count())->toBe(0);
+    } finally {
+        fleetopsProfileAccountLeaveSandbox();
+    }
+
+    // Outside the sandbox the live account is removed the same way
+    $live = fleetopsProfileAccountBoot();
+    $live->getSchemaBuilder()->drop('company_users');
+
+    expect(fn () => ProfileAccountManager::createManagedAccount('company-1', 'contact', 'Failing Contact', 'contact@example.com', null))
+        ->toThrow(Illuminate\Database\QueryException::class);
+
+    expect($live->table('users')->where('email', 'contact@example.com')->count())->toBe(0);
+});

From 7e27d5a60d6f096f2ef52228bf5ee63c1306c528 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Fri, 9 Oct 2026 16:57:26 +0800
Subject: [PATCH 28/87] refactor(descriptors): build the shared resource
 descriptors from fleetops-data

The driver, vehicle, customer, contact, place, order, vendor and fleet
descriptors, their pill, summary, identity-cell and select-option wrappers,
and the styled placeholder images now come from @fleetbase/fleetops-data, so
every extension that lists those resources renders them the same way without
loading this engine. FleetOps keeps registering all 53 descriptors; for the
eight shared ones it takes the shared descriptor and attaches its own panel
opener, which the registry keeps over the lazy opener the shared package
registers.

The helpers module re-exports the shared building blocks and keeps the
openers that only make sense inside this engine; the placeholder-images
module keeps its import path as a re-export.
---
 addon/components/cell/contact-identity.hbs    |   1 -
 addon/components/cell/customer-identity.hbs   |   1 -
 addon/components/cell/driver-identity.hbs     |   1 -
 addon/components/cell/fleet-identity.hbs      |   1 -
 addon/components/cell/order-identity.hbs      |   1 -
 addon/components/cell/place-identity.hbs      |   1 -
 addon/components/cell/vehicle-identity.hbs    |   1 -
 addon/components/cell/vendor-identity.hbs     |   1 -
 addon/components/contact/pill.hbs             |  24 ---
 addon/components/contact/summary.hbs          |   1 -
 addon/components/customer/pill.hbs            |  24 ---
 addon/components/customer/summary.hbs         |   1 -
 addon/components/driver/pill.hbs              |  24 ---
 addon/components/driver/summary.hbs           |   1 -
 addon/components/fleet/pill.hbs               |  24 ---
 addon/components/fleet/summary.hbs            |   1 -
 addon/components/order/pill.hbs               |  24 ---
 addon/components/order/summary.hbs            |   1 -
 addon/components/place/pill.hbs               |  24 ---
 addon/components/place/summary.hbs            |   1 -
 addon/components/select-option/contact.hbs    |  12 --
 addon/components/select-option/customer.hbs   |  12 --
 addon/components/select-option/driver.hbs     |  12 --
 addon/components/select-option/fleet.hbs      |  12 --
 addon/components/select-option/order.hbs      |  12 --
 addon/components/select-option/place.hbs      |  12 --
 addon/components/select-option/vehicle.hbs    |  12 --
 addon/components/select-option/vendor.hbs     |  12 --
 addon/components/vehicle/pill.hbs             |  24 ---
 addon/components/vehicle/summary.hbs          |   1 -
 addon/components/vendor/pill.hbs              |  24 ---
 addon/components/vendor/summary.hbs           |   1 -
 addon/utils/placeholder-images.js             |  73 +--------
 addon/utils/resource-descriptors/assets.js    |  59 +------
 addon/utils/resource-descriptors/helpers.js   | 145 +++---------------
 .../utils/resource-descriptors/operations.js  |  63 +-------
 addon/utils/resource-descriptors/people.js    | 145 +-----------------
 addon/utils/resource-descriptors/shared.js    |  18 +++
 app/components/cell/contact-identity.js       |   1 -
 app/components/cell/customer-identity.js      |   1 -
 app/components/cell/driver-identity.js        |   1 -
 app/components/cell/fleet-identity.js         |   1 -
 app/components/cell/order-identity.js         |   1 -
 app/components/cell/place-identity.js         |   1 -
 app/components/cell/vehicle-identity.js       |   1 -
 app/components/cell/vendor-identity.js        |   1 -
 app/components/contact/pill.js                |   1 -
 app/components/contact/summary.js             |   1 -
 app/components/customer/pill.js               |   1 -
 app/components/customer/summary.js            |   1 -
 app/components/driver/pill.js                 |   1 -
 app/components/driver/summary.js              |   1 -
 app/components/fleet/pill.js                  |   1 -
 app/components/fleet/summary.js               |   1 -
 app/components/order/pill.js                  |   1 -
 app/components/order/summary.js               |   1 -
 app/components/place/pill.js                  |   1 -
 app/components/place/summary.js               |   1 -
 app/components/select-option/contact.js       |   1 -
 app/components/select-option/customer.js      |   1 -
 app/components/select-option/driver.js        |   1 -
 app/components/select-option/fleet.js         |   1 -
 app/components/select-option/order.js         |   1 -
 app/components/select-option/place.js         |   1 -
 app/components/select-option/vehicle.js       |   1 -
 app/components/select-option/vendor.js        |   1 -
 app/components/vehicle/pill.js                |   1 -
 app/components/vehicle/summary.js             |   1 -
 app/components/vendor/pill.js                 |   1 -
 app/components/vendor/summary.js              |   1 -
 70 files changed, 52 insertions(+), 787 deletions(-)
 delete mode 100644 addon/components/cell/contact-identity.hbs
 delete mode 100644 addon/components/cell/customer-identity.hbs
 delete mode 100644 addon/components/cell/driver-identity.hbs
 delete mode 100644 addon/components/cell/fleet-identity.hbs
 delete mode 100644 addon/components/cell/order-identity.hbs
 delete mode 100644 addon/components/cell/place-identity.hbs
 delete mode 100644 addon/components/cell/vehicle-identity.hbs
 delete mode 100644 addon/components/cell/vendor-identity.hbs
 delete mode 100644 addon/components/contact/pill.hbs
 delete mode 100644 addon/components/contact/summary.hbs
 delete mode 100644 addon/components/customer/pill.hbs
 delete mode 100644 addon/components/customer/summary.hbs
 delete mode 100644 addon/components/driver/pill.hbs
 delete mode 100644 addon/components/driver/summary.hbs
 delete mode 100644 addon/components/fleet/pill.hbs
 delete mode 100644 addon/components/fleet/summary.hbs
 delete mode 100644 addon/components/order/pill.hbs
 delete mode 100644 addon/components/order/summary.hbs
 delete mode 100644 addon/components/place/pill.hbs
 delete mode 100644 addon/components/place/summary.hbs
 delete mode 100644 addon/components/select-option/contact.hbs
 delete mode 100644 addon/components/select-option/customer.hbs
 delete mode 100644 addon/components/select-option/driver.hbs
 delete mode 100644 addon/components/select-option/fleet.hbs
 delete mode 100644 addon/components/select-option/order.hbs
 delete mode 100644 addon/components/select-option/place.hbs
 delete mode 100644 addon/components/select-option/vehicle.hbs
 delete mode 100644 addon/components/select-option/vendor.hbs
 delete mode 100644 addon/components/vehicle/pill.hbs
 delete mode 100644 addon/components/vehicle/summary.hbs
 delete mode 100644 addon/components/vendor/pill.hbs
 delete mode 100644 addon/components/vendor/summary.hbs
 create mode 100644 addon/utils/resource-descriptors/shared.js
 delete mode 100644 app/components/cell/contact-identity.js
 delete mode 100644 app/components/cell/customer-identity.js
 delete mode 100644 app/components/cell/driver-identity.js
 delete mode 100644 app/components/cell/fleet-identity.js
 delete mode 100644 app/components/cell/order-identity.js
 delete mode 100644 app/components/cell/place-identity.js
 delete mode 100644 app/components/cell/vehicle-identity.js
 delete mode 100644 app/components/cell/vendor-identity.js
 delete mode 100644 app/components/contact/pill.js
 delete mode 100644 app/components/contact/summary.js
 delete mode 100644 app/components/customer/pill.js
 delete mode 100644 app/components/customer/summary.js
 delete mode 100644 app/components/driver/pill.js
 delete mode 100644 app/components/driver/summary.js
 delete mode 100644 app/components/fleet/pill.js
 delete mode 100644 app/components/fleet/summary.js
 delete mode 100644 app/components/order/pill.js
 delete mode 100644 app/components/order/summary.js
 delete mode 100644 app/components/place/pill.js
 delete mode 100644 app/components/place/summary.js
 delete mode 100644 app/components/select-option/contact.js
 delete mode 100644 app/components/select-option/customer.js
 delete mode 100644 app/components/select-option/driver.js
 delete mode 100644 app/components/select-option/fleet.js
 delete mode 100644 app/components/select-option/order.js
 delete mode 100644 app/components/select-option/place.js
 delete mode 100644 app/components/select-option/vehicle.js
 delete mode 100644 app/components/select-option/vendor.js
 delete mode 100644 app/components/vehicle/pill.js
 delete mode 100644 app/components/vehicle/summary.js
 delete mode 100644 app/components/vendor/pill.js
 delete mode 100644 app/components/vendor/summary.js

diff --git a/addon/components/cell/contact-identity.hbs b/addon/components/cell/contact-identity.hbs
deleted file mode 100644
index 853719f46..000000000
--- a/addon/components/cell/contact-identity.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Table::Cell::Identity @row={{@row}} @column={{@column}} @value={{@value}} @onClick={{@onClick}} @resourceType="contact" ...attributes />
diff --git a/addon/components/cell/customer-identity.hbs b/addon/components/cell/customer-identity.hbs
deleted file mode 100644
index 2a25fec37..000000000
--- a/addon/components/cell/customer-identity.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Table::Cell::Identity @row={{@row}} @column={{@column}} @value={{@value}} @onClick={{@onClick}} @resourceType="customer" ...attributes />
diff --git a/addon/components/cell/driver-identity.hbs b/addon/components/cell/driver-identity.hbs
deleted file mode 100644
index 24624a8bd..000000000
--- a/addon/components/cell/driver-identity.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Table::Cell::Identity @row={{@row}} @column={{@column}} @value={{@value}} @onClick={{@onClick}} @resourceType="driver" ...attributes />
diff --git a/addon/components/cell/fleet-identity.hbs b/addon/components/cell/fleet-identity.hbs
deleted file mode 100644
index 2efe4afc3..000000000
--- a/addon/components/cell/fleet-identity.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Table::Cell::Identity @row={{@row}} @column={{@column}} @value={{@value}} @onClick={{@onClick}} @resourceType="fleet" ...attributes />
diff --git a/addon/components/cell/order-identity.hbs b/addon/components/cell/order-identity.hbs
deleted file mode 100644
index f6e6ddebb..000000000
--- a/addon/components/cell/order-identity.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Table::Cell::Identity @row={{@row}} @column={{@column}} @value={{@value}} @onClick={{@onClick}} @resourceType="order" ...attributes />
diff --git a/addon/components/cell/place-identity.hbs b/addon/components/cell/place-identity.hbs
deleted file mode 100644
index eea619a5e..000000000
--- a/addon/components/cell/place-identity.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Table::Cell::Identity @row={{@row}} @column={{@column}} @value={{@value}} @onClick={{@onClick}} @resourceType="place" ...attributes />
diff --git a/addon/components/cell/vehicle-identity.hbs b/addon/components/cell/vehicle-identity.hbs
deleted file mode 100644
index 3374e7e79..000000000
--- a/addon/components/cell/vehicle-identity.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Table::Cell::Identity @row={{@row}} @column={{@column}} @value={{@value}} @onClick={{@onClick}} @resourceType="vehicle" ...attributes />
diff --git a/addon/components/cell/vendor-identity.hbs b/addon/components/cell/vendor-identity.hbs
deleted file mode 100644
index 364f72b01..000000000
--- a/addon/components/cell/vendor-identity.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Table::Cell::Identity @row={{@row}} @column={{@column}} @value={{@value}} @onClick={{@onClick}} @resourceType="vendor" ...attributes />
diff --git a/addon/components/contact/pill.hbs b/addon/components/contact/pill.hbs
deleted file mode 100644
index 43118e203..000000000
--- a/addon/components/contact/pill.hbs
+++ /dev/null
@@ -1,24 +0,0 @@
-<Resource::Pill
-    @resource={{(or @contact @resource)}}
-    @resourceType="contact"
-    @title={{@title}}
-    @titleFallback={{@titleFallback}}
-    @subtitle={{@subtitle}}
-    @showOnlineIndicator={{@showOnlineIndicator}}
-    @noPopover={{@noPopover}}
-    @popoverPlacement={{@popoverPlacement}}
-    @static={{@static}}
-    @onClick={{@onClick}}
-    @onView={{@onView}}
-    @anchorClass={{@anchorClass}}
-    @imageClass={{@imageClass}}
-    @imageWrapperClass={{@imageWrapperClass}}
-    @contentWrapperClass={{@contentWrapperClass}}
-    @titleClass={{@titleClass}}
-    @subtitleClass={{@subtitleClass}}
-    @useBlock={{(has-block)}}
-    ...attributes
-    as |resource|
->
-    {{yield resource}}
-</Resource::Pill>
diff --git a/addon/components/contact/summary.hbs b/addon/components/contact/summary.hbs
deleted file mode 100644
index b27212aac..000000000
--- a/addon/components/contact/summary.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Resource::Summary @resource={{(or @contact @resource)}} @resourceType="contact" @onView={{@onView}} @showView={{@showView}} @onClose={{@onClose}} @titleFallback={{@titleFallback}} ...attributes />
diff --git a/addon/components/customer/pill.hbs b/addon/components/customer/pill.hbs
deleted file mode 100644
index 160ea62ba..000000000
--- a/addon/components/customer/pill.hbs
+++ /dev/null
@@ -1,24 +0,0 @@
-<Resource::Pill
-    @resource={{(or @customer @resource)}}
-    @resourceType="customer"
-    @title={{@title}}
-    @titleFallback={{@titleFallback}}
-    @subtitle={{@subtitle}}
-    @showOnlineIndicator={{@showOnlineIndicator}}
-    @noPopover={{@noPopover}}
-    @popoverPlacement={{@popoverPlacement}}
-    @static={{@static}}
-    @onClick={{@onClick}}
-    @onView={{@onView}}
-    @anchorClass={{@anchorClass}}
-    @imageClass={{@imageClass}}
-    @imageWrapperClass={{@imageWrapperClass}}
-    @contentWrapperClass={{@contentWrapperClass}}
-    @titleClass={{@titleClass}}
-    @subtitleClass={{@subtitleClass}}
-    @useBlock={{(has-block)}}
-    ...attributes
-    as |resource|
->
-    {{yield resource}}
-</Resource::Pill>
diff --git a/addon/components/customer/summary.hbs b/addon/components/customer/summary.hbs
deleted file mode 100644
index 6c168790d..000000000
--- a/addon/components/customer/summary.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Resource::Summary @resource={{(or @customer @resource)}} @resourceType="customer" @onView={{@onView}} @showView={{@showView}} @onClose={{@onClose}} @titleFallback={{@titleFallback}} ...attributes />
diff --git a/addon/components/driver/pill.hbs b/addon/components/driver/pill.hbs
deleted file mode 100644
index cefeed497..000000000
--- a/addon/components/driver/pill.hbs
+++ /dev/null
@@ -1,24 +0,0 @@
-<Resource::Pill
-    @resource={{(or @driver @resource)}}
-    @resourceType="driver"
-    @title={{@title}}
-    @titleFallback={{@titleFallback}}
-    @subtitle={{@subtitle}}
-    @showOnlineIndicator={{@showOnlineIndicator}}
-    @noPopover={{@noPopover}}
-    @popoverPlacement={{@popoverPlacement}}
-    @static={{@static}}
-    @onClick={{@onClick}}
-    @onView={{@onView}}
-    @anchorClass={{@anchorClass}}
-    @imageClass={{@imageClass}}
-    @imageWrapperClass={{@imageWrapperClass}}
-    @contentWrapperClass={{@contentWrapperClass}}
-    @titleClass={{@titleClass}}
-    @subtitleClass={{@subtitleClass}}
-    @useBlock={{(has-block)}}
-    ...attributes
-    as |resource|
->
-    {{yield resource}}
-</Resource::Pill>
diff --git a/addon/components/driver/summary.hbs b/addon/components/driver/summary.hbs
deleted file mode 100644
index 2f2834fa9..000000000
--- a/addon/components/driver/summary.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Resource::Summary @resource={{(or @driver @resource)}} @resourceType="driver" @onView={{@onView}} @showView={{@showView}} @onClose={{@onClose}} @titleFallback={{@titleFallback}} ...attributes />
diff --git a/addon/components/fleet/pill.hbs b/addon/components/fleet/pill.hbs
deleted file mode 100644
index 68f25548d..000000000
--- a/addon/components/fleet/pill.hbs
+++ /dev/null
@@ -1,24 +0,0 @@
-<Resource::Pill
-    @resource={{(or @fleet @resource)}}
-    @resourceType="fleet"
-    @title={{@title}}
-    @titleFallback={{@titleFallback}}
-    @subtitle={{@subtitle}}
-    @showOnlineIndicator={{@showOnlineIndicator}}
-    @noPopover={{@noPopover}}
-    @popoverPlacement={{@popoverPlacement}}
-    @static={{@static}}
-    @onClick={{@onClick}}
-    @onView={{@onView}}
-    @anchorClass={{@anchorClass}}
-    @imageClass={{@imageClass}}
-    @imageWrapperClass={{@imageWrapperClass}}
-    @contentWrapperClass={{@contentWrapperClass}}
-    @titleClass={{@titleClass}}
-    @subtitleClass={{@subtitleClass}}
-    @useBlock={{(has-block)}}
-    ...attributes
-    as |resource|
->
-    {{yield resource}}
-</Resource::Pill>
diff --git a/addon/components/fleet/summary.hbs b/addon/components/fleet/summary.hbs
deleted file mode 100644
index fc035f943..000000000
--- a/addon/components/fleet/summary.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Resource::Summary @resource={{(or @fleet @resource)}} @resourceType="fleet" @onView={{@onView}} @showView={{@showView}} @onClose={{@onClose}} @titleFallback={{@titleFallback}} ...attributes />
diff --git a/addon/components/order/pill.hbs b/addon/components/order/pill.hbs
deleted file mode 100644
index 434fc468c..000000000
--- a/addon/components/order/pill.hbs
+++ /dev/null
@@ -1,24 +0,0 @@
-<Resource::Pill
-    @resource={{(or @order @resource)}}
-    @resourceType="order"
-    @title={{@title}}
-    @titleFallback={{@titleFallback}}
-    @subtitle={{@subtitle}}
-    @showOnlineIndicator={{@showOnlineIndicator}}
-    @noPopover={{@noPopover}}
-    @popoverPlacement={{@popoverPlacement}}
-    @static={{@static}}
-    @onClick={{@onClick}}
-    @onView={{@onView}}
-    @anchorClass={{@anchorClass}}
-    @imageClass={{@imageClass}}
-    @imageWrapperClass={{@imageWrapperClass}}
-    @contentWrapperClass={{@contentWrapperClass}}
-    @titleClass={{@titleClass}}
-    @subtitleClass={{@subtitleClass}}
-    @useBlock={{(has-block)}}
-    ...attributes
-    as |resource|
->
-    {{yield resource}}
-</Resource::Pill>
diff --git a/addon/components/order/summary.hbs b/addon/components/order/summary.hbs
deleted file mode 100644
index f3f42a464..000000000
--- a/addon/components/order/summary.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Resource::Summary @resource={{(or @order @resource)}} @resourceType="order" @onView={{@onView}} @showView={{@showView}} @onClose={{@onClose}} @titleFallback={{@titleFallback}} ...attributes />
diff --git a/addon/components/place/pill.hbs b/addon/components/place/pill.hbs
deleted file mode 100644
index 0b96aa8f5..000000000
--- a/addon/components/place/pill.hbs
+++ /dev/null
@@ -1,24 +0,0 @@
-<Resource::Pill
-    @resource={{(or @place @resource)}}
-    @resourceType="place"
-    @title={{@title}}
-    @titleFallback={{@titleFallback}}
-    @subtitle={{@subtitle}}
-    @showOnlineIndicator={{@showOnlineIndicator}}
-    @noPopover={{@noPopover}}
-    @popoverPlacement={{@popoverPlacement}}
-    @static={{@static}}
-    @onClick={{@onClick}}
-    @onView={{@onView}}
-    @anchorClass={{@anchorClass}}
-    @imageClass={{@imageClass}}
-    @imageWrapperClass={{@imageWrapperClass}}
-    @contentWrapperClass={{@contentWrapperClass}}
-    @titleClass={{@titleClass}}
-    @subtitleClass={{@subtitleClass}}
-    @useBlock={{(has-block)}}
-    ...attributes
-    as |resource|
->
-    {{yield resource}}
-</Resource::Pill>
diff --git a/addon/components/place/summary.hbs b/addon/components/place/summary.hbs
deleted file mode 100644
index a96ae6a4b..000000000
--- a/addon/components/place/summary.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Resource::Summary @resource={{(or @place @resource)}} @resourceType="place" @onView={{@onView}} @showView={{@showView}} @onClose={{@onClose}} @titleFallback={{@titleFallback}} ...attributes />
diff --git a/addon/components/select-option/contact.hbs b/addon/components/select-option/contact.hbs
deleted file mode 100644
index 08e782a09..000000000
--- a/addon/components/select-option/contact.hbs
+++ /dev/null
@@ -1,12 +0,0 @@
-<Resource::SelectOption
-    @option={{or @option @model @contact}}
-    @resourceType="contact"
-    @compact={{@compact}}
-    @title={{@title}}
-    @details={{@details}}
-    @photo={{@photo}}
-    @fallbackPhoto={{@fallbackPhoto}}
-    @icon={{@icon}}
-    @shape={{@shape}}
-    ...attributes
-/>
diff --git a/addon/components/select-option/customer.hbs b/addon/components/select-option/customer.hbs
deleted file mode 100644
index 5c626e92f..000000000
--- a/addon/components/select-option/customer.hbs
+++ /dev/null
@@ -1,12 +0,0 @@
-<Resource::SelectOption
-    @option={{or @option @model @customer}}
-    @resourceType="customer"
-    @compact={{@compact}}
-    @title={{@title}}
-    @details={{@details}}
-    @photo={{@photo}}
-    @fallbackPhoto={{@fallbackPhoto}}
-    @icon={{@icon}}
-    @shape={{@shape}}
-    ...attributes
-/>
diff --git a/addon/components/select-option/driver.hbs b/addon/components/select-option/driver.hbs
deleted file mode 100644
index 06f2f8fa1..000000000
--- a/addon/components/select-option/driver.hbs
+++ /dev/null
@@ -1,12 +0,0 @@
-<Resource::SelectOption
-    @option={{or @option @model @driver}}
-    @resourceType="driver"
-    @compact={{@compact}}
-    @title={{@title}}
-    @details={{@details}}
-    @photo={{@photo}}
-    @fallbackPhoto={{@fallbackPhoto}}
-    @icon={{@icon}}
-    @shape={{@shape}}
-    ...attributes
-/>
diff --git a/addon/components/select-option/fleet.hbs b/addon/components/select-option/fleet.hbs
deleted file mode 100644
index 88894a8dd..000000000
--- a/addon/components/select-option/fleet.hbs
+++ /dev/null
@@ -1,12 +0,0 @@
-<Resource::SelectOption
-    @option={{or @option @model @fleet}}
-    @resourceType="fleet"
-    @compact={{@compact}}
-    @title={{@title}}
-    @details={{@details}}
-    @photo={{@photo}}
-    @fallbackPhoto={{@fallbackPhoto}}
-    @icon={{@icon}}
-    @shape={{@shape}}
-    ...attributes
-/>
diff --git a/addon/components/select-option/order.hbs b/addon/components/select-option/order.hbs
deleted file mode 100644
index d8da9184c..000000000
--- a/addon/components/select-option/order.hbs
+++ /dev/null
@@ -1,12 +0,0 @@
-<Resource::SelectOption
-    @option={{or @option @model @order}}
-    @resourceType="order"
-    @compact={{@compact}}
-    @title={{@title}}
-    @details={{@details}}
-    @photo={{@photo}}
-    @fallbackPhoto={{@fallbackPhoto}}
-    @icon={{@icon}}
-    @shape={{@shape}}
-    ...attributes
-/>
diff --git a/addon/components/select-option/place.hbs b/addon/components/select-option/place.hbs
deleted file mode 100644
index 1e65f260b..000000000
--- a/addon/components/select-option/place.hbs
+++ /dev/null
@@ -1,12 +0,0 @@
-<Resource::SelectOption
-    @option={{or @option @model @place}}
-    @resourceType="place"
-    @compact={{@compact}}
-    @title={{@title}}
-    @details={{@details}}
-    @photo={{@photo}}
-    @fallbackPhoto={{@fallbackPhoto}}
-    @icon={{@icon}}
-    @shape={{@shape}}
-    ...attributes
-/>
diff --git a/addon/components/select-option/vehicle.hbs b/addon/components/select-option/vehicle.hbs
deleted file mode 100644
index d144b4962..000000000
--- a/addon/components/select-option/vehicle.hbs
+++ /dev/null
@@ -1,12 +0,0 @@
-<Resource::SelectOption
-    @option={{or @option @model @vehicle}}
-    @resourceType="vehicle"
-    @compact={{@compact}}
-    @title={{@title}}
-    @details={{@details}}
-    @photo={{@photo}}
-    @fallbackPhoto={{@fallbackPhoto}}
-    @icon={{@icon}}
-    @shape={{@shape}}
-    ...attributes
-/>
diff --git a/addon/components/select-option/vendor.hbs b/addon/components/select-option/vendor.hbs
deleted file mode 100644
index 83355a005..000000000
--- a/addon/components/select-option/vendor.hbs
+++ /dev/null
@@ -1,12 +0,0 @@
-<Resource::SelectOption
-    @option={{or @option @model @vendor}}
-    @resourceType="vendor"
-    @compact={{@compact}}
-    @title={{@title}}
-    @details={{@details}}
-    @photo={{@photo}}
-    @fallbackPhoto={{@fallbackPhoto}}
-    @icon={{@icon}}
-    @shape={{@shape}}
-    ...attributes
-/>
diff --git a/addon/components/vehicle/pill.hbs b/addon/components/vehicle/pill.hbs
deleted file mode 100644
index 16e8dc110..000000000
--- a/addon/components/vehicle/pill.hbs
+++ /dev/null
@@ -1,24 +0,0 @@
-<Resource::Pill
-    @resource={{(or @vehicle @resource)}}
-    @resourceType="vehicle"
-    @title={{@title}}
-    @titleFallback={{@titleFallback}}
-    @subtitle={{@subtitle}}
-    @showOnlineIndicator={{@showOnlineIndicator}}
-    @noPopover={{@noPopover}}
-    @popoverPlacement={{@popoverPlacement}}
-    @static={{@static}}
-    @onClick={{@onClick}}
-    @onView={{@onView}}
-    @anchorClass={{@anchorClass}}
-    @imageClass={{@imageClass}}
-    @imageWrapperClass={{@imageWrapperClass}}
-    @contentWrapperClass={{@contentWrapperClass}}
-    @titleClass={{@titleClass}}
-    @subtitleClass={{@subtitleClass}}
-    @useBlock={{(has-block)}}
-    ...attributes
-    as |resource|
->
-    {{yield resource}}
-</Resource::Pill>
diff --git a/addon/components/vehicle/summary.hbs b/addon/components/vehicle/summary.hbs
deleted file mode 100644
index 577d3938c..000000000
--- a/addon/components/vehicle/summary.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Resource::Summary @resource={{(or @vehicle @resource)}} @resourceType="vehicle" @onView={{@onView}} @showView={{@showView}} @onClose={{@onClose}} @titleFallback={{@titleFallback}} ...attributes />
diff --git a/addon/components/vendor/pill.hbs b/addon/components/vendor/pill.hbs
deleted file mode 100644
index 4fcf04ef5..000000000
--- a/addon/components/vendor/pill.hbs
+++ /dev/null
@@ -1,24 +0,0 @@
-<Resource::Pill
-    @resource={{(or @vendor @resource)}}
-    @resourceType="vendor"
-    @title={{@title}}
-    @titleFallback={{@titleFallback}}
-    @subtitle={{@subtitle}}
-    @showOnlineIndicator={{@showOnlineIndicator}}
-    @noPopover={{@noPopover}}
-    @popoverPlacement={{@popoverPlacement}}
-    @static={{@static}}
-    @onClick={{@onClick}}
-    @onView={{@onView}}
-    @anchorClass={{@anchorClass}}
-    @imageClass={{@imageClass}}
-    @imageWrapperClass={{@imageWrapperClass}}
-    @contentWrapperClass={{@contentWrapperClass}}
-    @titleClass={{@titleClass}}
-    @subtitleClass={{@subtitleClass}}
-    @useBlock={{(has-block)}}
-    ...attributes
-    as |resource|
->
-    {{yield resource}}
-</Resource::Pill>
diff --git a/addon/components/vendor/summary.hbs b/addon/components/vendor/summary.hbs
deleted file mode 100644
index c231423b0..000000000
--- a/addon/components/vendor/summary.hbs
+++ /dev/null
@@ -1 +0,0 @@
-<Resource::Summary @resource={{(or @vendor @resource)}} @resourceType="vendor" @onView={{@onView}} @showView={{@showView}} @onClose={{@onClose}} @titleFallback={{@titleFallback}} ...attributes />
diff --git a/addon/utils/placeholder-images.js b/addon/utils/placeholder-images.js
index 28b8e36f4..f3af16abc 100644
--- a/addon/utils/placeholder-images.js
+++ b/addon/utils/placeholder-images.js
@@ -1,71 +1,6 @@
-import config from 'ember-get-config';
-
 /**
- * Flat silhouettes shown wherever a resource has no photo, in one consistent style
- * across the console. They are inline data URIs so the engine does not depend on a
- * hosted asset; a console can override any of them through
- * `defaultValues.placeholders.<type>` in its environment config.
+ * The styled placeholder silhouettes now live in `@fleetbase/fleetops-data`,
+ * where every extension that shows a driver, vehicle or contact can reach
+ * them. This module keeps the FleetOps import path working.
  */
-export const PLACEHOLDER_IMAGES = {
-    trailer:
-        'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2NDAgNDgwIiB3aWR0aD0iNjQwIiBoZWlnaHQ9IjQ4MCI+PGcgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIj48cmVjdCB4PSI4OCIgeT0iMTI4IiB3aWR0aD0iNDcwIiBoZWlnaHQ9IjE5NiIgcng9IjE2IiBmaWxsPSIjYmRiZGJkIiBzdHJva2U9IiNkZWRlZGUiIHN0cm9rZS13aWR0aD0iMTAiLz48cmVjdCB4PSIxMDgiIHk9IjE1MCIgd2lkdGg9IjQzMCIgaGVpZ2h0PSIxNTIiIHJ4PSI4IiBmaWxsPSIjYzljOWM5Ii8+PHBhdGggZD0iTTEyOCAxNzhoMzkwTTEyOCAyMjZoMzkwTTEyOCAyNzRoMzkwIiBzdHJva2U9IiNiZGJkYmQiIHN0cm9rZS13aWR0aD0iNiIvPjxyZWN0IHg9IjUyMiIgeT0iMTQ2IiB3aWR0aD0iMTAiIGhlaWdodD0iMTYwIiByeD0iNCIgZmlsbD0iI2IwYjBiMCIvPjxyZWN0IHg9Ijg4IiB5PSIzMjQiIHdpZHRoPSI0NzAiIGhlaWdodD0iMTgiIHJ4PSI2IiBmaWxsPSIjYTlhOWE5Ii8+PHJlY3QgeD0iMTU2IiB5PSIzNDIiIHdpZHRoPSIxNCIgaGVpZ2h0PSI1MiIgcng9IjQiIGZpbGw9IiNhOWE5YTkiLz48cmVjdCB4PSIxNDYiIHk9IjM5MiIgd2lkdGg9IjM0IiBoZWlnaHQ9IjEwIiByeD0iNCIgZmlsbD0iI2E5YTlhOSIvPjxyZWN0IHg9Ijg4IiB5PSIzNDIiIHdpZHRoPSI1MiIgaGVpZ2h0PSIxNiIgcng9IjYiIGZpbGw9IiNhOWE5YTkiLz48Y2lyY2xlIGN4PSI0MTIiIGN5PSIzNjYiIHI9IjQwIiBmaWxsPSIjOGY4ZjhmIiBzdHJva2U9IiNkZWRlZGUiIHN0cm9rZS13aWR0aD0iOCIvPjxjaXJjbGUgY3g9IjQxMiIgY3k9IjM2NiIgcj0iMTYiIGZpbGw9IiNkOWQ5ZDkiLz48Y2lyY2xlIGN4PSI1MDAiIGN5PSIzNjYiIHI9IjQwIiBmaWxsPSIjOGY4ZjhmIiBzdHJva2U9IiNkZWRlZGUiIHN0cm9rZS13aWR0aD0iOCIvPjxjaXJjbGUgY3g9IjUwMCIgY3k9IjM2NiIgcj0iMTYiIGZpbGw9IiNkOWQ5ZDkiLz48L2c+PC9zdmc+',
-    vehicle:
-        'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2NDAgNDgwIiB3aWR0aD0iNjQwIiBoZWlnaHQ9IjQ4MCI+PGcgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIj48ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgwIDApIHNjYWxlKDEuMCkiIG9wYWNpdHk9IjEuMCI+PHJlY3QgeD0iMjE2IiB5PSIxMzIiIHdpZHRoPSIzNTAiIGhlaWdodD0iMTkyIiByeD0iMTQiIGZpbGw9IiNiZGJkYmQiIHN0cm9rZT0iI2RlZGVkZSIgc3Ryb2tlLXdpZHRoPSIxMCIvPjxyZWN0IHg9IjIzNiIgeT0iMTU0IiB3aWR0aD0iMzEwIiBoZWlnaHQ9IjE0OCIgcng9IjgiIGZpbGw9IiNjOWM5YzkiLz48cGF0aCBkPSJNMjU2IDE4MmgyNzBNMjU2IDIzMGgyNzBNMjU2IDI3OGgyNzAiIHN0cm9rZT0iI2JkYmRiZCIgc3Ryb2tlLXdpZHRoPSI2Ii8+PHBhdGggZD0iTTIxNiAzMjRWMTkwSDk2Yy0xMiAwLTIyIDgtMjYgMjBMNjAgMjQ0djgweiIgZmlsbD0iI2JkYmRiZCIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjEwIi8+PHBhdGggZD0iTTEwNCAyMDZoODh2NTJIODR6IiBmaWxsPSIjZDlkOWQ5Ii8+PHJlY3QgeD0iNjAiIHk9IjMyNCIgd2lkdGg9IjUwNiIgaGVpZ2h0PSIxOCIgcng9IjYiIGZpbGw9IiNhOWE5YTkiLz48cmVjdCB4PSI1NiIgeT0iMjkyIiB3aWR0aD0iMTgiIGhlaWdodD0iMzAiIHJ4PSI1IiBmaWxsPSIjZDlkOWQ5Ii8+PGNpcmNsZSBjeD0iMTUwIiBjeT0iMzY2IiByPSI0MCIgZmlsbD0iIzhmOGY4ZiIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjgiLz48Y2lyY2xlIGN4PSIxNTAiIGN5PSIzNjYiIHI9IjE2IiBmaWxsPSIjZDlkOWQ5Ii8+PGNpcmNsZSBjeD0iNDcwIiBjeT0iMzY2IiByPSI0MCIgZmlsbD0iIzhmOGY4ZiIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjgiLz48Y2lyY2xlIGN4PSI0NzAiIGN5PSIzNjYiIHI9IjE2IiBmaWxsPSIjZDlkOWQ5Ii8+PC9nPjwvZz48L3N2Zz4=',
-    driver: 'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2NDAgNDgwIiB3aWR0aD0iNjQwIiBoZWlnaHQ9IjQ4MCI+PGcgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIj48cGF0aCBkPSJNMTEwIDQ4MGMwLTk2IDc2LTE2NiAyMTAtMTY2czIxMCA3MCAyMTAgMTY2eiIgZmlsbD0iI2JkYmRiZCIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjEwIi8+PHBhdGggZD0iTTI3MCAzMjJsNTAgNTQgNTAtNTQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2Q5ZDlkOSIgc3Ryb2tlLXdpZHRoPSI4Ii8+PGNpcmNsZSBjeD0iMzIwIiBjeT0iMjA0IiByPSI5MiIgZmlsbD0iI2JkYmRiZCIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjEwIi8+PHBhdGggZD0iTTIzMCAxODZjMC02MiA0Mi05NiA5MC05NnM5MCAzNCA5MCA5NnoiIGZpbGw9IiNhOWE5YTkiIHN0cm9rZT0iI2RlZGVkZSIgc3Ryb2tlLXdpZHRoPSIxMCIvPjxwYXRoIGQ9Ik0zMjAgOTZ2ODgiIHN0cm9rZT0iI2RlZGVkZSIgc3Ryb2tlLXdpZHRoPSI2Ii8+PGNpcmNsZSBjeD0iMzIwIiBjeT0iOTIiIHI9IjkiIGZpbGw9IiNhOWE5YTkiIHN0cm9rZT0iI2RlZGVkZSIgc3Ryb2tlLXdpZHRoPSI2Ii8+PHBhdGggZD0iTTIyMiAxODZoMTkwYzY2IDAgOTYgMTAgOTYgMjJzLTMwIDIyLTk2IDIySDIyMnoiIGZpbGw9IiNhOWE5YTkiIHN0cm9rZT0iI2RlZGVkZSIgc3Ryb2tlLXdpZHRoPSI4Ii8+PC9nPjwvc3ZnPg==',
-    contact:
-        'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2NDAgNDgwIiB3aWR0aD0iNjQwIiBoZWlnaHQ9IjQ4MCI+PGcgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIj48cGF0aCBkPSJNMTEwIDQ4MGMwLTk2IDc2LTE2NiAyMTAtMTY2czIxMCA3MCAyMTAgMTY2eiIgZmlsbD0iI2JkYmRiZCIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjEwIi8+PHBhdGggZD0iTTI3MCAzMjJsNTAgNTQgNTAtNTQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2Q5ZDlkOSIgc3Ryb2tlLXdpZHRoPSI4Ii8+PGNpcmNsZSBjeD0iMzIwIiBjeT0iMTg4IiByPSI5NiIgZmlsbD0iI2JkYmRiZCIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjEwIi8+PC9nPjwvc3ZnPg==',
-    customer:
-        'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2NDAgNDgwIiB3aWR0aD0iNjQwIiBoZWlnaHQ9IjQ4MCI+PGcgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIj48cGF0aCBkPSJNMTEwIDQ4MGMwLTk2IDc2LTE2NiAyMTAtMTY2czIxMCA3MCAyMTAgMTY2eiIgZmlsbD0iI2JkYmRiZCIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjEwIi8+PHBhdGggZD0iTTI3MCAzMjJsNTAgNTQgNTAtNTQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2Q5ZDlkOSIgc3Ryb2tlLXdpZHRoPSI4Ii8+PGNpcmNsZSBjeD0iMzIwIiBjeT0iMTg4IiByPSI5NiIgZmlsbD0iI2JkYmRiZCIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjEwIi8+PGNpcmNsZSBjeD0iNDkwIiBjeT0iMzkyIiByPSI2MCIgZmlsbD0iIzhmOGY4ZiIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjEwIi8+PHBhdGggZD0iTTQ1OCAzOTRsMjIgMjIgNDQtNDgiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2Q5ZDlkOSIgc3Ryb2tlLXdpZHRoPSIxNCIvPjwvZz48L3N2Zz4=',
-    vendor: 'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2NDAgNDgwIiB3aWR0aD0iNjQwIiBoZWlnaHQ9IjQ4MCI+PGcgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIj48cGF0aCBkPSJNNzIgMjAwTDMyMCA5NmwyNDggMTA0djI0SDcyeiIgZmlsbD0iI2E5YTlhOSIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjEwIi8+PHJlY3QgeD0iMTAwIiB5PSIyMjIiIHdpZHRoPSI0NDAiIGhlaWdodD0iMTkwIiByeD0iOCIgZmlsbD0iI2JkYmRiZCIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjEwIi8+PHJlY3QgeD0iMjcyIiB5PSIyOTIiIHdpZHRoPSI5NiIgaGVpZ2h0PSIxMjAiIHJ4PSI2IiBmaWxsPSIjOGY4ZjhmIiBzdHJva2U9IiNkZWRlZGUiIHN0cm9rZS13aWR0aD0iOCIvPjxyZWN0IHg9IjE0MCIgeT0iMjYyIiB3aWR0aD0iODgiIGhlaWdodD0iNjYiIHJ4PSI2IiBmaWxsPSIjZDlkOWQ5Ii8+PHJlY3QgeD0iNDEyIiB5PSIyNjIiIHdpZHRoPSI4OCIgaGVpZ2h0PSI2NiIgcng9IjYiIGZpbGw9IiNkOWQ5ZDkiLz48cGF0aCBkPSJNMTg0IDI2MnY2Nk0xNDAgMjk1aDg4TTQ1NiAyNjJ2NjZNNDEyIDI5NWg4OCIgc3Ryb2tlPSIjYmRiZGJkIiBzdHJva2Utd2lkdGg9IjYiLz48cmVjdCB4PSI2MCIgeT0iNDEyIiB3aWR0aD0iNTIwIiBoZWlnaHQ9IjE2IiByeD0iNiIgZmlsbD0iI2E5YTlhOSIvPjwvZz48L3N2Zz4=',
-    fleet: 'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2NDAgNDgwIiB3aWR0aD0iNjQwIiBoZWlnaHQ9IjQ4MCI+PGcgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIj48ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgxNTAgLTQwKSBzY2FsZSgwLjcyKSIgb3BhY2l0eT0iMC40NSI+PHJlY3QgeD0iMjE2IiB5PSIxMzIiIHdpZHRoPSIzNTAiIGhlaWdodD0iMTkyIiByeD0iMTQiIGZpbGw9IiNiZGJkYmQiIHN0cm9rZT0iI2RlZGVkZSIgc3Ryb2tlLXdpZHRoPSIxMCIvPjxyZWN0IHg9IjIzNiIgeT0iMTU0IiB3aWR0aD0iMzEwIiBoZWlnaHQ9IjE0OCIgcng9IjgiIGZpbGw9IiNjOWM5YzkiLz48cGF0aCBkPSJNMjU2IDE4MmgyNzBNMjU2IDIzMGgyNzBNMjU2IDI3OGgyNzAiIHN0cm9rZT0iI2JkYmRiZCIgc3Ryb2tlLXdpZHRoPSI2Ii8+PHBhdGggZD0iTTIxNiAzMjRWMTkwSDk2Yy0xMiAwLTIyIDgtMjYgMjBMNjAgMjQ0djgweiIgZmlsbD0iI2JkYmRiZCIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjEwIi8+PHBhdGggZD0iTTEwNCAyMDZoODh2NTJIODR6IiBmaWxsPSIjZDlkOWQ5Ii8+PHJlY3QgeD0iNjAiIHk9IjMyNCIgd2lkdGg9IjUwNiIgaGVpZ2h0PSIxOCIgcng9IjYiIGZpbGw9IiNhOWE5YTkiLz48cmVjdCB4PSI1NiIgeT0iMjkyIiB3aWR0aD0iMTgiIGhlaWdodD0iMzAiIHJ4PSI1IiBmaWxsPSIjZDlkOWQ5Ii8+PGNpcmNsZSBjeD0iMTUwIiBjeT0iMzY2IiByPSI0MCIgZmlsbD0iIzhmOGY4ZiIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjgiLz48Y2lyY2xlIGN4PSIxNTAiIGN5PSIzNjYiIHI9IjE2IiBmaWxsPSIjZDlkOWQ5Ii8+PGNpcmNsZSBjeD0iNDcwIiBjeT0iMzY2IiByPSI0MCIgZmlsbD0iIzhmOGY4ZiIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjgiLz48Y2lyY2xlIGN4PSI0NzAiIGN5PSIzNjYiIHI9IjE2IiBmaWxsPSIjZDlkOWQ5Ii8+PC9nPjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDgwIDEwKSBzY2FsZSgwLjgpIiBvcGFjaXR5PSIwLjciPjxyZWN0IHg9IjIxNiIgeT0iMTMyIiB3aWR0aD0iMzUwIiBoZWlnaHQ9IjE5MiIgcng9IjE0IiBmaWxsPSIjYmRiZGJkIiBzdHJva2U9IiNkZWRlZGUiIHN0cm9rZS13aWR0aD0iMTAiLz48cmVjdCB4PSIyMzYiIHk9IjE1NCIgd2lkdGg9IjMxMCIgaGVpZ2h0PSIxNDgiIHJ4PSI4IiBmaWxsPSIjYzljOWM5Ii8+PHBhdGggZD0iTTI1NiAxODJoMjcwTTI1NiAyMzBoMjcwTTI1NiAyNzhoMjcwIiBzdHJva2U9IiNiZGJkYmQiIHN0cm9rZS13aWR0aD0iNiIvPjxwYXRoIGQ9Ik0yMTYgMzI0VjE5MEg5NmMtMTIgMC0yMiA4LTI2IDIwTDYwIDI0NHY4MHoiIGZpbGw9IiNiZGJkYmQiIHN0cm9rZT0iI2RlZGVkZSIgc3Ryb2tlLXdpZHRoPSIxMCIvPjxwYXRoIGQ9Ik0xMDQgMjA2aDg4djUySDg0eiIgZmlsbD0iI2Q5ZDlkOSIvPjxyZWN0IHg9IjYwIiB5PSIzMjQiIHdpZHRoPSI1MDYiIGhlaWdodD0iMTgiIHJ4PSI2IiBmaWxsPSIjYTlhOWE5Ii8+PHJlY3QgeD0iNTYiIHk9IjI5MiIgd2lkdGg9IjE4IiBoZWlnaHQ9IjMwIiByeD0iNSIgZmlsbD0iI2Q5ZDlkOSIvPjxjaXJjbGUgY3g9IjE1MCIgY3k9IjM2NiIgcj0iNDAiIGZpbGw9IiM4ZjhmOGYiIHN0cm9rZT0iI2RlZGVkZSIgc3Ryb2tlLXdpZHRoPSI4Ii8+PGNpcmNsZSBjeD0iMTUwIiBjeT0iMzY2IiByPSIxNiIgZmlsbD0iI2Q5ZDlkOSIvPjxjaXJjbGUgY3g9IjQ3MCIgY3k9IjM2NiIgcj0iNDAiIGZpbGw9IiM4ZjhmOGYiIHN0cm9rZT0iI2RlZGVkZSIgc3Ryb2tlLXdpZHRoPSI4Ii8+PGNpcmNsZSBjeD0iNDcwIiBjeT0iMzY2IiByPSIxNiIgZmlsbD0iI2Q5ZDlkOSIvPjwvZz48ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgwIDYwKSBzY2FsZSgwLjg4KSIgb3BhY2l0eT0iMS4wIj48cmVjdCB4PSIyMTYiIHk9IjEzMiIgd2lkdGg9IjM1MCIgaGVpZ2h0PSIxOTIiIHJ4PSIxNCIgZmlsbD0iI2JkYmRiZCIgc3Ryb2tlPSIjZGVkZWRlIiBzdHJva2Utd2lkdGg9IjEwIi8+PHJlY3QgeD0iMjM2IiB5PSIxNTQiIHdpZHRoPSIzMTAiIGhlaWdodD0iMTQ4IiByeD0iOCIgZmlsbD0iI2M5YzljOSIvPjxwYXRoIGQ9Ik0yNTYgMTgyaDI3ME0yNTYgMjMwaDI3ME0yNTYgMjc4aDI3MCIgc3Ryb2tlPSIjYmRiZGJkIiBzdHJva2Utd2lkdGg9IjYiLz48cGF0aCBkPSJNMjE2IDMyNFYxOTBIOTZjLTEyIDAtMjIgOC0yNiAyMEw2MCAyNDR2ODB6IiBmaWxsPSIjYmRiZGJkIiBzdHJva2U9IiNkZWRlZGUiIHN0cm9rZS13aWR0aD0iMTAiLz48cGF0aCBkPSJNMTA0IDIwNmg4OHY1Mkg4NHoiIGZpbGw9IiNkOWQ5ZDkiLz48cmVjdCB4PSI2MCIgeT0iMzI0IiB3aWR0aD0iNTA2IiBoZWlnaHQ9IjE4IiByeD0iNiIgZmlsbD0iI2E5YTlhOSIvPjxyZWN0IHg9IjU2IiB5PSIyOTIiIHdpZHRoPSIxOCIgaGVpZ2h0PSIzMCIgcng9IjUiIGZpbGw9IiNkOWQ5ZDkiLz48Y2lyY2xlIGN4PSIxNTAiIGN5PSIzNjYiIHI9IjQwIiBmaWxsPSIjOGY4ZjhmIiBzdHJva2U9IiNkZWRlZGUiIHN0cm9rZS13aWR0aD0iOCIvPjxjaXJjbGUgY3g9IjE1MCIgY3k9IjM2NiIgcj0iMTYiIGZpbGw9IiNkOWQ5ZDkiLz48Y2lyY2xlIGN4PSI0NzAiIGN5PSIzNjYiIHI9IjQwIiBmaWxsPSIjOGY4ZjhmIiBzdHJva2U9IiNkZWRlZGUiIHN0cm9rZS13aWR0aD0iOCIvPjxjaXJjbGUgY3g9IjQ3MCIgY3k9IjM2NiIgcj0iMTYiIGZpbGw9IiNkOWQ5ZDkiLz48L2c+PC9nPjwvc3ZnPg==',
-};
-
-/**
- * Hosted images the data models and console config fall back to when a record has no
- * photo. Treat them as "no photo" so the styled placeholder wins over the legacy PNG.
- */
-const LEGACY_DEFAULT_PATTERN = /(no-avatar|vehicle-placeholder|image-file-icon|fallback-placeholder|default-extension-icon)\.(png|svg|jpe?g)/i;
-
-const CONFIG_KEYS = {
-    vehicle: 'vehicleImage',
-    driver: 'driverImage',
-    vendor: 'vendorImage',
-    contact: 'contactImage',
-    customer: 'customerImage',
-    fleet: 'fleetImage',
-    trailer: 'trailerImage',
-};
-
-export function getPlaceholderImage(type = 'contact') {
-    const overrides = config?.defaultValues?.placeholders ?? {};
-    // A console that already replaced its hosted defaults with inline images wins;
-    // hosted PNG defaults are ignored so the silhouette set stays consistent.
-    const configured = config?.defaultValues?.[CONFIG_KEYS[type]];
-    const inlineConfigured = typeof configured === 'string' && configured.startsWith('data:') ? configured : null;
-
-    return overrides[type] || inlineConfigured || PLACEHOLDER_IMAGES[type] || PLACEHOLDER_IMAGES.contact;
-}
-
-export function isDefaultImage(url) {
-    if (typeof url !== 'string' || url.trim() === '') {
-        return true;
-    }
-
-    if (LEGACY_DEFAULT_PATTERN.test(url)) {
-        return true;
-    }
-
-    const defaults = Object.values(config?.defaultValues ?? {}).filter((value) => typeof value === 'string');
-
-    return defaults.includes(url);
-}
-
-/**
- * The image to show for a record: its own photo, or the styled placeholder when the
- * photo is missing or one of the legacy hosted defaults.
- */
-export function resolveResourceImage(url, type) {
-    return isDefaultImage(url) ? getPlaceholderImage(type) : url;
-}
-
-export default getPlaceholderImage;
+export { PLACEHOLDER_IMAGES, getPlaceholderImage, isDefaultImage, resolveResourceImage, default } from '@fleetbase/fleetops-data/utils/placeholder-images';
diff --git a/addon/utils/resource-descriptors/assets.js b/addon/utils/resource-descriptors/assets.js
index 3875af786..3b38dce42 100644
--- a/addon/utils/resource-descriptors/assets.js
+++ b/addon/utils/resource-descriptors/assets.js
@@ -1,68 +1,13 @@
 import { get } from '@ember/object';
 import { first, present, relation, photo, icon, badge, badges, fact, relatedFact, money, join, panelOpener } from './helpers';
+import { sharedDescriptors } from './shared';
 
 /**
  * Vehicles, trailers, equipment, parts, generic assets and warranties.
  */
 export default function buildAssetDescriptors(owner) {
     return [
-        {
-            key: 'vehicle',
-            labelKey: 'resource.vehicle',
-            icon: 'truck',
-            modelNames: ['vehicle'],
-            aliases: ['attachable-vehicle', 'maintenance-subject-vehicle'],
-            polymorphicTypes: ['fleet-ops:vehicle', 'Fleetbase\\FleetOps\\Models\\Vehicle'],
-            permission: 'fleet-ops view vehicle',
-            statusTones: {
-                available: 'text-green-500',
-                active: 'text-green-500',
-                in_service: 'text-green-500',
-                maintenance: 'text-yellow-500',
-                unavailable: 'text-gray-400',
-                inactive: 'text-gray-400',
-                out_of_service: 'text-red-500',
-            },
-            title: (vehicle) =>
-                first(vehicle, 'displayName', 'display_name', 'name', 'yearMakeModel', 'public_id') ?? join([get(vehicle, 'year'), get(vehicle, 'make'), get(vehicle, 'model')]),
-            identifier: (vehicle) => first(vehicle, 'plate_number', 'call_sign', 'vin', 'serial_number'),
-            image: (vehicle) => photo(vehicle, 'vehicle'),
-            online: (vehicle) => {
-                const online = get(vehicle, 'online');
-
-                return typeof online === 'boolean' ? online : undefined;
-            },
-            status: (vehicle) => first(vehicle, 'status'),
-            badges: (vehicle) => {
-                const driver = relation(owner, vehicle, 'driver');
-
-                return badges(
-                    badge('plate', 'id-card', first(vehicle, 'plate_number', 'call_sign', 'vehicle_number')),
-                    badge('driver', 'user', first(driver, 'name', 'displayName') ?? first(vehicle, 'driver_name'), {
-                        relatedType: 'driver',
-                        relatedId: driver?.id ?? get(vehicle, 'driver_uuid'),
-                    })
-                );
-            },
-            selectDetails: (vehicle) => [first(vehicle, 'plate_number', 'vin', 'serial_number', 'call_sign'), first(vehicle, 'driver_name')],
-            facts: (vehicle) => {
-                const driver = relation(owner, vehicle, 'driver');
-                const trailers = relation(owner, vehicle, 'trailers');
-                const trailer = trailers && typeof trailers.objectAt === 'function' ? trailers.objectAt(0) : Array.isArray(trailers) ? trailers[0] : null;
-                const extra = trailers?.length > 1 ? ` (+${trailers.length - 1})` : '';
-
-                return [
-                    fact('make-model', join([get(vehicle, 'year'), get(vehicle, 'make'), get(vehicle, 'model'), get(vehicle, 'trim')])),
-                    fact('plate', join([first(vehicle, 'plate_number'), first(vehicle, 'vin')], ' · ')),
-                    relatedFact('driver', driver, 'driver', first(vehicle, 'driver_name')),
-                    trailer ? { ...relatedFact('trailer', trailer, 'trailer', first(trailer, 'displayName', 'display_name', 'name')), suffix: extra } : fact('trailer', null),
-                    fact('odometer', present(get(vehicle, 'odometer')) ? join([get(vehicle, 'odometer'), get(vehicle, 'odometer_unit')]) : null),
-                    fact('status', first(vehicle, 'status'), { format: 'humanize' }),
-                ];
-            },
-            open: panelOpener(owner, 'vehicle-actions'),
-            components: { identity: 'cell/vehicle-identity' },
-        },
+        ...sharedDescriptors(owner, ['vehicle']),
         {
             key: 'trailer',
             labelKey: 'resource.trailer',
diff --git a/addon/utils/resource-descriptors/helpers.js b/addon/utils/resource-descriptors/helpers.js
index ce786123f..8d2065ad6 100644
--- a/addon/utils/resource-descriptors/helpers.js
+++ b/addon/utils/resource-descriptors/helpers.js
@@ -1,59 +1,29 @@
-import formatDate from '@fleetbase/ember-ui/utils/format-date';
-import { get } from '@ember/object';
-import { getPlaceholderImage, resolveResourceImage } from '../placeholder-images';
+import { first, relation } from '@fleetbase/fleetops-data/utils/resource-descriptors/helpers';
 
 /**
- * Small building blocks the FleetOps descriptors share. They are written
- * against attribute names, so an identity stub or an API payload renders
- * the same as an Ember Data record.
+ * The building blocks the FleetOps descriptors share. The ones a descriptor
+ * needs to read a record live in `@fleetbase/fleetops-data`, so the shared
+ * resources render the same in every extension; this module re-exports them
+ * and adds the openers that only make sense with the FleetOps engine's own
+ * services and routes.
  */
-
-export function present(value) {
-    return value !== undefined && value !== null && String(value).trim() !== '';
-}
-
-/** The first present value at any of the paths. */
-export function first(record, ...paths) {
-    if (!record) {
-        return null;
-    }
-
-    for (const path of paths) {
-        const value = get(record, path);
-
-        if (present(value)) {
-            return value;
-        }
-    }
-
-    return null;
-}
-
-/** A related record read through its reference, never a promise proxy. */
-export function relation(owner, record, name) {
-    const registry = owner?.lookup?.('service:resource-registry');
-
-    if (registry && typeof registry.relationValue === 'function') {
-        return registry.relationValue(record, name);
-    }
-
-    const value = record ? get(record, name) : null;
-
-    if (value && typeof value === 'object' && typeof value.then === 'function') {
-        return value.content ?? null;
-    }
-
-    return value ?? null;
-}
-
-/** A photo with the styled placeholder as fallback. */
-export function photo(record, type, path = 'photo_url') {
-    return { url: resolveResourceImage(get(record, path), type), fallback: getPlaceholderImage(type), shape: type === 'vehicle' || type === 'trailer' ? 'square' : 'round' };
-}
-
-export function icon(name, iconClass) {
-    return iconClass ? { icon: name, iconClass } : { icon: name };
-}
+export {
+    present,
+    first,
+    lookupService,
+    relation,
+    photo,
+    icon,
+    badge,
+    badges,
+    fact,
+    relatedFact,
+    dateLabel,
+    typeLabel,
+    money,
+    join,
+    polymorphicType,
+} from '@fleetbase/fleetops-data/utils/resource-descriptors/helpers';
 
 /** A coloured tile for records that carry their own colour (service areas, zones). */
 export function colourTile(record, name) {
@@ -62,75 +32,6 @@ export function colourTile(record, name) {
     return colour ? { icon: name, iconClass: 'resource-colour-tile', colour } : { icon: name };
 }
 
-export function badge(key, iconName, label, extra = {}) {
-    return present(label) ? { key, icon: iconName, label, ...extra } : null;
-}
-
-export function badges(...list) {
-    return list.filter(Boolean);
-}
-
-export function fact(label, value, extra = {}) {
-    return { labelKey: `resource-summary.facts.${label}`, value, ...extra };
-}
-
-/** A fact that renders as the related record's pill when the record is loaded. */
-export function relatedFact(label, related, relatedType, fallbackValue) {
-    return { labelKey: `resource-summary.facts.${label}`, related: related ?? null, relatedType, value: fallbackValue ?? null };
-}
-
-/**
- * A date the way the console writes one everywhere else (date-fns, not the
- * browser locale), or null for anything that is not a date.
- */
-export function dateLabel(value, pattern = 'dd MMM yyyy, HH:mm') {
-    if (!present(value)) {
-        return null;
-    }
-
-    const date = value instanceof Date ? value : new Date(value);
-
-    return Number.isNaN(date.getTime()) ? null : formatDate(date, pattern);
-}
-
-/**
- * A contact's type the way a person reads it: "customer-fleet-ops:contact"
- * and "customer" both become "Customer"; anything unreadable becomes null.
- */
-export function typeLabel(value) {
-    if (!present(value)) {
-        return null;
-    }
-
-    const head = String(value)
-        .split(':')[0]
-        .replace(/-fleet-ops$/, '')
-        .replace(/[-_]+/g, ' ')
-        .trim();
-
-    return head ? head.charAt(0).toUpperCase() + head.slice(1) : null;
-}
-
-export function money(amount, currency) {
-    if (!present(amount)) {
-        return null;
-    }
-
-    return present(currency) ? `${amount} ${currency}` : String(amount);
-}
-
-export function join(parts, separator = ' ') {
-    return parts.filter(present).join(separator) || null;
-}
-
-/** The resolved `*_type` for a polymorphic relation, from the record or a `_type` attribute. */
-export function polymorphicType(record, relationName, typeAttr) {
-    const related = record ? get(record, relationName) : null;
-    const modelName = related?.constructor?.modelName ?? related?.content?.constructor?.modelName;
-
-    return modelName ?? (typeAttr ? get(record, typeAttr) : null) ?? null;
-}
-
 /**
  * An opener that hands the record to an action service's context panel,
  * falling back to its route transition. Resolved lazily from the engine
diff --git a/addon/utils/resource-descriptors/operations.js b/addon/utils/resource-descriptors/operations.js
index 6247438b9..ed6721e4c 100644
--- a/addon/utils/resource-descriptors/operations.js
+++ b/addon/utils/resource-descriptors/operations.js
@@ -1,5 +1,6 @@
 import { get } from '@ember/object';
 import { first, present, relation, icon, colourTile, fact, relatedFact, money, join, panelOpener, routeOpener, polymorphicType, dateLabel } from './helpers';
+import { sharedDescriptors } from './shared';
 
 /**
  * Places, orders, order configs, service rates, service areas, zones,
@@ -7,67 +8,7 @@ import { first, present, relation, icon, colourTile, fact, relatedFact, money, j
  */
 export default function buildOperationsDescriptors(owner) {
     return [
-        {
-            key: 'place',
-            labelKey: 'resource.place',
-            icon: 'location-dot',
-            modelNames: ['place'],
-            polymorphicTypes: ['fleet-ops:place', 'Fleetbase\\FleetOps\\Models\\Place'],
-            permission: 'fleet-ops view place',
-            title: (place) => first(place, 'displayName', 'name', 'address', 'street1', 'public_id'),
-            identifier: (place) => join([first(place, 'city'), first(place, 'country')], ', ') ?? first(place, 'public_id'),
-            image: () => icon('location-dot'),
-            selectDetails: (place) => [first(place, 'address', 'street1'), join([first(place, 'city'), first(place, 'country')], ', ')],
-            facts: (place) => [
-                fact('address', first(place, 'address', 'street1')),
-                fact('phone', first(place, 'phone')),
-                fact('type', first(place, 'type'), { format: 'humanize' }),
-                relatedFact('vendor', relation(owner, place, 'vendor'), 'vendor', first(place, 'vendor_name')),
-                fact('coordinates', first(place, 'positionString') ?? (present(get(place, 'latitude')) ? `${get(place, 'latitude')}, ${get(place, 'longitude')}` : null)),
-            ],
-            open: panelOpener(owner, 'place-actions'),
-        },
-        {
-            key: 'order',
-            labelKey: 'resource.order',
-            icon: 'box',
-            modelNames: ['order'],
-            polymorphicTypes: ['fleet-ops:order', 'Fleetbase\\FleetOps\\Models\\Order'],
-            permission: 'fleet-ops view order',
-            statusTones: {
-                created: 'text-gray-400',
-                preparing: 'text-yellow-500',
-                dispatched: 'text-yellow-500',
-                started: 'text-yellow-500',
-                in_progress: 'text-yellow-500',
-                enroute: 'text-yellow-500',
-                completed: 'text-green-500',
-                delivered: 'text-green-500',
-                canceled: 'text-red-500',
-                cancelled: 'text-red-500',
-                failed: 'text-red-500',
-            },
-            title: (order) => first(order, 'tracking', 'tracking_number.tracking_number', 'public_id'),
-            identifier: (order) => first(order, 'public_id', 'internal_id'),
-            image: () => icon('box'),
-            status: (order) => first(order, 'status'),
-            selectDetails: (order) => [first(order, 'public_id'), first(order, 'status')],
-            facts: (order) => [
-                fact('status', first(order, 'status'), { format: 'humanize' }),
-                relatedFact('customer', relation(owner, order, 'customer'), polymorphicType(order, 'customer', 'customer_type'), first(order, 'customer_name')),
-                relatedFact('driver', relation(owner, order, 'driver_assigned'), 'driver', first(order, 'driver_name')),
-                fact('route', join([first(order, 'pickupName', 'pickup_name'), first(order, 'dropoffName', 'dropoff_name')], ' → ')),
-                fact('scheduled', get(order, 'scheduled_at'), { format: 'date' }),
-                fact('order-config', first(order, 'order_config.name', 'type')),
-            ],
-            open: (order) => {
-                if (!order || order.isIdentityStub || !first(order, 'id', 'uuid')) {
-                    return false;
-                }
-
-                return panelOpener(owner, 'order-actions')(order);
-            },
-        },
+        ...sharedDescriptors(owner, ['place', 'order']),
         {
             key: 'order-config',
             labelKey: 'resource.order-config',
diff --git a/addon/utils/resource-descriptors/people.js b/addon/utils/resource-descriptors/people.js
index 7a8eec6bc..926ce1014 100644
--- a/addon/utils/resource-descriptors/people.js
+++ b/addon/utils/resource-descriptors/people.js
@@ -1,88 +1,13 @@
 import { get } from '@ember/object';
-import { first, present, relation, photo, badge, badges, fact, relatedFact, join, panelOpener, dateLabel, typeLabel } from './helpers';
+import { first, photo, fact, panelOpener } from './helpers';
+import { sharedDescriptors } from './shared';
 
 /**
  * Drivers, vendors, contacts, customers and fleets.
  */
 export default function buildPeopleDescriptors(owner) {
     return [
-        {
-            key: 'driver',
-            labelKey: 'resource.driver',
-            icon: 'id-card',
-            modelNames: ['driver'],
-            aliases: ['attachable-driver', 'facilitator-driver', 'fleet-driver'],
-            polymorphicTypes: ['fleet-ops:driver', 'Fleetbase\\FleetOps\\Models\\Driver'],
-            permission: 'fleet-ops view driver',
-            statusTones: {
-                available: 'text-green-500',
-                active: 'text-green-500',
-                on_duty: 'text-green-500',
-                busy: 'text-yellow-500',
-                assigned: 'text-yellow-500',
-                unavailable: 'text-gray-400',
-                offline: 'text-gray-400',
-                suspended: 'text-red-500',
-            },
-            title: (driver) => first(driver, 'name', 'displayName', 'display_name', 'public_id'),
-            identifier: (driver) => first(driver, 'phone', 'email'),
-            image: (driver) => photo(driver, 'driver'),
-            online: (driver) => {
-                const online = get(driver, 'online');
-
-                return typeof online === 'boolean' ? online : undefined;
-            },
-            status: (driver) => first(driver, 'status'),
-            badges: (driver) => {
-                const vehicle = relation(owner, driver, 'vehicle');
-                const label = first(vehicle, 'displayName', 'display_name', 'name') ?? first(driver, 'vehicle_assigned.display_name', 'vehicle_name');
-
-                return badges(badge('vehicle', 'car', label, { relatedType: 'vehicle', relatedId: vehicle?.id ?? get(driver, 'vehicle_uuid') }));
-            },
-            selectDetails: (driver) => [first(driver, 'phone'), first(driver, 'email')],
-            facts: (driver) => [
-                fact('phone', first(driver, 'phone')),
-                fact('email', first(driver, 'email')),
-                relatedFact('vehicle', relation(owner, driver, 'vehicle'), 'vehicle', first(driver, 'vehicle_name')),
-                fact(
-                    'licence',
-                    join(
-                        [
-                            first(driver, 'drivers_license_number'),
-                            dateLabel(get(driver, 'license_expiry'), 'dd MMM yyyy') ? `expires ${dateLabel(get(driver, 'license_expiry'), 'dd MMM yyyy')}` : null,
-                        ],
-                        ' · '
-                    )
-                ),
-                relatedFact('vendor', relation(owner, driver, 'vendor'), 'vendor', first(driver, 'vendor_name')),
-                fact('status', first(driver, 'status'), { format: 'humanize' }),
-            ],
-            open: panelOpener(owner, 'driver-actions'),
-            components: { identity: 'cell/driver-identity' },
-        },
-        {
-            key: 'vendor',
-            labelKey: 'resource.vendor',
-            icon: 'building',
-            modelNames: ['vendor'],
-            aliases: ['facilitator-vendor', 'customer-vendor'],
-            polymorphicTypes: ['fleet-ops:vendor', 'Fleetbase\\FleetOps\\Models\\Vendor'],
-            permission: 'fleet-ops view vendor',
-            title: (vendor) => first(vendor, 'name', 'public_id'),
-            identifier: (vendor) => first(vendor, 'prettyType', 'internal_id', 'business_id'),
-            image: (vendor) => photo(vendor, 'vendor', 'logo_url'),
-            status: (vendor) => first(vendor, 'status'),
-            selectDetails: (vendor) => [first(vendor, 'email'), first(vendor, 'phone')],
-            facts: (vendor) => [
-                fact('type', first(vendor, 'prettyType', 'type'), { format: 'humanize' }),
-                fact('email', first(vendor, 'email')),
-                fact('phone', first(vendor, 'phone')),
-                fact('website', first(vendor, 'website_url')),
-                fact('address', first(vendor, 'address', 'place.address', 'address_street')),
-                fact('country', first(vendor, 'country')),
-            ],
-            open: panelOpener(owner, 'vendor-actions'),
-        },
+        ...sharedDescriptors(owner, ['driver', 'vendor', 'contact', 'customer', 'fleet']),
         {
             key: 'integrated-vendor',
             labelKey: 'resource.integrated-vendor',
@@ -105,69 +30,5 @@ export default function buildPeopleDescriptors(owner) {
             ],
             open: panelOpener(owner, 'integrated-vendor-actions'),
         },
-        {
-            key: 'contact',
-            labelKey: 'resource.contact',
-            icon: 'address-book',
-            modelNames: ['contact'],
-            aliases: ['facilitator-contact', 'customer-contact'],
-            polymorphicTypes: ['fleet-ops:contact', 'Fleetbase\\FleetOps\\Models\\Contact'],
-            permission: 'fleet-ops view contact',
-            title: (contact) => first(contact, 'name', 'public_id'),
-            identifier: (contact) => first(contact, 'title') ?? typeLabel(first(contact, 'type')),
-            image: (contact) => photo(contact, 'contact'),
-            selectDetails: (contact) => [first(contact, 'email'), first(contact, 'phone')],
-            facts: (contact) => [
-                fact('title', first(contact, 'title')),
-                fact('email', first(contact, 'email')),
-                fact('phone', first(contact, 'phone')),
-                relatedFact('place', relation(owner, contact, 'place'), 'place', first(contact, 'address', 'place.address')),
-                relatedFact('user', relation(owner, contact, 'user'), 'user', first(contact, 'user.name')),
-            ],
-            open: panelOpener(owner, 'contact-actions'),
-        },
-        {
-            key: 'customer',
-            labelKey: 'resource.customer',
-            icon: 'user-tag',
-            modelNames: ['customer'],
-            aliases: ['facilitator-customer'],
-            polymorphicTypes: ['fleet-ops:customer', 'Fleetbase\\FleetOps\\Models\\Customer'],
-            permission: 'fleet-ops view contact',
-            title: (customer) => first(customer, 'name', 'public_id'),
-            identifier: (customer) => typeLabel(first(customer, 'customer_type', 'type')) ?? 'Customer',
-            image: (customer) => photo(customer, 'customer'),
-            selectDetails: (customer) => [first(customer, 'email'), first(customer, 'phone')],
-            facts: (customer) => [
-                fact('type', typeLabel(first(customer, 'customer_type', 'type'))),
-                fact('email', first(customer, 'email')),
-                fact('phone', first(customer, 'phone')),
-                fact('address', first(customer, 'address', 'address_street')),
-                relatedFact('place', relation(owner, customer, 'place'), 'place', first(customer, 'place.address')),
-            ],
-            open: panelOpener(owner, 'customer-actions'),
-        },
-        {
-            key: 'fleet',
-            labelKey: 'resource.fleet',
-            icon: 'layer-group',
-            modelNames: ['fleet'],
-            polymorphicTypes: ['fleet-ops:fleet', 'Fleetbase\\FleetOps\\Models\\Fleet'],
-            permission: 'fleet-ops view fleet',
-            title: (fleet) => first(fleet, 'name', 'public_id'),
-            identifier: (fleet) => first(fleet, 'task', 'public_id'),
-            image: (fleet) => photo(fleet, 'fleet'),
-            status: (fleet) => first(fleet, 'status'),
-            selectDetails: (fleet) => [first(fleet, 'task'), present(get(fleet, 'drivers_count')) ? `${get(fleet, 'drivers_count')} drivers` : null],
-            facts: (fleet) => [
-                fact('task', first(fleet, 'task')),
-                relatedFact('service-area', relation(owner, fleet, 'service_area'), 'service-area', first(fleet, 'service_area.name')),
-                relatedFact('zone', relation(owner, fleet, 'zone'), 'zone', first(fleet, 'zone.name')),
-                relatedFact('vendor', relation(owner, fleet, 'vendor'), 'vendor', first(fleet, 'vendor.name')),
-                fact('drivers', present(get(fleet, 'drivers_count')) ? `${get(fleet, 'drivers_online_count') ?? 0} online of ${get(fleet, 'drivers_count')}` : null),
-                fact('vehicles', present(get(fleet, 'vehicles_count')) ? `${get(fleet, 'vehicles_online_count') ?? 0} online of ${get(fleet, 'vehicles_count')}` : null),
-            ],
-            open: panelOpener(owner, 'fleet-actions'),
-        },
     ];
 }
diff --git a/addon/utils/resource-descriptors/shared.js b/addon/utils/resource-descriptors/shared.js
new file mode 100644
index 000000000..52996a19f
--- /dev/null
+++ b/addon/utils/resource-descriptors/shared.js
@@ -0,0 +1,18 @@
+import { buildSharedResourceDescriptors, guardOrder } from '@fleetbase/fleetops-data/utils/resource-descriptors';
+import { panelOpener } from './helpers';
+
+/**
+ * The descriptors `@fleetbase/fleetops-data` shares with every extension,
+ * opened through this engine's own action services instead of through a
+ * lazy engine load: inside FleetOps the services are already here, and the
+ * registry keeps these richer versions over the shared ones.
+ */
+export function sharedDescriptors(owner, keys) {
+    const byKey = Object.fromEntries(buildSharedResourceDescriptors(owner).map((descriptor) => [descriptor.key, descriptor]));
+
+    return keys.map((key) => {
+        const open = panelOpener(owner, `${key}-actions`);
+
+        return { ...byKey[key], canOpen: undefined, open: key === 'order' ? guardOrder(open) : open };
+    });
+}
diff --git a/app/components/cell/contact-identity.js b/app/components/cell/contact-identity.js
deleted file mode 100644
index 1376da5c5..000000000
--- a/app/components/cell/contact-identity.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/cell/contact-identity';
diff --git a/app/components/cell/customer-identity.js b/app/components/cell/customer-identity.js
deleted file mode 100644
index c6c49f586..000000000
--- a/app/components/cell/customer-identity.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/cell/customer-identity';
diff --git a/app/components/cell/driver-identity.js b/app/components/cell/driver-identity.js
deleted file mode 100644
index b5d3ccad4..000000000
--- a/app/components/cell/driver-identity.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/cell/driver-identity';
diff --git a/app/components/cell/fleet-identity.js b/app/components/cell/fleet-identity.js
deleted file mode 100644
index 68a9502ea..000000000
--- a/app/components/cell/fleet-identity.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/cell/fleet-identity';
diff --git a/app/components/cell/order-identity.js b/app/components/cell/order-identity.js
deleted file mode 100644
index 76de50a6a..000000000
--- a/app/components/cell/order-identity.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/cell/order-identity';
diff --git a/app/components/cell/place-identity.js b/app/components/cell/place-identity.js
deleted file mode 100644
index 839bb7cfb..000000000
--- a/app/components/cell/place-identity.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/cell/place-identity';
diff --git a/app/components/cell/vehicle-identity.js b/app/components/cell/vehicle-identity.js
deleted file mode 100644
index 75d5c291b..000000000
--- a/app/components/cell/vehicle-identity.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/cell/vehicle-identity';
diff --git a/app/components/cell/vendor-identity.js b/app/components/cell/vendor-identity.js
deleted file mode 100644
index f950c37d3..000000000
--- a/app/components/cell/vendor-identity.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/cell/vendor-identity';
diff --git a/app/components/contact/pill.js b/app/components/contact/pill.js
deleted file mode 100644
index 0750ead81..000000000
--- a/app/components/contact/pill.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/contact/pill';
diff --git a/app/components/contact/summary.js b/app/components/contact/summary.js
deleted file mode 100644
index cd939f193..000000000
--- a/app/components/contact/summary.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/contact/summary';
diff --git a/app/components/customer/pill.js b/app/components/customer/pill.js
deleted file mode 100644
index 52396929a..000000000
--- a/app/components/customer/pill.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/customer/pill';
diff --git a/app/components/customer/summary.js b/app/components/customer/summary.js
deleted file mode 100644
index 015e5e9a3..000000000
--- a/app/components/customer/summary.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/customer/summary';
diff --git a/app/components/driver/pill.js b/app/components/driver/pill.js
deleted file mode 100644
index b83229abd..000000000
--- a/app/components/driver/pill.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/driver/pill';
diff --git a/app/components/driver/summary.js b/app/components/driver/summary.js
deleted file mode 100644
index e5f6dea18..000000000
--- a/app/components/driver/summary.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/driver/summary';
diff --git a/app/components/fleet/pill.js b/app/components/fleet/pill.js
deleted file mode 100644
index 6035f0a78..000000000
--- a/app/components/fleet/pill.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/fleet/pill';
diff --git a/app/components/fleet/summary.js b/app/components/fleet/summary.js
deleted file mode 100644
index 1e6ad64c2..000000000
--- a/app/components/fleet/summary.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/fleet/summary';
diff --git a/app/components/order/pill.js b/app/components/order/pill.js
deleted file mode 100644
index 25f6c506a..000000000
--- a/app/components/order/pill.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/order/pill';
diff --git a/app/components/order/summary.js b/app/components/order/summary.js
deleted file mode 100644
index f9fb14c7d..000000000
--- a/app/components/order/summary.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/order/summary';
diff --git a/app/components/place/pill.js b/app/components/place/pill.js
deleted file mode 100644
index 81613fc7f..000000000
--- a/app/components/place/pill.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/place/pill';
diff --git a/app/components/place/summary.js b/app/components/place/summary.js
deleted file mode 100644
index f76f00435..000000000
--- a/app/components/place/summary.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/place/summary';
diff --git a/app/components/select-option/contact.js b/app/components/select-option/contact.js
deleted file mode 100644
index eb901f6c2..000000000
--- a/app/components/select-option/contact.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/select-option/contact';
diff --git a/app/components/select-option/customer.js b/app/components/select-option/customer.js
deleted file mode 100644
index 6cfc77a27..000000000
--- a/app/components/select-option/customer.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/select-option/customer';
diff --git a/app/components/select-option/driver.js b/app/components/select-option/driver.js
deleted file mode 100644
index 85f6b655b..000000000
--- a/app/components/select-option/driver.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/select-option/driver';
diff --git a/app/components/select-option/fleet.js b/app/components/select-option/fleet.js
deleted file mode 100644
index e2a5c0d97..000000000
--- a/app/components/select-option/fleet.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/select-option/fleet';
diff --git a/app/components/select-option/order.js b/app/components/select-option/order.js
deleted file mode 100644
index 0cdbb5fb1..000000000
--- a/app/components/select-option/order.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/select-option/order';
diff --git a/app/components/select-option/place.js b/app/components/select-option/place.js
deleted file mode 100644
index 3616ffca7..000000000
--- a/app/components/select-option/place.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/select-option/place';
diff --git a/app/components/select-option/vehicle.js b/app/components/select-option/vehicle.js
deleted file mode 100644
index faa85864d..000000000
--- a/app/components/select-option/vehicle.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/select-option/vehicle';
diff --git a/app/components/select-option/vendor.js b/app/components/select-option/vendor.js
deleted file mode 100644
index 7c771c3ff..000000000
--- a/app/components/select-option/vendor.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/select-option/vendor';
diff --git a/app/components/vehicle/pill.js b/app/components/vehicle/pill.js
deleted file mode 100644
index c1dcb8086..000000000
--- a/app/components/vehicle/pill.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/vehicle/pill';
diff --git a/app/components/vehicle/summary.js b/app/components/vehicle/summary.js
deleted file mode 100644
index 261636caa..000000000
--- a/app/components/vehicle/summary.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/vehicle/summary';
diff --git a/app/components/vendor/pill.js b/app/components/vendor/pill.js
deleted file mode 100644
index da3df5298..000000000
--- a/app/components/vendor/pill.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/vendor/pill';
diff --git a/app/components/vendor/summary.js b/app/components/vendor/summary.js
deleted file mode 100644
index 635d4c80e..000000000
--- a/app/components/vendor/summary.js
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from '@fleetbase/fleetops-engine/components/vendor/summary';

From 0350439c0f85725efb71eba4526a1ce8d5cba7f4 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Fri, 9 Oct 2026 17:20:02 +0800
Subject: [PATCH 29/87] refactor(identity-stub): build identity stubs from
 fleetops-data

---
 addon/utils/identity-cell-resource.js | 58 +--------------------------
 1 file changed, 2 insertions(+), 56 deletions(-)

diff --git a/addon/utils/identity-cell-resource.js b/addon/utils/identity-cell-resource.js
index a0fadc771..3460be6c5 100644
--- a/addon/utils/identity-cell-resource.js
+++ b/addon/utils/identity-cell-resource.js
@@ -1,5 +1,7 @@
 import { get } from '@ember/object';
 
+export { buildIdentityStub } from '@fleetbase/fleetops-data/utils/identity-stub';
+
 export function resolveIdentityCellResource(args) {
     const column = args.column ?? {};
     const resourcePath = column.resourcePath;
@@ -18,59 +20,3 @@ export function resolveIdentityCellResource(args) {
 
     return args.row;
 }
-
-const inflight = new WeakMap();
-
-/**
- * A stand-in for a related record a row only knows by name: enough for an
- * identity cell to render (`name`, `resourceType`) and a `loadResource()`
- * the cell, pill or summary calls when the real record is needed. The
- * stub never carries a UUID in an identifier field, so nothing renders one
- * as a plate or an id, and concurrent loads of the same row share one
- * request.
- *
- * `load` receives the row and returns the record (or a promise of it); with
- * no `load`, `loadResource()` resolves to null and the stub stays static.
- */
-export function buildIdentityStub(row, { type, nameKey = `${type}_name`, name, load, extra = {} } = {}) {
-    const label = name ?? (row ? get(row, nameKey) : null);
-
-    if (!label) {
-        return null;
-    }
-
-    const stub = {
-        ...extra,
-        name: label,
-        display_name: label,
-        displayName: label,
-        resourceType: type,
-        isIdentityStub: true,
-        loadResource: async () => {
-            if (typeof load !== 'function') {
-                return null;
-            }
-
-            let loads = inflight.get(row);
-
-            if (!loads) {
-                loads = new Map();
-                inflight.set(row, loads);
-            }
-
-            if (!loads.has(type)) {
-                loads.set(
-                    type,
-                    Promise.resolve()
-                        .then(() => load(row))
-                        .catch(() => null)
-                        .finally(() => loads.delete(type))
-                );
-            }
-
-            return loads.get(type);
-        },
-    };
-
-    return stub;
-}

From d88257cb03a0813d5034e0b54290aac149596376 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Sat, 10 Oct 2026 21:17:38 +0800
Subject: [PATCH 30/87] fix(telematics): the retention pruner no longer scans
 the whole device_events table every run

fleetops:prune-telematics-data ran every 15 minutes and, on a 2.3M-row device_events table, held the database for minutes per batch even though every telematics connection was inactive and nothing was left to prune:

- batches were ordered by id while the scope ranged over created_at, so MySQL walked the primary key instead of the (company_uuid, created_at) retention index; batches now order by the ranged column
- the orphan scope was 'company_uuid IS NULL OR NOT IN (select uuid from companies)', which cannot use an index; the gone company uuids are now resolved once per table from a grouped index scan and the scope becomes IS NULL / IN (...)
- the compaction sweep re-read every already-compacted row on every run; a per-scope watermark (cache) now limits it to rows that aged into the window since the last complete sweep
- the soft-deleted purge had no index on deleted_at; two migrations add (company_uuid, deleted_at) on device_events and positions

Polling itself was already correct: fleetops:sync-telematics only queues connections in active/connected states.
---
 ...001_add_trashed_index_to_device_events.php |  40 ++++++
 ..._000002_add_trashed_index_to_positions.php |  40 ++++++
 .../Console/Commands/PruneTelematicsData.php  | 127 ++++++++++++++----
 3 files changed, 181 insertions(+), 26 deletions(-)
 create mode 100644 server/migrations/2026_10_10_000001_add_trashed_index_to_device_events.php
 create mode 100644 server/migrations/2026_10_10_000002_add_trashed_index_to_positions.php

diff --git a/server/migrations/2026_10_10_000001_add_trashed_index_to_device_events.php b/server/migrations/2026_10_10_000001_add_trashed_index_to_device_events.php
new file mode 100644
index 000000000..8e08ecf34
--- /dev/null
+++ b/server/migrations/2026_10_10_000001_add_trashed_index_to_device_events.php
@@ -0,0 +1,40 @@
+<?php
+
+use Fleetbase\FleetOps\Support\Database\TableIndexes;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * fleetops:prune-telematics-data purges soft-deleted rows on every run; without an
+ * index on deleted_at that sweep walks the whole table even when nothing is trashed.
+ */
+return new class extends Migration {
+    private const TABLE   = 'device_events';
+    private const INDEX   = 'device_events_company_deleted_at_index';
+    private const COLUMNS = ['company_uuid', 'deleted_at'];
+
+    public function up(): void
+    {
+        if (!Schema::hasTable(self::TABLE) || !Schema::hasColumns(self::TABLE, self::COLUMNS)) {
+            return;
+        }
+
+        if (TableIndexes::covers(self::TABLE, self::COLUMNS)) {
+            return;
+        }
+
+        Schema::table(self::TABLE, fn (Blueprint $table) => $table->index(self::COLUMNS, self::INDEX));
+    }
+
+    public function down(): void
+    {
+        if (!Schema::hasTable(self::TABLE)) {
+            return;
+        }
+
+        if ((TableIndexes::for(self::TABLE)[self::INDEX] ?? null) === self::COLUMNS) {
+            Schema::table(self::TABLE, fn (Blueprint $table) => $table->dropIndex(self::INDEX));
+        }
+    }
+};
diff --git a/server/migrations/2026_10_10_000002_add_trashed_index_to_positions.php b/server/migrations/2026_10_10_000002_add_trashed_index_to_positions.php
new file mode 100644
index 000000000..3c2246f1c
--- /dev/null
+++ b/server/migrations/2026_10_10_000002_add_trashed_index_to_positions.php
@@ -0,0 +1,40 @@
+<?php
+
+use Fleetbase\FleetOps\Support\Database\TableIndexes;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * fleetops:prune-telematics-data purges soft-deleted rows on every run; without an
+ * index on deleted_at that sweep walks the whole table even when nothing is trashed.
+ */
+return new class extends Migration {
+    private const TABLE   = 'positions';
+    private const INDEX   = 'positions_company_deleted_at_index';
+    private const COLUMNS = ['company_uuid', 'deleted_at'];
+
+    public function up(): void
+    {
+        if (!Schema::hasTable(self::TABLE) || !Schema::hasColumns(self::TABLE, self::COLUMNS)) {
+            return;
+        }
+
+        if (TableIndexes::covers(self::TABLE, self::COLUMNS)) {
+            return;
+        }
+
+        Schema::table(self::TABLE, fn (Blueprint $table) => $table->index(self::COLUMNS, self::INDEX));
+    }
+
+    public function down(): void
+    {
+        if (!Schema::hasTable(self::TABLE)) {
+            return;
+        }
+
+        if ((TableIndexes::for(self::TABLE)[self::INDEX] ?? null) === self::COLUMNS) {
+            Schema::table(self::TABLE, fn (Blueprint $table) => $table->dropIndex(self::INDEX));
+        }
+    }
+};
diff --git a/server/src/Console/Commands/PruneTelematicsData.php b/server/src/Console/Commands/PruneTelematicsData.php
index 492003f11..7422168c7 100644
--- a/server/src/Console/Commands/PruneTelematicsData.php
+++ b/server/src/Console/Commands/PruneTelematicsData.php
@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Console\Commands;
 
+use Carbon\Carbon;
 use Fleetbase\FleetOps\Support\Telematics\Retention\RetentionPolicy;
 use Illuminate\Console\Command;
 use Illuminate\Support\Collection;
@@ -21,6 +22,9 @@ class PruneTelematicsData extends Command
 
     public const LOCK = 'fleetops:prune-telematics-data';
 
+    /** Cache key prefix for the per-scope compaction watermark (see pruneDeviceEvents). */
+    public const WATERMARK_PREFIX = 'fleetops:prune-telematics-data:compacted:';
+
     protected $signature = 'fleetops:prune-telematics-data
         {--company= : Only prune data for this company (uuid or public id)}
         {--orphans-only : Only prune data without an existing company or connection}
@@ -36,6 +40,9 @@ class PruneTelematicsData extends Command
     protected int $maxBatches = 50;
     protected bool $dryRun    = false;
 
+    /** table => company uuids present in that table whose company no longer exists; resolved once per run. */
+    protected array $orphanCompaniesByTable = [];
+
     public function handle(): int
     {
         $tables = $this->requestedTables();
@@ -142,7 +149,7 @@ protected function pruneCompany(string $companyUuid, RetentionPolicy $policy, ar
         }
         $inbox = $telematics ? fn ($query) => $query->whereIn('telematic_uuid', $telematics) : null;
 
-        return $this->prune($rows, $inbox, $policy, $tables);
+        return $this->prune($rows, $inbox, $policy, $tables, $companyUuid);
     }
 
     /**
@@ -150,9 +157,7 @@ protected function pruneCompany(string $companyUuid, RetentionPolicy $policy, ar
      */
     protected function pruneOrphans(RetentionPolicy $policy, array $tables): array
     {
-        $rows = fn ($query) => $query->where(function ($where) {
-            $where->whereNull('company_uuid')->orWhereNotIn('company_uuid', DB::table('companies')->select('uuid'));
-        });
+        $rows  = fn ($query) => $this->scopeOrphanRows($query);
         $inbox = fn ($query) => $query->whereNotExists(function ($connections) use ($query) {
             $connections->selectRaw('1')
                 ->from('telematics')
@@ -160,14 +165,46 @@ protected function pruneOrphans(RetentionPolicy $policy, array $tables): array
                 ->whereColumn('telematics.uuid', $query->from . '.telematic_uuid');
         });
 
-        return $this->prune($rows, $inbox, $policy, $tables);
+        return $this->prune($rows, $inbox, $policy, $tables, 'orphans');
+    }
+
+    /**
+     * Rows without a company, plus rows whose company uuid no longer exists. The gone
+     * companies are resolved once per table from the distinct company uuids it holds, so
+     * every batch ranges over the (company_uuid, created_at) index instead of evaluating
+     * a NOT IN subquery against every row.
+     */
+    protected function scopeOrphanRows($query)
+    {
+        $table = $query->from;
+        $gone  = $this->orphanCompaniesByTable[$table] ??= $this->orphanCompanies($table);
+
+        return $query->where(function ($where) use ($gone) {
+            $where->whereNull('company_uuid');
+            if ($gone !== []) {
+                $where->orWhereIn('company_uuid', $gone);
+            }
+        });
+    }
+
+    /**
+     * @return string[]
+     */
+    protected function orphanCompanies(string $table): array
+    {
+        return DB::table($table)
+            ->whereNotNull('company_uuid')
+            ->whereNotIn('company_uuid', DB::table('companies')->select('uuid'))
+            ->groupBy('company_uuid')
+            ->pluck('company_uuid')
+            ->all();
     }
 
-    protected function prune(\Closure $rows, ?\Closure $inbox, RetentionPolicy $policy, array $tables): array
+    protected function prune(\Closure $rows, ?\Closure $inbox, RetentionPolicy $policy, array $tables, string $scope): array
     {
         $stats = $this->emptyStats();
         if (in_array('device_events', $tables, true)) {
-            $stats['tables']['device_events'] = $this->pruneDeviceEvents($rows, $policy);
+            $stats['tables']['device_events'] = $this->pruneDeviceEvents($rows, $policy, $scope);
         }
         if (in_array('positions', $tables, true)) {
             $stats['tables']['positions'] = $this->prunePositions($rows, $policy);
@@ -188,40 +225,69 @@ protected function prune(\Closure $rows, ?\Closure $inbox, RetentionPolicy $poli
         return $stats;
     }
 
-    protected function pruneDeviceEvents(\Closure $rows, RetentionPolicy $policy): array
+    protected function pruneDeviceEvents(\Closure $rows, RetentionPolicy $policy, string $scope): array
     {
         $stats  = $this->emptyTableStats();
         $cutoff = $policy->cutoff('event_retention_days');
         // Soft-deleted events only grow the table; purge them regardless of age.
-        $this->deleteInBatches('device_events', 'id', fn ($query) => $rows($query)->whereNotNull('deleted_at'), $stats);
+        $this->deleteInBatches('device_events', 'id', fn ($query) => $rows($query)->whereNotNull('deleted_at'), $stats, 'deleted_at');
         if ($cutoff) {
-            $this->deleteInBatches('device_events', 'id', fn ($query) => $rows($query)->where('created_at', '<', $cutoff->toDateTimeString()), $stats);
+            $this->deleteInBatches('device_events', 'id', fn ($query) => $rows($query)->where('created_at', '<', $cutoff->toDateTimeString()), $stats, 'created_at');
         }
         if ($policy->compactsEvents() && ($compactAt = $policy->cutoff('event_compact_after_days'))) {
             // Keep the event (type, severity, location, normalized data) but drop the raw provider blobs.
             // Rows past the delete cutoff are left to the delete sweep rather than rewritten first.
-            $this->updateInBatches(
+            // Everything older than the watermark was compacted by an earlier complete sweep, so
+            // only the rows that aged into the window since then are visited; without it every
+            // run re-scanned the whole history looking for blobs that were already gone.
+            $watermark = $this->compactionWatermark($scope);
+            $since     = $cutoff && (!$watermark || $cutoff->greaterThan($watermark)) ? $cutoff : $watermark;
+            $completed = $this->updateInBatches(
                 'device_events',
                 'id',
-                function ($query) use ($rows, $cutoff, $compactAt) {
+                function ($query) use ($rows, $since, $compactAt) {
                     $query = $rows($query)->where('created_at', '<', $compactAt->toDateTimeString())->where(fn ($where) => $where->whereNotNull('payload')->orWhereNotNull('meta'));
 
-                    return $cutoff ? $query->where('created_at', '>=', $cutoff->toDateTimeString()) : $query;
+                    return $since ? $query->where('created_at', '>=', $since->toDateTimeString()) : $query;
                 },
                 ['payload' => null, 'meta' => null],
-                $stats
+                $stats,
+                'created_at'
             );
+            if ($completed && !$this->dryRun) {
+                $this->rememberCompactionWatermark($scope, $compactAt);
+            }
         }
 
         return $stats;
     }
 
+    protected function compactionWatermark(string $scope): ?Carbon
+    {
+        try {
+            $value = Cache::get(self::WATERMARK_PREFIX . $scope);
+        } catch (\Throwable) {
+            return null;
+        }
+
+        return $value ? Carbon::parse($value) : null;
+    }
+
+    protected function rememberCompactionWatermark(string $scope, Carbon $compactedBefore): void
+    {
+        try {
+            Cache::forever(self::WATERMARK_PREFIX . $scope, $compactedBefore->toDateTimeString());
+        } catch (\Throwable) {
+            // A cache outage only costs the next run a wider scan.
+        }
+    }
+
     protected function prunePositions(\Closure $rows, RetentionPolicy $policy): array
     {
         $stats = $this->emptyTableStats();
-        $this->deleteInBatches('positions', 'id', fn ($query) => $rows($query)->whereNotNull('deleted_at'), $stats);
+        $this->deleteInBatches('positions', 'id', fn ($query) => $rows($query)->whereNotNull('deleted_at'), $stats, 'deleted_at');
         if ($cutoff = $policy->cutoff('position_retention_days')) {
-            $this->deleteInBatches('positions', 'id', fn ($query) => $rows($query)->where('created_at', '<', $cutoff->toDateTimeString()), $stats);
+            $this->deleteInBatches('positions', 'id', fn ($query) => $rows($query)->where('created_at', '<', $cutoff->toDateTimeString()), $stats, 'created_at');
         }
 
         return $stats;
@@ -232,7 +298,7 @@ protected function pruneDeliveries(\Closure $inbox, RetentionPolicy $policy): ar
         $stats = $this->emptyTableStats();
         foreach (['processed' => 'processed_retention_hours', 'quarantined' => 'quarantine_retention_days'] as $status => $key) {
             if ($cutoff = $policy->cutoff($key)) {
-                $this->deleteInBatches('telematic_deliveries', 'uuid', fn ($query) => $inbox($query)->where('status', $status)->where('updated_at', '<', $cutoff->toDateTimeString()), $stats);
+                $this->deleteInBatches('telematic_deliveries', 'uuid', fn ($query) => $inbox($query)->where('status', $status)->where('updated_at', '<', $cutoff->toDateTimeString()), $stats, 'updated_at');
             }
         }
 
@@ -244,46 +310,55 @@ protected function pruneSyncRuns(\Closure $inbox, RetentionPolicy $policy): arra
         $stats = $this->emptyTableStats();
         if ($cutoff = $policy->cutoff('sync_run_retention_days')) {
             // In-flight runs are recovered by the drain command, never expired here.
-            $this->deleteInBatches('telematic_sync_runs', 'uuid', fn ($query) => $inbox($query)->whereNotIn('status', ['fetching', 'ingesting'])->where('updated_at', '<', $cutoff->toDateTimeString()), $stats);
+            $this->deleteInBatches('telematic_sync_runs', 'uuid', fn ($query) => $inbox($query)->whereNotIn('status', ['fetching', 'ingesting'])->where('updated_at', '<', $cutoff->toDateTimeString()), $stats, 'updated_at');
         }
 
         return $stats;
     }
 
-    protected function deleteInBatches(string $table, string $key, \Closure $scope, array &$stats): void
+    /**
+     * Batches are ordered by the column the scope ranges over (the retention indexes lead
+     * with company_uuid and that column), so each pick is an index range rather than a
+     * primary-key walk across the whole table. Returns true when the scope was drained.
+     */
+    protected function deleteInBatches(string $table, string $key, \Closure $scope, array &$stats, ?string $orderBy = null): bool
     {
         if ($this->dryRun) {
             $stats['deleted'] += $scope(DB::table($table))->count();
 
-            return;
+            return true;
         }
         for ($batch = 0; $batch < $this->maxBatches; $batch++) {
-            $ids = $scope(DB::table($table))->orderBy($key)->limit($this->batchSize)->pluck($key);
+            $ids = $scope(DB::table($table))->orderBy($orderBy ?? $key)->limit($this->batchSize)->pluck($key);
             if ($ids->isEmpty()) {
-                return;
+                return true;
             }
             $stats['batches']++;
             $stats['deleted'] += DB::table($table)->whereIn($key, $ids->all())->delete();
         }
         $stats['capped'] = true;
+
+        return false;
     }
 
-    protected function updateInBatches(string $table, string $key, \Closure $scope, array $values, array &$stats): void
+    protected function updateInBatches(string $table, string $key, \Closure $scope, array $values, array &$stats, ?string $orderBy = null): bool
     {
         if ($this->dryRun) {
             $stats['compacted'] += $scope(DB::table($table))->count();
 
-            return;
+            return true;
         }
         for ($batch = 0; $batch < $this->maxBatches; $batch++) {
-            $ids = $scope(DB::table($table))->orderBy($key)->limit($this->batchSize)->pluck($key);
+            $ids = $scope(DB::table($table))->orderBy($orderBy ?? $key)->limit($this->batchSize)->pluck($key);
             if ($ids->isEmpty()) {
-                return;
+                return true;
             }
             $stats['batches']++;
             $stats['compacted'] += DB::table($table)->whereIn($key, $ids->all())->update($values);
         }
         $stats['capped'] = true;
+
+        return false;
     }
 
     protected function report(string $label, array $stats): void

From d8c2b87c9ac916c51e2b30c17a93fd8e8679bdef Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Sun, 11 Oct 2026 12:08:28 +0800
Subject: [PATCH 31/87] fix(zone): return geofence trigger, dwell and speed
 limit settings from the zone resource

The zone API saved trigger_on_entry, trigger_on_exit, dwell_threshold_minutes
and speed_limit_kmh but never serialized them, so clients could not confirm
the saved values. The zone resource and webhook payload now include them,
typed through the model casts, matching the service area resource.
---
 server/src/Http/Resources/v1/Zone.php         |  54 ++++----
 .../ZoneGeofenceSettingsResourceTest.php      | 121 ++++++++++++++++++
 2 files changed, 152 insertions(+), 23 deletions(-)
 create mode 100644 server/tests/ZoneGeofenceSettingsResourceTest.php

diff --git a/server/src/Http/Resources/v1/Zone.php b/server/src/Http/Resources/v1/Zone.php
index eec2b8d10..acac2e8c3 100644
--- a/server/src/Http/Resources/v1/Zone.php
+++ b/server/src/Http/Resources/v1/Zone.php
@@ -17,19 +17,23 @@ class Zone extends FleetbaseResource
     public function toArray($request)
     {
         return $this->withCustomFields([
-            'id'                => $this->when(Http::isInternalRequest(), $this->id, $this->public_id),
-            'public_id'         => $this->when(Http::isInternalRequest(), $this->public_id),
-            'uuid'              => $this->when(Http::isInternalRequest(), $this->uuid),
-            'service_area_uuid' => $this->when(Http::isInternalRequest(), $this->service_area_uuid),
-            'name'              => $this->name,
-            'description'       => $this->description,
-            'center'            => $this->location,
-            'border'            => $this->border,
-            'color'             => $this->color,
-            'stroke_color'      => $this->stroke_color,
-            'status'            => $this->status,
-            'updated_at'        => $this->updated_at,
-            'created_at'        => $this->created_at,
+            'id'                      => $this->when(Http::isInternalRequest(), $this->id, $this->public_id),
+            'public_id'               => $this->when(Http::isInternalRequest(), $this->public_id),
+            'uuid'                    => $this->when(Http::isInternalRequest(), $this->uuid),
+            'service_area_uuid'       => $this->when(Http::isInternalRequest(), $this->service_area_uuid),
+            'name'                    => $this->name,
+            'description'             => $this->description,
+            'center'                  => $this->location,
+            'border'                  => $this->border,
+            'color'                   => $this->color,
+            'stroke_color'            => $this->stroke_color,
+            'trigger_on_entry'        => $this->trigger_on_entry,
+            'trigger_on_exit'         => $this->trigger_on_exit,
+            'dwell_threshold_minutes' => $this->dwell_threshold_minutes,
+            'speed_limit_kmh'         => $this->speed_limit_kmh,
+            'status'                  => $this->status,
+            'updated_at'              => $this->updated_at,
+            'created_at'              => $this->created_at,
         ]);
     }
 
@@ -41,16 +45,20 @@ public function toArray($request)
     public function toWebhookPayload()
     {
         return [
-            'id'           => $this->public_id,
-            'name'         => $this->name,
-            'description'  => $this->description,
-            'center'       => $this->location,
-            'border'       => $this->border,
-            'color'        => $this->color,
-            'stroke_color' => $this->stroke_color,
-            'status'       => $this->status,
-            'updated_at'   => $this->updated_at,
-            'created_at'   => $this->created_at,
+            'id'                      => $this->public_id,
+            'name'                    => $this->name,
+            'description'             => $this->description,
+            'center'                  => $this->location,
+            'border'                  => $this->border,
+            'color'                   => $this->color,
+            'stroke_color'            => $this->stroke_color,
+            'trigger_on_entry'        => $this->trigger_on_entry,
+            'trigger_on_exit'         => $this->trigger_on_exit,
+            'dwell_threshold_minutes' => $this->dwell_threshold_minutes,
+            'speed_limit_kmh'         => $this->speed_limit_kmh,
+            'status'                  => $this->status,
+            'updated_at'              => $this->updated_at,
+            'created_at'              => $this->created_at,
         ];
     }
 }
diff --git a/server/tests/ZoneGeofenceSettingsResourceTest.php b/server/tests/ZoneGeofenceSettingsResourceTest.php
new file mode 100644
index 000000000..978fd7da0
--- /dev/null
+++ b/server/tests/ZoneGeofenceSettingsResourceTest.php
@@ -0,0 +1,121 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Resources\v1\ServiceArea as ServiceAreaResource;
+use Fleetbase\FleetOps\Http\Resources\v1\Zone as ZoneResource;
+use Fleetbase\FleetOps\Models\ServiceArea;
+use Fleetbase\FleetOps\Models\Zone;
+use Fleetbase\LaravelMysqlSpatial\Types\Point;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Route;
+
+class FleetOpsGeofenceSettingsZoneFake extends Zone
+{
+    public function getLocationAttribute(): Point
+    {
+        return new Point(1.3, 103.8);
+    }
+
+    public function withCustomFields(array $attributes = [], int|string $position = 'middle'): array
+    {
+        return $attributes;
+    }
+}
+
+class FleetOpsGeofenceSettingsServiceAreaFake extends ServiceArea
+{
+    public function getLocationAttribute(): Point
+    {
+        return new Point(1.3, 103.8);
+    }
+
+    public function withCustomFields(array $attributes = [], int|string $position = 'middle'): array
+    {
+        return $attributes;
+    }
+}
+
+function fleetopsGeofenceSettingsRequest(bool $internal): Request
+{
+    $uri     = $internal ? 'int/v1/zones/zone_public' : 'v1/zones/zone_public';
+    $request = Request::create('/' . $uri, 'GET');
+    $route   = new Route('GET', $internal ? 'int/v1/zones/{id}' : 'v1/zones/{id}', []);
+
+    $request->setRouteResolver(fn () => $route);
+    app()->instance('request', $request);
+
+    return $request;
+}
+
+/**
+ * Raw attributes shaped the way MySQL hands them back: tinyint/smallint
+ * columns arrive as strings, so the resource must rely on the model casts.
+ */
+function fleetopsGeofenceSettingsRawAttributes(): array
+{
+    return [
+        'uuid'                    => 'zone-uuid',
+        'public_id'               => 'zone_public',
+        'service_area_uuid'       => 'area-uuid',
+        'name'                    => 'Loading Dock',
+        'status'                  => 'active',
+        'trigger_on_entry'        => '0',
+        'trigger_on_exit'         => '1',
+        'dwell_threshold_minutes' => '15',
+        'speed_limit_kmh'         => '25',
+    ];
+}
+
+test('zone resource returns geofence settings typed on public and internal requests', function (bool $internal) {
+    $zone = new FleetOpsGeofenceSettingsZoneFake();
+    $zone->setRawAttributes(fleetopsGeofenceSettingsRawAttributes(), true);
+
+    $payload = (new ZoneResource($zone))->resolve(fleetopsGeofenceSettingsRequest($internal));
+
+    expect($payload['id'])->toBe($internal ? null : 'zone_public')
+        ->and($payload['trigger_on_entry'])->toBeFalse()
+        ->and($payload['trigger_on_exit'])->toBeTrue()
+        ->and($payload['dwell_threshold_minutes'])->toBe(15)
+        ->and($payload['speed_limit_kmh'])->toBe(25);
+})->with(['public' => false, 'internal' => true]);
+
+test('zone webhook payload includes typed geofence settings', function () {
+    $zone = new FleetOpsGeofenceSettingsZoneFake();
+    $zone->setRawAttributes(array_merge(fleetopsGeofenceSettingsRawAttributes(), ['dwell_threshold_minutes' => null]), true);
+
+    expect((new ZoneResource($zone))->toWebhookPayload())->toMatchArray([
+        'id'                      => 'zone_public',
+        'trigger_on_entry'        => false,
+        'trigger_on_exit'         => true,
+        'dwell_threshold_minutes' => null,
+        'speed_limit_kmh'         => 25,
+    ]);
+});
+
+test('zone and service area updates fill geofence settings and round-trip through the resource', function (string $modelClass, string $resourceClass) {
+    // Request-shaped input, as the update endpoints pass it to fill()/update().
+    $input = [
+        'trigger_on_entry'        => '1',
+        'trigger_on_exit'         => false,
+        'dwell_threshold_minutes' => '30',
+        'speed_limit_kmh'         => 60,
+    ];
+
+    $model = new $modelClass();
+    $model->setRawAttributes(['public_id' => 'record_public', 'name' => 'Before'], true);
+    $model->fill($input);
+
+    expect($model->isDirty(['trigger_on_entry', 'trigger_on_exit', 'dwell_threshold_minutes', 'speed_limit_kmh']))->toBeTrue();
+
+    $payload = (new $resourceClass($model))->resolve(fleetopsGeofenceSettingsRequest(false));
+
+    expect($payload)->toMatchArray([
+        'id'                      => 'record_public',
+        'trigger_on_entry'        => true,
+        'trigger_on_exit'         => false,
+        'dwell_threshold_minutes' => 30,
+        'speed_limit_kmh'         => 60,
+    ]);
+})->with([
+    'zone'         => [FleetOpsGeofenceSettingsZoneFake::class, ZoneResource::class],
+    'service area' => [FleetOpsGeofenceSettingsServiceAreaFake::class, ServiceAreaResource::class],
+]);

From 04911c9fbef983875621091ec4c424cd387680ec Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Sun, 11 Oct 2026 12:08:52 +0800
Subject: [PATCH 32/87] fix(orders): stop measuring order distance from a
 driver's POINT(0 0) placeholder

Order::getCurrentOriginPosition() returned the assigned driver's location
unconditionally. Drivers are created with POINT(0 0) until their first
location report, so orders assigned to such a driver were measured from
null island: a ~25 km run became ~14,474 km and, through the calculate
provider's 7.2 s per 100 m, ~1,042,000 s.

The origin now falls back to the pickup when the driver has no known
position, and both distance setters skip the write when either endpoint is
still a placeholder (e.g. an ungeocoded place) instead of storing a
null-island distance.
---
 server/src/Models/Order.php                   | 19 +++++-
 .../OrderPayloadConfigAndDistanceTest.php     | 60 +++++++++++++++++++
 2 files changed, 76 insertions(+), 3 deletions(-)

diff --git a/server/src/Models/Order.php b/server/src/Models/Order.php
index b523689ad..e82e5236e 100644
--- a/server/src/Models/Order.php
+++ b/server/src/Models/Order.php
@@ -1697,7 +1697,10 @@ public function getCurrentOriginPosition()
                 $driverAssigned = Driver::where('uuid', $this->driver_assigned_uuid)->first();
             }
 
-            if ($driverAssigned instanceof Driver) {
+            // A driver that has never reported a position still carries the
+            // POINT(0 0) placeholder it was created with. Measuring from there
+            // puts the origin at null island, so fall back to the pickup.
+            if ($driverAssigned instanceof Driver && static::isKnownPosition($driverAssigned->location)) {
                 return $driverAssigned->location;
             }
         }
@@ -1728,6 +1731,16 @@ public function getDestinationPosition()
         return $destination ? $destination->location : null;
     }
 
+    /**
+     * Determines whether a position is a real, resolved location rather than
+     * missing or the POINT(0 0) placeholder stored for drivers that have not
+     * reported a position yet and for places that failed to geocode.
+     */
+    public static function isKnownPosition($position): bool
+    {
+        return $position instanceof Point && ($position->getLat() != 0.0 || $position->getLng() != 0.0);
+    }
+
     /**
      * Sets the preliminary distance and time for the order.
      * Uses a utility method to calculate the distance and time between the current origin and destination positions.
@@ -1739,7 +1752,7 @@ public function setPreliminaryDistanceAndTime()
         $origin      = $this->getCurrentOriginPosition();
         $destination = $this->getDestinationPosition();
 
-        if ($origin === null || $destination === null) {
+        if (!static::isKnownPosition($origin) || !static::isKnownPosition($destination)) {
             return $this;
         }
 
@@ -1761,7 +1774,7 @@ public function setDistanceAndTime(array $options = []): self
         $origin      = $this->getCurrentOriginPosition();
         $destination = $this->getDestinationPosition();
 
-        if (!$origin || !$destination) {
+        if (!static::isKnownPosition($origin) || !static::isKnownPosition($destination)) {
             return $this;
         }
 
diff --git a/server/tests/Unit/Models/OrderPayloadConfigAndDistanceTest.php b/server/tests/Unit/Models/OrderPayloadConfigAndDistanceTest.php
index 193beecb2..f78a13420 100644
--- a/server/tests/Unit/Models/OrderPayloadConfigAndDistanceTest.php
+++ b/server/tests/Unit/Models/OrderPayloadConfigAndDistanceTest.php
@@ -240,6 +240,66 @@ function fleetopsOrderPayloadFetch(SQLiteConnection $connection, string $uuid):
     expect($origin?->getLat())->toBe(1.20);
 });
 
+test('a driver without a reported location does not turn the order origin into null island', function () {
+    $connection = fleetopsOrderPayloadBoot();
+    // Sunshine -> Melton, Victoria: a ~25 km straight-line run
+    $connection->table('places')->insert([
+        ['uuid' => '11111111-1111-4111-8111-111111111111', 'public_id' => 'place_vicpickup', 'company_uuid' => 'company-1', 'location' => fleetopsOrderPayloadWkb(-37.78, 144.83)],
+        ['uuid' => '22222222-2222-4222-8222-222222222222', 'public_id' => 'place_vicdropoff', 'company_uuid' => 'company-1', 'location' => fleetopsOrderPayloadWkb(-37.68, 144.58)],
+    ]);
+    $connection->table('payloads')->insert(['uuid' => 'payload-1', 'company_uuid' => 'company-1', 'pickup_uuid' => '11111111-1111-4111-8111-111111111111', 'dropoff_uuid' => '22222222-2222-4222-8222-222222222222']);
+    $connection->table('users')->insert(['uuid' => 'user-1', 'company_uuid' => 'company-1', 'type' => 'user']);
+    // Drivers are created with a POINT(0 0) placeholder until their first location report
+    $connection->table('drivers')->insert(['uuid' => '44444444-4444-4444-8444-444444444444', 'public_id' => 'driver_vicnoloc', 'company_uuid' => 'company-1', 'user_uuid' => 'user-1', 'location' => fleetopsOrderPayloadWkb(0, 0)]);
+    $connection->table('orders')->insert(['uuid' => 'order-1', 'company_uuid' => 'company-1', 'payload_uuid' => 'payload-1', 'driver_assigned_uuid' => '44444444-4444-4444-8444-444444444444']);
+
+    $order  = Order::query()->where('uuid', 'order-1')->first();
+    $origin = $order->getCurrentOriginPosition();
+    expect($origin?->getLat())->toBe(-37.78)
+        ->and($origin?->getLng())->toBe(144.83);
+
+    $order->setPreliminaryDistanceAndTime();
+    $distance = (float) $connection->table('orders')->value('distance');
+    $time     = (float) $connection->table('orders')->value('time');
+    expect($distance)->toBeGreaterThan(20000)->toBeLessThan(30000)
+        ->and($time)->toBe(round($distance / 100) * 7.2);
+
+    $connection->table('orders')->where('uuid', 'order-1')->update(['distance' => null, 'time' => null]);
+    $order = Order::query()->where('uuid', 'order-1')->first();
+    $order->setDistanceAndTime(['provider' => 'calculate']);
+    expect((float) $connection->table('orders')->value('distance'))->toBe($distance)
+        ->and((float) $connection->table('orders')->value('time'))->toBe($time);
+
+    // Once the driver reports a real position it becomes the origin again
+    $connection->table('drivers')->update(['location' => fleetopsOrderPayloadWkb(-37.70, 144.70)]);
+    $order = Order::query()->where('uuid', 'order-1')->first();
+    expect($order->getCurrentOriginPosition()?->getLat())->toBe(-37.70);
+});
+
+test('distance setters leave the order untouched when an endpoint is an ungeocoded placeholder', function () {
+    $connection = fleetopsOrderPayloadBoot();
+    $connection->table('places')->insert([
+        ['uuid' => '11111111-1111-4111-8111-111111111111', 'public_id' => 'place_vicpickup', 'company_uuid' => 'company-1', 'location' => fleetopsOrderPayloadWkb(-37.78, 144.83)],
+        ['uuid' => '22222222-2222-4222-8222-222222222222', 'public_id' => 'place_ungeocoded', 'company_uuid' => 'company-1', 'location' => fleetopsOrderPayloadWkb(0, 0)],
+    ]);
+    $connection->table('payloads')->insert([
+        ['uuid' => 'payload-1', 'company_uuid' => 'company-1', 'pickup_uuid' => '11111111-1111-4111-8111-111111111111', 'dropoff_uuid' => '22222222-2222-4222-8222-222222222222'],
+        ['uuid' => 'payload-2', 'company_uuid' => 'company-1', 'pickup_uuid' => '22222222-2222-4222-8222-222222222222', 'dropoff_uuid' => '11111111-1111-4111-8111-111111111111'],
+    ]);
+    $connection->table('orders')->insert([
+        ['uuid' => 'order-1', 'company_uuid' => 'company-1', 'payload_uuid' => 'payload-1'],
+        ['uuid' => 'order-2', 'company_uuid' => 'company-1', 'payload_uuid' => 'payload-2'],
+    ]);
+
+    foreach (['order-1', 'order-2'] as $uuid) {
+        $order = Order::query()->where('uuid', $uuid)->first();
+        expect($order->setPreliminaryDistanceAndTime())->toBe($order)
+            ->and($order->setDistanceAndTime(['provider' => 'calculate']))->toBe($order)
+            ->and($connection->table('orders')->where('uuid', $uuid)->value('distance'))->toBeNull()
+            ->and($connection->table('orders')->where('uuid', $uuid)->value('time'))->toBeNull();
+    }
+});
+
 test('config resolution prefers uuid then company default', function () {
     $connection = fleetopsOrderPayloadBoot();
     $flow       = json_encode([

From db6067303649fe51ea86bd837434158d2ea6ccc6 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Sun, 11 Oct 2026 12:10:42 +0800
Subject: [PATCH 33/87] fix(orders): a queued creation dispatch no longer moves
 a started order back to dispatched

Orders created through the API with dispatch: true are dispatched by the
queued FinalizeApiOrderCreation job. When that job ran after the order had
already been dispatched and started, it called dispatchWithActivity()
unconditionally, resetting the status to dispatched, adding a duplicate
dispatched tracking status and firing OrderDispatched again.

The job now dispatches only when Order::isAwaitingDispatch() holds: no
dispatch or start recorded, the status still at its initial code, and no
dispatched tracking status.
---
 server/src/Jobs/FinalizeApiOrderCreation.php  |   4 +-
 server/src/Models/Order.php                   |  23 ++
 server/tests/QueueJobContractsTest.php        |   3 +-
 ...alizeApiOrderCreationDispatchGuardTest.php | 266 ++++++++++++++++++
 4 files changed, 294 insertions(+), 2 deletions(-)
 create mode 100644 server/tests/Unit/Jobs/FinalizeApiOrderCreationDispatchGuardTest.php

diff --git a/server/src/Jobs/FinalizeApiOrderCreation.php b/server/src/Jobs/FinalizeApiOrderCreation.php
index 364b640e2..4b8318eab 100644
--- a/server/src/Jobs/FinalizeApiOrderCreation.php
+++ b/server/src/Jobs/FinalizeApiOrderCreation.php
@@ -38,7 +38,9 @@ public function handle(): void
         $order->setPreliminaryDistanceAndTime();
         $order->purchaseServiceQuote($serviceQuote);
 
-        if ($this->shouldDispatch) {
+        // The order may have been dispatched or started while this job waited in the
+        // queue; dispatching it again would move its status backwards.
+        if ($this->shouldDispatch && $order->isAwaitingDispatch()) {
             $order->dispatchWithActivity();
         }
 
diff --git a/server/src/Models/Order.php b/server/src/Models/Order.php
index b523689ad..d32f95d7f 100644
--- a/server/src/Models/Order.php
+++ b/server/src/Models/Order.php
@@ -1333,6 +1333,29 @@ public function dispatchWithActivity(): Order
         return $this;
     }
 
+    /**
+     * Determine whether the order is still waiting to be dispatched.
+     *
+     * A deferred dispatch, such as the queued finalize job for orders created with
+     * `dispatch: true`, can run after the order was already dispatched or started
+     * through another path. Dispatching it then would move the status back to
+     * "dispatched", so only an order that still sits at its initial status with no
+     * dispatch or start recorded qualifies.
+     */
+    public function isAwaitingDispatch(): bool
+    {
+        if ($this->dispatched || $this->dispatched_at || $this->started || $this->started_at) {
+            return false;
+        }
+
+        $status = $this->status ?? 'created';
+        if ($status !== 'created' && $status !== $this->config()?->getInitialStatusCode()) {
+            return false;
+        }
+
+        return !$this->hasDispatchedStatus();
+    }
+
     /**
      * Dispatches the order only if it hasn't been dispatched yet.
      * A check is performed before dispatching the order.
diff --git a/server/tests/QueueJobContractsTest.php b/server/tests/QueueJobContractsTest.php
index c4bea73a0..f1a30c8ef 100644
--- a/server/tests/QueueJobContractsTest.php
+++ b/server/tests/QueueJobContractsTest.php
@@ -609,7 +609,8 @@ function fleetOpsReplayPositionAt(string $uuid, string $createdAt): Position
     expect($missingOrderJob->events)->toBe([]);
 
     $order = new FleetOpsFinalizeOrderFake();
-    $order->setRawAttributes(['uuid' => 'order-uuid'], true);
+    $order->setRawAttributes(['uuid' => 'order-uuid', 'status' => 'created'], true);
+    $order->setRelation('trackingStatuses', collect());
 
     $serviceQuote = new ServiceQuote();
     $serviceQuote->setRawAttributes(['uuid' => 'service-quote-uuid'], true);
diff --git a/server/tests/Unit/Jobs/FinalizeApiOrderCreationDispatchGuardTest.php b/server/tests/Unit/Jobs/FinalizeApiOrderCreationDispatchGuardTest.php
new file mode 100644
index 000000000..f9296be85
--- /dev/null
+++ b/server/tests/Unit/Jobs/FinalizeApiOrderCreationDispatchGuardTest.php
@@ -0,0 +1,266 @@
+<?php
+
+if (!function_exists('Fleetbase\FleetOps\Models\dispatch')) {
+    eval('namespace Fleetbase\FleetOps\Models; function dispatch($job) { return \FleetOpsOrderUnitDispatchRecorder::record($job); }');
+}
+
+if (!function_exists('Fleetbase\FleetOps\Models\event')) {
+    eval('namespace Fleetbase\FleetOps\Models; function event($event = null) { \FleetOpsOrderUnitDispatchRecorder::$events[] = $event; return $event; }');
+}
+
+if (!function_exists('Fleetbase\FleetOps\Models\now')) {
+    eval('namespace Fleetbase\FleetOps\Models; function now($tz = null) { return \Illuminate\Support\Carbon::now($tz); }');
+}
+
+if (!class_exists('Fleetbase\FleetOps\Events\OrderDispatched', false)) {
+    eval('namespace Fleetbase\FleetOps\Events; class OrderDispatched { public function __construct(public $order) {} }');
+}
+
+if (!class_exists('FleetOpsOrderUnitDispatchRecorder', false)) {
+    class FleetOpsOrderUnitDispatchRecorder
+    {
+        public static array $jobs   = [];
+        public static array $events = [];
+
+        public static function reset(): void
+        {
+            static::$jobs   = [];
+            static::$events = [];
+        }
+
+        public static function record($job): object
+        {
+            static::$jobs[] = $job;
+
+            if ($job instanceof Closure) {
+                $job();
+            }
+
+            return new class {
+                public function afterCommit(): self
+                {
+                    return $this;
+                }
+            };
+        }
+    }
+}
+
+use Fleetbase\FleetOps\Events\OrderDispatched;
+use Fleetbase\FleetOps\Flow\Activity;
+use Fleetbase\FleetOps\Jobs\FinalizeApiOrderCreation;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\OrderConfig;
+use Fleetbase\FleetOps\Models\ServiceQuote;
+use Fleetbase\FleetOps\Models\TrackingStatus;
+use Illuminate\Support\Carbon;
+
+class FleetOpsQueuedDispatchOrderFake extends Order
+{
+    public bool $quietSaved         = false;
+    public array $calls             = [];
+    public array $activityRows      = [];
+    public array $statuses          = [];
+    public ?OrderConfig $fakeConfig = null;
+
+    public function getDateFormat()
+    {
+        return 'Y-m-d H:i:s';
+    }
+
+    public function load($relations)
+    {
+        return $this;
+    }
+
+    public function saveQuietly(array $options = []): bool
+    {
+        $this->quietSaved = true;
+
+        return true;
+    }
+
+    public function flushAttributesCache(): bool
+    {
+        return true;
+    }
+
+    public function config(): ?OrderConfig
+    {
+        return $this->fakeConfig;
+    }
+
+    public function notifyDriverAssigned(): void
+    {
+        $this->calls[] = 'notifyDriverAssigned';
+    }
+
+    public function setPreliminaryDistanceAndTime(): void
+    {
+        $this->calls[] = 'setPreliminaryDistanceAndTime';
+    }
+
+    public function purchaseServiceQuote($serviceQuote, $meta = [])
+    {
+        $this->calls[] = 'purchaseServiceQuote';
+    }
+
+    public function insertActivity(Activity $activity, $location = [], $proof = null): string
+    {
+        $this->activityRows[] = $activity->code;
+
+        return 'tracking_status_public';
+    }
+
+    public function setStatus(?string $status, $andSave = true)
+    {
+        $this->statuses[] = $status;
+        $this->status     = $status;
+
+        return $this;
+    }
+}
+
+class FleetOpsQueuedDispatchConfigFake extends OrderConfig
+{
+    public function getDispatchActivity(): ?Activity
+    {
+        return new Activity(['code' => 'dispatched']);
+    }
+}
+
+class FleetOpsQueuedDispatchJobProbe extends FinalizeApiOrderCreation
+{
+    public ?Order $order = null;
+    public array $ready  = [];
+
+    protected function findOrder(): ?Order
+    {
+        return $this->order;
+    }
+
+    protected function findServiceQuote(): ?ServiceQuote
+    {
+        return null;
+    }
+
+    protected function fireOrderReady(Order $order): void
+    {
+        $this->ready[] = $order->uuid;
+    }
+}
+
+function fleetopsQueuedDispatchTrackingStatus(string $code): TrackingStatus
+{
+    $status       = new TrackingStatus();
+    $status->code = $code;
+
+    return $status;
+}
+
+function fleetopsQueuedDispatchOrder(array $attributes = [], array $trackingCodes = ['CREATED'], array $lifecycle = []): FleetOpsQueuedDispatchOrderFake
+{
+    $config = new FleetOpsQueuedDispatchConfigFake();
+    $config->setRawAttributes(['meta' => json_encode($lifecycle ? ['lifecycle' => $lifecycle] : [])], true);
+
+    $order = new FleetOpsQueuedDispatchOrderFake();
+    $order->setRawAttributes(array_merge([
+        'uuid'                 => 'order-uuid',
+        'tracking_number_uuid' => 'tracking-number-uuid',
+        'status'               => 'created',
+        'dispatched'           => false,
+        'started'              => false,
+    ], $attributes), true);
+    $order->fakeConfig = $config;
+    $order->setRelation('trackingStatuses', collect(array_map('fleetopsQueuedDispatchTrackingStatus', $trackingCodes)));
+    $order->setRelation('driverAssigned', null);
+    $order->setRelation('payload', null);
+
+    return $order;
+}
+
+function fleetopsRunQueuedDispatch(Order $order): FleetOpsQueuedDispatchJobProbe
+{
+    $job        = new FleetOpsQueuedDispatchJobProbe($order->uuid, null, true);
+    $job->order = $order;
+    $job->handle();
+
+    return $job;
+}
+
+beforeEach(function () {
+    FleetOpsOrderUnitDispatchRecorder::reset();
+    Carbon::setTestNow(Carbon::parse('2026-10-11 09:30:00'));
+});
+
+afterEach(function () {
+    Carbon::setTestNow();
+});
+
+test('queued api dispatch still dispatches an order that is waiting at created', function () {
+    $order = fleetopsQueuedDispatchOrder();
+
+    $job = fleetopsRunQueuedDispatch($order);
+
+    expect($order->dispatched)->toBeTrue()
+        ->and($order->dispatched_at->toDateTimeString())->toBe('2026-10-11 09:30:00')
+        ->and($order->status)->toBe('dispatched')
+        ->and($order->activityRows)->toBe(['dispatched'])
+        ->and(FleetOpsOrderUnitDispatchRecorder::$events)->toHaveCount(1)
+        ->and(FleetOpsOrderUnitDispatchRecorder::$events[0])->toBeInstanceOf(OrderDispatched::class)
+        ->and($job->ready)->toBe(['order-uuid']);
+});
+
+test('queued api dispatch is a no-op once the order was dispatched and started', function () {
+    $dispatchedAt = Carbon::parse('2026-10-11 09:00:00');
+    $startedAt    = Carbon::parse('2026-10-11 09:10:00');
+    $order        = fleetopsQueuedDispatchOrder([
+        'status'        => 'started',
+        'dispatched'    => true,
+        'dispatched_at' => $dispatchedAt->toDateTimeString(),
+        'started'       => true,
+        'started_at'    => $startedAt->toDateTimeString(),
+    ], ['CREATED', 'DISPATCHED', 'STARTED']);
+
+    $job = fleetopsRunQueuedDispatch($order);
+
+    expect($order->status)->toBe('started')
+        ->and($order->dispatched_at->toDateTimeString())->toBe('2026-10-11 09:00:00')
+        ->and($order->started_at->toDateTimeString())->toBe('2026-10-11 09:10:00')
+        ->and($order->quietSaved)->toBeFalse()
+        ->and($order->activityRows)->toBe([])
+        ->and($order->statuses)->toBe([])
+        ->and(FleetOpsOrderUnitDispatchRecorder::$jobs)->toBe([])
+        ->and(FleetOpsOrderUnitDispatchRecorder::$events)->toBe([])
+        ->and($order->calls)->toBe(['notifyDriverAssigned', 'setPreliminaryDistanceAndTime', 'purchaseServiceQuote'])
+        ->and($job->ready)->toBe(['order-uuid']);
+});
+
+test('an order is only awaiting dispatch at its initial status with nothing recorded', function () {
+    expect(fleetopsQueuedDispatchOrder()->isAwaitingDispatch())->toBeTrue()
+        ->and(fleetopsQueuedDispatchOrder(['status' => null])->isAwaitingDispatch())->toBeTrue()
+        ->and(fleetopsQueuedDispatchOrder(['status' => 'pending'], ['PENDING'], ['initial' => 'pending'])->isAwaitingDispatch())->toBeTrue()
+        ->and(fleetopsQueuedDispatchOrder(['dispatched' => true])->isAwaitingDispatch())->toBeFalse()
+        ->and(fleetopsQueuedDispatchOrder(['dispatched_at' => '2026-10-11 09:00:00'])->isAwaitingDispatch())->toBeFalse()
+        ->and(fleetopsQueuedDispatchOrder(['started' => true])->isAwaitingDispatch())->toBeFalse()
+        ->and(fleetopsQueuedDispatchOrder(['started_at' => '2026-10-11 09:10:00'])->isAwaitingDispatch())->toBeFalse()
+        ->and(fleetopsQueuedDispatchOrder(['status' => 'enroute'])->isAwaitingDispatch())->toBeFalse()
+        ->and(fleetopsQueuedDispatchOrder(['status' => 'completed'])->isAwaitingDispatch())->toBeFalse()
+        ->and(fleetopsQueuedDispatchOrder([], ['CREATED', 'DISPATCHED'])->isAwaitingDispatch())->toBeFalse();
+
+    $withoutConfig             = fleetopsQueuedDispatchOrder(['status' => 'pending']);
+    $withoutConfig->fakeConfig = null;
+
+    expect($withoutConfig->isAwaitingDispatch())->toBeFalse();
+});
+
+test('a terminal or later status on a custom lifecycle is never dispatched by the queued job', function () {
+    $order = fleetopsQueuedDispatchOrder(['status' => 'delivered'], ['PENDING', 'DELIVERED'], ['initial' => 'pending', 'completed' => 'delivered']);
+
+    fleetopsRunQueuedDispatch($order);
+
+    expect($order->status)->toBe('delivered')
+        ->and($order->dispatched)->toBeFalse()
+        ->and($order->activityRows)->toBe([])
+        ->and(FleetOpsOrderUnitDispatchRecorder::$events)->toBe([]);
+});

From 7c759982dd2381f3ee5c66b1a59783822400f498 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Sun, 11 Oct 2026 12:12:14 +0800
Subject: [PATCH 34/87] fix(geofence): mark arrival against the order's current
 destination stop

HandleGeofenceEntered resolved the arrival target with
Payload::getPickupOrCurrentWaypoint(), which always returns the pickup when
one is set, so entering a zone at the dropoff never marked a pickup+dropoff
order as arrived. It then read `->place` / `->getPlace()` off the returned
Place, which Place does not have; the resulting exception was swallowed, so
with real models no arrival fired at all.

Resolve the destination through ResolvesOrderServiceStops instead: the
payload's current service stop (pickup, waypoints, dropoff in sequence via
current_waypoint_uuid), moving on to the next incomplete stop when the
current one is already complete. The exit and dwell listeners only write
event logs and have no destination check.
---
 .../src/Listeners/HandleGeofenceEntered.php   |  46 ++--
 server/tests/EventContractsTest.php           |  81 ++-----
 .../Listeners/HandleGeofenceEnteredTest.php   | 204 ++++++++++++++++--
 3 files changed, 234 insertions(+), 97 deletions(-)

diff --git a/server/src/Listeners/HandleGeofenceEntered.php b/server/src/Listeners/HandleGeofenceEntered.php
index f95f7609f..edc78e785 100644
--- a/server/src/Listeners/HandleGeofenceEntered.php
+++ b/server/src/Listeners/HandleGeofenceEntered.php
@@ -6,7 +6,10 @@
 use Fleetbase\FleetOps\Flow\Activity;
 use Fleetbase\FleetOps\Models\GeofenceEventLog;
 use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Payload;
+use Fleetbase\FleetOps\Models\Place;
 use Fleetbase\FleetOps\Notifications\DriverArrivedAtGeofence;
+use Fleetbase\FleetOps\Support\ResolvesOrderServiceStops;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Support\Facades\Log;
@@ -24,6 +27,7 @@
 class HandleGeofenceEntered implements ShouldQueue
 {
     use InteractsWithQueue;
+    use ResolvesOrderServiceStops;
 
     /**
      * The number of times the job may be attempted.
@@ -89,10 +93,11 @@ private function handleOrderArrival($driver, $geofence, Order $order, GeofenceEn
             return;
         }
 
-        // Get the current destination waypoint
-        $destination = null;
+        // Resolve the stop the driver is currently heading to: the pickup
+        // until it is completed, then the next waypoint or the dropoff.
+        $place = null;
         try {
-            $destination = $order->payload?->getPickupOrCurrentWaypoint();
+            $place = $this->currentDestination($order);
         } catch (\Throwable $e) {
             Log::warning('GeofenceEntered: Could not resolve order destination', [
                 'order_uuid'  => $order->uuid,
@@ -103,18 +108,6 @@ private function handleOrderArrival($driver, $geofence, Order $order, GeofenceEn
             return;
         }
 
-        if (!$destination) {
-            return;
-        }
-
-        // Resolve the destination place
-        $place = null;
-        try {
-            $place = $destination->place ?? $destination->getPlace();
-        } catch (\Throwable $e) {
-            return;
-        }
-
         if (!$place || !$place->location) {
             return;
         }
@@ -171,6 +164,29 @@ private function handleOrderArrival($driver, $geofence, Order $order, GeofenceEn
         }
     }
 
+    /**
+     * Resolve the place of the order's current destination stop.
+     *
+     * Uses the payload's current service stop (pickup, waypoints, dropoff in
+     * sequence, tracked by `current_waypoint_uuid`). When that stop has
+     * already been completed but the pointer was not advanced, the next
+     * incomplete stop is the destination instead.
+     */
+    protected function currentDestination(Order $order): ?Place
+    {
+        $payload = $order->payload;
+        if (!$payload instanceof Payload) {
+            return null;
+        }
+
+        $stop = $this->payloadCurrentServiceStop($payload);
+        if ($stop && $this->serviceStopIsComplete($order, $payload, $stop)) {
+            $stop = $this->nextIncompleteServiceStop($order, $payload);
+        }
+
+        return $stop['place'] ?? null;
+    }
+
     /**
      * Calculate the haversine distance in metres between two lat/lng points.
      *
diff --git a/server/tests/EventContractsTest.php b/server/tests/EventContractsTest.php
index a9092640a..044b758de 100644
--- a/server/tests/EventContractsTest.php
+++ b/server/tests/EventContractsTest.php
@@ -33,6 +33,8 @@
 use Fleetbase\FleetOps\Models\FuelReport;
 use Fleetbase\FleetOps\Models\GeofenceEventLog;
 use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Payload;
+use Fleetbase\FleetOps\Models\Place;
 use Fleetbase\FleetOps\Models\TrackingStatus;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Waypoint;
@@ -832,8 +834,19 @@ public function getPickupOrCurrentWaypoint(): mixed
         'name'      => 'Event Zone',
     ], 'zone', new Point(1.3521, 103.8198));
 
-    $place        = (object) ['location' => new Point(1.3521, 103.8198)];
-    $destination  = (object) ['place' => $place];
+    $payloadTo = function (?Point $location): Payload {
+        $pickup = new Place();
+        $pickup->setRawAttributes(['uuid' => 'pickup-place-uuid', 'location' => $location], true);
+
+        $payload = new Payload();
+        $payload->setRawAttributes(['uuid' => 'arrival-payload-uuid'], true);
+        $payload->setRelation('pickup', $pickup);
+        $payload->setRelation('dropoff', null);
+        $payload->setRelation('waypoints', collect());
+        $payload->setRelation('waypointMarkers', collect());
+
+        return $payload;
+    };
     $nearGeofence = new class {
         public string $uuid      = 'near-zone-uuid';
         public string $public_id = 'near_zone_public';
@@ -896,66 +909,14 @@ public function getLongitudeAttribute(): float
         return $order;
     };
 
-    $missingPlaceOrder = $makeOrder((object) [
-        'getPickupOrCurrentWaypoint' => null,
-    ]);
-    $missingPlaceOrder->setRelation('payload', new class($destination) {
-        public function __construct(private object $destination)
-        {
-        }
-
-        public function getPickupOrCurrentWaypoint(): object
-        {
-            return (object) ['place' => (object) ['location' => null]];
-        }
-    });
-
-    $farOrder = $makeOrder(new class($destination) {
-        public function __construct(private object $destination)
-        {
-        }
-
-        public function getPickupOrCurrentWaypoint(): object
-        {
-            return $this->destination;
-        }
-    });
-
-    $badCentroidOrder = $makeOrder(new class($destination) {
-        public function __construct(private object $destination)
-        {
-        }
-
-        public function getPickupOrCurrentWaypoint(): object
-        {
-            return $this->destination;
-        }
-    });
-
-    $customer     = new FleetOpsGeofenceArrivalCustomerFake();
-    $successOrder = $makeOrder(new class($destination) {
-        public function __construct(private object $destination)
-        {
-        }
-
-        public function getPickupOrCurrentWaypoint(): object
-        {
-            return $this->destination;
-        }
-    }, $customer);
-
+    $missingPlaceOrder             = $makeOrder($payloadTo(null));
+    $farOrder                      = $makeOrder($payloadTo(new Point(1.3521, 103.8198)));
+    $badCentroidOrder              = $makeOrder($payloadTo(new Point(1.3521, 103.8198)));
+    $customer                      = new FleetOpsGeofenceArrivalCustomerFake();
+    $successOrder                  = $makeOrder($payloadTo(new Point(1.3521, 103.8198)), $customer);
     $throwingCustomer              = new FleetOpsGeofenceArrivalCustomerFake();
     $throwingCustomer->shouldThrow = true;
-    $notificationFailureOrder      = $makeOrder(new class($destination) {
-        public function __construct(private object $destination)
-        {
-        }
-
-        public function getPickupOrCurrentWaypoint(): object
-        {
-            return $this->destination;
-        }
-    }, $throwingCustomer);
+    $notificationFailureOrder      = $makeOrder($payloadTo(new Point(1.3521, 103.8198)), $throwingCustomer);
 
     $arrival->invoke($listener, $driver, $nearGeofence, $missingPlaceOrder, $event);
     $arrival->invoke($listener, $driver, $farGeofence, $farOrder, $event);
diff --git a/server/tests/Unit/Listeners/HandleGeofenceEnteredTest.php b/server/tests/Unit/Listeners/HandleGeofenceEnteredTest.php
index e0669ccdb..d27fef97f 100644
--- a/server/tests/Unit/Listeners/HandleGeofenceEnteredTest.php
+++ b/server/tests/Unit/Listeners/HandleGeofenceEnteredTest.php
@@ -14,8 +14,11 @@
 use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\FleetOps\Models\GeofenceEventLog;
 use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Payload;
+use Fleetbase\FleetOps\Models\Place;
 use Fleetbase\FleetOps\Models\TrackingStatus;
 use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Models\Waypoint;
 use Fleetbase\LaravelMysqlSpatial\Types\Point;
 use Illuminate\Database\ConnectionResolver;
 use Illuminate\Database\Eloquent\Model as EloquentModel;
@@ -96,8 +99,12 @@ function fleetopsHandleGeofenceEnteredConnection(): SQLiteConnection
     $connection = new SQLiteConnection($pdo, 'default');
     $connection->statement('create table geofence_events_log (uuid varchar(64) primary key, company_uuid varchar(64), driver_uuid varchar(64) null, vehicle_uuid varchar(64) null, order_uuid varchar(64) null, subject_uuid varchar(64) null, subject_type varchar(255) null, subject_name varchar(255) null, geofence_uuid varchar(64), geofence_type varchar(64), geofence_name varchar(255) null, event_type varchar(64), latitude numeric null, longitude numeric null, speed_kmh numeric null, dwell_duration_minutes integer null, occurred_at datetime null, created_at datetime null, updated_at datetime null)');
 
+    $connection->statement('create table tracking_numbers (id integer primary key autoincrement, uuid varchar(64), public_id varchar(64) null, company_uuid varchar(64) null, status_uuid varchar(64) null, created_at datetime null, updated_at datetime null, deleted_at datetime null)');
+    $connection->statement('create table tracking_statuses (id integer primary key autoincrement, uuid varchar(64), public_id varchar(64) null, company_uuid varchar(64) null, tracking_number_uuid varchar(64) null, code varchar(64) null, complete integer null, created_at datetime null, updated_at datetime null, deleted_at datetime null)');
+
     $resolver = new ConnectionResolver([
         'default' => $connection,
+        'mysql'   => $connection,
     ]);
     $resolver->setDefaultConnection('default');
     EloquentModel::setConnectionResolver($resolver);
@@ -212,7 +219,73 @@ public function getPickupOrCurrentWaypoint(): mixed
         ->and($log->subject_name)->toBe('Dock Van');
 });
 
+function fleetopsEnteredZone(string $name, float $lat, float $lng): object
+{
+    return new class($name, $lat, $lng) {
+        public string $uuid;
+        public string $public_id;
+
+        public function __construct(public string $name, private float $lat, private float $lng)
+        {
+            $this->uuid      = $name . '-uuid';
+            $this->public_id = $name . '-public';
+        }
+
+        public function getLatitudeAttribute(): float
+        {
+            return $this->lat;
+        }
+
+        public function getLongitudeAttribute(): float
+        {
+            return $this->lng;
+        }
+    };
+}
+
+function fleetopsEnteredPlace(string $uuid, ?Point $location): Place
+{
+    $place = new Place();
+    $place->setRawAttributes(['uuid' => $uuid, 'public_id' => $uuid . '-public', 'location' => $location], true);
+
+    return $place;
+}
+
+/**
+ * Build a pickup -> dropoff payload. The pickup sits on the default event
+ * zone centroid; the dropoff is roughly 9km away.
+ */
+function fleetopsEnteredEndpointPayload(?string $currentWaypointUuid = null, ?string $pickupTrackingNumberUuid = null): Payload
+{
+    $payload = new Payload();
+    $payload->setRawAttributes([
+        'uuid'                        => 'payload-uuid',
+        'current_waypoint_uuid'       => $currentWaypointUuid,
+        'pickup_tracking_number_uuid' => $pickupTrackingNumberUuid,
+    ], true);
+    $payload->setRelation('pickup', fleetopsEnteredPlace('pickup-place', new Point(1.3521, 103.8198)));
+    $payload->setRelation('dropoff', fleetopsEnteredPlace('dropoff-place', new Point(1.3000, 103.9000)));
+    $payload->setRelation('waypoints', collect());
+    $payload->setRelation('waypointMarkers', collect());
+
+    return $payload;
+}
+
+function fleetopsEnteredCompleteStatus(SQLiteConnection $connection, string $trackingNumberUuid): void
+{
+    $connection->table('tracking_numbers')->insert(['uuid' => $trackingNumberUuid, 'status_uuid' => $trackingNumberUuid . '-status']);
+    $connection->table('tracking_statuses')->insert(['uuid' => $trackingNumberUuid . '-status', 'tracking_number_uuid' => $trackingNumberUuid, 'code' => 'completed', 'complete' => 1]);
+}
+
+function fleetopsEnteredArrive(Order $order, object $zone): void
+{
+    $driver = fleetopsEnteredDriver($order);
+
+    (new HandleGeofenceEntered())->handle(fleetopsEnteredEvent($driver, $zone));
+}
+
 test('geofence entered arrival handles destination and status failures', function () {
+    fleetopsHandleGeofenceEnteredConnection();
     $listener = new HandleGeofenceEntered();
     $arrival  = new ReflectionMethod(HandleGeofenceEntered::class, 'handleOrderArrival');
     $arrival->setAccessible(true);
@@ -220,37 +293,124 @@ public function getPickupOrCurrentWaypoint(): mixed
     $driver = fleetopsEnteredDriver();
     $event  = fleetopsEnteredEvent($driver);
 
-    $destinationFailure = fleetopsEnteredOrder(new class {
-        public function getPickupOrCurrentWaypoint(): mixed
+    $throwingPayload = new class extends Payload {
+        public function loadMissing($relations)
         {
             throw new RuntimeException('destination failed');
         }
-    });
+    };
+    $destinationFailure = fleetopsEnteredOrder($throwingPayload);
     $arrival->invoke($listener, $driver, $event->geofence, $destinationFailure, $event);
 
-    $placeFailure = fleetopsEnteredOrder(new class {
-        public function getPickupOrCurrentWaypoint(): object
-        {
-            return new class {
-                public function getPlace(): mixed
-                {
-                    throw new RuntimeException('place failed');
-                }
-            };
-        }
-    });
-    $arrival->invoke($listener, $driver, $event->geofence, $placeFailure, $event);
+    $emptyPayload = new Payload();
+    $emptyPayload->setRelation('pickup', null);
+    $emptyPayload->setRelation('dropoff', null);
+    $emptyPayload->setRelation('waypoints', collect());
+    $emptyPayload->setRelation('waypointMarkers', collect());
+    $noStops = fleetopsEnteredOrder($emptyPayload);
+    $arrival->invoke($listener, $driver, $event->geofence, $noStops, $event);
 
-    $statusFailure = fleetopsEnteredOrder(new class {
-        public function getPickupOrCurrentWaypoint(): object
-        {
-            return (object) ['place' => (object) ['location' => new Point(1.3521, 103.8198)]];
-        }
-    });
+    $statusFailure                = fleetopsEnteredOrder(fleetopsEnteredEndpointPayload());
     $statusFailure->throwOnStatus = true;
     $arrival->invoke($listener, $driver, $event->geofence, $statusFailure, $event);
 
     expect($destinationFailure->calls)->toBe([])
-        ->and($placeFailure->calls)->toBe([])
+        ->and($noStops->calls)->toBe([])
         ->and($statusFailure->calls)->toBe([]);
 });
+
+test('geofence entered arrival targets the pickup before the pickup is completed', function () {
+    fleetopsHandleGeofenceEnteredConnection();
+
+    $atDropoff = fleetopsEnteredOrder(fleetopsEnteredEndpointPayload());
+    fleetopsEnteredArrive($atDropoff, fleetopsEnteredZone('dropoff-zone', 1.3000, 103.9000));
+
+    $atPickup = fleetopsEnteredOrder(fleetopsEnteredEndpointPayload('pickup-place'));
+    fleetopsEnteredArrive($atPickup, fleetopsEnteredZone('pickup-zone', 1.3521, 103.8198));
+
+    expect($atDropoff->calls)->toBe([])
+        ->and($atDropoff->status)->toBe('dispatched')
+        ->and($atPickup->calls[0])->toBe(['setStatus', 'arrived', true])
+        ->and($atPickup->calls[1][1]->get('details'))->toBe('Driver entered destination geofence "pickup-zone".');
+});
+
+test('geofence entered arrival targets the dropoff once the order has advanced past the pickup', function () {
+    fleetopsHandleGeofenceEnteredConnection();
+
+    $atPickup = fleetopsEnteredOrder(fleetopsEnteredEndpointPayload('dropoff-place'));
+    fleetopsEnteredArrive($atPickup, fleetopsEnteredZone('pickup-zone', 1.3521, 103.8198));
+
+    $atDropoff = fleetopsEnteredOrder(fleetopsEnteredEndpointPayload('dropoff-place'));
+    fleetopsEnteredArrive($atDropoff, fleetopsEnteredZone('dropoff-zone', 1.3000, 103.9000));
+
+    expect($atPickup->calls)->toBe([])
+        ->and($atDropoff->calls[0])->toBe(['setStatus', 'arrived', true])
+        ->and($atDropoff->calls[1][1]->get('details'))->toBe('Driver entered destination geofence "dropoff-zone".');
+});
+
+test('geofence entered arrival skips a completed pickup the payload pointer has not advanced past', function () {
+    $connection = fleetopsHandleGeofenceEnteredConnection();
+    fleetopsEnteredCompleteStatus($connection, 'pickup-tracking');
+
+    $atPickup = fleetopsEnteredOrder(fleetopsEnteredEndpointPayload('pickup-place', 'pickup-tracking'));
+    fleetopsEnteredArrive($atPickup, fleetopsEnteredZone('pickup-zone', 1.3521, 103.8198));
+
+    $atDropoff = fleetopsEnteredOrder(fleetopsEnteredEndpointPayload(null, 'pickup-tracking'));
+    fleetopsEnteredArrive($atDropoff, fleetopsEnteredZone('dropoff-zone', 1.3000, 103.9000));
+
+    expect($atPickup->calls)->toBe([])
+        ->and($atDropoff->calls[0])->toBe(['setStatus', 'arrived', true]);
+});
+
+test('geofence entered arrival targets the current stop of a multi-waypoint order', function () {
+    $connection = fleetopsHandleGeofenceEnteredConnection();
+    fleetopsEnteredCompleteStatus($connection, 'first-tracking');
+
+    $multiDropPayload = function (?string $currentWaypointUuid): Payload {
+        $payload = new Payload();
+        $payload->setRawAttributes(['uuid' => 'multi-payload-uuid', 'current_waypoint_uuid' => $currentWaypointUuid], true);
+        $payload->setRelation('pickup', null);
+        $payload->setRelation('dropoff', null);
+        $payload->setRelation('waypoints', collect());
+
+        $markers = collect([
+            ['first', 'first-tracking', new Point(1.3521, 103.8198)],
+            ['second', null, new Point(1.3000, 103.9000)],
+            ['third', null, new Point(1.4000, 103.7000)],
+        ])->map(function (array $stop, int $index) {
+            [$name, $trackingNumberUuid, $location] = $stop;
+
+            $waypoint = new Waypoint();
+            $waypoint->setRawAttributes([
+                'uuid'                 => $name . '-waypoint',
+                'place_uuid'           => $name . '-place',
+                'tracking_number_uuid' => $trackingNumberUuid,
+                'order'                => $index,
+            ], true);
+            $waypoint->setRelation('place', fleetopsEnteredPlace($name . '-place', $location));
+            $waypoint->setRelation('trackingNumber', null);
+
+            return $waypoint;
+        });
+        $payload->setRelation('waypointMarkers', $markers);
+
+        return $payload;
+    };
+
+    $atCompletedStop = fleetopsEnteredOrder($multiDropPayload('second-place'));
+    fleetopsEnteredArrive($atCompletedStop, fleetopsEnteredZone('first-zone', 1.3521, 103.8198));
+
+    $atLaterStop = fleetopsEnteredOrder($multiDropPayload('second-place'));
+    fleetopsEnteredArrive($atLaterStop, fleetopsEnteredZone('third-zone', 1.4000, 103.7000));
+
+    $atCurrentStop = fleetopsEnteredOrder($multiDropPayload('second-place'));
+    fleetopsEnteredArrive($atCurrentStop, fleetopsEnteredZone('second-zone', 1.3000, 103.9000));
+
+    $staleFirstStop = fleetopsEnteredOrder($multiDropPayload(null));
+    fleetopsEnteredArrive($staleFirstStop, fleetopsEnteredZone('second-zone', 1.3000, 103.9000));
+
+    expect($atCompletedStop->calls)->toBe([])
+        ->and($atLaterStop->calls)->toBe([])
+        ->and($atCurrentStop->calls[0])->toBe(['setStatus', 'arrived', true])
+        ->and($staleFirstStop->calls[0])->toBe(['setStatus', 'arrived', true]);
+});

From cc4d5218bb13aa991bc44e5e5f935e9d556d8d67 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Sun, 11 Oct 2026 12:19:10 +0800
Subject: [PATCH 35/87] fix(tenancy): scope reports, inspection forms,
 maintenance and telematics to the session company

Adds company-scoped filters for inspection forms and submissions, maintenances, telematics, warranties, proofs and routes, and scopes the maintenance line-item, inspection submission action and vehicle-by-name lookups to the session company.
---
 .../v1/InspectionSubmissionController.php     |  21 +-
 .../Internal/v1/MaintenanceController.php     |   6 +-
 .../src/Http/Filter/InspectionFormFilter.php  |  23 ++
 .../Filter/InspectionSubmissionFilter.php     |  23 ++
 server/src/Http/Filter/MaintenanceFilter.php  |  23 ++
 server/src/Http/Filter/ProofFilter.php        |  18 ++
 server/src/Http/Filter/RouteFilter.php        |  18 ++
 server/src/Http/Filter/TelematicFilter.php    |  23 ++
 server/src/Http/Filter/WarrantyFilter.php     |  23 ++
 server/src/Models/Vehicle.php                 |   2 +-
 server/tests/TenantScopingTest.php            | 206 ++++++++++++++++++
 server/tests/Unit/Models/VehicleTest.php      |  18 +-
 12 files changed, 391 insertions(+), 13 deletions(-)
 create mode 100644 server/src/Http/Filter/InspectionFormFilter.php
 create mode 100644 server/src/Http/Filter/InspectionSubmissionFilter.php
 create mode 100644 server/src/Http/Filter/MaintenanceFilter.php
 create mode 100644 server/src/Http/Filter/ProofFilter.php
 create mode 100644 server/src/Http/Filter/RouteFilter.php
 create mode 100644 server/src/Http/Filter/TelematicFilter.php
 create mode 100644 server/src/Http/Filter/WarrantyFilter.php
 create mode 100644 server/tests/TenantScopingTest.php

diff --git a/server/src/Http/Controllers/Internal/v1/InspectionSubmissionController.php b/server/src/Http/Controllers/Internal/v1/InspectionSubmissionController.php
index 441053dbc..223c82c75 100644
--- a/server/src/Http/Controllers/Internal/v1/InspectionSubmissionController.php
+++ b/server/src/Http/Controllers/Internal/v1/InspectionSubmissionController.php
@@ -111,8 +111,7 @@ public function export(ExportRequest $request)
 
     public function submit(string $id): JsonResponse
     {
-        $submission = InspectionSubmission::where('uuid', $id)
-            ->orWhere('public_id', $id)
+        $submission = $this->submissionQuery($id)
             ->with(['itemResults', 'vehicle', 'driver', 'form'])
             ->firstOrFail();
 
@@ -127,8 +126,7 @@ public function submit(string $id): JsonResponse
 
     public function createIssue(string $id): JsonResponse
     {
-        $submission = InspectionSubmission::where('uuid', $id)
-            ->orWhere('public_id', $id)
+        $submission = $this->submissionQuery($id)
             ->with(['itemResults', 'vehicle', 'driver', 'form'])
             ->firstOrFail();
 
@@ -145,8 +143,7 @@ public function createIssue(string $id): JsonResponse
 
     public function createWorkOrder(string $id): JsonResponse
     {
-        $submission = InspectionSubmission::where('uuid', $id)
-            ->orWhere('public_id', $id)
+        $submission = $this->submissionQuery($id)
             ->with(['itemResults', 'vehicle', 'driver', 'form'])
             ->firstOrFail();
 
@@ -164,8 +161,7 @@ public function createWorkOrder(string $id): JsonResponse
 
     public function resolve(string $id): JsonResponse
     {
-        $submission = InspectionSubmission::where('uuid', $id)
-            ->orWhere('public_id', $id)
+        $submission = $this->submissionQuery($id)
             ->firstOrFail();
 
         $submission->update([
@@ -180,6 +176,15 @@ public function resolve(string $id): JsonResponse
         ]);
     }
 
+    /** A submission by uuid or public id, only ever within the session's company. */
+    protected function submissionQuery(string $id)
+    {
+        return InspectionSubmission::where('company_uuid', session('company'))
+            ->where(function ($query) use ($id) {
+                $query->where('uuid', $id)->orWhere('public_id', $id);
+            });
+    }
+
     protected function syncItemResultsFromRequest(Request $request, InspectionSubmission $submission): void
     {
         $items = static::arrayInput($request, 'inspection_submission.item_results', 'item_results');
diff --git a/server/src/Http/Controllers/Internal/v1/MaintenanceController.php b/server/src/Http/Controllers/Internal/v1/MaintenanceController.php
index 4205c2fe9..49e1ca3e3 100644
--- a/server/src/Http/Controllers/Internal/v1/MaintenanceController.php
+++ b/server/src/Http/Controllers/Internal/v1/MaintenanceController.php
@@ -194,8 +194,10 @@ protected function recalculateCosts(Maintenance $maintenance): void
 
     protected function findMaintenanceForLineItem(string $id): Maintenance
     {
-        return Maintenance::where('uuid', $id)
-            ->orWhere('public_id', $id)
+        return Maintenance::where('company_uuid', session('company'))
+            ->where(function ($query) use ($id) {
+                $query->where('uuid', $id)->orWhere('public_id', $id);
+            })
             ->firstOrFail();
     }
 
diff --git a/server/src/Http/Filter/InspectionFormFilter.php b/server/src/Http/Filter/InspectionFormFilter.php
new file mode 100644
index 000000000..120cca698
--- /dev/null
+++ b/server/src/Http/Filter/InspectionFormFilter.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Filter;
+
+use Fleetbase\Http\Filter\Filter;
+
+class InspectionFormFilter extends Filter
+{
+    public function queryForInternal()
+    {
+        $this->builder->where('company_uuid', $this->session->get('company'));
+    }
+
+    public function queryForPublic()
+    {
+        $this->queryForInternal();
+    }
+
+    public function query(?string $searchQuery)
+    {
+        $this->builder->search($searchQuery);
+    }
+}
diff --git a/server/src/Http/Filter/InspectionSubmissionFilter.php b/server/src/Http/Filter/InspectionSubmissionFilter.php
new file mode 100644
index 000000000..3bf052922
--- /dev/null
+++ b/server/src/Http/Filter/InspectionSubmissionFilter.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Filter;
+
+use Fleetbase\Http\Filter\Filter;
+
+class InspectionSubmissionFilter extends Filter
+{
+    public function queryForInternal()
+    {
+        $this->builder->where('company_uuid', $this->session->get('company'));
+    }
+
+    public function queryForPublic()
+    {
+        $this->queryForInternal();
+    }
+
+    public function query(?string $searchQuery)
+    {
+        $this->builder->search($searchQuery);
+    }
+}
diff --git a/server/src/Http/Filter/MaintenanceFilter.php b/server/src/Http/Filter/MaintenanceFilter.php
new file mode 100644
index 000000000..bea29e3e1
--- /dev/null
+++ b/server/src/Http/Filter/MaintenanceFilter.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Filter;
+
+use Fleetbase\Http\Filter\Filter;
+
+class MaintenanceFilter extends Filter
+{
+    public function queryForInternal()
+    {
+        $this->builder->where('company_uuid', $this->session->get('company'));
+    }
+
+    public function queryForPublic()
+    {
+        $this->queryForInternal();
+    }
+
+    public function query(?string $searchQuery)
+    {
+        $this->builder->search($searchQuery);
+    }
+}
diff --git a/server/src/Http/Filter/ProofFilter.php b/server/src/Http/Filter/ProofFilter.php
new file mode 100644
index 000000000..3b70b4f91
--- /dev/null
+++ b/server/src/Http/Filter/ProofFilter.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Filter;
+
+use Fleetbase\Http\Filter\Filter;
+
+class ProofFilter extends Filter
+{
+    public function queryForInternal()
+    {
+        $this->builder->where('company_uuid', $this->session->get('company'));
+    }
+
+    public function queryForPublic()
+    {
+        $this->queryForInternal();
+    }
+}
diff --git a/server/src/Http/Filter/RouteFilter.php b/server/src/Http/Filter/RouteFilter.php
new file mode 100644
index 000000000..b6ff9979f
--- /dev/null
+++ b/server/src/Http/Filter/RouteFilter.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Filter;
+
+use Fleetbase\Http\Filter\Filter;
+
+class RouteFilter extends Filter
+{
+    public function queryForInternal()
+    {
+        $this->builder->where('company_uuid', $this->session->get('company'));
+    }
+
+    public function queryForPublic()
+    {
+        $this->queryForInternal();
+    }
+}
diff --git a/server/src/Http/Filter/TelematicFilter.php b/server/src/Http/Filter/TelematicFilter.php
new file mode 100644
index 000000000..80fb5d876
--- /dev/null
+++ b/server/src/Http/Filter/TelematicFilter.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Filter;
+
+use Fleetbase\Http\Filter\Filter;
+
+class TelematicFilter extends Filter
+{
+    public function queryForInternal()
+    {
+        $this->builder->where('company_uuid', $this->session->get('company'));
+    }
+
+    public function queryForPublic()
+    {
+        $this->queryForInternal();
+    }
+
+    public function query(?string $searchQuery)
+    {
+        $this->builder->search($searchQuery);
+    }
+}
diff --git a/server/src/Http/Filter/WarrantyFilter.php b/server/src/Http/Filter/WarrantyFilter.php
new file mode 100644
index 000000000..8ae1b3c16
--- /dev/null
+++ b/server/src/Http/Filter/WarrantyFilter.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Filter;
+
+use Fleetbase\Http\Filter\Filter;
+
+class WarrantyFilter extends Filter
+{
+    public function queryForInternal()
+    {
+        $this->builder->where('company_uuid', $this->session->get('company'));
+    }
+
+    public function queryForPublic()
+    {
+        $this->queryForInternal();
+    }
+
+    public function query(?string $searchQuery)
+    {
+        $this->builder->search($searchQuery);
+    }
+}
diff --git a/server/src/Models/Vehicle.php b/server/src/Models/Vehicle.php
index 250b440d9..e2315fa87 100644
--- a/server/src/Models/Vehicle.php
+++ b/server/src/Models/Vehicle.php
@@ -795,7 +795,7 @@ public static function findByName(?string $vehicleName = null): ?Vehicle
             return null;
         }
 
-        return static::where(function ($query) use ($vehicleName) {
+        return static::where('company_uuid', session('company'))->where(function ($query) use ($vehicleName) {
             $query->where('public_id', $vehicleName)
                     ->orWhere('internal_id', $vehicleName)
                     ->orWhere('plate_number', $vehicleName)
diff --git a/server/tests/TenantScopingTest.php b/server/tests/TenantScopingTest.php
new file mode 100644
index 000000000..4b085e30e
--- /dev/null
+++ b/server/tests/TenantScopingTest.php
@@ -0,0 +1,206 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\InspectionSubmissionController;
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\MaintenanceController;
+use Fleetbase\FleetOps\Http\Filter\InspectionFormFilter;
+use Fleetbase\FleetOps\Http\Filter\InspectionSubmissionFilter;
+use Fleetbase\FleetOps\Http\Filter\MaintenanceFilter;
+use Fleetbase\FleetOps\Http\Filter\ProofFilter;
+use Fleetbase\FleetOps\Http\Filter\RouteFilter;
+use Fleetbase\FleetOps\Http\Filter\TelematicFilter;
+use Fleetbase\FleetOps\Http\Filter\WarrantyFilter;
+use Fleetbase\FleetOps\Models\InspectionForm;
+use Fleetbase\FleetOps\Models\InspectionSubmission;
+use Fleetbase\FleetOps\Models\Maintenance;
+use Fleetbase\FleetOps\Models\Proof;
+use Fleetbase\FleetOps\Models\Route;
+use Fleetbase\FleetOps\Models\Telematic;
+use Fleetbase\FleetOps\Models\Warranty;
+use Fleetbase\Support\Find;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Http\Request;
+
+/*
+ * A console list is scoped to the signed-in company only by the resource's
+ * Filter (core-api applies `queryForInternal` and nothing else), so a model
+ * without one lists every company's rows. These tests hold each tenant-owned
+ * resource to its own company, for lists and for the by-id endpoints that
+ * look records up themselves.
+ */
+
+const FLEETOPS_TENANT_OWN   = 'company-own';
+const FLEETOPS_TENANT_OTHER = 'company-other';
+
+function fleetopsTenantScopingBoot(): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+    app()->instance('db', new class($connection) {
+        public function __construct(public SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null): SQLiteConnection
+        {
+            return $this->c;
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+
+    $columns = ['uuid', 'public_id', 'company_uuid', 'name', 'description', 'type', 'status', 'result', 'summary', 'notes', 'provider', 'model', 'serial_number', 'imei', 'policy_number', 'vehicle_uuid', 'driver_uuid', 'user_uuid', 'inspection_form_uuid', 'line_items', 'labor_cost', 'tax', 'parts_cost', 'total_cost'];
+    $schema  = $connection->getSchemaBuilder();
+    foreach (['inspection_forms', 'inspection_submissions', 'maintenances', 'telematics', 'warranties', 'proofs', 'routes', 'vehicles', 'drivers', 'users'] as $table) {
+        $schema->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    foreach (['inspection_forms', 'inspection_submissions', 'maintenances', 'telematics', 'warranties', 'proofs', 'routes'] as $table) {
+        foreach ([FLEETOPS_TENANT_OWN => 'own', FLEETOPS_TENANT_OTHER => 'other'] as $company => $label) {
+            $connection->table($table)->insert([
+                'uuid'          => "{$table}-{$label}",
+                'public_id'     => "{$table}_{$label}",
+                'company_uuid'  => $company,
+                'name'          => 'Shared name',
+                'summary'       => 'Shared name',
+                'provider'      => 'shared',
+                'type'          => 'shared',
+                'policy_number' => 'shared',
+            ]);
+        }
+    }
+
+    session(['company' => FLEETOPS_TENANT_OWN]);
+
+    return $connection;
+}
+
+function fleetopsTenantScopingRequest(string $uri, array $query = []): Request
+{
+    $request = Request::create('/' . $uri, 'GET', $query);
+    $session = app('session.store');
+    $session->put('company', FLEETOPS_TENANT_OWN);
+    $request->setLaravelSession($session);
+    $request->setRouteResolver(fn () => new class($uri) {
+        public array $action = [];
+
+        public function __construct(private string $uri)
+        {
+        }
+
+        public function uri(): string
+        {
+            return $this->uri;
+        }
+    });
+
+    return $request;
+}
+
+dataset('tenant scoped resources', [
+    'inspection forms'       => [InspectionForm::class, InspectionFormFilter::class, 'inspection_forms'],
+    'inspection submissions' => [InspectionSubmission::class, InspectionSubmissionFilter::class, 'inspection_submissions'],
+    'maintenances'           => [Maintenance::class, MaintenanceFilter::class, 'maintenances'],
+    'telematics'             => [Telematic::class, TelematicFilter::class, 'telematics'],
+    'warranties'             => [Warranty::class, WarrantyFilter::class, 'warranties'],
+    'proofs'                 => [Proof::class, ProofFilter::class, 'proofs'],
+    'routes'                 => [Route::class, RouteFilter::class, 'routes'],
+]);
+
+test('the resource resolves to its tenant filter', function (string $model, string $filter) {
+    expect(ltrim((string) Find::httpFilterForModel(new $model()), '\\'))->toBe($filter);
+})->with('tenant scoped resources');
+
+test('a console list returns only the session company rows', function (string $model, string $filter, string $table) {
+    fleetopsTenantScopingBoot();
+
+    $uuids = $model::query()
+        ->filter(new $filter(fleetopsTenantScopingRequest("int/v1/fleet-ops/{$table}")))
+        ->pluck('uuid')
+        ->all();
+
+    expect($uuids)->toBe(["{$table}-own"]);
+})->with('tenant scoped resources');
+
+test('a public api list returns only the session company rows', function (string $model, string $filter, string $table) {
+    fleetopsTenantScopingBoot();
+
+    $uuids = $model::query()
+        ->filter(new $filter(fleetopsTenantScopingRequest("v1/{$table}")))
+        ->pluck('uuid')
+        ->all();
+
+    expect($uuids)->toBe(["{$table}-own"]);
+})->with('tenant scoped resources');
+
+test('a search that matches every company still returns only the session company rows', function (string $model, string $filter, string $table) {
+    fleetopsTenantScopingBoot();
+
+    $uuids = $model::query()
+        ->filter(new $filter(fleetopsTenantScopingRequest("int/v1/fleet-ops/{$table}", ['query' => 'shared'])))
+        ->pluck('uuid')
+        ->all();
+
+    expect($uuids)->toBe(["{$table}-own"]);
+})->with('tenant scoped resources');
+
+function fleetopsTenantScopingController(string $class): object
+{
+    return (new ReflectionClass($class))->newInstanceWithoutConstructor();
+}
+
+function fleetopsTenantScopingCall(object $controller, string $method, ...$arguments): mixed
+{
+    $reflection = new ReflectionMethod($controller, $method);
+    $reflection->setAccessible(true);
+
+    return $reflection->invoke($controller, ...$arguments);
+}
+
+test('a maintenance line item endpoint resolves only the session company record', function () {
+    fleetopsTenantScopingBoot();
+    $controller = fleetopsTenantScopingController(MaintenanceController::class);
+
+    expect(fleetopsTenantScopingCall($controller, 'findMaintenanceForLineItem', 'maintenances-own')->uuid)->toBe('maintenances-own')
+        ->and(fleetopsTenantScopingCall($controller, 'findMaintenanceForLineItem', 'maintenances_own')->uuid)->toBe('maintenances-own');
+
+    foreach (['maintenances-other', 'maintenances_other'] as $id) {
+        expect(fn () => fleetopsTenantScopingCall($controller, 'findMaintenanceForLineItem', $id))->toThrow(ModelNotFoundException::class);
+    }
+
+    $request = Request::create('/int/v1/fleet-ops/maintenances/maintenances-other/line-items', 'POST', ['description' => 'x', 'quantity' => 1, 'unit_cost' => 1]);
+    expect(fn () => $controller->addLineItem('maintenances-other', $request))->toThrow(ModelNotFoundException::class)
+        ->and(fn () => $controller->updateLineItem('maintenances-other', 0, $request))->toThrow(ModelNotFoundException::class)
+        ->and(fn () => $controller->removeLineItem('maintenances-other', 0))->toThrow(ModelNotFoundException::class);
+});
+
+test('an inspection submission action resolves only the session company record', function () {
+    $connection = fleetopsTenantScopingBoot();
+    $controller = fleetopsTenantScopingController(InspectionSubmissionController::class);
+
+    expect(fleetopsTenantScopingCall($controller, 'submissionQuery', 'inspection_submissions-own')->value('uuid'))->toBe('inspection_submissions-own')
+        ->and(fleetopsTenantScopingCall($controller, 'submissionQuery', 'inspection_submissions_own')->value('uuid'))->toBe('inspection_submissions-own')
+        ->and(fleetopsTenantScopingCall($controller, 'submissionQuery', 'inspection_submissions-other')->exists())->toBeFalse()
+        ->and(fleetopsTenantScopingCall($controller, 'submissionQuery', 'inspection_submissions_other')->exists())->toBeFalse();
+
+    foreach (['submit', 'createIssue', 'createWorkOrder', 'resolve'] as $action) {
+        expect(fn () => $controller->{$action}('inspection_submissions-other'))->toThrow(ModelNotFoundException::class);
+    }
+
+    expect($connection->table('inspection_submissions')->where('uuid', 'inspection_submissions-other')->value('status'))->toBeNull();
+});
diff --git a/server/tests/Unit/Models/VehicleTest.php b/server/tests/Unit/Models/VehicleTest.php
index 67c849a0d..62c938ce5 100644
--- a/server/tests/Unit/Models/VehicleTest.php
+++ b/server/tests/Unit/Models/VehicleTest.php
@@ -100,6 +100,17 @@ public function __construct(public ?Vehicle $result, public FleetOpsVehicleModel
     {
     }
 
+    public function where($column, $operator = null): static
+    {
+        if (is_callable($column)) {
+            $column($this->query);
+        } else {
+            $this->query->calls[] = ['where', [$column, $operator]];
+        }
+
+        return $this;
+    }
+
     public function first(): ?Vehicle
     {
         return $this->result;
@@ -117,6 +128,8 @@ public static function where($column, $operator = null, $value = null, $boolean
 
         if (is_callable($column)) {
             $column($query);
+        } else {
+            $query->calls[] = ['where', [$column, $operator]];
         }
 
         self::$lastQuery = $query;
@@ -258,9 +271,10 @@ function fleetopsVehicleModelUseInMemoryConnection(): SQLiteConnection
     FleetOpsVehicleModelFindableFake::$result = $found;
 
     expect(FleetOpsVehicleModelFindableFake::findByName('ABC-123'))->toBe($found)
+        ->and(FleetOpsVehicleModelFindableFake::$lastQuery->calls[0])->toBe(['where', ['company_uuid', 'company-vehicle']])
         ->and(FleetOpsVehicleModelFindableFake::$lastQuery->calls)->toContain(['where', ['public_id', 'ABC-123']])
         ->and(FleetOpsVehicleModelFindableFake::$lastQuery->calls)->toContain(['orWhere', ['plate_number', 'ABC-123']])
         ->and(FleetOpsVehicleModelFindableFake::$lastQuery->calls)->toContain(['orWhere', ['fuel_card_number', 'ABC-123']])
-        ->and(FleetOpsVehicleModelFindableFake::$lastQuery->calls[7][0])->toBe('orWhereRaw')
-        ->and(FleetOpsVehicleModelFindableFake::$lastQuery->calls[8][0])->toBe('orWhereRaw');
+        ->and(FleetOpsVehicleModelFindableFake::$lastQuery->calls[8][0])->toBe('orWhereRaw')
+        ->and(FleetOpsVehicleModelFindableFake::$lastQuery->calls[9][0])->toBe('orWhereRaw');
 });

From 659aa17bf20db4d6c33193aa2b7fcee09e90da48 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Sun, 11 Oct 2026 12:25:11 +0800
Subject: [PATCH 36/87] fix(orchestrator): run the engine selected in settings
 and report honest results

The Orchestrator ignored the engine an organization selected. The settings
page saves it to the company setting fleet-ops.allocation-settings
(allocation_engine), but runs read the never-written system key
fleetops.orchestrator_engine and fell back to greedy. The workbench also
hard-coded "greedy" into every phase, and optimize_routes always used the
built-in route sequencer, so VROOM was never used.

- Add OrchestratorSettings as the single reader of the company settings
  (legacy key honoured, greedy default) for the workbench, public API and
  ProcessAllocationJob; the settings page now lists server engines.
- OrchestrationEngineRegistry::allocateWithFallback falls back to greedy
  (multi-order) when the selected engine is missing or unavailable and
  records engine, requested_engine, fallback_reason and a warning.
- optimize_routes runs the selected solver per vehicle, falling back to the
  route sequencer with the reason.
- RouteMetrics adds per-stop arrival and route distance/duration
  (route_distance/route_duration, as the workbench reads) to greedy and
  sequencer results; VROOM now maps route totals, anchors relative
  arrivals to the run start and names itself in the summary.
- The workbench starts phases with the configured engine, lets the server
  pick when none is set, and shows the fallback warning.
---
 addon/components/orchestrator-workbench.hbs   |   8 +-
 addon/components/orchestrator-workbench.js    |  18 +-
 .../components/orchestrator/phase-builder.js  |   3 +-
 addon/controllers/settings/orchestrator.js    |  14 +-
 addon/services/order-allocation.js            |   2 +-
 .../Internal/v1/OrchestrationController.php   |  90 ++++-
 .../Internal/v1/SettingController.php         |  14 +-
 server/src/Jobs/ProcessAllocationJob.php      |  22 +-
 .../Engines/RouteSequencingEngine.php         |  24 +-
 .../Engines/VroomOrchestrationEngine.php      |  46 ++-
 .../OrchestrationEngineRegistry.php           |  62 +++-
 .../Support/OrchestratorSettings.php          |  61 ++++
 .../Orchestration/Support/RouteMetrics.php    | 165 +++++++++
 .../OrchestrationControllerContractsTest.php  | 172 ++++++++-
 .../ProcessAllocationJobContractsTest.php     |  20 ++
 server/tests/RouteSequencingEngineTest.php    |  17 +
 .../EngineSelectionAndRouteMetricsTest.php    | 336 ++++++++++++++++++
 .../VroomOrchestrationEngineLifecycleTest.php |   9 +-
 server/tests/VroomOrchestrationEngineTest.php |  35 +-
 .../components/orchestrator-workbench-test.js | 148 ++++++++
 .../orchestrator/phase-builder-test.js        |  22 ++
 .../controllers/settings/orchestrator-test.js |  68 ++++
 tests/unit/services/order-allocation-test.js  |  39 ++
 23 files changed, 1345 insertions(+), 50 deletions(-)
 create mode 100644 server/src/Orchestration/Support/OrchestratorSettings.php
 create mode 100644 server/src/Orchestration/Support/RouteMetrics.php
 create mode 100644 server/tests/Unit/Orchestration/EngineSelectionAndRouteMetricsTest.php
 create mode 100644 tests/unit/components/orchestrator-workbench-test.js
 create mode 100644 tests/unit/components/orchestrator/phase-builder-test.js
 create mode 100644 tests/unit/controllers/settings/orchestrator-test.js
 create mode 100644 tests/unit/services/order-allocation-test.js

diff --git a/addon/components/orchestrator-workbench.hbs b/addon/components/orchestrator-workbench.hbs
index 5a76e6328..797d2ce33 100644
--- a/addon/components/orchestrator-workbench.hbs
+++ b/addon/components/orchestrator-workbench.hbs
@@ -59,7 +59,13 @@
     {{! ── Phase builder panel (collapsible, below toolbar) ── }}
     {{#if this.showPhaseBuilder}}
         <div class="workbench-phase-panel border-b dark:border-gray-700 bg-white dark:bg-gray-900 flex-shrink-0 h-80">
-            <Orchestrator::PhaseBuilder @phases={{this.phases}} @availableEngines={{this.availableEngines}} @onPhasesChange={{this.onPhasesChange}} @onRunPhases={{this.onRunPhases}} />
+            <Orchestrator::PhaseBuilder
+                @phases={{this.phases}}
+                @availableEngines={{this.availableEngines}}
+                @defaultEngine={{this.defaultEngine}}
+                @onPhasesChange={{this.onPhasesChange}}
+                @onRunPhases={{this.onRunPhases}}
+            />
         </div>
     {{/if}}
 
diff --git a/addon/components/orchestrator-workbench.js b/addon/components/orchestrator-workbench.js
index 2c63fedd8..3f55e4222 100644
--- a/addon/components/orchestrator-workbench.js
+++ b/addon/components/orchestrator-workbench.js
@@ -49,6 +49,8 @@ export default class OrchestratorWorkbenchComponent extends Component {
     @tracked availableVehicles = [];
     @tracked availableDrivers = [];
     @tracked availableEngines = [];
+    /** The engine selected in Orchestrator settings; new phases start with it. */
+    @tracked defaultEngine = null;
 
     // ── Plan state ────────────────────────────────────────────────────────────
 
@@ -204,6 +206,12 @@ export default class OrchestratorWorkbenchComponent extends Component {
         } catch {
             this.availableEngines = [{ id: 'greedy', name: 'Greedy (built-in)' }];
         }
+        try {
+            const settings = yield this.fetch.get('fleet-ops/settings/orchestrator-settings');
+            this.defaultEngine = settings?.allocation_engine ?? null;
+        } catch {
+            this.defaultEngine = null;
+        }
     }
 
     @task *loadCardFields() {
@@ -270,7 +278,8 @@ export default class OrchestratorWorkbenchComponent extends Component {
                 mode: phase.mode,
                 order_statuses: phase.orderStatuses ?? ['created'],
                 options: {
-                    engine: phase.engine ?? 'greedy',
+                    // Without an explicit engine the server runs the one selected in Orchestrator settings.
+                    engine: phase.engine ?? null,
                     allocation_strategy: phase.allocationStrategy ?? 'route_aware',
                     vehicle_packing: phase.vehiclePacking ?? 'minimize_vehicles',
                     balance_workload: phase.balanceWorkload ?? false,
@@ -311,6 +320,11 @@ export default class OrchestratorWorkbenchComponent extends Component {
             if (result.message) {
                 this.orchestratorRunMessage = result.message;
             }
+            // The server substituted another engine (e.g. VROOM unavailable) — say so.
+            if (result.warning) {
+                this.orchestratorRunMessage = result.warning;
+                this.notifications.warning(result.warning, { autoClear: true, clearDuration: 10000 });
+            }
             // If the run returned zero assignments, surface the error/message to
             // the user immediately — otherwise the right panel stays blank with
             // no feedback (PlanViewer is only rendered when hasProposedPlan).
@@ -401,7 +415,7 @@ export default class OrchestratorWorkbenchComponent extends Component {
             id: 'legacy',
             mode: 'allocate',
             label: 'Allocate',
-            engine: 'greedy',
+            engine: null,
             allocationStrategy: 'route_aware',
             orderStatuses: ['created'],
             balanceWorkload: false,
diff --git a/addon/components/orchestrator/phase-builder.js b/addon/components/orchestrator/phase-builder.js
index 86ae71f52..3c12a7730 100644
--- a/addon/components/orchestrator/phase-builder.js
+++ b/addon/components/orchestrator/phase-builder.js
@@ -15,6 +15,7 @@ import { inject as service } from '@ember/service';
  *
  * @arg phases              - Array of phase objects (managed externally)
  * @arg availableEngines    - Array of { id, name } engine options
+ * @arg defaultEngine       - Engine id selected in Orchestrator settings; new phases start with it
  * @arg onPhasesChange      - Action(phases) — called when phases array changes
  * @arg onRunPhases         - Action(phases) — called when "Run" is clicked
  */
@@ -49,7 +50,7 @@ export default class OrchestratorPhaseBuilderComponent extends Component {
             id: crypto.randomUUID(),
             mode,
             label: this.intl.t(`orchestrator.mode-${mode.replace(/_/g, '-')}`),
-            engine: 'greedy',
+            engine: this.args.defaultEngine ?? 'greedy',
             allocationStrategy: 'route_aware',
             vehiclePacking: 'minimize_vehicles',
             orderStatuses: ['created'],
diff --git a/addon/controllers/settings/orchestrator.js b/addon/controllers/settings/orchestrator.js
index be24bcc69..bb7039f76 100644
--- a/addon/controllers/settings/orchestrator.js
+++ b/addon/controllers/settings/orchestrator.js
@@ -17,7 +17,8 @@ export default class SettingsOrchestratorController extends Controller {
     @service intl;
     @service('orchestration-engine') engineRegistry;
 
-    @tracked allocationEngine = 'vroom';
+    @tracked allocationEngine = 'greedy';
+    @tracked serverEngines = null;
     @tracked autoAllocateOnCreate = false;
     @tracked autoReallocateOnComplete = false;
     @tracked maxTravelTimeSeconds = 3600;
@@ -26,18 +27,19 @@ export default class SettingsOrchestratorController extends Controller {
 
     /**
      * Engine options for the selector dropdown.
-     * Populated from the allocation-engine registry so new engines appear
-     * automatically without modifying this controller.
+     * Populated from the engines registered on the server (the ones a run can
+     * actually use), falling back to the frontend allocation-engine registry.
      */
     get engineOptions() {
-        return this.engineRegistry.availableEngines;
+        return this.serverEngines ?? this.engineRegistry.availableEngines;
     }
 
     @task *loadSettings() {
         this.isLoading = true;
         try {
-            const settings = yield this.fetch.get('fleet-ops/settings/orchestrator-settings');
-            this.allocationEngine = settings.allocation_engine ?? 'vroom';
+            const [settings, engines] = yield Promise.all([this.fetch.get('fleet-ops/settings/orchestrator-settings'), this.fetch.get('fleet-ops/orchestrator/engines').catch(() => null)]);
+            this.serverEngines = engines?.engines ?? null;
+            this.allocationEngine = settings.allocation_engine ?? 'greedy';
             this.autoAllocateOnCreate = settings.auto_allocate_on_create ?? false;
             this.autoReallocateOnComplete = settings.auto_reallocate_on_complete ?? false;
             this.maxTravelTimeSeconds = settings.max_travel_time_seconds ?? 3600;
diff --git a/addon/services/order-allocation.js b/addon/services/order-allocation.js
index 3b2880b8c..3132c6894 100644
--- a/addon/services/order-allocation.js
+++ b/addon/services/order-allocation.js
@@ -35,7 +35,7 @@ export default class OrderAllocationService extends Service {
     @task *loadSettings() {
         try {
             const settings = yield this.fetch.get('fleet-ops/settings/orchestrator-settings');
-            this.activeEngineId = settings.orchestrator_engine ?? 'greedy';
+            this.activeEngineId = settings.allocation_engine ?? 'greedy';
             return settings;
         } catch (error) {
             this.notifications.serverError(error);
diff --git a/server/src/Http/Controllers/Internal/v1/OrchestrationController.php b/server/src/Http/Controllers/Internal/v1/OrchestrationController.php
index 965960a58..cfccd48b5 100644
--- a/server/src/Http/Controllers/Internal/v1/OrchestrationController.php
+++ b/server/src/Http/Controllers/Internal/v1/OrchestrationController.php
@@ -13,12 +13,14 @@
 use Fleetbase\FleetOps\Models\Place;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Orchestration\Contracts\OrchestrationEngineInterface;
 use Fleetbase\FleetOps\Orchestration\Engines\DriverAssignmentEngine;
 use Fleetbase\FleetOps\Orchestration\Engines\RouteSequencingEngine;
 use Fleetbase\FleetOps\Orchestration\OrchestrationEngineRegistry;
+use Fleetbase\FleetOps\Orchestration\Support\OrchestratorSettings;
+use Fleetbase\FleetOps\Orchestration\Support\RouteMetrics;
 use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
-use Fleetbase\Models\Setting;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Carbon;
@@ -42,6 +44,11 @@ class OrchestrationController extends Controller
 {
     use AuthorizesMethods;
 
+    /**
+     * Engines that assign orders to vehicles without producing a stop sequence.
+     */
+    protected const ASSIGNMENT_ONLY_ENGINES = ['greedy', 'capacity'];
+
     public function __construct(protected OrchestrationEngineRegistry $registry)
     {
         $this->authorizeMethods([
@@ -281,7 +288,7 @@ public function run(Request $request): JsonResponse
         // ── Run engine ────────────────────────────────────────────────────────
         $engineId = $mode === 'assign_drivers'
             ? 'driver_assignment'
-            : ($request->input('options.engine') ?? $this->orchestratorEngineSetting());
+            : ($request->input('options.engine') ?: $this->orchestratorEngineSetting());
 
         try {
             if ($mode === 'assign_drivers') {
@@ -308,14 +315,13 @@ public function run(Request $request): JsonResponse
                         }
                     }
                 }
-                $engine = $this->routeSequencingEngine();
-                $result = $engine->sequence($orders, $options);
+                $result = $this->optimizeRoutes($engineId, $orders, $options);
             } else {
-                $engine = $this->registry->resolve($engineId);
-                $result = $engine->allocate($orders, $vehicles, $options);
+                $result = $this->registry->allocateWithFallback($engineId, $orders, $vehicles, $options);
             }
         } catch (\RuntimeException $e) {
-            // Engine is unavailable (e.g. VROOM not reachable).
+            // Engine is unavailable (e.g. VROOM not reachable) and there is no
+            // built-in engine to fall back to.
             // Return a structured JSON 503 so the frontend can display a
             // user-friendly message instead of an unhandled exception page.
             return response()->json([
@@ -325,6 +331,10 @@ public function run(Request $request): JsonResponse
             ], 503);
         }
 
+        if ($mode !== 'assign_drivers') {
+            $result = RouteMetrics::annotate($result, $orders, $vehicles);
+        }
+
         return response()->json($result);
     }
 
@@ -384,7 +394,71 @@ protected function vehicleByUuidWithDriver(string $uuid): ?Vehicle
 
     protected function orchestratorEngineSetting(): string
     {
-        return Setting::lookup('fleetops.orchestrator_engine', 'greedy');
+        return OrchestratorSettings::engineForCompany($this->companyUuid());
+    }
+
+    /**
+     * Re-sequence each vehicle's already-assigned orders.
+     *
+     * A solver engine (e.g. VROOM) is run once per vehicle, restricted to
+     * that vehicle and its orders, so the stop order, arrival times and
+     * distances come from the selected engine. Engines that only assign
+     * orders (greedy, capacity) cannot sequence stops, and a solver that is
+     * missing or unavailable is replaced; in both cases the built-in route
+     * sequencer runs and the result says which engine ran and why.
+     */
+    protected function optimizeRoutes(string $engineId, $orders, array $options): array
+    {
+        $warn = true;
+        if (in_array($engineId, self::ASSIGNMENT_ONLY_ENGINES, true)) {
+            $warn   = false;
+            $reason = sprintf('The "%s" engine assigns orders but does not sequence stops; stops were sequenced by the built-in route sequencer.', $engineId);
+        } elseif (!$this->registry->has($engineId)) {
+            $reason = sprintf('No orchestration engine is registered as "%s".', $engineId);
+        } else {
+            try {
+                return $this->sequenceWithEngine($this->registry->resolve($engineId), $orders, $options);
+            } catch (\RuntimeException $e) {
+                $reason = $e->getMessage();
+            }
+        }
+
+        $result = $this->routeSequencingEngine()->sequence($orders, $options);
+
+        return OrchestrationEngineRegistry::markFallback($result, $result['summary']['engine'] ?? 'route_sequencing', $engineId, $reason, $warn);
+    }
+
+    /**
+     * Run a solver engine once per vehicle group, keeping every order on its vehicle.
+     */
+    protected function sequenceWithEngine(OrchestrationEngineInterface $engine, $orders, array $options): array
+    {
+        $options     = array_merge($options, ['allocation_strategy' => 'route_aware']);
+        $assignments = [];
+        $unassigned  = [];
+
+        foreach ($orders->groupBy(fn ($order) => $order->vehicle_assigned_uuid ?? '') as $vehicleUuid => $vehicleOrders) {
+            $vehicle = $vehicleUuid !== '' && $vehicleOrders->first()->relationLoaded('vehicle') ? $vehicleOrders->first()->vehicle : null;
+            if (!$vehicle) {
+                // Without an assigned vehicle there is no route to sequence.
+                array_push($unassigned, ...$vehicleOrders->pluck('public_id')->all());
+                continue;
+            }
+
+            $result = $engine->allocate($vehicleOrders->values(), collect([$vehicle]), $options);
+            array_push($assignments, ...($result['assignments'] ?? []));
+            array_push($unassigned, ...($result['unassigned'] ?? []));
+        }
+
+        return [
+            'assignments' => $assignments,
+            'unassigned'  => array_values(array_unique($unassigned)),
+            'summary'     => [
+                'engine'     => $engine->getIdentifier(),
+                'assigned'   => count($assignments),
+                'unassigned' => count(array_unique($unassigned)),
+            ],
+        ];
     }
 
     protected function driverAssignmentEngine(): DriverAssignmentEngine
diff --git a/server/src/Http/Controllers/Internal/v1/SettingController.php b/server/src/Http/Controllers/Internal/v1/SettingController.php
index 3699c4bf7..1b9721f83 100644
--- a/server/src/Http/Controllers/Internal/v1/SettingController.php
+++ b/server/src/Http/Controllers/Internal/v1/SettingController.php
@@ -3,6 +3,7 @@
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
 use Fleetbase\FleetOps\Jobs\DispatchTelematicsRetentionJobs;
+use Fleetbase\FleetOps\Orchestration\Support\OrchestratorSettings;
 use Fleetbase\FleetOps\Support\Telematics\Retention\RetentionPolicy;
 use Fleetbase\FleetOps\Support\Telematics\Telemetry\Queue;
 use Fleetbase\FleetOps\Support\TrackingPage\TrackingPageConfig;
@@ -555,14 +556,7 @@ public function saveSchedulingSettings(Request $request)
      */
     public function getOrchestratorSettings()
     {
-        $defaults = [
-            'allocation_engine'           => 'vroom',
-            'auto_allocate_on_create'     => false,
-            'auto_reallocate_on_complete' => false,
-            'max_travel_time_seconds'     => 3600,
-            'balance_workload'            => false,
-        ];
-        $settings = $this->lookupFromCompanySetting('fleet-ops.allocation-settings', $defaults);
+        $settings = $this->lookupFromCompanySetting(OrchestratorSettings::KEY, OrchestratorSettings::defaults());
 
         return response()->json($settings);
     }
@@ -575,13 +569,13 @@ public function getOrchestratorSettings()
     public function saveOrchestratorSettings(Request $request)
     {
         $settings = [
-            'allocation_engine'           => $request->input('allocation_engine', 'vroom'),
+            'allocation_engine'           => $request->input('allocation_engine', OrchestratorSettings::DEFAULT_ENGINE),
             'auto_allocate_on_create'     => (bool) $request->input('auto_allocate_on_create', false),
             'auto_reallocate_on_complete' => (bool) $request->input('auto_reallocate_on_complete', false),
             'max_travel_time_seconds'     => (int) $request->input('max_travel_time_seconds', 3600),
             'balance_workload'            => (bool) $request->input('balance_workload', false),
         ];
-        $this->configureCompanySetting('fleet-ops.allocation-settings', $settings);
+        $this->configureCompanySetting(OrchestratorSettings::KEY, $settings);
 
         return response()->json($settings);
     }
diff --git a/server/src/Jobs/ProcessAllocationJob.php b/server/src/Jobs/ProcessAllocationJob.php
index b9741af32..47012ce43 100644
--- a/server/src/Jobs/ProcessAllocationJob.php
+++ b/server/src/Jobs/ProcessAllocationJob.php
@@ -6,7 +6,7 @@
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Orchestration\OrchestrationEngineRegistry;
-use Fleetbase\Models\Setting;
+use Fleetbase\FleetOps\Orchestration\Support\OrchestratorSettings;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
@@ -69,9 +69,17 @@ public function handle(OrchestrationEngineRegistry $registry): void
             return;
         }
 
-        $engine = $registry->resolve($this->engineId());
+        $result = $registry->allocateWithFallback($this->engineId(), $orders, $vehicles, $this->allocationOptions());
 
-        $result = $engine->allocate($orders, $vehicles, $this->allocationOptions());
+        if (!empty($result['summary']['fallback_reason'])) {
+            $this->logInfo(sprintf(
+                '[ProcessAllocationJob] Used the %s engine instead of %s for company %s: %s',
+                $result['summary']['engine'],
+                $result['summary']['requested_engine'],
+                $this->companyUuid,
+                $result['summary']['fallback_reason']
+            ));
+        }
 
         foreach ($result['assignments'] as $assignment) {
             $order  = $this->findOrderByPublicId($assignment['order_id']);
@@ -125,14 +133,16 @@ protected function availableVehicles()
 
     protected function engineId(): string
     {
-        return Setting::lookup('fleetops.orchestrator_engine', 'greedy');
+        return OrchestratorSettings::engineForCompany($this->companyUuid);
     }
 
     protected function allocationOptions(): array
     {
+        $settings = OrchestratorSettings::forCompany($this->companyUuid);
+
         return [
-            'max_travel_time'  => Setting::lookup('fleetops.allocation_max_travel_time', 3600),
-            'balance_workload' => Setting::lookup('fleetops.allocation_balance_workload', false),
+            'max_travel_time'  => (int) $settings['max_travel_time_seconds'],
+            'balance_workload' => (bool) $settings['balance_workload'],
         ];
     }
 
diff --git a/server/src/Orchestration/Engines/RouteSequencingEngine.php b/server/src/Orchestration/Engines/RouteSequencingEngine.php
index 3f6ade888..8bdf1e08a 100644
--- a/server/src/Orchestration/Engines/RouteSequencingEngine.php
+++ b/server/src/Orchestration/Engines/RouteSequencingEngine.php
@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Orchestration\Engines;
 
+use Fleetbase\FleetOps\Orchestration\Support\RouteMetrics;
 use Illuminate\Support\Collection;
 
 /**
@@ -18,6 +19,8 @@
  *      using a nearest-neighbour TSP heuristic.
  *   3. Returns one assignment entry per order, preserving the existing
  *      vehicle_id / driver_id and updating only the sequence number.
+ *   4. Estimates arrival times and route distance/duration along the
+ *      sequenced stops (see RouteMetrics).
  *
  * This ensures that running "Assign Vehicles" followed by "Optimize Routes"
  * produces one properly-sequenced route per vehicle rather than re-running
@@ -37,6 +40,9 @@ public function sequence(Collection $orders, array $options = []): array
     {
         $assignments = [];
         $unassigned  = [];
+        $startTime   = now()->timestamp;
+        $distance    = 0;
+        $duration    = 0;
 
         // Group orders by their currently assigned vehicle UUID
         $byVehicle = [];
@@ -73,6 +79,13 @@ public function sequence(Collection $orders, array $options = []): array
             // (or waypoints for multi-drop orders). We keep pickup before its own
             // dropoff as a hard constraint.
             $sequenced = $this->_sequenceOrdersForVehicle($vehicleOrders, $startLat, $startLng);
+            $metrics   = RouteMetrics::measure(
+                $startLat !== null && $startLng !== null ? [$startLat, $startLng] : null,
+                array_map(fn ($stop) => ['order_id' => $stop['order_public_id'], 'lat' => $stop['lat'], 'lng' => $stop['lng']], $sequenced),
+                $startTime
+            );
+            $distance += $metrics['distance'];
+            $duration += $metrics['duration'];
 
             // Build assignment entries — one per order, with the sequence number
             // being the position of the order's FIRST stop in the sequenced list.
@@ -92,9 +105,11 @@ public function sequence(Collection $orders, array $options = []): array
                     'driver_id'         => $driverPublicId,
                     'sequence'          => $orderSequences[$order->public_id] ?? 1,
                     'waypoint_sequence' => null,
-                    'arrival'           => null,
-                    'duration'          => null,
-                    'distance'          => null,
+                    'arrival'           => $metrics['orders'][$order->public_id]['arrival'] ?? null,
+                    'duration'          => $metrics['orders'][$order->public_id]['duration'] ?? null,
+                    'distance'          => $metrics['orders'][$order->public_id]['distance'] ?? null,
+                    'route_distance'    => $metrics['distance'],
+                    'route_duration'    => $metrics['duration'],
                 ];
             }
         }
@@ -106,6 +121,9 @@ public function sequence(Collection $orders, array $options = []): array
                 'engine'     => 'route_sequencing',
                 'assigned'   => count($assignments),
                 'unassigned' => count($unassigned),
+                'distance'   => $distance,
+                'duration'   => $duration,
+                'metrics'    => 'estimated',
             ],
         ];
     }
diff --git a/server/src/Orchestration/Engines/VroomOrchestrationEngine.php b/server/src/Orchestration/Engines/VroomOrchestrationEngine.php
index ecb3e74b9..1caa2e888 100644
--- a/server/src/Orchestration/Engines/VroomOrchestrationEngine.php
+++ b/server/src/Orchestration/Engines/VroomOrchestrationEngine.php
@@ -37,6 +37,11 @@
  */
 class VroomOrchestrationEngine implements OrchestrationEngineInterface
 {
+    /**
+     * Arrivals below this (2001-09-09) are offsets from the route start, not unix timestamps.
+     */
+    protected const ABSOLUTE_TIMESTAMP_THRESHOLD = 1000000000;
+
     /**
      * The company whose VROOM settings apply to the current allocation run.
      * Resolved from the orders so queued runs work without a company session.
@@ -202,6 +207,14 @@ protected function allocateCapacityOnly(Collection $orders, Collection $vehicles
 
         $result = $this->mapVroomResponse($this->callVroom($vroomPayload), $jobIdReverse);
 
+        // Capacity-only solves run on a uniform placeholder matrix, so VROOM's
+        // timings are meaningless here; clear them so real estimates replace them.
+        $result['assignments'] = array_map(
+            fn (array $assignment) => array_merge($assignment, array_fill_keys(['arrival', 'duration', 'distance', 'route_distance', 'route_duration'], null)),
+            $result['assignments']
+        );
+        unset($result['summary']['distance'], $result['summary']['duration']);
+
         $result['summary'] = array_merge($result['summary'] ?? [], [
             'engine'              => 'vroom',
             'allocation_strategy' => 'capacity_only',
@@ -339,6 +352,7 @@ protected function partitionRouteTasks(array $tasks): array
     protected function mapVroomResponse(array $vroomResult, array $jobIdReverse): array
     {
         $assignments = [];
+        $startTime   = now()->timestamp;
 
         foreach ($vroomResult['routes'] ?? [] as $route) {
             $vehicleDesc = json_decode($route['description'] ?? '{}', true);
@@ -355,13 +369,15 @@ protected function mapVroomResponse(array $vroomResult, array $jobIdReverse): ar
                     continue;
                 }
                 $assignments[] = [
-                    'order_id'   => $orderId,
-                    'vehicle_id' => $vehicleId,
-                    'driver_id'  => $driverId,
-                    'sequence'   => ++$sequence,
-                    'arrival'    => $step['arrival'] ?? null,
-                    'duration'   => $step['duration'] ?? null,
-                    'distance'   => $step['distance'] ?? null,
+                    'order_id'       => $orderId,
+                    'vehicle_id'     => $vehicleId,
+                    'driver_id'      => $driverId,
+                    'sequence'       => ++$sequence,
+                    'arrival'        => $this->absoluteArrival($step['arrival'] ?? null, $startTime),
+                    'duration'       => $step['duration'] ?? null,
+                    'distance'       => $step['distance'] ?? null,
+                    'route_distance' => $route['distance'] ?? null,
+                    'route_duration' => $route['duration'] ?? null,
                 ];
             }
         }
@@ -374,10 +390,24 @@ protected function mapVroomResponse(array $vroomResult, array $jobIdReverse): ar
         return [
             'assignments' => $assignments,
             'unassigned'  => array_values(array_unique($unassigned)),
-            'summary'     => $vroomResult['summary'] ?? [],
+            'summary'     => array_merge(['engine' => 'vroom'], $vroomResult['summary'] ?? []),
         ];
     }
 
+    /**
+     * VROOM reports arrivals on the timeline of the time windows it was given.
+     * Without absolute windows that timeline starts at 0, so small values are
+     * offsets from the start of the run rather than unix timestamps.
+     */
+    protected function absoluteArrival($arrival, int $startTime): ?int
+    {
+        if ($arrival === null) {
+            return null;
+        }
+
+        return $arrival < self::ABSOLUTE_TIMESTAMP_THRESHOLD ? $startTime + (int) $arrival : (int) $arrival;
+    }
+
     protected function mapTaskToVroomJob(array $task, array &$jobIdReverse): ?array
     {
         $stop = $task['stops'][0] ?? null;
diff --git a/server/src/Orchestration/OrchestrationEngineRegistry.php b/server/src/Orchestration/OrchestrationEngineRegistry.php
index af5ca5b54..5533edea5 100644
--- a/server/src/Orchestration/OrchestrationEngineRegistry.php
+++ b/server/src/Orchestration/OrchestrationEngineRegistry.php
@@ -3,6 +3,7 @@
 namespace Fleetbase\FleetOps\Orchestration;
 
 use Fleetbase\FleetOps\Orchestration\Contracts\OrchestrationEngineInterface;
+use Illuminate\Support\Collection;
 
 /**
  * OrchestrationEngineRegistry.
@@ -10,7 +11,7 @@
  * A simple service-locator for orchestration engines. Engines register
  * themselves (typically from a service provider) and the
  * OrchestrationController resolves the active engine at runtime from the
- * FleetOps setting key 'fleetops.orchestrator_engine'.
+ * organization's Orchestrator settings (see OrchestratorSettings).
  *
  * Third-party extensions can register their own engines by resolving this
  * registry in their service provider:
@@ -21,6 +22,11 @@
  */
 class OrchestrationEngineRegistry
 {
+    /**
+     * Built-in engine that runs when the selected engine is missing or unavailable.
+     */
+    public const FALLBACK_ENGINE = 'greedy';
+
     /**
      * Registered engines keyed by their identifier.
      *
@@ -80,4 +86,58 @@ public function has(string $identifier): bool
     {
         return isset($this->engines[$identifier]);
     }
+
+    /**
+     * Run the selected engine, falling back to the built-in greedy engine when
+     * the selected engine is not registered or reports itself unavailable
+     * (a RuntimeException, e.g. VROOM unreachable or misconfigured).
+     *
+     * The result's summary always names the engine that produced it. A
+     * fallback result also carries `requested_engine` and `fallback_reason`
+     * so callers can tell the user the plan did not come from their engine.
+     *
+     * @throws \RuntimeException when the selected engine fails and there is no fallback to run
+     */
+    public function allocateWithFallback(string $identifier, Collection $orders, Collection $vehicles, array $options = []): array
+    {
+        try {
+            $engine            = $this->resolve($identifier);
+            $result            = $engine->allocate($orders, $vehicles, $options);
+            $result['summary'] = array_merge(['engine' => $engine->getIdentifier()], $result['summary'] ?? []);
+
+            return $result;
+        } catch (\RuntimeException $e) {
+            if ($identifier === static::FALLBACK_ENGINE || !$this->has(static::FALLBACK_ENGINE)) {
+                throw $e;
+            }
+
+            // The selected solvers build multi-stop routes, so the fallback
+            // must too or orders would be dropped when vehicles are scarce.
+            $result = $this->resolve(static::FALLBACK_ENGINE)->allocate($orders, $vehicles, array_merge(['allow_multi_order' => true], $options));
+
+            return static::markFallback($result, static::FALLBACK_ENGINE, $identifier, $e->getMessage());
+        }
+    }
+
+    /**
+     * Record on a result that it came from a different engine than requested, and why.
+     *
+     * @param bool $warn whether the substitution is a failure the user should be warned about,
+     *                   rather than the expected behaviour for the requested engine
+     */
+    public static function markFallback(array $result, string $engine, string $requestedEngine, string $reason, bool $warn = true): array
+    {
+        $result['summary'] = array_merge($result['summary'] ?? [], [
+            'engine'           => $engine,
+            'requested_engine' => $requestedEngine,
+            'fallback_reason'  => $reason,
+        ]);
+        if (!$warn) {
+            return $result;
+        }
+
+        $result['warning'] = sprintf('The "%s" engine was used instead of "%s": %s', $engine, $requestedEngine, $reason);
+
+        return $result;
+    }
 }
diff --git a/server/src/Orchestration/Support/OrchestratorSettings.php b/server/src/Orchestration/Support/OrchestratorSettings.php
new file mode 100644
index 000000000..eca140c1a
--- /dev/null
+++ b/server/src/Orchestration/Support/OrchestratorSettings.php
@@ -0,0 +1,61 @@
+<?php
+
+namespace Fleetbase\FleetOps\Orchestration\Support;
+
+use Fleetbase\Models\Setting;
+
+/**
+ * OrchestratorSettings.
+ *
+ * Single reader for the organization's Orchestrator settings. The settings
+ * page saves them as one company setting (`fleet-ops.allocation-settings`);
+ * every runtime consumer (workbench runs, the public API, auto-allocation)
+ * reads them through here so they all see what the organization selected.
+ */
+class OrchestratorSettings
+{
+    public const KEY = 'fleet-ops.allocation-settings';
+
+    /**
+     * System-level engine key read before the company setting existed.
+     * Still honoured as the default for organizations that never saved.
+     */
+    public const LEGACY_ENGINE_KEY = 'fleetops.orchestrator_engine';
+
+    public const DEFAULT_ENGINE = 'greedy';
+
+    public static function defaults(): array
+    {
+        return [
+            'allocation_engine'           => static::DEFAULT_ENGINE,
+            'auto_allocate_on_create'     => false,
+            'auto_reallocate_on_complete' => false,
+            'max_travel_time_seconds'     => 3600,
+            'balance_workload'            => false,
+        ];
+    }
+
+    /**
+     * Resolve the organization's settings merged over the defaults.
+     */
+    public static function forCompany(?string $companyUuid): array
+    {
+        $saved    = Setting::lookupForCompany($companyUuid, static::KEY, []);
+        $saved    = array_filter(is_array($saved) ? $saved : [], fn ($value) => $value !== null && $value !== '');
+        $defaults = static::defaults();
+
+        if (!isset($saved['allocation_engine'])) {
+            $defaults['allocation_engine'] = Setting::lookup(static::LEGACY_ENGINE_KEY) ?: static::DEFAULT_ENGINE;
+        }
+
+        return array_merge($defaults, $saved);
+    }
+
+    /**
+     * Identifier of the orchestration engine the organization selected.
+     */
+    public static function engineForCompany(?string $companyUuid): string
+    {
+        return (string) static::forCompany($companyUuid)['allocation_engine'];
+    }
+}
diff --git a/server/src/Orchestration/Support/RouteMetrics.php b/server/src/Orchestration/Support/RouteMetrics.php
new file mode 100644
index 000000000..5417e20ef
--- /dev/null
+++ b/server/src/Orchestration/Support/RouteMetrics.php
@@ -0,0 +1,165 @@
+<?php
+
+namespace Fleetbase\FleetOps\Orchestration\Support;
+
+use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\LaravelMysqlSpatial\Types\Point;
+use Illuminate\Support\Collection;
+
+/**
+ * RouteMetrics.
+ *
+ * Estimates per-stop arrival times and route distance/duration for engines
+ * that only decide a sequence (greedy, the built-in route sequencer) or for
+ * solver routes that came back without some of those figures.
+ *
+ * Legs are measured with FleetOps' local distance-matrix calculation
+ * (Utils::calculateDrivingDistanceAndTime), which needs no routing provider,
+ * so estimates are always available and are flagged as such in the summary.
+ *
+ * Assignment fields follow the VROOM step convention so every engine
+ * produces the same shape:
+ *   - arrival:        unix timestamp the vehicle reaches the order's last stop
+ *   - distance:       cumulative route distance (m) at that stop
+ *   - duration:       cumulative travel time (s) at that stop
+ *   - route_distance: total distance (m) of the vehicle's route
+ *   - route_duration: total travel time (s) of the vehicle's route
+ */
+class RouteMetrics
+{
+    /**
+     * Measure an ordered stop list.
+     *
+     * @param array|null $start     [lat, lng] the vehicle starts from, or null to start at the first stop
+     * @param array      $stops     ordered list of ['order_id' => string, 'lat' => float, 'lng' => float]
+     * @param int        $startTime unix timestamp the route starts
+     *
+     * @return array{orders: array<string, array{arrival: int, distance: int, duration: int}>, distance: int, duration: int}
+     */
+    public static function measure(?array $start, array $stops, int $startTime): array
+    {
+        $distance = 0.0;
+        $duration = 0.0;
+        $previous = $start;
+        $orders   = [];
+
+        foreach ($stops as $stop) {
+            $current = [(float) $stop['lat'], (float) $stop['lng']];
+
+            if ($previous !== null) {
+                $leg = Utils::calculateDrivingDistanceAndTime(new Point($previous[0], $previous[1]), new Point($current[0], $current[1]));
+                $distance += (float) $leg->distance;
+                $duration += (float) $leg->time;
+            }
+
+            // The order's figures are those of its last stop in the route.
+            $orders[$stop['order_id']] = [
+                'arrival'  => $startTime + (int) round($duration),
+                'distance' => (int) round($distance),
+                'duration' => (int) round($duration),
+            ];
+            $previous = $current;
+        }
+
+        return [
+            'orders'   => $orders,
+            'distance' => (int) round($distance),
+            'duration' => (int) round($duration),
+        ];
+    }
+
+    /**
+     * Fill in arrival, distance and duration figures the engine did not supply.
+     *
+     * A route without any engine timing is estimated in full; a route with
+     * engine timing keeps the engine's figures and only has gaps filled.
+     *
+     * @param array      $result   standard orchestration result
+     * @param Collection $orders   orders that were orchestrated, keyed or not
+     * @param Collection $vehicles vehicles that were available to the run
+     */
+    public static function annotate(array $result, Collection $orders, Collection $vehicles, ?int $startTime = null): array
+    {
+        $assignments = $result['assignments'] ?? [];
+        if (empty($assignments)) {
+            return $result;
+        }
+
+        $startTime     = $startTime ?? now()->timestamp;
+        $ordersById    = $orders->keyBy('public_id');
+        $vehiclesById  = $vehicles->keyBy('public_id');
+        $routes        = [];
+        $estimated     = false;
+
+        foreach ($assignments as $index => $assignment) {
+            $routes[$assignment['vehicle_id'] ?? ''][] = $index;
+        }
+
+        foreach ($routes as $vehicleId => $indexes) {
+            usort($indexes, fn ($a, $b) => ($assignments[$a]['sequence'] ?? 0) <=> ($assignments[$b]['sequence'] ?? 0));
+
+            $hasEngineTiming = collect($indexes)->contains(fn ($i) => ($assignments[$i]['arrival'] ?? null) !== null
+                || ($assignments[$i]['route_duration'] ?? null) !== null
+                || ($assignments[$i]['route_distance'] ?? null) !== null);
+
+            $stops = [];
+            foreach ($indexes as $i) {
+                $order = $ordersById->get($assignments[$i]['order_id'] ?? null);
+                if (!$order) {
+                    continue;
+                }
+                foreach (OrchestrationPayloadBuilder::buildRouteStops($order) as $stop) {
+                    $stops[] = ['order_id' => $order->public_id, 'lng' => $stop['location'][0], 'lat' => $stop['location'][1]];
+                }
+            }
+
+            $metrics = static::measure(static::vehicleStart($vehiclesById->get($vehicleId), $ordersById, $assignments, $indexes), $stops, $startTime);
+
+            foreach ($indexes as $i) {
+                $orderMetrics = $metrics['orders'][$assignments[$i]['order_id'] ?? ''] ?? null;
+                $estimate     = [
+                    'arrival'        => $orderMetrics['arrival'] ?? null,
+                    'distance'       => $orderMetrics['distance'] ?? null,
+                    'duration'       => $orderMetrics['duration'] ?? null,
+                    'route_distance' => $metrics['distance'],
+                    'route_duration' => $metrics['duration'],
+                ];
+
+                foreach ($estimate as $key => $value) {
+                    if (!$hasEngineTiming || ($assignments[$i][$key] ?? null) === null) {
+                        $assignments[$i][$key] = $value;
+                        $estimated             = true;
+                    }
+                }
+            }
+        }
+
+        $result['assignments'] = $assignments;
+
+        $summary            = $result['summary'] ?? [];
+        $routeTotals        = collect($routes)->map(fn ($indexes) => $assignments[$indexes[0]]);
+        $summary['distance'] ??= (int) $routeTotals->sum('route_distance');
+        $summary['duration'] ??= (int) $routeTotals->sum('route_duration');
+        $summary['metrics'] = $estimated ? 'estimated' : ($summary['metrics'] ?? 'engine');
+        $result['summary']  = $summary;
+
+        return $result;
+    }
+
+    /**
+     * Resolve the [lat, lng] a vehicle starts from: the run's vehicle list
+     * first, then the vehicle relation of one of its orders.
+     */
+    protected static function vehicleStart($vehicle, Collection $ordersById, array $assignments, array $indexes): ?array
+    {
+        if (!$vehicle) {
+            $order   = $ordersById->get($assignments[$indexes[0]]['order_id'] ?? null);
+            $vehicle = $order?->relationLoaded('vehicle') ? $order->vehicle : null;
+        }
+
+        $driver   = $vehicle?->relationLoaded('driver') ? $vehicle->driver : null;
+        $location = $driver?->location ?? $vehicle?->location;
+
+        return $location ? [(float) $location->getLat(), (float) $location->getLng()] : null;
+    }
+}
diff --git a/server/tests/Feature/Http/Internal/OrchestrationControllerContractsTest.php b/server/tests/Feature/Http/Internal/OrchestrationControllerContractsTest.php
index d5f674190..c28f3795f 100644
--- a/server/tests/Feature/Http/Internal/OrchestrationControllerContractsTest.php
+++ b/server/tests/Feature/Http/Internal/OrchestrationControllerContractsTest.php
@@ -327,6 +327,9 @@ function fleetopsOrchestrationOrder(string $publicId, ?string $dropoffUuid = 'dr
     $payload = new Payload();
     $payload->setRawAttributes(['uuid' => 'payload-' . $publicId], true);
     $payload->setRelation('dropoff', $dropoff);
+    // the run resolves route stops, so every stop relation is set up front
+    $payload->setRelation('pickup', null);
+    $payload->setRelation('waypoints', collect());
 
     $order = new FleetOpsOrchestrationCommitOrderFake();
     $order->setRawAttributes([
@@ -518,8 +521,17 @@ function callOrchestrationControllerHelper(OrchestrationController $controller,
         'mode' => 'optimize_routes',
     ]));
 
+    $payload = $response->getData(true);
+
+    // greedy (the probe's configured engine) cannot sequence stops, so the
+    // built-in sequencer runs and the summary says so without raising a warning
     expect($response->getStatusCode())->toBe(200)
-        ->and($response->getData(true)['summary'])->toBe(['engine' => 'route_sequence_fake'])
+        ->and($payload['summary'])->toMatchArray([
+            'engine'           => 'route_sequence_fake',
+            'requested_engine' => 'greedy',
+        ])
+        ->and($payload['summary']['fallback_reason'])->toContain('does not sequence stops')
+        ->and($payload)->not->toHaveKey('warning')
         ->and($order->relationLoaded('vehicle'))->toBeTrue()
         ->and($order->vehicle->driver->public_id)->toBe('driver_one')
         ->and($controller->routeEngine->calls)->toHaveCount(1);
@@ -926,3 +938,161 @@ public function callSanitize(mixed $payload): mixed
     expect($matched->vehicle_assigned_uuid)->toBe('vehicle_one-uuid')
         ->and($unmatched->vehicle_assigned_uuid)->toBeNull();
 });
+
+class FleetOpsSolverEngineFake implements OrchestrationEngineInterface
+{
+    public array $calls = [];
+
+    public function allocate(Collection $orders, Collection $vehicles, array $options = []): array
+    {
+        $this->calls[] = compact('orders', 'vehicles', 'options');
+        $vehicle       = $vehicles->first();
+
+        return [
+            'assignments' => $orders->values()->map(fn ($order, $index) => [
+                'order_id'       => $order->public_id,
+                'vehicle_id'     => $vehicle->public_id,
+                'driver_id'      => null,
+                'sequence'       => $index + 1,
+                'arrival'        => 1778918400 + $index,
+                'duration'       => 600,
+                'distance'       => 4200,
+                'route_distance' => 4200,
+                'route_duration' => 600,
+            ])->all(),
+            'unassigned'  => [],
+            'summary'     => ['cost' => 600],
+        ];
+    }
+
+    public function getName(): string
+    {
+        return 'VROOM';
+    }
+
+    public function getIdentifier(): string
+    {
+        return 'vroom';
+    }
+}
+
+function fleetopsOrchestrationAssignedOrder(string $publicId, ?string $vehicleUuid, ?Vehicle $vehicle = null): FleetOpsOrchestrationCommitOrderFake
+{
+    $order                        = fleetopsOrchestrationOrder($publicId);
+    $order->vehicle_assigned_uuid = $vehicleUuid;
+    if ($vehicle) {
+        $order->setRelation('vehicle', $vehicle);
+    }
+
+    return $order;
+}
+
+test('orchestration run falls back to greedy and reports why when the selected engine is unavailable', function () {
+    $registry = new OrchestrationEngineRegistry();
+    $registry->register(new GreedyOrchestrationEngine());
+    $registry->register(new FleetOpsThrowingOrchestrationEngineFake());
+
+    $vehicle = fleetopsOrchestrationVehicle('vehicle_one');
+    $vehicle->setRelation('driver', fleetopsOrchestrationDriver('driver_one'));
+
+    $controller                = new FleetOpsOrchestrationCommitControllerProbe($registry);
+    $controller->engineSetting = 'throwing';
+    $controller->orderQuery    = new FleetOpsOrchestrationQueryFake(collect([fleetopsOrchestrationOrder('order_one'), fleetopsOrchestrationOrder('order_two')]));
+    $controller->vehicleQuery  = new FleetOpsOrchestrationQueryFake(collect([$vehicle]));
+
+    // an empty engine option defers to the organization's selected engine
+    $response = $controller->run(Request::create('/orchestrator/run', 'POST', [
+        'mode'    => 'assign_vehicles',
+        'options' => ['engine' => ''],
+    ]));
+
+    $payload = $response->getData(true);
+
+    expect($response->getStatusCode())->toBe(200)
+        ->and($payload['summary'])->toMatchArray([
+            'engine'           => 'greedy',
+            'requested_engine' => 'throwing',
+            'fallback_reason'  => 'orchestration unavailable',
+            'metrics'          => 'estimated',
+            'distance'         => 0,
+            'duration'         => 0,
+        ])
+        ->and($payload['warning'])->toBe('The "greedy" engine was used instead of "throwing": orchestration unavailable')
+        // the fallback still routes every order onto the one vehicle
+        ->and(array_column($payload['assignments'], 'order_id'))->toBe(['order_one', 'order_two'])
+        ->and($payload['assignments'][0])->toHaveKeys(['arrival', 'route_distance', 'route_duration']);
+});
+
+test('orchestration optimize routes runs the selected solver once per vehicle', function () {
+    $solver   = new FleetOpsSolverEngineFake();
+    $registry = new OrchestrationEngineRegistry();
+    $registry->register(new GreedyOrchestrationEngine());
+    $registry->register($solver);
+
+    $vehicle       = fleetopsOrchestrationVehicle('vehicle_one');
+    $vehicle->uuid = 'vehicle-one-uuid';
+
+    $controller                = new FleetOpsOrchestrationCommitControllerProbe($registry);
+    $controller->engineSetting = 'vroom';
+    $controller->orderQuery    = new FleetOpsOrchestrationQueryFake(collect([
+        fleetopsOrchestrationAssignedOrder('order_one', 'vehicle-one-uuid', $vehicle),
+        fleetopsOrchestrationAssignedOrder('order_two', 'vehicle-one-uuid', $vehicle),
+        // a vehicle that can no longer be found, and an order with no vehicle
+        fleetopsOrchestrationAssignedOrder('order_ghost', 'ghost-uuid'),
+        fleetopsOrchestrationAssignedOrder('order_loose', null),
+    ]));
+    $controller->vehicleQuery = new FleetOpsOrchestrationQueryFake(collect([$vehicle]));
+
+    $response = $controller->run(Request::create('/orchestrator/run', 'POST', [
+        'mode'    => 'optimize_routes',
+        'options' => ['allocation_strategy' => 'capacity_only'],
+    ]));
+
+    $payload = $response->getData(true);
+
+    expect($response->getStatusCode())->toBe(200)
+        ->and($solver->calls)->toHaveCount(1)
+        ->and($solver->calls[0]['vehicles']->all())->toBe([$vehicle])
+        ->and($solver->calls[0]['orders']->pluck('public_id')->all())->toBe(['order_one', 'order_two'])
+        // sequencing always needs a routed solve, whatever the phase asked for
+        ->and($solver->calls[0]['options']['allocation_strategy'])->toBe('route_aware')
+        ->and(array_column($payload['assignments'], 'arrival'))->toBe([1778918400, 1778918401])
+        ->and($payload['unassigned'])->toBe(['order_ghost', 'order_loose'])
+        ->and($payload['summary'])->toBe([
+            'engine'     => 'vroom',
+            'assigned'   => 2,
+            'unassigned' => 2,
+            'distance'   => 4200,
+            'duration'   => 600,
+            'metrics'    => 'engine',
+        ])
+        ->and($payload)->not->toHaveKey('warning');
+});
+
+test('orchestration optimize routes falls back to the route sequencer with a warning', function (string $engineSetting, string $reason) {
+    $registry = new OrchestrationEngineRegistry();
+    $registry->register(new GreedyOrchestrationEngine());
+    $registry->register(new FleetOpsThrowingOrchestrationEngineFake());
+
+    $vehicle       = fleetopsOrchestrationVehicle('vehicle_one');
+    $vehicle->uuid = 'vehicle-one-uuid';
+    $vehicle->setRelation('driver', fleetopsOrchestrationDriver('driver_one'));
+
+    $controller                = new FleetOpsOrchestrationCommitControllerProbe($registry);
+    $controller->engineSetting = $engineSetting;
+    $controller->orderQuery    = new FleetOpsOrchestrationQueryFake(collect([fleetopsOrchestrationAssignedOrder('order_one', 'vehicle-one-uuid', $vehicle)]));
+    $controller->vehicleQuery  = new FleetOpsOrchestrationQueryFake(collect([$vehicle]));
+
+    $payload = $controller->run(Request::create('/orchestrator/run', 'POST', ['mode' => 'optimize_routes']))->getData(true);
+
+    expect($controller->routeEngine->calls)->toHaveCount(1)
+        ->and($payload['summary'])->toMatchArray([
+            'engine'           => 'route_sequence_fake',
+            'requested_engine' => $engineSetting,
+            'fallback_reason'  => $reason,
+        ])
+        ->and($payload['warning'])->toContain($reason);
+})->with([
+    'unavailable solver' => ['throwing', 'orchestration unavailable'],
+    'unregistered'       => ['missing', 'No orchestration engine is registered as "missing".'],
+]);
diff --git a/server/tests/ProcessAllocationJobContractsTest.php b/server/tests/ProcessAllocationJobContractsTest.php
index 53777487a..3efd188af 100644
--- a/server/tests/ProcessAllocationJobContractsTest.php
+++ b/server/tests/ProcessAllocationJobContractsTest.php
@@ -222,3 +222,23 @@ function fleetOpsProcessAllocationRegistry(FleetOpsProcessAllocationEngineFake $
             '[ProcessAllocationJob] Committed 4 assignments, 1 unassigned for company company-assign.',
         ]);
 });
+
+test('process allocation job logs when the selected engine was replaced by the fallback', function () {
+    $fallback = new class(['assignments' => [], 'unassigned' => ['order_one'], 'summary' => []]) extends FleetOpsProcessAllocationEngineFake {
+        public function getIdentifier(): string
+        {
+            return 'greedy';
+        }
+    };
+
+    $job           = new FleetOpsProcessAllocationJobProbe('company-fallback');
+    $job->engine   = 'vroom';
+    $job->orders   = collect([fleetOpsProcessAllocationOrder('order_one')]);
+    $job->vehicles = collect([(object) ['public_id' => 'vehicle_one']]);
+
+    $job->handle(fleetOpsProcessAllocationRegistry($fallback));
+
+    expect($fallback->calls)->toHaveCount(1)
+        ->and($job->messages[0])->toBe('[ProcessAllocationJob] Used the greedy engine instead of vroom for company company-fallback: No orchestration engine registered with identifier \'vroom\'. Available engines: greedy')
+        ->and($job->messages[1])->toContain('Committed 0 assignments, 1 unassigned');
+});
diff --git a/server/tests/RouteSequencingEngineTest.php b/server/tests/RouteSequencingEngineTest.php
index 39d43c45a..322e71876 100644
--- a/server/tests/RouteSequencingEngineTest.php
+++ b/server/tests/RouteSequencingEngineTest.php
@@ -128,6 +128,20 @@ function routeSequencingInvoke(RouteSequencingEngine $engine, string $method, ar
         'sequence'   => 1,
     ]);
     expect($assignments['order_far']['sequence'])->toBeGreaterThan($assignments['order_near']['sequence']);
+
+    // arrival, distance and duration are estimated along the sequenced stops
+    $near = $assignments['order_near'];
+    $far  = $assignments['order_far'];
+    expect($near['arrival'])->toBeGreaterThan(0)
+        ->and($far['arrival'])->toBeGreaterThan($near['arrival'])
+        ->and($far['distance'])->toBe($far['route_distance'])
+        ->and($near['distance'])->toBeLessThan($far['distance'])
+        ->and($near['route_duration'])->toBe($far['duration'])
+        ->and($result['summary'])->toMatchArray([
+            'distance' => $far['route_distance'],
+            'duration' => $far['route_duration'],
+            'metrics'  => 'estimated',
+        ]);
 });
 
 test('route sequencing handles multi drop waypoints and missing vehicle relations', function () {
@@ -150,7 +164,10 @@ function routeSequencingInvoke(RouteSequencingEngine $engine, string $method, ar
             'vehicle_id' => 'vehicle-missing-relation',
             'driver_id'  => null,
             'sequence'   => 1,
+            // with no vehicle position the route is measured from its first stop
+            'route_distance' => $result['assignments'][0]['distance'],
         ])
+        ->and($result['assignments'][0]['distance'])->toBeGreaterThan(0)
         ->and($result['summary']['assigned'])->toBe(1);
 });
 
diff --git a/server/tests/Unit/Orchestration/EngineSelectionAndRouteMetricsTest.php b/server/tests/Unit/Orchestration/EngineSelectionAndRouteMetricsTest.php
new file mode 100644
index 000000000..e2166169a
--- /dev/null
+++ b/server/tests/Unit/Orchestration/EngineSelectionAndRouteMetricsTest.php
@@ -0,0 +1,336 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Orchestration\Contracts\OrchestrationEngineInterface;
+use Fleetbase\FleetOps\Orchestration\OrchestrationEngineRegistry;
+use Fleetbase\FleetOps\Orchestration\Support\OrchestratorSettings;
+use Fleetbase\FleetOps\Orchestration\Support\RouteMetrics;
+use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\LaravelMysqlSpatial\Types\Point;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Support\Collection;
+
+/**
+ * Covers how the Orchestrator picks its engine and what a run reports:
+ * the organization's saved engine (with the legacy system key and the
+ * built-in default behind it), the greedy fallback that names the engine it
+ * replaced and why, and the arrival/distance/duration estimates added to
+ * routes whose engine did not supply them.
+ */
+function fleetopsEngineSelectionBoot(): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+
+    $connection->getSchemaBuilder()->create('settings', function ($blueprint) {
+        $blueprint->increments('id');
+        $blueprint->string('key')->nullable();
+        $blueprint->text('value')->nullable();
+        $blueprint->timestamps();
+        $blueprint->timestamp('deleted_at')->nullable();
+    });
+
+    return $connection;
+}
+
+class FleetOpsEngineSelectionEngineFake implements OrchestrationEngineInterface
+{
+    public array $calls = [];
+
+    public function __construct(private string $identifier, private array|RuntimeException $result)
+    {
+    }
+
+    public function allocate(Collection $orders, Collection $vehicles, array $options = []): array
+    {
+        $this->calls[] = $options;
+
+        if ($this->result instanceof RuntimeException) {
+            throw $this->result;
+        }
+
+        return $this->result;
+    }
+
+    public function getName(): string
+    {
+        return ucfirst($this->identifier);
+    }
+
+    public function getIdentifier(): string
+    {
+        return $this->identifier;
+    }
+}
+
+function fleetopsEngineSelectionRegistry(OrchestrationEngineInterface ...$engines): OrchestrationEngineRegistry
+{
+    $registry = new OrchestrationEngineRegistry();
+    foreach ($engines as $engine) {
+        $registry->register($engine);
+    }
+
+    return $registry;
+}
+
+function fleetopsMetricsLocation(float $lat, float $lng): object
+{
+    return new class($lat, $lng) {
+        public function __construct(private float $lat, private float $lng)
+        {
+        }
+
+        public function getLat(): float
+        {
+            return $this->lat;
+        }
+
+        public function getLng(): float
+        {
+            return $this->lng;
+        }
+    };
+}
+
+function fleetopsMetricsVehicle(string $publicId, ?object $location, ?object $driver = null): object
+{
+    return new class($publicId, $location, $driver) {
+        public function __construct(public string $public_id, public ?object $location, public ?object $driver)
+        {
+        }
+
+        public function relationLoaded(string $relation): bool
+        {
+            return $relation === 'driver' && $this->driver !== null;
+        }
+    };
+}
+
+function fleetopsMetricsOrder(string $publicId, array $pickup, array $dropoff, ?object $vehicle = null): Order
+{
+    $order            = new Order();
+    $order->public_id = $publicId;
+    $order->setRelation('payload', (object) [
+        'pickup'    => (object) ['location' => fleetopsMetricsLocation(...$pickup)],
+        'dropoff'   => (object) ['location' => fleetopsMetricsLocation(...$dropoff)],
+        'waypoints' => null,
+    ]);
+
+    if ($vehicle) {
+        $order->setRelation('vehicle', $vehicle);
+    }
+
+    return $order;
+}
+
+function fleetopsMetricsLeg(array $from, array $to): array
+{
+    $leg = Utils::calculateDrivingDistanceAndTime(new Point(...$from), new Point(...$to));
+
+    return [$leg->distance, $leg->time];
+}
+
+test('orchestrator settings resolve the organization engine before the legacy key and the default', function () {
+    $connection = fleetopsEngineSelectionBoot();
+
+    // nothing saved anywhere: the built-in default
+    expect(OrchestratorSettings::engineForCompany('company-1'))->toBe('greedy')
+        ->and(OrchestratorSettings::forCompany(null))->toBe(OrchestratorSettings::defaults());
+
+    // the legacy system key still applies to organizations that never saved
+    $connection->table('settings')->insert(['key' => 'fleetops.orchestrator_engine', 'value' => json_encode('capacity')]);
+    expect(OrchestratorSettings::engineForCompany('company-1'))->toBe('capacity');
+
+    // the organization's saved settings win, and blank values keep their defaults
+    $connection->table('settings')->insert(['key' => 'company.company-1.fleet-ops.allocation-settings', 'value' => json_encode([
+        'allocation_engine'       => 'vroom',
+        'max_travel_time_seconds' => 1800,
+        'balance_workload'        => null,
+    ])]);
+
+    expect(OrchestratorSettings::forCompany('company-1'))->toBe([
+        'allocation_engine'           => 'vroom',
+        'auto_allocate_on_create'     => false,
+        'auto_reallocate_on_complete' => false,
+        'max_travel_time_seconds'     => 1800,
+        'balance_workload'            => false,
+    ])
+        ->and(OrchestratorSettings::engineForCompany('company-1'))->toBe('vroom');
+
+    // a malformed saved value is ignored rather than trusted
+    $connection->table('settings')->insert(['key' => 'company.company-2.fleet-ops.allocation-settings', 'value' => json_encode('vroom')]);
+    expect(OrchestratorSettings::engineForCompany('company-2'))->toBe('capacity');
+});
+
+test('registry runs the selected engine and names it in the summary', function () {
+    $vroom    = new FleetOpsEngineSelectionEngineFake('vroom', ['assignments' => [], 'unassigned' => [], 'summary' => ['cost' => 10]]);
+    $named    = new FleetOpsEngineSelectionEngineFake('custom', ['assignments' => [], 'unassigned' => [], 'summary' => ['engine' => 'custom-v2']]);
+    $registry = fleetopsEngineSelectionRegistry($vroom, $named);
+
+    expect($registry->allocateWithFallback('vroom', collect(), collect(), ['geometry' => true]))->toBe([
+        'assignments' => [],
+        'unassigned'  => [],
+        'summary'     => ['engine' => 'vroom', 'cost' => 10],
+    ])
+        ->and($vroom->calls)->toBe([['geometry' => true]])
+        // an engine that names itself keeps its own label
+        ->and($registry->allocateWithFallback('custom', collect(), collect())['summary'])->toBe(['engine' => 'custom-v2']);
+});
+
+test('registry falls back to greedy with multi-order routes and the reason', function () {
+    $greedy   = new FleetOpsEngineSelectionEngineFake('greedy', ['assignments' => [], 'unassigned' => [], 'summary' => ['engine' => 'greedy']]);
+    $vroom    = new FleetOpsEngineSelectionEngineFake('vroom', new RuntimeException('VROOM returned an error: HTTP 401'));
+    $registry = fleetopsEngineSelectionRegistry($greedy, $vroom);
+
+    $result = $registry->allocateWithFallback('vroom', collect(), collect(), ['balance_workload' => true]);
+
+    expect($result['summary'])->toBe([
+        'engine'           => 'greedy',
+        'requested_engine' => 'vroom',
+        'fallback_reason'  => 'VROOM returned an error: HTTP 401',
+    ])
+        ->and($result['warning'])->toBe('The "greedy" engine was used instead of "vroom": VROOM returned an error: HTTP 401')
+        ->and($greedy->calls)->toBe([['allow_multi_order' => true, 'balance_workload' => true]]);
+
+    // an unregistered engine falls back the same way, and an explicit option is kept
+    $missing = $registry->allocateWithFallback('or-tools', collect(), collect(), ['allow_multi_order' => false]);
+    expect($missing['summary']['requested_engine'])->toBe('or-tools')
+        ->and($missing['summary']['fallback_reason'])->toContain("No orchestration engine registered with identifier 'or-tools'")
+        ->and($greedy->calls[1])->toBe(['allow_multi_order' => false]);
+
+    // markFallback can record an expected substitution without warning about it
+    expect(OrchestrationEngineRegistry::markFallback([], 'route_sequencing', 'greedy', 'expected', false))->toBe([
+        'summary' => ['engine' => 'route_sequencing', 'requested_engine' => 'greedy', 'fallback_reason' => 'expected'],
+    ]);
+});
+
+test('registry rethrows when there is nothing to fall back to', function () {
+    $failingGreedy = fleetopsEngineSelectionRegistry(new FleetOpsEngineSelectionEngineFake('greedy', new RuntimeException('greedy failed')));
+    $noGreedy      = fleetopsEngineSelectionRegistry(new FleetOpsEngineSelectionEngineFake('vroom', new RuntimeException('vroom down')));
+
+    expect(fn () => $failingGreedy->allocateWithFallback('greedy', collect(), collect()))->toThrow(RuntimeException::class, 'greedy failed')
+        ->and(fn () => $noGreedy->allocateWithFallback('vroom', collect(), collect()))->toThrow(RuntimeException::class, 'vroom down');
+});
+
+test('route metrics measure cumulative distance duration and arrival along a stop list', function () {
+    $start = [1.30, 103.80];
+    $a     = [1.31, 103.81];
+    $b     = [1.33, 103.85];
+
+    [$d1, $t1] = fleetopsMetricsLeg($start, $a);
+    [$d2, $t2] = fleetopsMetricsLeg($a, $b);
+
+    $metrics = RouteMetrics::measure($start, [
+        ['order_id' => 'order_one', 'lat' => $a[0], 'lng' => $a[1]],
+        ['order_id' => 'order_one', 'lat' => $b[0], 'lng' => $b[1]],
+    ], 1000);
+
+    expect($metrics)->toBe([
+        'orders'   => ['order_one' => ['arrival' => 1000 + (int) round($t1 + $t2), 'distance' => (int) round($d1 + $d2), 'duration' => (int) round($t1 + $t2)]],
+        'distance' => (int) round($d1 + $d2),
+        'duration' => (int) round($t1 + $t2),
+    ])
+        ->and($metrics['distance'])->toBeGreaterThan(0);
+
+    // without a start position the route begins at its first stop
+    expect(RouteMetrics::measure(null, [['order_id' => 'order_one', 'lat' => $a[0], 'lng' => $a[1]]], 50))->toBe([
+        'orders'   => ['order_one' => ['arrival' => 50, 'distance' => 0, 'duration' => 0]],
+        'distance' => 0,
+        'duration' => 0,
+    ]);
+});
+
+test('route metrics estimate routes whose engine reported no timing', function () {
+    $driver  = (object) ['location' => fleetopsMetricsLocation(1.30, 103.80)];
+    $vehicle = fleetopsMetricsVehicle('vehicle_one', fleetopsMetricsLocation(9.0, 9.0), $driver);
+    $first   = fleetopsMetricsOrder('order_first', [1.31, 103.81], [1.32, 103.82]);
+    $second  = fleetopsMetricsOrder('order_second', [1.33, 103.83], [1.34, 103.84]);
+
+    $result = RouteMetrics::annotate([
+        'assignments' => [
+            // listed out of sequence, with greedy's pickup distance, plus an order the run no longer has
+            ['order_id' => 'order_second', 'vehicle_id' => 'vehicle_one', 'sequence' => 2, 'arrival' => null, 'distance' => 5],
+            ['order_id' => 'order_first', 'vehicle_id' => 'vehicle_one', 'sequence' => 1, 'arrival' => null, 'distance' => 5],
+            ['order_id' => 'order_gone', 'vehicle_id' => 'vehicle_one', 'sequence' => 3],
+        ],
+        'unassigned' => [],
+        'summary'    => ['engine' => 'greedy'],
+    ], collect([$first, $second]), collect([$vehicle]), 1000);
+
+    // the driver's position is the start, then each order's pickup and dropoff in sequence
+    $legs = [
+        fleetopsMetricsLeg([1.30, 103.80], [1.31, 103.81]),
+        fleetopsMetricsLeg([1.31, 103.81], [1.32, 103.82]),
+        fleetopsMetricsLeg([1.32, 103.82], [1.33, 103.83]),
+        fleetopsMetricsLeg([1.33, 103.83], [1.34, 103.84]),
+    ];
+    $firstDistance = (int) round($legs[0][0] + $legs[1][0]);
+    $firstDuration = (int) round($legs[0][1] + $legs[1][1]);
+    $totalDistance = (int) round(array_sum(array_column($legs, 0)));
+    $totalDuration = (int) round(array_sum(array_column($legs, 1)));
+
+    [$second, $first, $gone] = $result['assignments'];
+
+    expect($first)->toMatchArray([
+        'arrival'        => 1000 + $firstDuration,
+        'distance'       => $firstDistance,
+        'duration'       => $firstDuration,
+        'route_distance' => $totalDistance,
+        'route_duration' => $totalDuration,
+    ])
+        ->and($second)->toMatchArray([
+            'arrival'  => 1000 + $totalDuration,
+            'distance' => $totalDistance,
+        ])
+        ->and($gone)->toMatchArray(['arrival' => null, 'route_distance' => $totalDistance])
+        ->and($result['summary'])->toBe([
+            'engine'   => 'greedy',
+            'distance' => $totalDistance,
+            'duration' => $totalDuration,
+            'metrics'  => 'estimated',
+        ]);
+});
+
+test('route metrics keep engine timing and only fill its gaps', function () {
+    $vehicle = fleetopsMetricsVehicle('vehicle_one', fleetopsMetricsLocation(1.30, 103.80));
+    $order   = fleetopsMetricsOrder('order_one', [1.31, 103.81], [1.32, 103.82], $vehicle);
+    $engine  = ['order_id' => 'order_one', 'vehicle_id' => 'vehicle_one', 'sequence' => 1, 'arrival' => 1778918400, 'duration' => 900, 'distance' => null, 'route_distance' => null, 'route_duration' => 900];
+
+    // the vehicle is not in the run's list, so its position comes from the order
+    $filled = RouteMetrics::annotate(['assignments' => [$engine], 'summary' => ['distance' => 77, 'duration' => 900]], collect([$order]), collect());
+
+    $total = (int) round(fleetopsMetricsLeg([1.30, 103.80], [1.31, 103.81])[0] + fleetopsMetricsLeg([1.31, 103.81], [1.32, 103.82])[0]);
+
+    expect($filled['assignments'][0])->toBe(array_merge($engine, ['distance' => $total, 'route_distance' => $total]))
+        ->and($filled['summary'])->toBe(['distance' => 77, 'duration' => 900, 'metrics' => 'estimated']);
+
+    // complete engine timing is left alone and the engine's metrics label is kept
+    $complete = array_merge($engine, ['distance' => 4200, 'route_distance' => 4200]);
+    $kept     = RouteMetrics::annotate(['assignments' => [$complete], 'summary' => ['metrics' => 'estimated']], collect([$order]), collect());
+    $vroom    = RouteMetrics::annotate(['assignments' => [$complete]], collect([$order]), collect());
+
+    expect($kept['assignments'][0])->toBe($complete)
+        ->and($kept['summary'])->toBe(['metrics' => 'estimated', 'distance' => 4200, 'duration' => 900])
+        ->and($vroom['summary']['metrics'])->toBe('engine');
+});
+
+test('route metrics leave empty plans alone and start where the vehicle is unknown', function () {
+    expect(RouteMetrics::annotate(['assignments' => [], 'summary' => []], collect(), collect()))->toBe(['assignments' => [], 'summary' => []]);
+
+    // no vehicle anywhere: the route starts at the first pickup
+    $order  = fleetopsMetricsOrder('order_one', [1.31, 103.81], [1.32, 103.82]);
+    $result = RouteMetrics::annotate([
+        'assignments' => [['order_id' => 'order_one', 'vehicle_id' => 'vehicle_missing', 'sequence' => 1]],
+    ], collect([$order]), collect(), 500);
+
+    [$distance, $time] = fleetopsMetricsLeg([1.31, 103.81], [1.32, 103.82]);
+
+    expect($result['assignments'][0])->toMatchArray([
+        'arrival'        => 500 + (int) round($time),
+        'route_distance' => (int) round($distance),
+    ]);
+});
diff --git a/server/tests/Unit/Orchestration/Engines/VroomOrchestrationEngineLifecycleTest.php b/server/tests/Unit/Orchestration/Engines/VroomOrchestrationEngineLifecycleTest.php
index 09024acb3..0280b64df 100644
--- a/server/tests/Unit/Orchestration/Engines/VroomOrchestrationEngineLifecycleTest.php
+++ b/server/tests/Unit/Orchestration/Engines/VroomOrchestrationEngineLifecycleTest.php
@@ -247,7 +247,7 @@ function fleetopsVroomLifecycleDriver(string $publicId, ?object $location = null
             'distance'   => 4200,
         ])
         ->and($result['unassigned'])->toBe([])
-        ->and($result['summary'])->toBe(['routes' => 1]);
+        ->and($result['summary'])->toBe(['engine' => 'vroom', 'routes' => 1]);
 
     $payload = $engine->payloads[0];
 
@@ -367,7 +367,14 @@ public function __construct(public ?object $pickup)
         'vehicle_id' => 'vehicle_capacity',
         'driver_id'  => 'driver_capacity',
         'sequence'   => 1,
+        // the placeholder matrix timings are cleared so estimates replace them
+        'arrival'        => null,
+        'duration'       => null,
+        'distance'       => null,
+        'route_distance' => null,
+        'route_duration' => null,
     ])
+        ->and($result['summary'])->not->toHaveKeys(['distance', 'duration'])
         ->and($result['summary'])->toMatchArray([
             'engine'              => 'vroom',
             'allocation_strategy' => 'capacity_only',
diff --git a/server/tests/VroomOrchestrationEngineTest.php b/server/tests/VroomOrchestrationEngineTest.php
index d3ff2149c..42c8f9838 100644
--- a/server/tests/VroomOrchestrationEngineTest.php
+++ b/server/tests/VroomOrchestrationEngineTest.php
@@ -112,7 +112,40 @@
         'duration'   => 900,
         'distance'   => 4200,
     ]);
-    expect($result['summary'])->toBe(['routes' => 1]);
+    expect($result['summary'])->toBe(['engine' => 'vroom', 'routes' => 1]);
+});
+
+test('vroom carries route totals onto assignments and anchors relative arrivals to the run start', function () {
+    $engine = new VroomOrchestrationEngine();
+    $method = new ReflectionMethod($engine, 'mapVroomResponse');
+
+    $method->setAccessible(true);
+
+    $before = now()->timestamp;
+    $result = $method->invoke($engine, [
+        'routes' => [
+            [
+                'description' => json_encode(['vehicle_id' => 'vehicle_one', 'driver_id' => 'driver_one']),
+                'distance'    => 9100,
+                'duration'    => 1500,
+                'steps'       => [
+                    ['type' => 'start', 'arrival' => 0],
+                    ['type' => 'job', 'id' => 1001, 'arrival' => 600, 'duration' => 600, 'distance' => 5000],
+                    ['type' => 'job', 'id' => 1002],
+                ],
+            ],
+        ],
+        'summary' => ['distance' => 9100, 'duration' => 1500],
+    ], [
+        1001 => 'order_one',
+        1002 => 'order_two',
+    ]);
+
+    expect($result['assignments'][0]['arrival'])->toBeGreaterThanOrEqual($before + 600)
+        ->and($result['assignments'][0]['arrival'])->toBeLessThanOrEqual(now()->timestamp + 600)
+        ->and($result['assignments'][0])->toMatchArray(['route_distance' => 9100, 'route_duration' => 1500])
+        ->and($result['assignments'][1]['arrival'])->toBeNull()
+        ->and($result['summary'])->toBe(['engine' => 'vroom', 'distance' => 9100, 'duration' => 1500]);
 });
 
 test('vroom capacity-only payload uses matrix indexes instead of coordinates', function () {
diff --git a/tests/unit/components/orchestrator-workbench-test.js b/tests/unit/components/orchestrator-workbench-test.js
new file mode 100644
index 000000000..91be1d8b3
--- /dev/null
+++ b/tests/unit/components/orchestrator-workbench-test.js
@@ -0,0 +1,148 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'dummy/tests/helpers';
+import Service from '@ember/service';
+import { setOwner } from '@ember/application';
+import OrchestratorWorkbenchComponent from 'dummy/components/orchestrator-workbench';
+
+module('Unit | Component | orchestrator-workbench', function (hooks) {
+    setupTest(hooks);
+
+    hooks.beforeEach(function () {
+        const context = this;
+        this.responses = {
+            'fleet-ops/orchestrator/orders': { orders: [] },
+            'fleet-ops/orchestrator/engines': {
+                engines: [
+                    { id: 'greedy', name: 'Greedy (built-in)' },
+                    { id: 'vroom', name: 'VROOM' },
+                ],
+            },
+            'fleet-ops/settings/orchestrator-settings': { allocation_engine: 'vroom' },
+            'fleet-ops/settings/orchestrator-card-fields': { settings: null },
+        };
+        this.posts = [];
+        this.runResult = { assignments: [], unassigned: [] };
+        this.warnings = [];
+
+        this.owner.register(
+            'service:fetch',
+            class extends Service {
+                get(url) {
+                    const response = context.responses[url];
+                    return response instanceof Error ? Promise.reject(response) : Promise.resolve(response);
+                }
+
+                post(url, payload) {
+                    context.posts.push({ url, payload });
+                    return Promise.resolve(context.runResult);
+                }
+            }
+        );
+        this.owner.register(
+            'service:store',
+            class extends Service {
+                query() {
+                    return Promise.resolve({ toArray: () => [] });
+                }
+            }
+        );
+        this.owner.register(
+            'service:location',
+            class extends Service {
+                getLatitude() {
+                    return null;
+                }
+
+                getLongitude() {
+                    return null;
+                }
+
+                getUserLocation() {
+                    return new Promise(() => {});
+                }
+            }
+        );
+        this.owner.register(
+            'service:notifications',
+            class extends Service {
+                warning(message) {
+                    context.warnings.push(message);
+                }
+
+                serverError(error) {
+                    throw error;
+                }
+            }
+        );
+        this.owner.register(
+            'service:intl',
+            class extends Service {
+                t(key) {
+                    return key;
+                }
+            }
+        );
+
+        this.createWorkbench = async () => {
+            // Built without the constructor (which needs the component manager
+            // and boots the map); the services are the stubs registered above.
+            const lookup = (name) => ({ value: this.owner.lookup(`service:${name}`) });
+            const workbench = Object.create(OrchestratorWorkbenchComponent.prototype, {
+                args: { value: {} },
+                fetch: lookup('fetch'),
+                notifications: lookup('notifications'),
+                intl: lookup('intl'),
+                _drawRoutingControls: { value: () => {} },
+            });
+            setOwner(workbench, this.owner);
+            await workbench.loadEngines.perform();
+            return workbench;
+        };
+    });
+
+    test('it starts new phases with the engine selected in orchestrator settings', async function (assert) {
+        const workbench = await this.createWorkbench();
+
+        assert.strictEqual(workbench.defaultEngine, 'vroom');
+        assert.deepEqual(
+            workbench.availableEngines.map((engine) => engine.id),
+            ['greedy', 'vroom']
+        );
+    });
+
+    test('it leaves the default engine unset when the settings cannot be loaded', async function (assert) {
+        this.responses['fleet-ops/settings/orchestrator-settings'] = new Error('forbidden');
+
+        const workbench = await this.createWorkbench();
+
+        assert.strictEqual(workbench.defaultEngine, null);
+    });
+
+    test('a phase without an engine lets the server use the configured engine', async function (assert) {
+        const workbench = await this.createWorkbench();
+
+        assert.strictEqual(workbench._legacyPhase().engine, null);
+
+        await workbench._runSinglePhase.perform({ mode: 'allocate' });
+
+        assert.strictEqual(this.posts[0].url, 'fleet-ops/orchestrator/run');
+        assert.strictEqual(this.posts[0].payload.options.engine, null);
+    });
+
+    test('it surfaces the fallback warning and the route totals the server reports', async function (assert) {
+        this.runResult = {
+            assignments: [{ order_id: 'order_one', vehicle_id: 'vehicle_one', sequence: 1, arrival: 1778918400, route_distance: 4200, route_duration: 900 }],
+            unassigned: [],
+            summary: { engine: 'greedy', requested_engine: 'vroom', fallback_reason: 'VROOM returned an error: HTTP 401' },
+            warning: 'The "greedy" engine was used instead of "vroom": VROOM returned an error: HTTP 401',
+        };
+        const workbench = await this.createWorkbench();
+
+        await workbench._runSinglePhase.perform({ mode: 'assign_vehicles', engine: 'vroom' });
+
+        assert.strictEqual(this.posts[0].payload.options.engine, 'vroom');
+        assert.deepEqual(this.warnings, [this.runResult.warning]);
+        assert.strictEqual(workbench.orchestratorRunMessage, this.runResult.warning);
+        assert.deepEqual(workbench.routeSummaries, { vehicle_one: { duration: 900, distance: 4200 } });
+    });
+});
diff --git a/tests/unit/components/orchestrator/phase-builder-test.js b/tests/unit/components/orchestrator/phase-builder-test.js
new file mode 100644
index 000000000..cfdf76a2d
--- /dev/null
+++ b/tests/unit/components/orchestrator/phase-builder-test.js
@@ -0,0 +1,22 @@
+import { module, test } from 'qunit';
+import PhaseBuilderComponent from 'dummy/components/orchestrator/phase-builder';
+
+function makeBuilder(args = {}) {
+    return Object.create(PhaseBuilderComponent.prototype, {
+        args: { value: args },
+        intl: { value: { t: (key) => key } },
+    });
+}
+
+module('Unit | Component | orchestrator/phase-builder', function () {
+    test('new phases use the engine selected in orchestrator settings', function (assert) {
+        const phase = makeBuilder({ defaultEngine: 'vroom' })._defaultPhase('optimize_routes');
+
+        assert.strictEqual(phase.engine, 'vroom');
+        assert.strictEqual(phase.mode, 'optimize_routes');
+    });
+
+    test('new phases fall back to the built-in greedy engine before settings load', function (assert) {
+        assert.strictEqual(makeBuilder()._defaultPhase().engine, 'greedy');
+    });
+});
diff --git a/tests/unit/controllers/settings/orchestrator-test.js b/tests/unit/controllers/settings/orchestrator-test.js
new file mode 100644
index 000000000..d106adc1f
--- /dev/null
+++ b/tests/unit/controllers/settings/orchestrator-test.js
@@ -0,0 +1,68 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'dummy/tests/helpers';
+import Service from '@ember/service';
+
+module('Unit | Controller | settings/orchestrator', function (hooks) {
+    setupTest(hooks);
+
+    hooks.beforeEach(function () {
+        const context = this;
+        this.responses = {
+            'fleet-ops/settings/orchestrator-settings': { max_travel_time_seconds: 1800 },
+            'fleet-ops/orchestrator/engines': {
+                engines: [
+                    { id: 'greedy', name: 'Greedy (built-in)' },
+                    { id: 'vroom', name: 'VROOM' },
+                ],
+            },
+        };
+
+        this.owner.register(
+            'service:fetch',
+            class extends Service {
+                get(url) {
+                    const response = context.responses[url];
+                    return response instanceof Error ? Promise.reject(response) : Promise.resolve(response);
+                }
+            }
+        );
+        this.owner.register(
+            'service:notifications',
+            class extends Service {
+                serverError(error) {
+                    throw error;
+                }
+            }
+        );
+        this.owner.register(
+            'service:orchestration-engine',
+            class extends Service {
+                availableEngines = [{ id: 'vroom', name: 'VROOM' }];
+            }
+        );
+    });
+
+    test('it offers the engines the server can run and defaults to greedy', async function (assert) {
+        const controller = this.owner.lookup('controller:settings/orchestrator');
+
+        await controller.loadSettings.perform();
+
+        assert.strictEqual(controller.allocationEngine, 'greedy');
+        assert.strictEqual(controller.maxTravelTimeSeconds, 1800);
+        assert.deepEqual(
+            controller.engineOptions.map((engine) => engine.id),
+            ['greedy', 'vroom']
+        );
+    });
+
+    test('it shows the saved engine and falls back to the frontend registry when engines cannot be listed', async function (assert) {
+        this.responses['fleet-ops/settings/orchestrator-settings'] = { allocation_engine: 'vroom' };
+        this.responses['fleet-ops/orchestrator/engines'] = new Error('unavailable');
+        const controller = this.owner.lookup('controller:settings/orchestrator');
+
+        await controller.loadSettings.perform();
+
+        assert.strictEqual(controller.allocationEngine, 'vroom');
+        assert.deepEqual(controller.engineOptions, [{ id: 'vroom', name: 'VROOM' }]);
+    });
+});
diff --git a/tests/unit/services/order-allocation-test.js b/tests/unit/services/order-allocation-test.js
new file mode 100644
index 000000000..fab38bee2
--- /dev/null
+++ b/tests/unit/services/order-allocation-test.js
@@ -0,0 +1,39 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'dummy/tests/helpers';
+import Service from '@ember/service';
+
+module('Unit | Service | order-allocation', function (hooks) {
+    setupTest(hooks);
+
+    hooks.beforeEach(function () {
+        const context = this;
+        this.settings = { allocation_engine: 'vroom' };
+
+        this.owner.register(
+            'service:fetch',
+            class extends Service {
+                get() {
+                    return Promise.resolve(context.settings);
+                }
+            }
+        );
+        this.owner.register('service:notifications', class extends Service {});
+    });
+
+    test('it reads the active engine from the saved orchestrator settings', async function (assert) {
+        const service = this.owner.lookup('service:order-allocation');
+
+        await service.loadSettings.perform();
+
+        assert.strictEqual(service.activeEngineId, 'vroom');
+    });
+
+    test('it defaults to the built-in greedy engine when none is saved', async function (assert) {
+        this.settings = {};
+        const service = this.owner.lookup('service:order-allocation');
+
+        await service.loadSettings.perform();
+
+        assert.strictEqual(service.activeEngineId, 'greedy');
+    });
+});

From 82d5afc6861b9b523b441ca3352d56da0b0dba6e Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Sun, 11 Oct 2026 15:41:03 +0800
Subject: [PATCH 37/87] feat(orders): show customer photos on live order and
 board cards

The lightweight index customer resource now sends photo_url (a contact's
photo, a vendor's logo), which the order list overlay and kanban cards
already render with a placeholder fallback. The internal order filter and
the live order query eager load the photo/logo file per customer type via
morphWith, so the list does not query once per row.
---
 server/src/Http/Filter/OrderFilter.php        |   4 +-
 .../src/Http/Resources/v1/Index/Customer.php  |  18 +++
 server/src/Support/LiveOrderQuery.php         |   4 +-
 server/tests/IndexCustomerPhotoTest.php       | 151 ++++++++++++++++++
 4 files changed, 175 insertions(+), 2 deletions(-)
 create mode 100644 server/tests/IndexCustomerPhotoTest.php

diff --git a/server/src/Http/Filter/OrderFilter.php b/server/src/Http/Filter/OrderFilter.php
index 11c202a82..151031140 100644
--- a/server/src/Http/Filter/OrderFilter.php
+++ b/server/src/Http/Filter/OrderFilter.php
@@ -3,12 +3,14 @@
 namespace Fleetbase\FleetOps\Http\Filter;
 
 use Fleetbase\FleetOps\Http\Filter\Concerns\ResolvesPublicRelationUuids;
+use Fleetbase\FleetOps\Http\Resources\v1\Index\Customer as CustomerIndexResource;
 use Fleetbase\FleetOps\Models\Contact;
 use Fleetbase\FleetOps\Models\IntegratedVendor;
 use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Filter\Filter;
 use Fleetbase\Support\Http;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Str;
 
@@ -63,7 +65,7 @@ public function queryForInternal()
             'vehicleAssigned' => function ($query) {
                 $query->without(['fleets', 'vendor']);
             },
-            'customer',
+            'customer' => static fn (MorphTo $relation) => CustomerIndexResource::withPhoto($relation),
             'facilitator',
         ]);
     }
diff --git a/server/src/Http/Resources/v1/Index/Customer.php b/server/src/Http/Resources/v1/Index/Customer.php
index 22b3d90d7..29b70db1e 100644
--- a/server/src/Http/Resources/v1/Index/Customer.php
+++ b/server/src/Http/Resources/v1/Index/Customer.php
@@ -2,8 +2,12 @@
 
 namespace Fleetbase\FleetOps\Http\Resources\v1\Index;
 
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Customer as CustomerModel;
+use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\Http\Resources\FleetbaseResource;
 use Fleetbase\Support\Http;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 /**
  * Lightweight Customer resource for index views.
@@ -28,6 +32,20 @@ public function toArray($request): array
             'name'         => $this->name,
             'phone'        => $this->phone ?? null,
             'email'        => $this->email ?? null,
+            'photo_url'    => $this->resource instanceof Vendor ? $this->logo_url : ($this->photo_url ?? null),
         ];
     }
+
+    /**
+     * Eager loads the file each customer type's `photo_url` reads (a contact's
+     * photo, a vendor's logo), so listing orders does not query once per row.
+     */
+    public static function withPhoto(MorphTo $relation): MorphTo
+    {
+        return $relation->morphWith([
+            Contact::class       => ['photo'],
+            CustomerModel::class => ['photo'],
+            Vendor::class        => ['logo'],
+        ]);
+    }
 }
diff --git a/server/src/Support/LiveOrderQuery.php b/server/src/Support/LiveOrderQuery.php
index 3ee9e4c43..807360e0e 100644
--- a/server/src/Support/LiveOrderQuery.php
+++ b/server/src/Support/LiveOrderQuery.php
@@ -2,8 +2,10 @@
 
 namespace Fleetbase\FleetOps\Support;
 
+use Fleetbase\FleetOps\Http\Resources\v1\Index\Customer as CustomerIndexResource;
 use Fleetbase\FleetOps\Models\Order;
 use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
 
 class LiveOrderQuery
 {
@@ -65,7 +67,7 @@ public static function make(?string $companyUuid = null, array $options = []): B
                 'vehicleAssigned' => function ($query) {
                     $query->without(['fleets', 'vendor']);
                 },
-                'customer',
+                'customer' => static fn (MorphTo $relation) => CustomerIndexResource::withPhoto($relation),
                 'facilitator',
             ]);
         }
diff --git a/server/tests/IndexCustomerPhotoTest.php b/server/tests/IndexCustomerPhotoTest.php
new file mode 100644
index 000000000..bce654b58
--- /dev/null
+++ b/server/tests/IndexCustomerPhotoTest.php
@@ -0,0 +1,151 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Filter\OrderFilter;
+use Fleetbase\FleetOps\Http\Resources\v1\Index\Customer as IndexCustomerResource;
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Customer;
+use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Support\LiveOrderQuery;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
+use Illuminate\Http\Request;
+
+class FleetOpsIndexCustomerPhotoMorphTo extends MorphTo
+{
+    public array $morphWith = [];
+
+    public function __construct()
+    {
+    }
+
+    public function morphWith(array $with)
+    {
+        $this->morphWith = $with;
+
+        return $this;
+    }
+}
+
+class FleetOpsIndexCustomerPhotoBuilder extends Builder
+{
+    public array $with = [];
+
+    public function __construct()
+    {
+    }
+
+    public function __call($method, $parameters)
+    {
+        return $this;
+    }
+
+    public function where($column, $operator = null, $value = null, $boolean = 'and')
+    {
+        return $this;
+    }
+
+    public function whereHas($relation, ?Closure $callback = null, $operator = '>=', $count = 1)
+    {
+        return $this;
+    }
+
+    public function whereNotIn($column, $values, $boolean = 'and')
+    {
+        return $this;
+    }
+
+    public function whereNull($columns, $boolean = 'and', $not = false)
+    {
+        return $this;
+    }
+
+    public function with($relations, $callback = null)
+    {
+        $this->with = array_merge($this->with, $relations);
+
+        return $this;
+    }
+}
+
+class FleetOpsIndexCustomerPhotoLiveQuery extends LiveOrderQuery
+{
+    public static FleetOpsIndexCustomerPhotoBuilder $builder;
+
+    protected static function newOrderQuery(string $companyUuid): Builder
+    {
+        return static::$builder = new FleetOpsIndexCustomerPhotoBuilder();
+    }
+}
+
+function fleetopsIndexCustomerPhotoExpectedMorphWith(): array
+{
+    return [
+        Contact::class  => ['photo'],
+        Customer::class => ['photo'],
+        Vendor::class   => ['logo'],
+    ];
+}
+
+function fleetopsIndexCustomerPhotoResolve(object $customer): array
+{
+    return (new IndexCustomerResource($customer))->resolve(Request::create('/', 'GET'));
+}
+
+test('index customer resource sends a contact photo url', function () {
+    $contact = new Contact();
+    $contact->setRawAttributes(['name' => 'Fixture Contact']);
+    $contact->setRelation('photo', (object) ['url' => 'https://cdn.example.test/contact.png']);
+
+    expect(fleetopsIndexCustomerPhotoResolve($contact)['photo_url'])->toBe('https://cdn.example.test/contact.png');
+});
+
+test('index customer resource sends a vendor logo as the photo url', function () {
+    $vendor = new Vendor();
+    $vendor->setRawAttributes(['name' => 'Fixture Vendor']);
+    $vendor->setRelation('logo', (object) ['url' => 'https://cdn.example.test/vendor.png']);
+
+    expect(fleetopsIndexCustomerPhotoResolve($vendor)['photo_url'])->toBe('https://cdn.example.test/vendor.png');
+});
+
+test('index customer resource sends a null photo url for a customer type without one', function () {
+    $payload = fleetopsIndexCustomerPhotoResolve(new ArrayObject(['name' => 'Fixture'], ArrayObject::ARRAY_AS_PROPS));
+
+    expect($payload)->toHaveKey('photo_url')
+        ->and($payload['photo_url'])->toBeNull();
+});
+
+test('index customer eager loads the photo file for each customer type', function () {
+    $relation = new FleetOpsIndexCustomerPhotoMorphTo();
+
+    expect(IndexCustomerResource::withPhoto($relation))->toBe($relation)
+        ->and($relation->morphWith)->toBe(fleetopsIndexCustomerPhotoExpectedMorphWith());
+});
+
+test('live order query eager loads customer photos', function () {
+    FleetOpsIndexCustomerPhotoLiveQuery::make('company-uuid', ['with_relations' => true, 'apply_permissions' => false]);
+
+    $relation = new FleetOpsIndexCustomerPhotoMorphTo();
+    FleetOpsIndexCustomerPhotoLiveQuery::$builder->with['customer']($relation);
+
+    expect($relation->morphWith)->toBe(fleetopsIndexCustomerPhotoExpectedMorphWith());
+});
+
+test('internal order filter eager loads customer photos', function () {
+    $builder = new FleetOpsIndexCustomerPhotoBuilder();
+    $request = Request::create('/int/v1/orders', 'GET');
+    $session = app('session.store');
+    $session->put('company', 'company_test');
+    $request->setLaravelSession($session);
+
+    $filter = new OrderFilter($request);
+    $prop   = (new ReflectionClass($filter))->getParentClass()->getProperty('builder');
+    $prop->setAccessible(true);
+    $prop->setValue($filter, $builder);
+
+    $filter->queryForInternal();
+
+    $relation = new FleetOpsIndexCustomerPhotoMorphTo();
+    $builder->with['customer']($relation);
+
+    expect($relation->morphWith)->toBe(fleetopsIndexCustomerPhotoExpectedMorphWith());
+});

From fa8b4fbe9df5e8ced862185ff0c8a1cb627e2288 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Sun, 11 Oct 2026 16:13:38 +0800
Subject: [PATCH 38/87] feat(dashboard): proof of delivery photos widget

Adds a Proof of Delivery dashboard tile showing the latest delivery photos
in a grid, each linking to its order, with loading and empty states.

Backed by GET /int/v1/fleet-ops/proofs/recent, which returns the session
company's latest photo proofs (file type 'photo') on orders, newest first,
with order public_id, customer name, capture time and a signed photo url.
The limit defaults to 12 and is capped between 1 and 24.
---
 addon/components/widget/proof-of-delivery.hbs |  49 +++++
 addon/components/widget/proof-of-delivery.js  |  62 +++++++
 addon/extension.js                            |  10 ++
 app/components/widget/proof-of-delivery.js    |   1 +
 .../Internal/v1/ProofController.php           |  47 +++++
 server/src/routes.php                         |   7 +-
 .../Internal/ProofControllerRecentTest.php    | 170 ++++++++++++++++++
 .../widget/proof-of-delivery-test.js          | 131 ++++++++++++++
 translations/en-us.yaml                       |   4 +
 9 files changed, 480 insertions(+), 1 deletion(-)
 create mode 100644 addon/components/widget/proof-of-delivery.hbs
 create mode 100644 addon/components/widget/proof-of-delivery.js
 create mode 100644 app/components/widget/proof-of-delivery.js
 create mode 100644 server/tests/Feature/Http/Internal/ProofControllerRecentTest.php
 create mode 100644 tests/unit/components/widget/proof-of-delivery-test.js

diff --git a/addon/components/widget/proof-of-delivery.hbs b/addon/components/widget/proof-of-delivery.hbs
new file mode 100644
index 000000000..696b8c3a2
--- /dev/null
+++ b/addon/components/widget/proof-of-delivery.hbs
@@ -0,0 +1,49 @@
+<div class="fleet-ops-widget fleet-ops-proof-of-delivery flex flex-col h-full {{@class}}" data-test-proof-of-delivery-widget ...attributes>
+    <div class="flex items-center justify-between px-3 py-1.5 border dark:border-gray-700 border-gray-200 dark:bg-gray-800 bg-gray-50 rounded-t-md shadow-sm">
+        <span class="text-xs font-bold text-black dark:text-gray-100">{{t "widget.proof-of-delivery.title"}}</span>
+        <FaIcon @icon="camera" class="text-gray-400" />
+    </div>
+
+    <div class="flex-1 p-2 border border-t-0 dark:border-gray-700 border-gray-200 rounded-b-md bg-white dark:bg-gray-900 overflow-auto min-h-0">
+        {{#if this.load.isRunning}}
+            <div class="flex items-center justify-center h-full"><Spinner /></div>
+        {{else if this.error}}
+            <div class="flex items-center justify-center h-full text-xs text-red-500">{{this.error}}</div>
+        {{else if this.photos.length}}
+            <div class="grid grid-cols-3 gap-2">
+                {{#each this.photos as |proof|}}
+                    <div class="min-w-0" data-test-proof-of-delivery-photo={{proof.id}}>
+                        <button
+                            type="button"
+                            class="block w-full aspect-square rounded-md overflow-hidden border dark:border-gray-700 border-gray-200 bg-gray-100 dark:bg-gray-800 hover:opacity-90"
+                            title={{or proof.remarks (t "widget.proof-of-delivery.open-photo")}}
+                            aria-label={{t "widget.proof-of-delivery.open-photo"}}
+                            {{on "click" (fn this.openPhoto proof)}}
+                        >
+                            <img src={{proof.url}} alt={{or proof.remarks (t "widget.proof-of-delivery.title")}} loading="lazy" class="w-full h-full object-cover" />
+                        </button>
+                        <div class="mt-0.5 leading-tight">
+                            {{#if proof.order_id}}
+                                <LinkTo
+                                    @route={{this.orderRoute}}
+                                    @model={{proof.order_id}}
+                                    class="block text-[10px] font-semibold text-blue-600 hover:text-blue-700 dark:text-blue-300 dark:hover:text-blue-200 truncate"
+                                    title={{proof.customer_name}}
+                                    data-test-proof-of-delivery-order
+                                >{{proof.order_id}}</LinkTo>
+                            {{/if}}
+                            {{#if proof.timeAgo}}
+                                <div class="text-[9px] text-gray-500 dark:text-gray-400 truncate">{{proof.timeAgo}}</div>
+                            {{/if}}
+                        </div>
+                    </div>
+                {{/each}}
+            </div>
+        {{else}}
+            <div class="flex flex-col items-center justify-center h-full text-center text-gray-500 dark:text-gray-400" data-test-proof-of-delivery-empty>
+                <FaIcon @icon="camera" class="text-lg mb-1 text-gray-300 dark:text-gray-600" />
+                <div class="text-[11px]">{{t "widget.proof-of-delivery.empty"}}</div>
+            </div>
+        {{/if}}
+    </div>
+</div>
\ No newline at end of file
diff --git a/addon/components/widget/proof-of-delivery.js b/addon/components/widget/proof-of-delivery.js
new file mode 100644
index 000000000..1d68d2f6d
--- /dev/null
+++ b/addon/components/widget/proof-of-delivery.js
@@ -0,0 +1,62 @@
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import { inject as service } from '@ember/service';
+import { getOwner } from '@ember/application';
+import { task } from 'ember-concurrency';
+import { formatDistanceToNowStrict, isValid } from 'date-fns';
+import config from '../../config/environment';
+
+/**
+ * The latest proof of delivery photos across the fleet, each linking to its order.
+ */
+export default class WidgetProofOfDeliveryComponent extends Component {
+    static widgetId = 'fleet-ops-proof-of-delivery-widget';
+    static limit = 12;
+
+    @service fetch;
+
+    @tracked proofs = [];
+    @tracked error = null;
+
+    constructor() {
+        super(...arguments);
+        this.load.perform();
+    }
+
+    get photos() {
+        return (this.proofs ?? [])
+            .filter((proof) => proof?.url)
+            .map((proof) => ({
+                ...proof,
+                timeAgo: this.timeAgo(proof.captured_at),
+            }));
+    }
+
+    get orderRoute() {
+        // Dashboard widgets render under the host owner, outside the engine's routing context.
+        return getOwner(this).mountPoint ? 'operations.orders.index.details' : `${config.mountedEngineRoutePrefix}.operations.orders.index.details`;
+    }
+
+    timeAgo(capturedAt) {
+        const date = capturedAt ? new Date(capturedAt) : null;
+
+        return date && isValid(date) ? formatDistanceToNowStrict(date, { addSuffix: true }) : null;
+    }
+
+    @action openPhoto(proof) {
+        if (proof?.url) {
+            window.open(proof.url, '_blank', 'noopener,noreferrer');
+        }
+    }
+
+    @task({ restartable: true }) *load() {
+        this.error = null;
+        try {
+            const response = yield this.fetch.get('fleet-ops/proofs/recent', { limit: WidgetProofOfDeliveryComponent.limit });
+            this.proofs = response?.proofs ?? [];
+        } catch (err) {
+            this.error = err?.message ?? 'Failed to load';
+        }
+    }
+}
diff --git a/addon/extension.js b/addon/extension.js
index ee1f1e52e..a4bd25358 100644
--- a/addon/extension.js
+++ b/addon/extension.js
@@ -467,6 +467,16 @@ export default {
                 order: 80,
                 default: true,
             }),
+            new Widget({
+                id: 'fleet-ops-proof-of-delivery-widget',
+                name: 'Proof of Delivery',
+                description: 'The latest proof of delivery photos, each linking to its order.',
+                icon: 'camera',
+                component: new ExtensionComponent('@fleetbase/fleetops-engine', 'widget/proof-of-delivery'),
+                grid_options: { w: 4, h: 9, minW: 3, minH: 6 },
+                category: 'Operations',
+                default: false,
+            }),
             new Widget({
                 id: 'fleet-ops-geofence-violations-widget',
                 name: 'Geofence Violations',
diff --git a/app/components/widget/proof-of-delivery.js b/app/components/widget/proof-of-delivery.js
new file mode 100644
index 000000000..1f47e2ded
--- /dev/null
+++ b/app/components/widget/proof-of-delivery.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/widget/proof-of-delivery';
diff --git a/server/src/Http/Controllers/Internal/v1/ProofController.php b/server/src/Http/Controllers/Internal/v1/ProofController.php
index 186d73495..9a59555e2 100644
--- a/server/src/Http/Controllers/Internal/v1/ProofController.php
+++ b/server/src/Http/Controllers/Internal/v1/ProofController.php
@@ -21,6 +21,53 @@ class ProofController extends FleetOpsController
      */
     public $resource = 'proof';
 
+    /**
+     * The most a dashboard can ask for in one request.
+     */
+    public const RECENT_LIMIT_MAX = 24;
+
+    /**
+     * The latest photo proofs captured for the company's orders, newest first,
+     * for the dashboard's proof-of-delivery tile.
+     */
+    public function recent(Request $request)
+    {
+        $limit  = max(1, min(static::RECENT_LIMIT_MAX, (int) $request->input('limit', 12)));
+        $proofs = Proof::where('company_uuid', session('company'))
+            ->whereNotNull('order_uuid')
+            ->whereHas('file', fn ($query) => $query->where('type', 'photo'))
+            ->with(['file', 'order.customer'])
+            ->orderByDesc('created_at')
+            ->limit($limit)
+            ->get();
+
+        return $this->jsonResponse([
+            'proofs' => $proofs->map(fn (Proof $proof) => $this->recentProofPayload($proof))->values()->all(),
+        ]);
+    }
+
+    protected function recentProofPayload(Proof $proof): array
+    {
+        $order = $proof->order;
+
+        return [
+            'id'            => $proof->public_id,
+            'order_id'      => $order?->public_id,
+            'customer_name' => data_get($order, 'customer.name'),
+            'remarks'       => $proof->remarks,
+            'url'           => $this->photoUrl($proof->file),
+            'captured_at'   => $proof->created_at?->toIso8601String(),
+        ];
+    }
+
+    /**
+     * File::url signs the object on s3/gcs, so a private bucket still serves the photo.
+     */
+    protected function photoUrl(File $file): ?string
+    {
+        return $file->url;
+    }
+
     /**
      * Verify a QR code.
      *
diff --git a/server/src/routes.php b/server/src/routes.php
index 9ee007feb..8060b5512 100644
--- a/server/src/routes.php
+++ b/server/src/routes.php
@@ -582,7 +582,12 @@ function ($router, $controller) {
                                 $router->post('import', $controller('import'));
                             }
                         );
-                        $router->fleetbaseRoutes('proofs');
+                        $router->fleetbaseRoutes(
+                            'proofs',
+                            function ($router, $controller) {
+                                $router->get('recent', $controller('recent'));
+                            }
+                        );
                         $router->fleetbaseRoutes('purchase-rates');
                         $router->fleetbaseRoutes('routes');
                         $router->fleetbaseRoutes('positions', function ($router, $controller) {
diff --git a/server/tests/Feature/Http/Internal/ProofControllerRecentTest.php b/server/tests/Feature/Http/Internal/ProofControllerRecentTest.php
new file mode 100644
index 000000000..d157347b5
--- /dev/null
+++ b/server/tests/Feature/Http/Internal/ProofControllerRecentTest.php
@@ -0,0 +1,170 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\ProofController;
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\Models\File;
+use Illuminate\Config\Repository;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Events\Dispatcher;
+use Illuminate\Http\Request;
+
+/**
+ * The real query over an in-memory database; only the signed file URL is stood in,
+ * since File::url resolves a storage disk the harness does not boot.
+ */
+class FleetOpsRecentProofController extends ProofController
+{
+    protected function photoUrl(File $file): ?string
+    {
+        return 'https://cdn.test/' . $file->path;
+    }
+}
+
+function fleetOpsRecentProofDatabase(): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+    EloquentModel::setEventDispatcher(new Dispatcher());
+    EloquentModel::clearBootedModels();
+
+    $config = new Repository([
+        'activitylog' => ['enabled' => false, 'default_auth_driver' => null, 'default_log_name' => 'default'],
+        'api'         => ['cache' => ['enabled' => false]],
+        'filesystems' => ['default' => 'local'],
+    ]);
+    app()->instance('config', $config);
+    app()->instance(Illuminate\Contracts\Config\Repository::class, $config);
+
+    $common = ['uuid', 'public_id', '_key', 'company_uuid', 'meta', 'slug', 'internal_id'];
+    $tables = [
+        'proofs'   => ['file_uuid', 'order_uuid', 'subject_uuid', 'subject_type', 'remarks', 'raw_data', 'data'],
+        'files'    => ['uploader_uuid', 'subject_uuid', 'subject_type', 'path', 'disk', 'bucket', 'type', 'content_type', 'original_filename'],
+        'orders'   => ['customer_uuid', 'customer_type', 'status', 'type'],
+        'contacts' => ['name', 'type'],
+        'vendors'  => ['name', 'type'],
+    ];
+
+    $schema = $connection->getSchemaBuilder();
+    foreach ($tables as $table => $columns) {
+        $schema->create($table, function ($blueprint) use ($common, $columns) {
+            $blueprint->increments('id');
+            foreach (array_unique(array_merge($common, $columns)) as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    $connection->table('contacts')->insert(['uuid' => 'contact-ada', 'public_id' => 'contact_ada', 'company_uuid' => 'company-a', 'name' => 'Ada Lovelace', 'type' => 'customer']);
+    $connection->table('vendors')->insert(['uuid' => 'vendor-acme', 'public_id' => 'vendor_acme', 'company_uuid' => 'company-a', 'name' => 'Acme Retail']);
+    $connection->table('orders')->insert([
+        ['uuid' => 'order-1', 'public_id' => 'order_1', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-ada', 'customer_type' => Contact::class],
+        ['uuid' => 'order-2', 'public_id' => 'order_2', 'company_uuid' => 'company-a', 'customer_uuid' => 'vendor-acme', 'customer_type' => Vendor::class],
+        ['uuid' => 'order-3', 'public_id' => 'order_3', 'company_uuid' => 'company-a', 'customer_uuid' => null, 'customer_type' => null],
+        ['uuid' => 'order-x', 'public_id' => 'order_x', 'company_uuid' => 'company-b', 'customer_uuid' => null, 'customer_type' => null],
+    ]);
+
+    session(['company' => 'company-a']);
+
+    return $connection;
+}
+
+function fleetOpsRecentProof(SQLiteConnection $connection, string $key, string $createdAt, array $proof = [], ?string $fileType = 'photo'): void
+{
+    $proof += ['company_uuid' => 'company-a', 'order_uuid' => 'order-1', 'remarks' => 'Verified by Photo'];
+
+    if ($fileType) {
+        $connection->table('files')->insert(['uuid' => "file-{$key}", 'public_id' => "file_{$key}", 'company_uuid' => $proof['company_uuid'], 'path' => "photos/{$key}.png", 'type' => $fileType]);
+    }
+
+    $connection->table('proofs')->insert($proof + [
+        'uuid'       => "proof-{$key}",
+        'public_id'  => "proof_{$key}",
+        'file_uuid'  => $fileType ? "file-{$key}" : null,
+        'created_at' => $createdAt,
+        'updated_at' => $createdAt,
+    ]);
+}
+
+function fleetOpsRecentProofs(array $query = []): array
+{
+    return (new FleetOpsRecentProofController())->recent(Request::create('/int/v1/fleet-ops/proofs/recent', 'GET', $query))->getData(true)['proofs'];
+}
+
+test('recent proofs are the company photo proofs on orders, newest first, with their order and customer', function () {
+    $db = fleetOpsRecentProofDatabase();
+
+    fleetOpsRecentProof($db, 'old', '2026-10-01 08:00:00');
+    fleetOpsRecentProof($db, 'new', '2026-10-03 08:00:00', ['order_uuid' => 'order-2', 'remarks' => 'Left at the door']);
+    fleetOpsRecentProof($db, 'mid', '2026-10-02 08:00:00', ['order_uuid' => 'order-3']);
+    // Not photos: a signature, a QR scan with no file, a photo on no order.
+    fleetOpsRecentProof($db, 'signature', '2026-10-04 08:00:00', [], 'signature');
+    fleetOpsRecentProof($db, 'scan', '2026-10-04 09:00:00', [], null);
+    fleetOpsRecentProof($db, 'orderless', '2026-10-04 10:00:00', ['order_uuid' => null]);
+    // Another company's photo.
+    fleetOpsRecentProof($db, 'foreign', '2026-10-05 08:00:00', ['company_uuid' => 'company-b', 'order_uuid' => 'order-x']);
+
+    $proofs = fleetOpsRecentProofs();
+
+    expect(array_column($proofs, 'id'))->toBe(['proof_new', 'proof_mid', 'proof_old'])
+        ->and($proofs[0])->toBe([
+            'id'            => 'proof_new',
+            'order_id'      => 'order_2',
+            'customer_name' => 'Acme Retail',
+            'remarks'       => 'Left at the door',
+            'url'           => 'https://cdn.test/photos/new.png',
+            'captured_at'   => '2026-10-03T08:00:00+00:00',
+        ])
+        ->and($proofs[1]['customer_name'])->toBeNull()
+        ->and($proofs[2]['customer_name'])->toBe('Ada Lovelace')
+        ->and($proofs[2]['order_id'])->toBe('order_1');
+});
+
+test('recent proofs default to 12 and cap the limit between 1 and 24', function () {
+    $db = fleetOpsRecentProofDatabase();
+
+    foreach (range(1, 30) as $index) {
+        fleetOpsRecentProof($db, "p{$index}", sprintf('2026-10-01 08:%02d:00', $index));
+    }
+
+    expect(fleetOpsRecentProofs())->toHaveCount(12)
+        ->and(fleetOpsRecentProofs(['limit' => 5]))->toHaveCount(5)
+        ->and(fleetOpsRecentProofs(['limit' => 500]))->toHaveCount(ProofController::RECENT_LIMIT_MAX)
+        ->and(fleetOpsRecentProofs(['limit' => 0]))->toHaveCount(1)
+        ->and(fleetOpsRecentProofs(['limit' => 'abc']))->toHaveCount(1)
+        ->and(fleetOpsRecentProofs(['limit' => 5])[0]['id'])->toBe('proof_p30');
+});
+
+test('recent proofs are empty when the session has no company', function () {
+    $db = fleetOpsRecentProofDatabase();
+    fleetOpsRecentProof($db, 'one', '2026-10-01 08:00:00');
+    session(['company' => null]);
+
+    expect(fleetOpsRecentProofs())->toBe([]);
+});
+
+test('the photo url is the file url, signed for private buckets', function () {
+    $file = new class extends File {
+        public function getUrlAttribute()
+        {
+            return 'https://signed.test/photo.png';
+        }
+    };
+
+    $method = new ReflectionMethod(ProofController::class, 'photoUrl');
+    $method->setAccessible(true);
+
+    expect($method->invoke(new ProofController(), $file))->toBe('https://signed.test/photo.png');
+});
+
+test('the recent proofs route is registered with the proof routes', function () {
+    $routes = file_get_contents(dirname(__DIR__, 4) . '/src/routes.php');
+
+    expect($routes)->toContain("\$router->get('recent', \$controller('recent'));");
+});
diff --git a/tests/unit/components/widget/proof-of-delivery-test.js b/tests/unit/components/widget/proof-of-delivery-test.js
new file mode 100644
index 000000000..6161a7f69
--- /dev/null
+++ b/tests/unit/components/widget/proof-of-delivery-test.js
@@ -0,0 +1,131 @@
+import Service from '@ember/service';
+import { setOwner } from '@ember/application';
+import { module, test } from 'qunit';
+import { settled } from '@ember/test-helpers';
+import { setupTest } from 'dummy/tests/helpers';
+import WidgetProofOfDeliveryComponent from 'dummy/components/widget/proof-of-delivery';
+
+class FetchStub extends Service {
+    requests = [];
+    response = Promise.resolve({ proofs: [] });
+
+    get(path, query) {
+        this.requests.push([path, query]);
+
+        return this.response;
+    }
+}
+
+module('Unit | Component | widget/proof-of-delivery', function (hooks) {
+    setupTest(hooks);
+
+    hooks.beforeEach(function () {
+        this.owner.register('service:fetch', FetchStub);
+        this.fetch = this.owner.lookup('service:fetch');
+        // Glimmer only lets its component manager construct a component, so build the
+        // instance on the prototype and run what the constructor runs.
+        this.makeWidget = async () => {
+            const component = Object.create(WidgetProofOfDeliveryComponent.prototype);
+            setOwner(component, this.owner);
+            component.load.perform();
+            await settled();
+
+            return component;
+        };
+    });
+
+    test('it registers under the dashboard widget id', function (assert) {
+        assert.strictEqual(WidgetProofOfDeliveryComponent.widgetId, 'fleet-ops-proof-of-delivery-widget');
+    });
+
+    test('loading asks for the latest photos and keeps them', async function (assert) {
+        const proofs = [{ id: 'proof_1', order_id: 'order_1', url: 'https://cdn.test/1.png' }];
+        this.fetch.response = Promise.resolve({ proofs });
+
+        const component = await this.makeWidget();
+
+        assert.deepEqual(this.fetch.requests, [['fleet-ops/proofs/recent', { limit: 12 }]]);
+        assert.deepEqual(component.proofs, proofs);
+        assert.strictEqual(component.error, null);
+    });
+
+    test('an empty response leaves no proofs', async function (assert) {
+        this.fetch.response = Promise.resolve(null);
+
+        const component = await this.makeWidget();
+
+        assert.deepEqual(component.proofs, []);
+        assert.deepEqual(component.photos, []);
+    });
+
+    test('a failed load reports the error', async function (assert) {
+        this.fetch.response = Promise.reject(new Error('Nope'));
+        const failing = await this.makeWidget();
+        assert.strictEqual(failing.error, 'Nope');
+
+        this.fetch.response = Promise.reject({});
+        const silent = await this.makeWidget();
+        assert.strictEqual(silent.error, 'Failed to load');
+    });
+
+    test('photos skip proofs without a url and carry a relative capture time', async function (assert) {
+        const component = await this.makeWidget();
+        const capturedAt = new Date(Date.now() - 5 * 60 * 1000).toISOString();
+        component.proofs = [
+            { id: 'proof_1', order_id: 'order_1', url: 'https://cdn.test/1.png', captured_at: capturedAt },
+            { id: 'proof_2', order_id: 'order_2', url: null, captured_at: capturedAt },
+            null,
+            { id: 'proof_3', order_id: null, url: 'https://cdn.test/3.png', captured_at: null },
+        ];
+
+        const photos = component.photos;
+
+        assert.deepEqual(
+            photos.map((photo) => photo.id),
+            ['proof_1', 'proof_3']
+        );
+        assert.strictEqual(photos[0].timeAgo, '5 minutes ago');
+        assert.strictEqual(photos[0].order_id, 'order_1', 'keeps the proof fields');
+        assert.strictEqual(photos[1].timeAgo, null, 'no capture time, no relative time');
+
+        component.proofs = null;
+        assert.deepEqual(component.photos, []);
+    });
+
+    test('time ago ignores invalid dates', async function (assert) {
+        const component = await this.makeWidget();
+
+        assert.strictEqual(component.timeAgo('not a date'), null);
+        assert.strictEqual(component.timeAgo(undefined), null);
+    });
+
+    test('order links resolve from the host dashboard and inside the engine', async function (assert) {
+        const component = await this.makeWidget();
+
+        assert.strictEqual(component.orderRoute, 'console.fleet-ops.operations.orders.index.details');
+
+        this.owner.mountPoint = 'console.fleet-ops';
+        try {
+            assert.strictEqual(component.orderRoute, 'operations.orders.index.details');
+        } finally {
+            delete this.owner.mountPoint;
+        }
+    });
+
+    test('opening a photo opens its url in a new tab', async function (assert) {
+        const component = await this.makeWidget();
+        const originalOpen = window.open;
+        const opened = [];
+        window.open = (...args) => opened.push(args);
+
+        try {
+            component.openPhoto({ url: 'https://cdn.test/1.png' });
+            component.openPhoto({ url: null });
+            component.openPhoto(undefined);
+        } finally {
+            window.open = originalOpen;
+        }
+
+        assert.deepEqual(opened, [['https://cdn.test/1.png', '_blank', 'noopener,noreferrer']]);
+    });
+});
diff --git a/translations/en-us.yaml b/translations/en-us.yaml
index cf1043c0b..6ecf22a9f 100644
--- a/translations/en-us.yaml
+++ b/translations/en-us.yaml
@@ -2578,6 +2578,10 @@ widget:
         title: Geofence Violations
     live-fleet:
         title: Live Fleet Map
+    proof-of-delivery:
+        title: Proof of Delivery
+        open-photo: Open photo
+        empty: No proof of delivery photos yet.
     get-started:
         title: Get Started with Fleet-Ops
         subtitle: Set up the essentials and complete your first dispatch flow.

From 4ee797473f2d08c2776803d64c2cb46936d7e3be Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 09:29:48 +0800
Subject: [PATCH 39/87] feat(map): let organisations choose where the live map
 opens

Adds a default map view to Settings > Map: a centre and zoom, or fit to
the organisation's positioned vehicles. With nothing configured and no
browser or IP location, maps now open over the centre of the company's
country (or its timezone's country) instead of a hardcoded Singapore.
---
 addon/components/map/leaflet-live-map.js      |  77 +++++-----
 addon/components/widget/live-fleet.js         |  60 +++++++-
 addon/controllers/settings/map.js             |  74 ++++++++++
 addon/services/location.js                    |  90 +++++++++---
 addon/services/map-settings.js                |  28 ++++
 addon/templates/settings/map.hbs              |  46 ++++++
 addon/utils/map-default-view.js               | 132 ++++++++++++++++++
 app/utils/map-default-view.js                 |   1 +
 .../Internal/v1/SettingController.php         | 103 ++++++++++++++
 .../tests/SettingControllerContractsTest.php  | 110 +++++++++++++++
 tests/unit/controllers/settings/map-test.js   |  83 +++++++++++
 tests/unit/services/location-test.js          | 129 ++++++++++++++++-
 tests/unit/services/map-settings-test.js      |  27 ++++
 tests/unit/utils/map-default-view-test.js     |  84 +++++++++++
 translations/en-us.yaml                       |   9 ++
 15 files changed, 990 insertions(+), 63 deletions(-)
 create mode 100644 addon/utils/map-default-view.js
 create mode 100644 app/utils/map-default-view.js
 create mode 100644 tests/unit/utils/map-default-view-test.js

diff --git a/addon/components/map/leaflet-live-map.js b/addon/components/map/leaflet-live-map.js
index ded9fcd65..c7491a16c 100644
--- a/addon/components/map/leaflet-live-map.js
+++ b/addon/components/map/leaflet-live-map.js
@@ -12,6 +12,7 @@ import { task, timeout } from 'ember-concurrency';
 import { next } from '@ember/runloop';
 import getModelName from '@fleetbase/ember-core/utils/get-model-name';
 import ensureLeafletPluginsReady, { hasLeafletPluginsReady } from '../../utils/leaflet-plugin-loader';
+import { FIT_VEHICLES_MAX_ZOOM, isZoom, positionedBounds } from '../../utils/map-default-view';
 
 export default class MapLeafletLiveMapComponent extends Component {
     liveViewportReloadDebounceMs = 300;
@@ -243,9 +244,45 @@ export default class MapLeafletLiveMapComponent extends Component {
         this.rebuildMapContextMenu();
     }
 
+    /**
+     * When the company chose "Fit to my vehicles", frame every positioned
+     * vehicle before the first viewport-filtered load. With no positioned
+     * vehicles the map stays on the default view resolved by the location
+     * service.
+     *
+     * @return {Boolean} whether the view was fitted
+     */
+    @task *fitToPositionedVehicles() {
+        if (!this.mapSettings.fitMapToVehicles || this.abilities.cannot('fleet-ops list vehicle')) {
+            return false;
+        }
+
+        try {
+            const vehicles = yield this.fetch.get('fleet-ops/live/vehicles', { limit: this.liveViewportResourceLimit });
+            const bounds = positionedBounds(vehicles);
+            if (!bounds) {
+                return false;
+            }
+
+            const options = { maxZoom: FIT_VEHICLES_MAX_ZOOM, padding: [40, 40], animate: false };
+            if (typeof this.mapManager.fitBounds === 'function' && this.mapManager.adapter) {
+                this.mapManager.fitBounds(bounds, options);
+            } else {
+                this.map?.fitBounds?.(bounds, options);
+            }
+
+            return true;
+        } catch (err) {
+            debug('Failed to fit live map to vehicles: ' + err.message);
+            return false;
+        }
+    }
+
     /** load resources and wait for stuff here and trigger map ready **/
     @task *load() {
         try {
+            yield this.fitToPositionedVehicles.perform();
+
             // Get initial map bounds for spatial filtering (provider-agnostic)
             const mapBounds = this.mapManager.getBounds?.() ?? (this.map ? this.map.getBounds() : null);
             const bounds = this.#serializeBoundsForRequest(mapBounds);
@@ -360,6 +397,11 @@ export default class MapLeafletLiveMapComponent extends Component {
         if (typeof zoom === 'number' && !isNaN(zoom) && zoom >= 1 && zoom <= 20) {
             return zoom;
         }
+        // The company's default view (or a country centre) suggests its own zoom
+        const locationZoom = this.location.getZoom?.();
+        if (isZoom(locationZoom)) {
+            return locationZoom;
+        }
         // Return default zoom of 14 if invalid
         return 14;
     }
@@ -428,6 +470,9 @@ export default class MapLeafletLiveMapComponent extends Component {
         if (coordinates && typeof coordinates.latitude === 'number' && typeof coordinates.longitude === 'number') {
             this.latitude = coordinates.latitude;
             this.longitude = coordinates.longitude;
+            if (isZoom(coordinates.zoom) && !isZoom(this.args.zoom)) {
+                this.zoom = coordinates.zoom;
+            }
 
             // Update map position if map is loaded
             if (this.map && this.map.setView) {
@@ -860,36 +905,4 @@ export default class MapLeafletLiveMapComponent extends Component {
 
         return contextmenuRegistry;
     }
-
-    /**
-     * Safely gets a valid latitude value with fallback to default
-     * @returns {number} Valid latitude value
-     */
-    #getValidLatitude() {
-        const lat = this.location.getLatitude();
-
-        // Validate latitude is a number and within valid range (-90 to 90)
-        if (typeof lat === 'number' && !isNaN(lat) && lat >= -90 && lat <= 90) {
-            return lat;
-        }
-
-        // Fallback to default Singapore latitude
-        return 1.369;
-    }
-
-    /**
-     * Safely gets a valid longitude value with fallback to default
-     * @returns {number} Valid longitude value
-     */
-    #getValidLongitude() {
-        const lng = this.location.getLongitude();
-
-        // Validate longitude is a number and within valid range (-180 to 180)
-        if (typeof lng === 'number' && !isNaN(lng) && lng >= -180 && lng <= 180) {
-            return lng;
-        }
-
-        // Fallback to default Singapore longitude
-        return 103.8864;
-    }
 }
diff --git a/addon/components/widget/live-fleet.js b/addon/components/widget/live-fleet.js
index 84600f692..2b2965479 100644
--- a/addon/components/widget/live-fleet.js
+++ b/addon/components/widget/live-fleet.js
@@ -9,6 +9,7 @@ import { renderCompleted, waitForInsertedAndSized } from '@fleetbase/ember-ui/ut
 import LeafletTrackingMarkerComponent from '../leaflet-tracking-marker';
 import ensureLeafletDrawEditNamespace from '../../utils/leaflet-draw-namespace-guard';
 import { DEFAULT_LEAFLET_TILE_ATTRIBUTION } from '../../utils/leaflet-tile-url';
+import { FIT_VEHICLES_MAX_ZOOM, positionedBounds } from '../../utils/map-default-view';
 
 const DEFAULT_CENTER = [1.31, 103.85];
 const DEFAULT_ZOOM = 11;
@@ -56,6 +57,8 @@ export default class WidgetLiveFleetComponent extends Component {
     #map = null;
     #mapSetPromise = null;
     #resolveMapSet = null;
+    /** Fit to the vehicles only on the first load, never on the periodic reconcile. */
+    #fittedToVehicles = false;
 
     constructor() {
         super(...arguments);
@@ -152,15 +155,57 @@ export default class WidgetLiveFleetComponent extends Component {
         return this.drivers.length + this.vehicles.length;
     }
 
-    /** Center on the first available marker (driver, then vehicle), else default. */
-    get center() {
+    /**
+     * Bounds around the positioned vehicles when the company chose "Fit to my
+     * vehicles" (Settings > Map), else null.
+     */
+    get vehicleBounds() {
+        if (!this.mapSettings.fitMapToVehicles) return null;
+        return positionedBounds(this.vehicles.map((vehicle) => ({ location: [vehicle.lat, vehicle.lng] })));
+    }
+
+    /**
+     * Where the map opens, in order: the positioned vehicles (when fitting is
+     * on), the company's default centre, the first positioned marker, the
+     * centre of the company's country, the hardcoded default.
+     */
+    get initialView() {
+        const bounds = this.vehicleBounds;
+        if (bounds) {
+            const [[south, west], [north, east]] = bounds;
+            return { center: [(south + north) / 2, (west + east) / 2], zoom: DEFAULT_ZOOM, bounds };
+        }
+
+        const defaultCenter = this.mapSettings.defaultMapCenter;
+        if (defaultCenter) return { center: [defaultCenter.latitude, defaultCenter.longitude], zoom: defaultCenter.zoom };
+
         const first = this.drivers[0] ?? this.vehicles[0];
-        if (first?.lat && first?.lng) return [first.lat, first.lng];
-        return DEFAULT_CENTER;
+        if (first?.lat && first?.lng) return { center: [first.lat, first.lng], zoom: DEFAULT_ZOOM };
+
+        const countryCenter = this.mapSettings.companyCountryCenter;
+        if (countryCenter) return { center: [countryCenter.latitude, countryCenter.longitude], zoom: countryCenter.zoom };
+
+        return { center: DEFAULT_CENTER, zoom: DEFAULT_ZOOM };
+    }
+
+    get center() {
+        return this.initialView.center;
     }
 
     get zoom() {
-        return DEFAULT_ZOOM;
+        return this.initialView.zoom;
+    }
+
+    /** Frame the positioned vehicles once, after the first data load. */
+    fitToVehicles(map) {
+        if (this.#fittedToVehicles) return false;
+
+        const bounds = this.vehicleBounds;
+        if (!bounds || typeof map?.fitBounds !== 'function') return false;
+
+        map.fitBounds(bounds, { padding: [30, 30], maxZoom: FIT_VEHICLES_MAX_ZOOM });
+        this.#fittedToVehicles = true;
+        return true;
     }
 
     statusColor(status) {
@@ -182,9 +227,12 @@ export default class WidgetLiveFleetComponent extends Component {
             // container before we add markers. Without this, markers added to a
             // not-yet-sized map silently no-op (the data arrives, count chip ticks
             // up, but nothing paints).
-            yield this.ensureInteractive();
+            const map = yield this.ensureInteractive();
             this.data = yield this.fetch.get('fleet-ops/analytics/live-fleet');
             this.error = null;
+            // The fit choice lives in the company's map settings, loaded in the constructor.
+            yield this.mapSettings.load();
+            this.fitToVehicles(map);
         } catch (e) {
             this.error = e?.message ?? 'Failed to load live fleet';
         }
diff --git a/addon/controllers/settings/map.js b/addon/controllers/settings/map.js
index 7639bdf3d..4a15b07ca 100644
--- a/addon/controllers/settings/map.js
+++ b/addon/controllers/settings/map.js
@@ -4,6 +4,7 @@ import { inject as service } from '@ember/service';
 import { action } from '@ember/object';
 import { task } from 'ember-concurrency';
 import MAP_PROVIDER_OPTIONS from '../../utils/map-provider-options';
+import { isLatitude, isLongitude, isZoom, toCoordinate } from '../../utils/map-default-view';
 
 export default class SettingsMapController extends Controller {
     @service fetch;
@@ -11,6 +12,7 @@ export default class SettingsMapController extends Controller {
     @service intl;
     @service mapManager;
     @service mapSettings;
+    @service location;
 
     /**
      * Available map provider options for the provider selector.
@@ -39,6 +41,21 @@ export default class SettingsMapController extends Controller {
     @tracked showGoogleMapsTrafficLayer = false;
     @tracked showGoogleMapsTransitLayer = false;
 
+    /**
+     * The company's default live map view. Latitude and longitude are both
+     * set or both null; zoom is optional.
+     */
+    @tracked defaultMapLatitude = null;
+    @tracked defaultMapLongitude = null;
+    @tracked defaultMapZoom = null;
+    @tracked fitMapToVehicles = false;
+
+    /**
+     * Bumped to re-create the coordinates input, which only reads its value
+     * when it is constructed (e.g. after clearing the default center).
+     */
+    @tracked defaultCenterInputKey = 0;
+
     /**
      * Whether settings have been loaded from the server.
      *
@@ -74,6 +91,35 @@ export default class SettingsMapController extends Controller {
         return this.mapProvider === 'leaflet';
     }
 
+    /**
+     * The default center as a GeoJSON point for the coordinates input, or null.
+     *
+     * @memberof SettingsMapController
+     * @return {Object|null}
+     */
+    get defaultMapCenterPoint() {
+        if (!this.hasDefaultMapCenter) {
+            return null;
+        }
+
+        return { type: 'Point', coordinates: [this.defaultMapLongitude, this.defaultMapLatitude] };
+    }
+
+    get hasDefaultMapCenter() {
+        return isLatitude(this.defaultMapLatitude) && isLongitude(this.defaultMapLongitude);
+    }
+
+    /**
+     * The zoom to save: a whole number from 1 to 20, else null.
+     *
+     * @memberof SettingsMapController
+     * @return {Number|null}
+     */
+    get normalizedDefaultMapZoom() {
+        const zoom = toCoordinate(this.defaultMapZoom);
+        return isZoom(zoom) ? zoom : null;
+    }
+
     // ─── Actions ───────────────────────────────────────────────────────────────
 
     /**
@@ -86,6 +132,24 @@ export default class SettingsMapController extends Controller {
         this.mapProvider = option?.value ?? option ?? 'leaflet';
     }
 
+    /**
+     * Receives coordinates typed into, or picked on the map of, the default
+     * center input.
+     *
+     * @param {{latitude: *, longitude: *}} coordinates
+     * @memberof SettingsMapController
+     */
+    @action setDefaultMapCenter({ latitude, longitude } = {}) {
+        this.defaultMapLatitude = toCoordinate(latitude);
+        this.defaultMapLongitude = toCoordinate(longitude);
+    }
+
+    @action clearDefaultMapCenter() {
+        this.defaultMapLatitude = null;
+        this.defaultMapLongitude = null;
+        this.defaultCenterInputKey++;
+    }
+
     @task *saveSettings() {
         const settings = {
             mapProvider: this.mapProvider,
@@ -94,12 +158,19 @@ export default class SettingsMapController extends Controller {
             googleMapsMapType: this.googleMapsMapType,
             showGoogleMapsTrafficLayer: this.showGoogleMapsTrafficLayer,
             showGoogleMapsTransitLayer: this.showGoogleMapsTransitLayer,
+            defaultMapLatitude: this.hasDefaultMapCenter ? this.defaultMapLatitude : null,
+            defaultMapLongitude: this.hasDefaultMapCenter ? this.defaultMapLongitude : null,
+            defaultMapZoom: this.normalizedDefaultMapZoom,
+            fitMapToVehicles: this.fitMapToVehicles,
         };
 
         try {
             const response = yield this.fetch.post('fleet-ops/settings/map', { settings });
             this.mapSettings.applySettings(response);
 
+            // Re-resolve where maps open so an open live map moves to the new default.
+            this.location.relocate();
+
             if (this.mapManager && typeof this.mapManager.setActiveProvider === 'function') {
                 this.mapManager.setActiveProvider(this.mapProvider);
             }
@@ -124,6 +195,9 @@ export default class SettingsMapController extends Controller {
             this.googleMapsMapType = response?.googleMapsMapType ?? 'roadmap';
             this.showGoogleMapsTrafficLayer = Boolean(response?.showGoogleMapsTrafficLayer);
             this.showGoogleMapsTransitLayer = Boolean(response?.showGoogleMapsTransitLayer);
+            this.setDefaultMapCenter({ latitude: response?.defaultMapLatitude, longitude: response?.defaultMapLongitude });
+            this.defaultMapZoom = response?.defaultMapZoom ?? null;
+            this.fitMapToVehicles = Boolean(response?.fitMapToVehicles);
             this.settingsLoaded = true;
         } catch (error) {
             this.notifications.serverError(error);
diff --git a/addon/services/location.js b/addon/services/location.js
index ed2c3c737..f44245a92 100644
--- a/addon/services/location.js
+++ b/addon/services/location.js
@@ -4,7 +4,7 @@ import { isBlank } from '@ember/utils';
 import { isArray } from '@ember/array';
 import { later } from '@ember/runloop';
 import { debug } from '@ember/debug';
-import getWithDefault from '@fleetbase/ember-core/utils/get-with-default';
+import { isLatitude, isLongitude, isZoom } from '../utils/map-default-view';
 
 /**
  * Service for managing and retrieving user location data.
@@ -46,17 +46,30 @@ export default class LocationService extends Service {
      */
     @service fetch;
 
+    /**
+     * Company map settings, which carry the default map view.
+     * @type {MapSettingsService}
+     */
+    @service mapSettings;
+
     /**
      * Current latitude of the user.
      * @type {number}
      */
-    @tracked latitude = this.DEFAULT_LATITUDE;
+    @tracked latitude = LocationService.DEFAULT_LATITUDE;
 
     /**
      * Current longitude of the user.
      * @type {number}
      */
-    @tracked longitude = this.DEFAULT_LONGITUDE;
+    @tracked longitude = LocationService.DEFAULT_LONGITUDE;
+
+    /**
+     * Zoom suggested by the source of the location (a company default view or
+     * a country centre), or null to let the map use its own default.
+     * @type {number|null}
+     */
+    @tracked zoom = null;
 
     /**
      * Flag indicating whether the user's location has been located.
@@ -73,7 +86,7 @@ export default class LocationService extends Service {
         if (typeof this.latitude === 'number' && !isNaN(this.latitude) && this.latitude >= -90 && this.latitude <= 90) {
             return this.latitude;
         }
-        return this.constructor.DEFAULT_LATITUDE;
+        return LocationService.DEFAULT_LATITUDE;
     }
 
     /**
@@ -85,14 +98,23 @@ export default class LocationService extends Service {
         if (typeof this.longitude === 'number' && !isNaN(this.longitude) && this.longitude >= -180 && this.longitude <= 180) {
             return this.longitude;
         }
-        return this.constructor.DEFAULT_LONGITUDE;
+        return LocationService.DEFAULT_LONGITUDE;
+    }
+
+    /**
+     * Retrieves the zoom suggested by the current location source, or null.
+     * @returns {number|null}
+     */
+    getZoom() {
+        return isZoom(this.zoom) ? this.zoom : null;
     }
 
     /**
-     * Attempts to fetch the user's location from various sources including cached data,
-     * navigator geolocation, or WHOIS data. It first tries to get the cached coordinates.
-     * If not available or outdated, it tries the browser's geolocation API.
-     * As a fallback, it uses WHOIS data associated with the user's account.
+     * Resolves where maps should open. A company-configured default centre
+     * (Settings > Map) wins outright. Otherwise it tries the active order
+     * destinations, then the browser's geolocation API, then the IP lookup,
+     * then the centre of the company's country, then the hardcoded default.
+     * See utils/map-default-view for the full precedence.
      *
      * @returns {Promise<Object>} A promise that resolves to an object containing latitude and longitude.
      */
@@ -102,6 +124,14 @@ export default class LocationService extends Service {
             return { latitude: this.latitude, longitude: this.longitude };
         }
 
+        // The company's chosen starting point beats any guess about the user.
+        await this.mapSettings.load();
+        const defaultCenter = this.mapSettings.defaultMapCenter;
+        if (defaultCenter) {
+            this.updateLocation(defaultCenter);
+            return { latitude: defaultCenter.latitude, longitude: defaultCenter.longitude };
+        }
+
         try {
             const coordinates = await this.fetch.cachedGet('fleet-ops/live/coordinates', {}, { expirationInterval: 1, expirationIntervalUnit: 'hour' });
 
@@ -184,33 +214,51 @@ export default class LocationService extends Service {
         }
     }
 
+    /**
+     * Discards the resolved location and resolves it again, e.g. after the
+     * company's default map view changed. Listeners of `user.located` (the
+     * live map) move to the new location.
+     *
+     * @returns {Promise<Object>} The newly resolved coordinates.
+     */
+    async relocate() {
+        this.located = false;
+        return this.getUserLocation();
+    }
+
     /**
      * Retrieves the user's location based on WHOIS data associated with their account.
-     * Defaults to predefined coordinates if WHOIS data is not available.
+     * When the IP lookup failed it falls back to the centre of the company's
+     * country, and only then to the predefined coordinates.
      *
      * @returns {Object} An object containing latitude and longitude from WHOIS data or default values.
      */
     getUserLocationFromWhois() {
-        const whois = this.currentUser.getOption('whois', {});
-        const coordinates = {
-            latitude: getWithDefault(whois, 'latitude', this.DEFAULT_LATITUDE),
-            longitude: getWithDefault(whois, 'longitude', this.DEFAULT_LONGITUDE),
-        };
-
-        this.updateLocation(coordinates);
-        return coordinates;
+        const whois = this.currentUser.getOption('whois', {}) ?? {};
+        const latitude = Number(whois.latitude);
+        const longitude = Number(whois.longitude);
+        // The IP lookup's fallback reports null coordinates, which Number() turns into Null Island.
+        const hasWhoisCoordinates = whois.latitude != null && whois.longitude != null && isLatitude(latitude) && isLongitude(longitude);
+
+        const location = hasWhoisCoordinates
+            ? { latitude, longitude }
+            : (this.mapSettings.companyCountryCenter ?? { latitude: LocationService.DEFAULT_LATITUDE, longitude: LocationService.DEFAULT_LONGITUDE });
+
+        this.updateLocation(location);
+        return { latitude: location.latitude, longitude: location.longitude };
     }
 
     /**
      * Updates the service's tracked properties with the new location data.
      * Triggers an event to notify other parts of the application that the user's location has been updated.
      *
-     * @param {Object} coordinates - An object containing the latitude and longitude to be set.
+     * @param {Object} coordinates - An object containing the latitude and longitude to be set, and optionally a suggested zoom.
      */
-    updateLocation({ latitude, longitude }) {
+    updateLocation({ latitude, longitude, zoom = null }) {
         this.latitude = latitude;
         this.longitude = longitude;
+        this.zoom = isZoom(zoom) ? zoom : null;
         this.located = true;
-        this.universe.trigger('user.located', { latitude, longitude });
+        this.universe.trigger('user.located', { latitude, longitude, zoom: this.zoom });
     }
 }
diff --git a/addon/services/map-settings.js b/addon/services/map-settings.js
index 9c5022c48..de4c1e03e 100644
--- a/addon/services/map-settings.js
+++ b/addon/services/map-settings.js
@@ -2,6 +2,7 @@ import Service from '@ember/service';
 import { tracked } from '@glimmer/tracking';
 import { inject as service } from '@ember/service';
 import { getLeafletTileUrl } from '../utils/leaflet-tile-url';
+import { defaultMapCenter, companyCountryCenter } from '../utils/map-default-view';
 
 const DEFAULT_SETTINGS = {
     mapProvider: 'leaflet',
@@ -12,6 +13,11 @@ const DEFAULT_SETTINGS = {
     googleMapsMapType: 'roadmap',
     showGoogleMapsTrafficLayer: false,
     showGoogleMapsTransitLayer: false,
+    defaultMapLatitude: null,
+    defaultMapLongitude: null,
+    defaultMapZoom: null,
+    fitMapToVehicles: false,
+    companyMapCenter: null,
 };
 
 export default class MapSettingsService extends Service {
@@ -47,6 +53,28 @@ export default class MapSettingsService extends Service {
         return Boolean(this.settings.showGoogleMapsTransitLayer);
     }
 
+    /**
+     * The company's configured default centre for the live map, or null.
+     *
+     * @return {{latitude: Number, longitude: Number, zoom: Number}|null}
+     */
+    get defaultMapCenter() {
+        return defaultMapCenter(this.settings);
+    }
+
+    /**
+     * The centre of the company's country, used when nothing better is known.
+     *
+     * @return {{latitude: Number, longitude: Number, zoom: Number}|null}
+     */
+    get companyCountryCenter() {
+        return companyCountryCenter(this.settings);
+    }
+
+    get fitMapToVehicles() {
+        return Boolean(this.settings.fitMapToVehicles);
+    }
+
     get isGoogleMaps() {
         return this.mapProvider === 'google';
     }
diff --git a/addon/templates/settings/map.hbs b/addon/templates/settings/map.hbs
index fe65273b5..502194b88 100644
--- a/addon/templates/settings/map.hbs
+++ b/addon/templates/settings/map.hbs
@@ -81,6 +81,52 @@
                 {{/if}}
             </ContentPanel>
 
+            {{! ─── Default Map View Panel ──────────────────────────────────────── }}
+            <ContentPanel @title={{t "settings.map.default-view"}} @open={{true}} @wrapperClass="bordered-classic">
+                {{#if this.settingsLoaded}}
+                    <p class="mb-4 text-sm text-gray-500 dark:text-gray-400">{{t "settings.map.default-view-help-text"}}</p>
+
+                    <InputGroup @name={{t "settings.map.default-center"}} @helpText={{t "settings.map.default-center-help-text"}}>
+                        {{#each (array this.defaultCenterInputKey) as |inputKey|}}
+                            <CoordinatesInput
+                                data-input-key={{inputKey}}
+                                @value={{this.defaultMapCenterPoint}}
+                                @onChange={{this.setDefaultMapCenter}}
+                                @onUpdatedFromMap={{this.setDefaultMapCenter}}
+                                @disabled={{cannot "fleet-ops update map-settings"}}
+                            />
+                        {{/each}}
+                        {{#if this.hasDefaultMapCenter}}
+                            <Button
+                                @type="link"
+                                @size="xs"
+                                @icon="times"
+                                @text={{t "settings.map.clear-default-center"}}
+                                @onClick={{this.clearDefaultMapCenter}}
+                                @permission="fleet-ops update map-settings"
+                            />
+                        {{/if}}
+                    </InputGroup>
+
+                    <InputGroup @name={{t "settings.map.default-zoom"}} @helpText={{t "settings.map.default-zoom-help-text"}}>
+                        <Input @type="number" @value={{this.defaultMapZoom}} min="1" max="20" step="1" placeholder="12" class="w-full form-input" />
+                    </InputGroup>
+
+                    <InputGroup>
+                        <Toggle
+                            @label={{t "settings.map.fit-to-vehicles"}}
+                            @isToggled={{this.fitMapToVehicles}}
+                            @onToggle={{fn (mut this.fitMapToVehicles)}}
+                            @helpText={{t "settings.map.fit-to-vehicles-help-text"}}
+                        />
+                    </InputGroup>
+                {{else}}
+                    <div class="flex items-center justify-center py-8">
+                        <Spinner />
+                    </div>
+                {{/if}}
+            </ContentPanel>
+
             {{! Extension point for third-party panels }}
             <RegistryYield @registry="fleet-ops:template:settings:map" as |RegistryComponent|>
                 <RegistryComponent @controller={{this}} />
diff --git a/addon/utils/map-default-view.js b/addon/utils/map-default-view.js
new file mode 100644
index 000000000..786265f6a
--- /dev/null
+++ b/addon/utils/map-default-view.js
@@ -0,0 +1,132 @@
+/**
+ * Helpers for the company's default live map view.
+ *
+ * Where the live map opens, in order of precedence:
+ *   1. "Fit to my vehicles" is on and at least one vehicle has a position:
+ *      the map fits every positioned vehicle once it has loaded.
+ *   2. The company has a default centre: the map opens there at the
+ *      configured zoom. An admin's explicit choice wins over browser
+ *      geolocation and active order destinations.
+ *   3. Otherwise the user's location: active order destinations, then
+ *      browser geolocation, then the IP lookup.
+ *   4. The centre of the company's country (or the country of its timezone).
+ *   5. The hardcoded fallback.
+ */
+
+/** Zoom used for a company-defined centre when no zoom was configured. */
+export const DEFAULT_CENTER_ZOOM = 12;
+
+/** Zoom used when the map falls back to the centre of the company's country. */
+export const COUNTRY_CENTER_ZOOM = 4;
+
+/** Closest the map zooms when fitting vehicles, so a single vehicle is not shown at street level. */
+export const FIT_VEHICLES_MAX_ZOOM = 15;
+
+export function isLatitude(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value >= -90 && value <= 90;
+}
+
+export function isLongitude(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value >= -180 && value <= 180;
+}
+
+export function isZoom(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 1 && value <= 20;
+}
+
+/**
+ * Parse a user-entered coordinate, returning null for blank or invalid input.
+ *
+ * @param {*} value
+ * @return {Number|null}
+ */
+export function toCoordinate(value) {
+    if (value === null || value === undefined || (typeof value === 'string' && value.trim() === '')) {
+        return null;
+    }
+
+    const number = Number(value);
+    return Number.isFinite(number) ? number : null;
+}
+
+/**
+ * The company's configured default centre, or null when none is set.
+ *
+ * @param {Object} settings map settings from `fleet-ops/settings/map`
+ * @return {{latitude: Number, longitude: Number, zoom: Number}|null}
+ */
+export function defaultMapCenter(settings = {}) {
+    const latitude = toCoordinate(settings?.defaultMapLatitude);
+    const longitude = toCoordinate(settings?.defaultMapLongitude);
+    if (!isLatitude(latitude) || !isLongitude(longitude)) {
+        return null;
+    }
+
+    const zoom = toCoordinate(settings?.defaultMapZoom);
+    return { latitude, longitude, zoom: isZoom(zoom) ? zoom : DEFAULT_CENTER_ZOOM };
+}
+
+/**
+ * The centre of the company's country, derived by the server, or null.
+ *
+ * @param {Object} settings map settings from `fleet-ops/settings/map`
+ * @return {{latitude: Number, longitude: Number, zoom: Number}|null}
+ */
+export function companyCountryCenter(settings = {}) {
+    const { latitude, longitude } = settings?.companyMapCenter ?? {};
+    if (!isLatitude(latitude) || !isLongitude(longitude)) {
+        return null;
+    }
+
+    return { latitude, longitude, zoom: COUNTRY_CENTER_ZOOM };
+}
+
+/**
+ * Extract `{ latitude, longitude }` from a GeoJSON point, a `[lat, lng]` pair
+ * or a `{ latitude, longitude }` object. Null Island (0,0) is treated as "no
+ * position" because that is what unpositioned records default to.
+ *
+ * @param {*} location
+ * @return {{latitude: Number, longitude: Number}|null}
+ */
+export function coordinatesOf(location) {
+    let latitude;
+    let longitude;
+
+    if (Array.isArray(location?.coordinates)) {
+        [longitude, latitude] = location.coordinates;
+    } else if (Array.isArray(location)) {
+        [latitude, longitude] = location;
+    } else {
+        latitude = location?.latitude;
+        longitude = location?.longitude;
+    }
+
+    if (!isLatitude(latitude) || !isLongitude(longitude) || (latitude === 0 && longitude === 0)) {
+        return null;
+    }
+
+    return { latitude, longitude };
+}
+
+/**
+ * Bounds `[[south, west], [north, east]]` around every record that has a
+ * position, or null when none do.
+ *
+ * @param {Array} records records with a `location` (e.g. live vehicles)
+ * @return {Array|null}
+ */
+export function positionedBounds(records = []) {
+    const points = (Array.isArray(records) ? records : []).map((record) => coordinatesOf(record?.location)).filter(Boolean);
+    if (points.length === 0) {
+        return null;
+    }
+
+    const latitudes = points.map((point) => point.latitude);
+    const longitudes = points.map((point) => point.longitude);
+
+    return [
+        [Math.min(...latitudes), Math.min(...longitudes)],
+        [Math.max(...latitudes), Math.max(...longitudes)],
+    ];
+}
diff --git a/app/utils/map-default-view.js b/app/utils/map-default-view.js
new file mode 100644
index 000000000..9206bb3b3
--- /dev/null
+++ b/app/utils/map-default-view.js
@@ -0,0 +1 @@
+export * from '@fleetbase/fleetops-engine/utils/map-default-view';
diff --git a/server/src/Http/Controllers/Internal/v1/SettingController.php b/server/src/Http/Controllers/Internal/v1/SettingController.php
index 3699c4bf7..aae9ac743 100644
--- a/server/src/Http/Controllers/Internal/v1/SettingController.php
+++ b/server/src/Http/Controllers/Internal/v1/SettingController.php
@@ -395,6 +395,10 @@ public function getMapSettings()
             'googleMapsMapType'           => 'roadmap',
             'showGoogleMapsTrafficLayer'  => false,
             'showGoogleMapsTransitLayer'  => false,
+            'defaultMapLatitude'          => null,
+            'defaultMapLongitude'         => null,
+            'defaultMapZoom'              => null,
+            'fitMapToVehicles'            => false,
         ];
 
         $systemMapSettings          = $this->lookupSetting('fleet-ops.map-settings', []);
@@ -408,6 +412,12 @@ public function getMapSettings()
         $mapSettings['googleMapsApiKey'] = $this->googleMapsApiKey();
         $mapSettings['googleMapsMapId']  = data_get($systemMapSettings, 'googleMapsMapId', '');
 
+        // Last-resort starting point for the live map when the company has no
+        // configured default view and the browser cannot locate the user: the
+        // centre of the company's country, so a fresh account opens in the
+        // right part of the world instead of a hardcoded city.
+        $mapSettings['companyMapCenter'] = $this->companyMapCenter();
+
         return response()->json($mapSettings);
     }
 
@@ -429,6 +439,9 @@ public function saveMapSettings(Request $request)
         // from the payload in case a client accidentally sends it.
         unset($settings['googleMapsApiKey']);
 
+        // Derived server-side on every read, never persisted.
+        unset($settings['companyMapCenter']);
+
         // Validate provider value
         $settings = $this->normalizeCompanyMapSettings($settings);
 
@@ -487,9 +500,99 @@ protected function normalizeCompanyMapSettings(array $settings): array
             'googleMapsMapType'          => $googleMapsMapType,
             'showGoogleMapsTrafficLayer' => filter_var(data_get($settings, 'showGoogleMapsTrafficLayer', false), FILTER_VALIDATE_BOOLEAN),
             'showGoogleMapsTransitLayer' => filter_var(data_get($settings, 'showGoogleMapsTransitLayer', false), FILTER_VALIDATE_BOOLEAN),
+            ...$this->normalizeDefaultMapView($settings),
+        ];
+    }
+
+    /**
+     * Normalize the company's default live map view. A centre is only kept as
+     * a valid latitude/longitude pair — half a coordinate would send the map
+     * to the equator or the meridian — and the zoom is clamped to the range
+     * both map providers support.
+     */
+    protected function normalizeDefaultMapView(array $settings): array
+    {
+        $latitude  = $this->normalizeCoordinate(data_get($settings, 'defaultMapLatitude'), 90);
+        $longitude = $this->normalizeCoordinate(data_get($settings, 'defaultMapLongitude'), 180);
+        $hasCenter = $latitude !== null && $longitude !== null;
+        $zoom      = filter_var(data_get($settings, 'defaultMapZoom'), FILTER_VALIDATE_INT);
+
+        return [
+            'defaultMapLatitude'  => $hasCenter ? $latitude : null,
+            'defaultMapLongitude' => $hasCenter ? $longitude : null,
+            'defaultMapZoom'      => $zoom === false ? null : max(1, min(20, $zoom)),
+            'fitMapToVehicles'    => filter_var(data_get($settings, 'fitMapToVehicles', false), FILTER_VALIDATE_BOOLEAN),
+        ];
+    }
+
+    protected function normalizeCoordinate($value, float $limit): ?float
+    {
+        if ($value === null || $value === '' || !is_numeric($value)) {
+            return null;
+        }
+
+        $value = (float) $value;
+
+        return abs($value) <= $limit ? $value : null;
+    }
+
+    /**
+     * Resolve the centre of the current company's country, from its country
+     * code or, when none was recorded, the country of its timezone.
+     */
+    protected function companyMapCenter(): ?array
+    {
+        $company = $this->currentCompany();
+        $country = $this->normalizeCountryCode(data_get($company, 'country')) ?? $this->countryFromTimezone(data_get($company, 'timezone'));
+        if ($country === null) {
+            return null;
+        }
+
+        $coordinates = data_get($this->countryData($country), 'coordinates', []);
+        $latitude    = $this->normalizeCoordinate(data_get($coordinates, 'latitude'), 90);
+        $longitude   = $this->normalizeCoordinate(data_get($coordinates, 'longitude'), 180);
+        if ($latitude === null || $longitude === null || ($latitude == 0 && $longitude == 0)) {
+            return null;
+        }
+
+        return [
+            'country'   => $country,
+            'latitude'  => $latitude,
+            'longitude' => $longitude,
         ];
     }
 
+    protected function normalizeCountryCode($country): ?string
+    {
+        return is_string($country) && preg_match('/^[A-Za-z]{2}$/', $country) ? strtoupper($country) : null;
+    }
+
+    protected function countryFromTimezone($timezone): ?string
+    {
+        if (!is_string($timezone) || $timezone === '') {
+            return null;
+        }
+
+        try {
+            $location = (new \DateTimeZone($timezone))->getLocation();
+        } catch (\Throwable $e) {
+            return null;
+        }
+
+        // UTC and other non-geographic zones report the country code "??".
+        return $this->normalizeCountryCode(data_get($location, 'country_code'));
+    }
+
+    protected function countryData(string $country): ?array
+    {
+        try {
+            return Utils::getCountryData($country);
+        } catch (\Throwable $e) {
+            // The countries package throws for codes it does not know.
+            return null;
+        }
+    }
+
     /**
      * Sanitize a Leaflet XYZ tile URL template — only http(s) URLs are accepted,
      * anything else is discarded so the frontend falls back to the default tiles.
diff --git a/server/tests/SettingControllerContractsTest.php b/server/tests/SettingControllerContractsTest.php
index 5989948c1..82222d759 100644
--- a/server/tests/SettingControllerContractsTest.php
+++ b/server/tests/SettingControllerContractsTest.php
@@ -162,6 +162,116 @@ function fleetopsJsonPayload(mixed $response): array
     return $response->getData(true);
 }
 
+class FleetOpsMapCenterRedisFake
+{
+    public array $sets = [];
+
+    public function __construct(private array $cached = [], private bool $throws = false)
+    {
+    }
+
+    public function exists(string $key): bool
+    {
+        if ($this->throws) {
+            throw new RuntimeException('redis unavailable');
+        }
+
+        return array_key_exists($key, $this->cached);
+    }
+
+    public function get(string $key): mixed
+    {
+        return json_encode($this->cached[$key]);
+    }
+
+    public function set(string $key, string $value): bool
+    {
+        $this->sets[] = $key;
+
+        return true;
+    }
+}
+
+function fleetopsMapCenterFor(mixed $company, FleetOpsMapCenterRedisFake $redis): mixed
+{
+    Illuminate\Support\Facades\Redis::swap($redis);
+
+    $controller          = new FleetOpsSettingControllerProbe();
+    $controller->company = $company;
+
+    return fleetopsJsonPayload($controller->getMapSettings())['companyMapCenter'];
+}
+
+test('map settings persist a company default view and never persist the derived country centre', function () {
+    $controller = new FleetOpsSettingControllerProbe();
+
+    $saved = fleetopsJsonPayload($controller->saveMapSettings(new Request([
+        'settings' => [
+            'defaultMapLatitude'  => '-33.8688',
+            'defaultMapLongitude' => 151.2093,
+            'defaultMapZoom'      => '25',
+            'fitMapToVehicles'    => '1',
+            'companyMapCenter'    => ['latitude' => 1, 'longitude' => 2],
+        ],
+    ])));
+
+    expect($controller->configuredCompany['fleet-ops.map-settings'])->toMatchArray([
+        'defaultMapLatitude'  => -33.8688,
+        'defaultMapLongitude' => 151.2093,
+        'defaultMapZoom'      => 20,
+        'fitMapToVehicles'    => true,
+    ])
+        ->and(array_key_exists('companyMapCenter', $controller->configuredCompany['fleet-ops.map-settings']))->toBeFalse()
+        ->and($saved['defaultMapLatitude'])->toBe(-33.8688)
+        ->and($saved['companyMapCenter'])->toBeNull();
+
+    // A fresh company reads the defaults: no centre, no zoom, no fitting.
+    $fresh = fleetopsJsonPayload((new FleetOpsSettingControllerProbe())->getMapSettings());
+    expect($fresh)->toMatchArray([
+        'defaultMapLatitude'  => null,
+        'defaultMapLongitude' => null,
+        'defaultMapZoom'      => null,
+        'fitMapToVehicles'    => false,
+        'companyMapCenter'    => null,
+    ]);
+});
+
+test('map default view drops half or out of range centres and clamps the zoom', function (array $input, array $expected) {
+    $controller = new FleetOpsSettingControllerProbe();
+    $controller->saveMapSettings(new Request(['settings' => $input]));
+
+    expect($controller->configuredCompany['fleet-ops.map-settings'])->toMatchArray($expected);
+})->with([
+    'latitude only'          => [['defaultMapLatitude' => '10'], ['defaultMapLatitude' => null, 'defaultMapLongitude' => null]],
+    'latitude out of range'  => [['defaultMapLatitude' => 91, 'defaultMapLongitude' => 10], ['defaultMapLatitude' => null, 'defaultMapLongitude' => null]],
+    'longitude out of range' => [['defaultMapLatitude' => 10, 'defaultMapLongitude' => -180.5], ['defaultMapLatitude' => null, 'defaultMapLongitude' => null]],
+    'non numeric'            => [['defaultMapLatitude' => 'north', 'defaultMapLongitude' => ''], ['defaultMapLatitude' => null, 'defaultMapLongitude' => null]],
+    'zero is a real place'   => [['defaultMapLatitude' => 0, 'defaultMapLongitude' => '0'], ['defaultMapLatitude' => 0.0, 'defaultMapLongitude' => 0.0]],
+    'zoom below range'       => [['defaultMapZoom' => 0], ['defaultMapZoom' => 1]],
+    'zoom not an integer'    => [['defaultMapZoom' => '4.5'], ['defaultMapZoom' => null]],
+]);
+
+test('map settings centre a company on its country, falling back to the country of its timezone', function () {
+    $australia = ['countryData:AU' => ['coordinates' => ['latitude' => -25.58, 'longitude' => 134.5]]];
+
+    expect(fleetopsMapCenterFor(['country' => 'au'], new FleetOpsMapCenterRedisFake($australia)))
+        ->toBe(['country' => 'AU', 'latitude' => -25.58, 'longitude' => 134.5])
+        ->and(fleetopsMapCenterFor(['country' => 'Australia', 'timezone' => 'Australia/Sydney'], new FleetOpsMapCenterRedisFake($australia)))
+        ->toBe(['country' => 'AU', 'latitude' => -25.58, 'longitude' => 134.5]);
+});
+
+test('map settings omit the country centre when the company location cannot be resolved', function (mixed $company, array $cached, bool $throws) {
+    expect(fleetopsMapCenterFor($company, new FleetOpsMapCenterRedisFake($cached, $throws)))->toBeNull();
+})->with([
+    'no company'             => [null, [], false],
+    'no country or timezone' => [['country' => null, 'timezone' => ''], [], false],
+    'utc timezone'           => [['timezone' => 'UTC'], [], false],
+    'unknown timezone'       => [['timezone' => 'Not/AZone'], [], false],
+    'unknown country'        => [['country' => 'ZZ'], ['countryData:ZZ' => []], false],
+    'null island centroid'   => [['country' => 'XX'], ['countryData:XX' => ['coordinates' => ['latitude' => 0, 'longitude' => 0]]], false],
+    'country lookup fails'   => [['country' => 'AU'], [], true],
+]);
+
 test('setting controller persists and returns basic company settings through configured keys', function () {
     session(['company' => 'company-1']);
     $controller                  = new FleetOpsSettingControllerProbe();
diff --git a/tests/unit/controllers/settings/map-test.js b/tests/unit/controllers/settings/map-test.js
index 82674d895..65a10fee7 100644
--- a/tests/unit/controllers/settings/map-test.js
+++ b/tests/unit/controllers/settings/map-test.js
@@ -54,7 +54,17 @@ module('Unit | Controller | settings/map', function (hooks) {
             }
         }
 
+        class LocationStubService extends Service {
+            relocations = 0;
+
+            relocate() {
+                this.relocations++;
+                return Promise.resolve({});
+            }
+        }
+
         this.owner.register('service:fetch', FetchStubService);
+        this.owner.register('service:location', LocationStubService);
         this.owner.register('service:notifications', NotificationsStubService);
         this.owner.register('service:intl', IntlStubService);
         this.owner.register('service:map-manager', MapManagerStubService);
@@ -78,12 +88,85 @@ module('Unit | Controller | settings/map', function (hooks) {
         assert.deepEqual(fetch.lastPost.payload, {
             settings: {
                 mapProvider: 'google',
+                leafletTileUrl: '',
+                leafletDarkTileUrl: '',
                 googleMapsMapType: 'satellite',
                 showGoogleMapsTrafficLayer: true,
                 showGoogleMapsTransitLayer: true,
+                defaultMapLatitude: null,
+                defaultMapLongitude: null,
+                defaultMapZoom: null,
+                fitMapToVehicles: false,
             },
         });
         assert.deepEqual(mapSettings.appliedSettings, fetch.lastPost.payload.settings);
         assert.true(mapManager.appliedViewSettings, 'google map view settings are applied after save');
     });
+
+    test('it loads the default map view', async function (assert) {
+        class MapSettingsWithViewStubService extends Service {
+            load() {
+                return Promise.resolve({ mapProvider: 'leaflet', defaultMapLatitude: -33.86, defaultMapLongitude: 151.2, defaultMapZoom: 9, fitMapToVehicles: true });
+            }
+        }
+        this.owner.unregister('service:map-settings');
+        this.owner.register('service:map-settings', MapSettingsWithViewStubService);
+
+        const controller = this.owner.lookup('controller:settings/map');
+        await controller.getSettings.last;
+
+        assert.strictEqual(controller.defaultMapLatitude, -33.86);
+        assert.strictEqual(controller.defaultMapLongitude, 151.2);
+        assert.strictEqual(controller.defaultMapZoom, 9);
+        assert.true(controller.fitMapToVehicles);
+        assert.true(controller.hasDefaultMapCenter);
+        assert.deepEqual(controller.defaultMapCenterPoint, { type: 'Point', coordinates: [151.2, -33.86] });
+    });
+
+    test('it saves the default map view and re-resolves where maps open', async function (assert) {
+        const controller = this.owner.lookup('controller:settings/map');
+        await controller.getSettings.last;
+
+        assert.strictEqual(controller.defaultMapCenterPoint, null, 'no centre loaded');
+
+        controller.setDefaultMapCenter({ latitude: '-27.47', longitude: '153.02' });
+        controller.defaultMapZoom = '11';
+        controller.fitMapToVehicles = true;
+        await controller.saveSettings.perform();
+
+        const fetch = this.owner.lookup('service:fetch');
+        const location = this.owner.lookup('service:location');
+        assert.deepEqual(
+            {
+                defaultMapLatitude: fetch.lastPost.payload.settings.defaultMapLatitude,
+                defaultMapLongitude: fetch.lastPost.payload.settings.defaultMapLongitude,
+                defaultMapZoom: fetch.lastPost.payload.settings.defaultMapZoom,
+                fitMapToVehicles: fetch.lastPost.payload.settings.fitMapToVehicles,
+            },
+            { defaultMapLatitude: -27.47, defaultMapLongitude: 153.02, defaultMapZoom: 11, fitMapToVehicles: true }
+        );
+        assert.strictEqual(location.relocations, 1);
+    });
+
+    test('it never saves half a centre or an invalid zoom, and clearing resets the input', async function (assert) {
+        const controller = this.owner.lookup('controller:settings/map');
+        await controller.getSettings.last;
+
+        controller.setDefaultMapCenter({ latitude: '-27.47', longitude: '' });
+        controller.defaultMapZoom = '4.5';
+        await controller.saveSettings.perform();
+
+        const { settings } = this.owner.lookup('service:fetch').lastPost.payload;
+        assert.strictEqual(settings.defaultMapLatitude, null);
+        assert.strictEqual(settings.defaultMapLongitude, null);
+        assert.strictEqual(settings.defaultMapZoom, null);
+
+        controller.setDefaultMapCenter({ latitude: 1, longitude: 2 });
+        const inputKey = controller.defaultCenterInputKey;
+        controller.clearDefaultMapCenter();
+        assert.false(controller.hasDefaultMapCenter);
+        assert.strictEqual(controller.defaultCenterInputKey, inputKey + 1);
+        controller.setDefaultMapCenter();
+        assert.strictEqual(controller.defaultMapLatitude, null);
+    });
 });
diff --git a/tests/unit/services/location-test.js b/tests/unit/services/location-test.js
index af7c0ca9d..ad2a763f5 100644
--- a/tests/unit/services/location-test.js
+++ b/tests/unit/services/location-test.js
@@ -1,12 +1,133 @@
 import { module, test } from 'qunit';
 import { setupTest } from 'dummy/tests/helpers';
+import Service from '@ember/service';
+import LocationService from '@fleetbase/fleetops-engine/services/location';
 
 module('Unit | Service | location', function (hooks) {
     setupTest(hooks);
 
-    // TODO: Replace this with your real tests.
-    test('it exists', function (assert) {
-        let service = this.owner.lookup('service:location');
-        assert.ok(service);
+    hooks.beforeEach(function () {
+        class FetchStubService extends Service {
+            coordinates = [];
+            requests = 0;
+
+            cachedGet() {
+                this.requests++;
+                return Promise.resolve(this.coordinates);
+            }
+        }
+
+        class CurrentUserStubService extends Service {
+            whois = {};
+
+            getOption(key, defaultValue) {
+                return key === 'whois' ? this.whois : defaultValue;
+            }
+        }
+
+        class UniverseStubService extends Service {
+            events = [];
+
+            trigger(name, payload) {
+                this.events.push({ name, payload });
+            }
+        }
+
+        class MapSettingsStubService extends Service {
+            defaultMapCenter = null;
+            companyCountryCenter = null;
+            loads = 0;
+
+            load() {
+                this.loads++;
+                return Promise.resolve({});
+            }
+        }
+
+        this.owner.register('service:fetch', FetchStubService);
+        this.owner.register('service:current-user', CurrentUserStubService);
+        this.owner.register('service:universe', UniverseStubService);
+        this.owner.register('service:map-settings', MapSettingsStubService);
+
+        this.fetch = this.owner.lookup('service:fetch');
+        this.currentUser = this.owner.lookup('service:current-user');
+        this.universe = this.owner.lookup('service:universe');
+        this.mapSettings = this.owner.lookup('service:map-settings');
+    });
+
+    test('it starts at the hardcoded default with no suggested zoom', function (assert) {
+        const service = this.owner.lookup('service:location');
+
+        assert.strictEqual(service.getLatitude(), LocationService.DEFAULT_LATITUDE);
+        assert.strictEqual(service.getLongitude(), LocationService.DEFAULT_LONGITUDE);
+        assert.strictEqual(service.getZoom(), null);
+    });
+
+    test('a company default centre wins over order destinations and the browser', async function (assert) {
+        this.mapSettings.defaultMapCenter = { latitude: -33.86, longitude: 151.2, zoom: 9 };
+        this.fetch.coordinates = [{ coordinates: [103.8, 1.3] }];
+        const service = this.owner.lookup('service:location');
+
+        const location = await service.getUserLocation();
+
+        assert.deepEqual(location, { latitude: -33.86, longitude: 151.2 });
+        assert.strictEqual(service.getZoom(), 9);
+        assert.strictEqual(this.fetch.requests, 0, 'no guessing when the company chose a view');
+        assert.deepEqual(this.universe.events, [{ name: 'user.located', payload: { latitude: -33.86, longitude: 151.2, zoom: 9 } }]);
+    });
+
+    test('without a default centre it opens on active order destinations', async function (assert) {
+        this.fetch.coordinates = [{ coordinates: [0, 0] }, { coordinates: [151.2, -33.86] }];
+        const service = this.owner.lookup('service:location');
+
+        assert.deepEqual(await service.getUserLocation(), { latitude: -33.86, longitude: 151.2 });
+        assert.strictEqual(service.getZoom(), null);
+        assert.strictEqual(this.mapSettings.loads, 1);
+    });
+
+    test('with no active orders it asks the browser', async function (assert) {
+        const service = this.owner.lookup('service:location');
+        service.getUserLocationFromNavigator = async () => ({ latitude: -37.81, longitude: 144.96 });
+
+        assert.deepEqual(await service.getUserLocation(), { latitude: -37.81, longitude: 144.96 });
+    });
+
+    test('the IP lookup is used before the country centre', async function (assert) {
+        this.fetch.coordinates = [{ coordinates: [0, 0] }];
+        this.currentUser.whois = { latitude: '-31.95', longitude: '115.86' };
+        this.mapSettings.companyCountryCenter = { latitude: -25.58, longitude: 134.5, zoom: 4 };
+        const service = this.owner.lookup('service:location');
+
+        assert.deepEqual(await service.getUserLocation(), { latitude: -31.95, longitude: 115.86 });
+        assert.strictEqual(service.getZoom(), null);
+    });
+
+    test('a failed IP lookup falls back to the company country, not Singapore', async function (assert) {
+        this.fetch.cachedGet = () => Promise.reject(new Error('offline'));
+        this.currentUser.whois = { latitude: null, longitude: null, _source: 'fallback' };
+        this.mapSettings.companyCountryCenter = { latitude: -25.58, longitude: 134.5, zoom: 4 };
+        const service = this.owner.lookup('service:location');
+
+        assert.deepEqual(await service.getUserLocation(), { latitude: -25.58, longitude: 134.5 });
+        assert.strictEqual(service.getZoom(), 4);
+    });
+
+    test('with nothing known it uses the hardcoded default', function (assert) {
+        this.currentUser.whois = null;
+        const service = this.owner.lookup('service:location');
+
+        assert.deepEqual(service.getUserLocationFromWhois(), { latitude: LocationService.DEFAULT_LATITUDE, longitude: LocationService.DEFAULT_LONGITUDE });
+        assert.true(service.located);
+    });
+
+    test('relocate re-resolves after the company default changes', async function (assert) {
+        this.fetch.coordinates = [{ coordinates: [151.2, -33.86] }];
+        const service = this.owner.lookup('service:location');
+        await service.getUserLocation();
+
+        this.mapSettings.defaultMapCenter = { latitude: -27.47, longitude: 153.02, zoom: 11 };
+        assert.deepEqual(await service.getUserLocation(), { latitude: -33.86, longitude: 151.2 }, 'resolved once per session');
+        assert.deepEqual(await service.relocate(), { latitude: -27.47, longitude: 153.02 });
+        assert.strictEqual(service.getZoom(), 11);
     });
 });
diff --git a/tests/unit/services/map-settings-test.js b/tests/unit/services/map-settings-test.js
index df7f86829..a17b06faa 100644
--- a/tests/unit/services/map-settings-test.js
+++ b/tests/unit/services/map-settings-test.js
@@ -52,6 +52,7 @@ module('Unit | Service | map-settings', function (hooks) {
     });
 
     test('it applies google view layer defaults when values are omitted', function (assert) {
+        this.owner.register('service:fetch', class extends Service {});
         const service = this.owner.lookup('service:map-settings');
         const settings = service.applySettings({ mapProvider: 'google' });
 
@@ -59,4 +60,30 @@ module('Unit | Service | map-settings', function (hooks) {
         assert.false(service.showGoogleMapsTrafficLayer);
         assert.false(service.showGoogleMapsTransitLayer);
     });
+
+    test('it exposes no default map view until the company sets one', function (assert) {
+        this.owner.register('service:fetch', class extends Service {});
+        const service = this.owner.lookup('service:map-settings');
+        service.applySettings({});
+
+        assert.strictEqual(service.defaultMapCenter, null);
+        assert.strictEqual(service.companyCountryCenter, null);
+        assert.false(service.fitMapToVehicles);
+    });
+
+    test('it exposes the company default map view and country centre', function (assert) {
+        this.owner.register('service:fetch', class extends Service {});
+        const service = this.owner.lookup('service:map-settings');
+        service.applySettings({
+            defaultMapLatitude: -33.86,
+            defaultMapLongitude: 151.2,
+            defaultMapZoom: 10,
+            fitMapToVehicles: true,
+            companyMapCenter: { country: 'AU', latitude: -25.58, longitude: 134.5 },
+        });
+
+        assert.deepEqual(service.defaultMapCenter, { latitude: -33.86, longitude: 151.2, zoom: 10 });
+        assert.deepEqual(service.companyCountryCenter, { latitude: -25.58, longitude: 134.5, zoom: 4 });
+        assert.true(service.fitMapToVehicles);
+    });
 });
diff --git a/tests/unit/utils/map-default-view-test.js b/tests/unit/utils/map-default-view-test.js
new file mode 100644
index 000000000..ede9972fc
--- /dev/null
+++ b/tests/unit/utils/map-default-view-test.js
@@ -0,0 +1,84 @@
+import { module, test } from 'qunit';
+import {
+    COUNTRY_CENTER_ZOOM,
+    DEFAULT_CENTER_ZOOM,
+    companyCountryCenter,
+    coordinatesOf,
+    defaultMapCenter,
+    isZoom,
+    positionedBounds,
+    toCoordinate,
+} from '@fleetbase/fleetops-engine/utils/map-default-view';
+
+module('Unit | Utility | map-default-view', function () {
+    test('toCoordinate parses entered numbers and rejects blanks', function (assert) {
+        assert.strictEqual(toCoordinate('-33.86'), -33.86);
+        assert.strictEqual(toCoordinate(151.2), 151.2);
+        assert.strictEqual(toCoordinate(0), 0);
+        assert.strictEqual(toCoordinate(''), null);
+        assert.strictEqual(toCoordinate('  '), null);
+        assert.strictEqual(toCoordinate(null), null);
+        assert.strictEqual(toCoordinate(undefined), null);
+        assert.strictEqual(toCoordinate('north'), null);
+    });
+
+    test('isZoom accepts whole zoom levels from 1 to 20', function (assert) {
+        assert.true(isZoom(1));
+        assert.true(isZoom(20));
+        assert.false(isZoom(0));
+        assert.false(isZoom(21));
+        assert.false(isZoom(4.5));
+        assert.false(isZoom('12'));
+    });
+
+    test('defaultMapCenter needs both coordinates and defaults the zoom', function (assert) {
+        assert.deepEqual(defaultMapCenter({ defaultMapLatitude: -33.86, defaultMapLongitude: 151.2, defaultMapZoom: 9 }), { latitude: -33.86, longitude: 151.2, zoom: 9 });
+        assert.deepEqual(defaultMapCenter({ defaultMapLatitude: '-33.86', defaultMapLongitude: '151.2' }), { latitude: -33.86, longitude: 151.2, zoom: DEFAULT_CENTER_ZOOM });
+        assert.deepEqual(defaultMapCenter({ defaultMapLatitude: 1, defaultMapLongitude: 2, defaultMapZoom: 99 }).zoom, DEFAULT_CENTER_ZOOM, 'an invalid zoom falls back');
+        assert.strictEqual(defaultMapCenter({ defaultMapLatitude: -33.86 }), null, 'half a centre is no centre');
+        assert.strictEqual(defaultMapCenter({ defaultMapLatitude: 95, defaultMapLongitude: 10 }), null);
+        assert.strictEqual(defaultMapCenter({}), null);
+        assert.strictEqual(defaultMapCenter(null), null);
+        assert.strictEqual(defaultMapCenter(), null);
+    });
+
+    test('companyCountryCenter uses the server-derived country centre at country zoom', function (assert) {
+        assert.deepEqual(companyCountryCenter({ companyMapCenter: { country: 'AU', latitude: -25.58, longitude: 134.5 } }), {
+            latitude: -25.58,
+            longitude: 134.5,
+            zoom: COUNTRY_CENTER_ZOOM,
+        });
+        assert.strictEqual(companyCountryCenter({ companyMapCenter: null }), null);
+        assert.strictEqual(companyCountryCenter({ companyMapCenter: { latitude: 'x', longitude: 1 } }), null);
+        assert.strictEqual(companyCountryCenter(null), null);
+        assert.strictEqual(companyCountryCenter(), null);
+    });
+
+    test('coordinatesOf reads GeoJSON points, pairs and objects and ignores Null Island', function (assert) {
+        assert.deepEqual(coordinatesOf({ type: 'Point', coordinates: [151.2, -33.86] }), { latitude: -33.86, longitude: 151.2 });
+        assert.deepEqual(coordinatesOf([-33.86, 151.2]), { latitude: -33.86, longitude: 151.2 });
+        assert.deepEqual(coordinatesOf({ latitude: -33.86, longitude: 151.2 }), { latitude: -33.86, longitude: 151.2 });
+        assert.strictEqual(coordinatesOf({ type: 'Point', coordinates: [0, 0] }), null);
+        assert.strictEqual(coordinatesOf([null, null]), null);
+        assert.strictEqual(coordinatesOf(null), null);
+    });
+
+    test('positionedBounds frames every positioned record', function (assert) {
+        const bounds = positionedBounds([
+            { location: { type: 'Point', coordinates: [151.2, -33.86] } },
+            { location: { type: 'Point', coordinates: [115.86, -31.95] } },
+            { location: { type: 'Point', coordinates: [0, 0] } },
+            { location: null },
+            null,
+        ]);
+
+        assert.deepEqual(bounds, [
+            [-33.86, 115.86],
+            [-31.95, 151.2],
+        ]);
+        assert.strictEqual(positionedBounds([{ location: null }]), null, 'no positioned vehicles');
+        assert.strictEqual(positionedBounds([]), null);
+        assert.strictEqual(positionedBounds(null), null);
+        assert.strictEqual(positionedBounds(), null);
+    });
+});
diff --git a/translations/en-us.yaml b/translations/en-us.yaml
index cf1043c0b..07c2b4d23 100644
--- a/translations/en-us.yaml
+++ b/translations/en-us.yaml
@@ -2868,6 +2868,15 @@ settings:
         show-transit-layer-help-text: Overlay public transit routes on the Google Maps view.
         settings-saved: Map settings saved successfully.
         settings-save-failed: Failed to save map settings. Please try again.
+        default-view: Default Map View
+        default-view-help-text: Where the live map and the Live Fleet Map widget open. A default center is used instead of the browser's location. Without one, the map opens near your active orders or your browser's location, then in your company's country.
+        default-center: Default Center
+        default-center-help-text: Enter coordinates or select a point from the map. Leave blank to locate users automatically.
+        clear-default-center: Clear default center
+        default-zoom: Default Zoom
+        default-zoom-help-text: Zoom level from 1 (whole world) to 20 (street level) used with the default center. Defaults to 12.
+        fit-to-vehicles: Fit to my vehicles
+        fit-to-vehicles-help-text: When the map opens, frame every vehicle that has a position. If no vehicle has a position yet, the default center is used.
     navigator-app:
         navigator-app-settings: Navigator App Settings
     payments:

From 4a932a80f2f2658bccf5440ae5dd849dc86691d7 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 12:33:04 +0800
Subject: [PATCH 40/87] fix(tracking-page): labelled map markers, a visible
 route line, Fleetbase attribution

- Stops are numbered pins, as the stop cards are, with their place name; the
  pickup area and the vehicle (driver's first name) are labelled too.
- The route line took its colour from a CSS variable passed as an SVG
  attribute, which SVG ignores; the colour now comes from a class.
- Until live routing sends a road line, a dashed line joins pickup (or the
  vehicle) and the stops still to come, in order.
- Marker shapes are drawn on a child element: Leaflet's positioning
  transform on the marker overwrote the pin rotation.
- The footer uses ember-ui's FleetbaseAttribution.
---
 addon/components/tracking-page.hbs     |  2 +-
 addon/components/tracking-page/map.hbs | 16 +++--
 addon/components/tracking-page/map.js  | 78 ++++++++++++++++++----
 addon/styles/fleetops-engine.css       | 89 ++++++++++++++++++++++++--
 translations/ar-ae.yml                 |  2 +
 translations/bg-bg.yaml                |  2 +
 translations/en-us.yaml                |  2 +
 translations/es-pa.yaml                |  2 +
 translations/fr-fr.yaml                |  2 +
 translations/mn-mn.yaml                |  2 +
 translations/pt-br.yaml                |  2 +
 translations/ru-ru.yaml                |  2 +
 translations/uk-ua.yaml                |  2 +
 translations/vi-vn.yaml                |  2 +
 14 files changed, 182 insertions(+), 23 deletions(-)

diff --git a/addon/components/tracking-page.hbs b/addon/components/tracking-page.hbs
index c0470d4c7..31b63c549 100644
--- a/addon/components/tracking-page.hbs
+++ b/addon/components/tracking-page.hbs
@@ -128,7 +128,7 @@
             </select>
         </label>
         {{#if this.company.powered_by}}
-            <div>{{t "tracking-page.page.powered-by"}}</div>
+            <FleetbaseAttribution @showPoweredBy={{true}} class="tp-attribution" />
         {{/if}}
     </footer>
 
diff --git a/addon/components/tracking-page/map.hbs b/addon/components/tracking-page/map.hbs
index 58bc960e2..332f3158c 100644
--- a/addon/components/tracking-page/map.hbs
+++ b/addon/components/tracking-page/map.hbs
@@ -3,16 +3,24 @@
     <LeafletMap class="tp-map-canvas" @lat={{get this.center 0}} @lng={{get this.center 1}} @zoom={{13}} @zoomControl={{false}} @onLoad={{this.setup}} as |layers|>
         <layers.tile @url={{(leaflet-tile-url)}} />
         {{#if this.hasRoute}}
-            <layers.polyline @locations={{this.route}} @color="var(--tp-accent)" @weight={{5}} @opacity={{0.9}} />
+            <layers.polyline @locations={{this.route}} @className="tp-map-route" @weight={{5}} @opacity={{0.9}} @interactive={{false}} />
+        {{else if this.hasPlannedRoute}}
+            <layers.polyline @locations={{this.plannedRoute}} @className="tp-map-route tp-map-route-planned" @weight={{3}} @dashArray="6 8" @interactive={{false}} />
         {{/if}}
         {{#if this.hub}}
-            <layers.marker @location={{this.hub}} @icon={{this.hubIcon}} @keyboard={{false}} />
+            <layers.marker @location={{this.hub}} @icon={{this.hubIcon}} @keyboard={{false}} as |marker|>
+                <marker.tooltip @permanent={{true}} @direction="top" @className="tp-map-label">{{t "tracking-page.page.map-pickup"}}</marker.tooltip>
+            </layers.marker>
         {{/if}}
         {{#each this.stops as |stop|}}
-            <layers.marker @location={{stop.location}} @icon={{this.stopIcon}} @title={{stop.place.name}} />
+            <layers.marker @location={{stop.location}} @icon={{stop.icon}} @title={{stop.label}} @riseOnHover={{true}} as |marker|>
+                <marker.tooltip @permanent={{true}} @direction="top" @className="tp-map-label tp-map-label-stop">{{stop.label}}</marker.tooltip>
+            </layers.marker>
         {{/each}}
         {{#if this.vehicle}}
-            <layers.marker @location={{this.vehicle}} @icon={{this.vehicleIcon}} @zIndexOffset={{1000}} />
+            <layers.marker @location={{this.vehicle}} @icon={{this.vehicleIcon}} @zIndexOffset={{1000}} @title={{this.vehicleLabel}} as |marker|>
+                <marker.tooltip @permanent={{true}} @direction="top" @className="tp-map-label tp-map-label-vehicle">{{this.vehicleLabel}}</marker.tooltip>
+            </layers.marker>
         {{/if}}
     </LeafletMap>
     <div class="tp-map-chip {{if @stale 'tp-map-chip-stale'}}">
diff --git a/addon/components/tracking-page/map.js b/addon/components/tracking-page/map.js
index 1f235122a..a4ee4bc09 100644
--- a/addon/components/tracking-page/map.js
+++ b/addon/components/tracking-page/map.js
@@ -1,13 +1,21 @@
 import Component from '@glimmer/component';
+import { inject as service } from '@ember/service';
 import { action } from '@ember/object';
 import { decodePolyline } from '../../utils/tracking-live-source';
 
 /**
- * The live map on the tracking page: the customer's stops, where the route starts, the
- * route line when every stop is theirs, and the vehicle while it is on its way to them.
- * It renders below the status text, so the page reads before the map loads.
+ * The live map on the tracking page: the customer's stops, numbered as the stop cards
+ * are, where the route starts, and the vehicle while it is on its way to them. Each
+ * marker carries a label, so the map reads without a legend.
+ *
+ * The road line comes from live routing, which the server sends only while the vehicle
+ * is on its way and every stop is the customer's. Until then a dashed line joins the
+ * points already on the map, in stop order: it shows the order of the trip and gives
+ * away nothing the markers don't.
  */
 export default class TrackingPageMapComponent extends Component {
+    @service intl;
+
     map = null;
 
     get data() {
@@ -20,11 +28,23 @@ export default class TrackingPageMapComponent extends Component {
         return location ? [location.latitude, location.longitude] : null;
     }
 
+    get vehicleLabel() {
+        return this.data.driver?.name || this.intl.t('tracking-page.page.map-driver');
+    }
+
     get stops() {
         const stops = [];
+        let number = 0;
         for (const stop of this.data.stops ?? []) {
+            number += 1;
             if (stop.place?.latitude && stop.place?.longitude) {
-                stops.push({ ...stop, location: [stop.place.latitude, stop.place.longitude] });
+                stops.push({
+                    ...stop,
+                    number,
+                    location: [stop.place.latitude, stop.place.longitude],
+                    label: stop.place.name || this.intl.t('tracking-page.page.your-stop', { number }),
+                    icon: this.stopIcon(number, stop.complete),
+                });
             }
         }
 
@@ -45,13 +65,37 @@ export default class TrackingPageMapComponent extends Component {
         return this.route.length > 1;
     }
 
+    /**
+     * Pickup, then each stop still to come; the vehicle stands in for the pickup once it
+     * is on its way.
+     */
+    get plannedRoute() {
+        const points = [];
+        const start = this.vehicle ?? this.hub;
+        if (start) {
+            points.push(start);
+        }
+
+        for (const stop of this.stops) {
+            if (!stop.complete) {
+                points.push(stop.location);
+            }
+        }
+
+        return points;
+    }
+
+    get hasPlannedRoute() {
+        return !this.hasRoute && this.plannedRoute.length > 1;
+    }
+
     get points() {
         const points = this.stops.map((stop) => stop.location);
         if (this.vehicle) {
             points.push(this.vehicle);
         }
 
-        if (this.hub && points.length < 2) {
+        if (this.hub) {
             points.push(this.hub);
         }
 
@@ -63,15 +107,27 @@ export default class TrackingPageMapComponent extends Component {
     }
 
     get vehicleIcon() {
-        return L.divIcon({ className: this.args.stale ? 'tp-map-vehicle tp-map-vehicle-stale' : 'tp-map-vehicle', iconSize: [28, 28], iconAnchor: [14, 14] });
+        return L.divIcon({
+            className: this.args.stale ? 'tp-map-marker tp-map-vehicle tp-map-vehicle-stale' : 'tp-map-marker tp-map-vehicle',
+            html: '<span class="tp-map-vehicle-dot"></span>',
+            iconSize: [28, 28],
+            iconAnchor: [14, 14],
+            tooltipAnchor: [0, -16],
+        });
     }
 
-    get stopIcon() {
-        return L.divIcon({ className: 'tp-map-stop', iconSize: [22, 22], iconAnchor: [11, 22] });
+    get hubIcon() {
+        return L.divIcon({ className: 'tp-map-marker tp-map-hub', html: '<span class="tp-map-hub-dot"></span>', iconSize: [18, 18], iconAnchor: [9, 9], tooltipAnchor: [0, -11] });
     }
 
-    get hubIcon() {
-        return L.divIcon({ className: 'tp-map-hub', iconSize: [16, 16], iconAnchor: [8, 8] });
+    stopIcon(number, complete) {
+        return L.divIcon({
+            className: complete ? 'tp-map-marker tp-map-stop tp-map-stop-complete' : 'tp-map-marker tp-map-stop',
+            html: `<span class="tp-map-stop-pin"><span class="tp-map-stop-number">${complete ? '✓' : Number(number)}</span></span>`,
+            iconSize: [30, 38],
+            iconAnchor: [15, 38],
+            tooltipAnchor: [0, -40],
+        });
     }
 
     @action setup({ target }) {
@@ -89,7 +145,7 @@ export default class TrackingPageMapComponent extends Component {
             return;
         }
 
-        this.map.fitBounds(L.latLngBounds(this.points), { padding: [36, 36], maxZoom: 15 });
+        this.map.fitBounds(L.latLngBounds(this.points), { padding: [48, 48], maxZoom: 15 });
     }
 
     @action recenter() {
diff --git a/addon/styles/fleetops-engine.css b/addon/styles/fleetops-engine.css
index 0e139a0b2..3369581e1 100644
--- a/addon/styles/fleetops-engine.css
+++ b/addon/styles/fleetops-engine.css
@@ -13356,32 +13356,106 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     cursor: pointer;
 }
 
+/* Leaflet positions markers with an inline transform, so a marker's shape is drawn on
+   its child element; a transform on the marker itself would be overwritten. */
+.tp-map-marker {
+    background: none;
+    border: 0;
+}
+
+.tp-root .tp-attribution,
+.tp-root .tp-attribution .fleetbase-attribution-link,
+.tp-root .tp-attribution .fleetbase-attribution-legal-link {
+    color: var(--tp-muted);
+}
+
 .tp-map-vehicle {
+    transition: transform 1s linear;
+}
+
+.tp-map-vehicle-dot {
+    display: block;
+    width: 100%;
+    height: 100%;
     border: 3px solid var(--tp-surface);
     border-radius: 999px;
     background: var(--tp-accent);
     box-shadow: 0 0 0 6px var(--tp-accent-soft);
-    transition: transform 1s linear;
 }
 
-.tp-map-vehicle-stale {
+.tp-map-vehicle-stale .tp-map-vehicle-dot {
     background: var(--tp-neutral);
     opacity: 0.5;
 }
 
-.tp-map-stop {
+.tp-map-stop-pin {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 30px;
+    height: 30px;
     border: 3px solid var(--tp-surface);
     border-radius: 999px 999px 999px 0;
-    background: var(--tp-text);
-    transform: rotate(-45deg);
+    background: var(--tp-accent);
+    box-shadow: 0 2px 6px rgb(0 0 0 / 25%);
+    transform: translateY(2px) rotate(-45deg);
+}
+
+.tp-map-stop-number {
+    color: var(--tp-ink);
+    font-size: 0.8125rem;
+    font-weight: 700;
+    line-height: 1;
+    transform: rotate(45deg);
+}
+
+.tp-map-stop-complete .tp-map-stop-pin {
+    background: var(--tp-neutral);
 }
 
-.tp-map-hub {
+.tp-map-hub-dot {
+    display: block;
+    width: 100%;
+    height: 100%;
     border: 3px solid var(--tp-text);
     border-radius: 999px;
     background: var(--tp-surface);
 }
 
+/* SVG presentation attributes don't resolve CSS variables, so the line takes its
+   colour here rather than from Leaflet's `color` option. */
+.tp-map-route {
+    stroke: var(--tp-accent);
+}
+
+.tp-map-route-planned {
+    stroke: var(--tp-muted);
+}
+
+.tp-root .tp-map-label {
+    max-width: 12rem;
+    padding: 0.125rem 0.5rem;
+    overflow: hidden;
+    border: 1px solid var(--tp-border);
+    border-radius: 999px;
+    background: var(--tp-surface);
+    box-shadow: 0 1px 3px rgb(0 0 0 / 15%);
+    color: var(--tp-text);
+    font-size: 0.75rem;
+    font-weight: 600;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.tp-root .tp-map-label::before {
+    display: none;
+}
+
+.tp-root .tp-map-label-vehicle {
+    border-color: var(--tp-accent);
+    color: var(--tp-accent);
+}
+
 .tp-eta-time {
     font-size: 2.25rem;
     font-weight: 700;
@@ -13698,7 +13772,8 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
 
 @media (prefers-reduced-motion: reduce) {
     .tp-live-dot,
-    .tp-map-vehicle {
+    .tp-root .tp-map-vehicle,
+    .tp-root .tp-map-vehicle-dot {
         animation: none;
         transition: none;
     }
diff --git a/translations/ar-ae.yml b/translations/ar-ae.yml
index 386903b9f..60d57ebb5 100644
--- a/translations/ar-ae.yml
+++ b/translations/ar-ae.yml
@@ -2247,6 +2247,8 @@ tracking-page:
     stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
     map: "Map"
     map-label: "Map of your delivery: the van on its way to your address."
+    map-pickup: "Pickup area"
+    map-driver: "Driver"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/bg-bg.yaml b/translations/bg-bg.yaml
index 5f4d10ce0..2ae53a130 100644
--- a/translations/bg-bg.yaml
+++ b/translations/bg-bg.yaml
@@ -2562,6 +2562,8 @@ tracking-page:
     stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
     map: "Map"
     map-label: "Map of your delivery: the van on its way to your address."
+    map-pickup: "Pickup area"
+    map-driver: "Driver"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/en-us.yaml b/translations/en-us.yaml
index 3d9601ed3..ce84bac78 100644
--- a/translations/en-us.yaml
+++ b/translations/en-us.yaml
@@ -3840,6 +3840,8 @@ tracking-page:
     stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
     map: "Map"
     map-label: "Map of your delivery: the van on its way to your address."
+    map-pickup: "Pickup area"
+    map-driver: "Driver"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/es-pa.yaml b/translations/es-pa.yaml
index d61e99616..71f71385a 100644
--- a/translations/es-pa.yaml
+++ b/translations/es-pa.yaml
@@ -2441,6 +2441,8 @@ tracking-page:
     stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
     map: "Map"
     map-label: "Map of your delivery: the van on its way to your address."
+    map-pickup: "Pickup area"
+    map-driver: "Driver"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/fr-fr.yaml b/translations/fr-fr.yaml
index 897aa7ee6..fc60becab 100644
--- a/translations/fr-fr.yaml
+++ b/translations/fr-fr.yaml
@@ -2587,6 +2587,8 @@ tracking-page:
     stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
     map: "Map"
     map-label: "Map of your delivery: the van on its way to your address."
+    map-pickup: "Pickup area"
+    map-driver: "Driver"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/mn-mn.yaml b/translations/mn-mn.yaml
index 33136c5a4..17dab8605 100644
--- a/translations/mn-mn.yaml
+++ b/translations/mn-mn.yaml
@@ -2531,6 +2531,8 @@ tracking-page:
     stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
     map: "Map"
     map-label: "Map of your delivery: the van on its way to your address."
+    map-pickup: "Pickup area"
+    map-driver: "Driver"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/pt-br.yaml b/translations/pt-br.yaml
index 635d58296..8ad1a272b 100644
--- a/translations/pt-br.yaml
+++ b/translations/pt-br.yaml
@@ -2552,6 +2552,8 @@ tracking-page:
     stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
     map: "Map"
     map-label: "Map of your delivery: the van on its way to your address."
+    map-pickup: "Pickup area"
+    map-driver: "Driver"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/ru-ru.yaml b/translations/ru-ru.yaml
index 1edc015ff..3ab769b87 100644
--- a/translations/ru-ru.yaml
+++ b/translations/ru-ru.yaml
@@ -2545,6 +2545,8 @@ tracking-page:
     stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
     map: "Map"
     map-label: "Map of your delivery: the van on its way to your address."
+    map-pickup: "Pickup area"
+    map-driver: "Driver"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/uk-ua.yaml b/translations/uk-ua.yaml
index bdf5bb4da..9d81ee336 100644
--- a/translations/uk-ua.yaml
+++ b/translations/uk-ua.yaml
@@ -3688,6 +3688,8 @@ tracking-page:
     stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
     map: "Map"
     map-label: "Map of your delivery: the van on its way to your address."
+    map-pickup: "Pickup area"
+    map-driver: "Driver"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/vi-vn.yaml b/translations/vi-vn.yaml
index 40c64a0ce..20bf668d3 100644
--- a/translations/vi-vn.yaml
+++ b/translations/vi-vn.yaml
@@ -2361,6 +2361,8 @@ tracking-page:
     stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
     map: "Map"
     map-label: "Map of your delivery: the van on its way to your address."
+    map-pickup: "Pickup area"
+    map-driver: "Driver"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"

From 0a42cdeb34bc1ec7da460d71c4887a539dce1ee2 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 13:13:22 +0800
Subject: [PATCH 41/87] fix(tracking-page): pickups by name, route line before
 dispatch, full screen map, working stop switcher

- Pickups show by name at their place: the payload pickup, waypoints typed as
  pickups, and on storefront orders the other stores, which storefront adds as
  waypoints with no type. They no longer count as the customer's stops.
- The tracker's road line is sent whenever every stop on it is the customer's,
  not only once the vehicle reports; before that it starts at the pickup.
- The expand button toggles full screen (or a window-filling map where the
  Fullscreen API is missing); fit-route has its own button.
- Updates leave out each stop tracking number's setup entry ("Waypoint
  Created") and name the stop the rest belong to.
- The stop tabs now switch a stop card, the selected pin, and the updates,
  items and proofs for that stop; items and proofs carry their stop's id.
---
 addon/components/tracking-page/full-view.hbs  |  20 ++-
 addon/components/tracking-page/full-view.js   |  26 ++-
 addon/components/tracking-page/map.hbs        |  15 +-
 addon/components/tracking-page/map.js         | 154 +++++++++++++++---
 addon/styles/fleetops-engine.css              |  43 ++++-
 .../src/Support/TrackingPage/TrackingView.php | 141 +++++++++++++---
 .../Support/TrackingPage/TrackingViewTest.php |  63 +++++--
 translations/ar-ae.yml                        |   6 +
 translations/bg-bg.yaml                       |   6 +
 translations/en-us.yaml                       |   6 +
 translations/es-pa.yaml                       |   6 +
 translations/fr-fr.yaml                       |   6 +
 translations/mn-mn.yaml                       |   6 +
 translations/pt-br.yaml                       |   6 +
 translations/ru-ru.yaml                       |   6 +
 translations/uk-ua.yaml                       |   6 +
 translations/vi-vn.yaml                       |   6 +
 17 files changed, 448 insertions(+), 74 deletions(-)

diff --git a/addon/components/tracking-page/full-view.hbs b/addon/components/tracking-page/full-view.hbs
index aeff45968..f2a23a3a2 100644
--- a/addon/components/tracking-page/full-view.hbs
+++ b/addon/components/tracking-page/full-view.hbs
@@ -75,6 +75,20 @@
             </div>
             <ClickToCopy class="tp-button tp-button-small" @value={{@data.tracking_number}}>{{t "tracking-page.page.copy"}}</ClickToCopy>
         </div>
+
+        {{#if this.currentStop}}
+            <section class="tp-card tp-card-tight tp-row-between" aria-labelledby="tp-stop-title">
+                <div class="tp-stack-xs tp-grow">
+                    <h2 id="tp-stop-title" class="tp-small tp-muted">{{this.stopCardTitle}}</h2>
+                    {{#if this.currentStop.place.name}}<span class="tp-strong">{{this.currentStop.place.name}}</span>{{/if}}
+                    {{#if this.currentStop.place.address}}<span class="tp-small tp-muted">{{this.currentStop.place.address}}</span>{{/if}}
+                    {{#if this.windowText}}<span class="tp-small"><span class="tp-muted">{{t "tracking-page.page.window"}}</span> {{this.windowText}}</span>{{/if}}
+                </div>
+                <span class="tp-chip {{if this.currentStop.complete 'tp-chip-accent'}}">
+                    {{#if this.currentStop.complete}}<FaIcon @icon="check" /> {{t "tracking-page.page.stop-complete"}}{{else}}{{t "tracking-page.page.stop-upcoming"}}{{/if}}
+                </span>
+            </section>
+        {{/if}}
     </div>
 
     {{#if @data.map}}
@@ -82,6 +96,7 @@
             <div class="tp-full-map">
                 <TrackingPage::Map
                     @data={{@data}}
+                    @selectedStopId={{this.currentStop.id}}
                     @live={{this.live}}
                     @stale={{this.stale}}
                     @staleText={{if this.stale this.staleText}}
@@ -189,7 +204,10 @@
                         <li class="tp-timeline-entry {{if entry.latest 'tp-timeline-latest'}}">
                             <span class="tp-timeline-dot" aria-hidden="true"></span>
                             <div class="tp-row-between tp-grow">
-                                <span class="tp-strong">{{entry.status}}</span>
+                                <div class="tp-stack-xs">
+                                    <span class="tp-strong">{{entry.status}}</span>
+                                    {{#if entry.place}}<span class="tp-small tp-muted">{{entry.place}}</span>{{/if}}
+                                </div>
                                 <span class="tp-small tp-muted">{{entry.time}}</span>
                             </div>
                         </li>
diff --git a/addon/components/tracking-page/full-view.js b/addon/components/tracking-page/full-view.js
index 53cff86c5..caadb5c4b 100644
--- a/addon/components/tracking-page/full-view.js
+++ b/addon/components/tracking-page/full-view.js
@@ -113,10 +113,30 @@ export default class TrackingPageFullViewComponent extends Component {
         return this.route.completed_stops + this.route.stops_before + 1;
     }
 
+    get currentStopNumber() {
+        return this.stops.indexOf(this.currentStop) + 1;
+    }
+
+    get stopCardTitle() {
+        return this.hasSeveralStops ? this.intl.t('tracking-page.page.your-stop', { number: this.currentStopNumber }) : this.intl.t('tracking-page.page.stop-card-title');
+    }
+
     @action selectStop(id) {
         this.selectedStopId = id;
     }
 
+    /**
+     * Entries that belong to one stop, filtered to the selected one; the rest are the
+     * whole order's and always show.
+     */
+    forCurrentStop(entries) {
+        if (!this.hasSeveralStops || !this.currentStop) {
+            return entries;
+        }
+
+        return entries.filter((entry) => !entry.stop || entry.stop === this.currentStop.id);
+    }
+
     /* ── Headline ──────────────────────────────────────────────────── */
 
     get eta() {
@@ -276,7 +296,7 @@ export default class TrackingPageFullViewComponent extends Component {
     }
 
     get timeline() {
-        return this.data.timeline ?? [];
+        return this.forCurrentStop(this.data.timeline ?? []);
     }
 
     get timelineGroups() {
@@ -310,11 +330,11 @@ export default class TrackingPageFullViewComponent extends Component {
     }
 
     get items() {
-        return this.data.items ?? [];
+        return this.forCurrentStop(this.data.items ?? []);
     }
 
     get proofs() {
-        return (this.data.proofs ?? []).map((proof) => ({ ...proof, url: this.proofUrls[proof.id] ?? null }));
+        return this.forCurrentStop(this.data.proofs ?? []).map((proof) => ({ ...proof, url: this.proofUrls[proof.id] ?? null }));
     }
 
     @action async loadProofs() {
diff --git a/addon/components/tracking-page/map.hbs b/addon/components/tracking-page/map.hbs
index 332f3158c..71ec40b3f 100644
--- a/addon/components/tracking-page/map.hbs
+++ b/addon/components/tracking-page/map.hbs
@@ -1,4 +1,4 @@
-<div class="tp-map">
+<div class="tp-map {{if this.expanded 'tp-map-expanded'}}" {{did-insert this.register}} {{did-update this.focusStop @selectedStopId}}>
     <span class="tp-sr-only">{{@label}}</span>
     <LeafletMap class="tp-map-canvas" @lat={{get this.center 0}} @lng={{get this.center 1}} @zoom={{13}} @zoomControl={{false}} @onLoad={{this.setup}} as |layers|>
         <layers.tile @url={{(leaflet-tile-url)}} />
@@ -7,11 +7,11 @@
         {{else if this.hasPlannedRoute}}
             <layers.polyline @locations={{this.plannedRoute}} @className="tp-map-route tp-map-route-planned" @weight={{3}} @dashArray="6 8" @interactive={{false}} />
         {{/if}}
-        {{#if this.hub}}
-            <layers.marker @location={{this.hub}} @icon={{this.hubIcon}} @keyboard={{false}} as |marker|>
-                <marker.tooltip @permanent={{true}} @direction="top" @className="tp-map-label">{{t "tracking-page.page.map-pickup"}}</marker.tooltip>
+        {{#each this.pickups as |pickup|}}
+            <layers.marker @location={{pickup.location}} @icon={{pickup.icon}} @title={{pickup.label}} @keyboard={{false}} as |marker|>
+                <marker.tooltip @permanent={{true}} @direction="top" @className="tp-map-label tp-map-label-pickup">{{pickup.label}}</marker.tooltip>
             </layers.marker>
-        {{/if}}
+        {{/each}}
         {{#each this.stops as |stop|}}
             <layers.marker @location={{stop.location}} @icon={{stop.icon}} @title={{stop.label}} @riseOnHover={{true}} as |marker|>
                 <marker.tooltip @permanent={{true}} @direction="top" @className="tp-map-label tp-map-label-stop">{{stop.label}}</marker.tooltip>
@@ -36,6 +36,9 @@
         {{#if this.vehicle}}
             <button type="button" class="tp-map-button" aria-label={{t "tracking-page.page.recenter"}} {{on "click" this.recenter}}><FaIcon @icon="crosshairs" /></button>
         {{/if}}
-        <button type="button" class="tp-map-button" aria-label={{t "tracking-page.page.fit-route"}} {{on "click" this.fitRoute}}><FaIcon @icon="expand" /></button>
+        <button type="button" class="tp-map-button" aria-label={{t "tracking-page.page.fit-route"}} {{on "click" this.fitRoute}}><FaIcon @icon="route" /></button>
+        <button type="button" class="tp-map-button" aria-label={{this.fullscreenLabel}} aria-pressed={{if this.expanded "true" "false"}} {{on "click" this.toggleFullscreen}}>
+            <FaIcon @icon={{if this.expanded "compress" "expand"}} />
+        </button>
     </div>
 </div>
diff --git a/addon/components/tracking-page/map.js b/addon/components/tracking-page/map.js
index a4ee4bc09..bb1aad3fb 100644
--- a/addon/components/tracking-page/map.js
+++ b/addon/components/tracking-page/map.js
@@ -1,22 +1,27 @@
 import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
 import { inject as service } from '@ember/service';
 import { action } from '@ember/object';
+import { next } from '@ember/runloop';
 import { decodePolyline } from '../../utils/tracking-live-source';
 
 /**
- * The live map on the tracking page: the customer's stops, numbered as the stop cards
- * are, where the route starts, and the vehicle while it is on its way to them. Each
+ * The live map on the tracking page: where the order is collected, the customer's stops,
+ * numbered as the stop cards are, and the vehicle while it is on its way to them. Each
  * marker carries a label, so the map reads without a legend.
  *
- * The road line comes from live routing, which the server sends only while the vehicle
- * is on its way and every stop is the customer's. Until then a dashed line joins the
- * points already on the map, in stop order: it shows the order of the trip and gives
- * away nothing the markers don't.
+ * The road line is the tracker's: from the vehicle once it reports, from the first
+ * pickup before that, sent only when every stop on it is the customer's. Without one, a
+ * dashed line joins the points already on the map in trip order, which gives away
+ * nothing the markers don't.
  */
 export default class TrackingPageMapComponent extends Component {
     @service intl;
 
+    @tracked expanded = false;
+
     map = null;
+    element = null;
 
     get data() {
         return this.args.data ?? {};
@@ -32,18 +37,24 @@ export default class TrackingPageMapComponent extends Component {
         return this.data.driver?.name || this.intl.t('tracking-page.page.map-driver');
     }
 
+    get hasSeveralStops() {
+        return (this.data.stops ?? []).length > 1;
+    }
+
     get stops() {
         const stops = [];
         let number = 0;
         for (const stop of this.data.stops ?? []) {
             number += 1;
             if (stop.place?.latitude && stop.place?.longitude) {
+                const selected = this.hasSeveralStops && stop.id === this.args.selectedStopId;
+                const dimmed = this.hasSeveralStops && !!this.args.selectedStopId && !selected;
                 stops.push({
                     ...stop,
                     number,
                     location: [stop.place.latitude, stop.place.longitude],
                     label: stop.place.name || this.intl.t('tracking-page.page.your-stop', { number }),
-                    icon: this.stopIcon(number, stop.complete),
+                    icon: this.stopIcon(number, stop.complete, selected, dimmed),
                 });
             }
         }
@@ -51,10 +62,13 @@ export default class TrackingPageMapComponent extends Component {
         return stops;
     }
 
-    get hub() {
-        const hub = this.data.map?.hub;
-
-        return hub ? [hub.latitude, hub.longitude] : null;
+    get pickups() {
+        return (this.data.map?.pickups ?? []).map((pickup) => ({
+            ...pickup,
+            location: [pickup.latitude, pickup.longitude],
+            label: pickup.name ? this.intl.t('tracking-page.page.map-pickup-named', { name: pickup.name }) : this.intl.t('tracking-page.page.map-pickup'),
+            icon: this.pickupIcon(pickup.complete),
+        }));
     }
 
     get route() {
@@ -66,14 +80,15 @@ export default class TrackingPageMapComponent extends Component {
     }
 
     /**
-     * Pickup, then each stop still to come; the vehicle stands in for the pickup once it
-     * is on its way.
+     * The vehicle, or the first store still to visit, then the pickups and stops still to
+     * come.
      */
     get plannedRoute() {
-        const points = [];
-        const start = this.vehicle ?? this.hub;
-        if (start) {
-            points.push(start);
+        const points = this.vehicle ? [this.vehicle] : [];
+        for (const pickup of this.pickups) {
+            if (!pickup.complete) {
+                points.push(pickup.location);
+            }
         }
 
         for (const stop of this.stops) {
@@ -90,15 +105,11 @@ export default class TrackingPageMapComponent extends Component {
     }
 
     get points() {
-        const points = this.stops.map((stop) => stop.location);
+        const points = [...this.pickups.map((pickup) => pickup.location), ...this.stops.map((stop) => stop.location)];
         if (this.vehicle) {
             points.push(this.vehicle);
         }
 
-        if (this.hub) {
-            points.push(this.hub);
-        }
-
         return points;
     }
 
@@ -116,13 +127,32 @@ export default class TrackingPageMapComponent extends Component {
         });
     }
 
-    get hubIcon() {
-        return L.divIcon({ className: 'tp-map-marker tp-map-hub', html: '<span class="tp-map-hub-dot"></span>', iconSize: [18, 18], iconAnchor: [9, 9], tooltipAnchor: [0, -11] });
+    pickupIcon(complete) {
+        return L.divIcon({
+            className: complete ? 'tp-map-marker tp-map-pickup tp-map-pickup-complete' : 'tp-map-marker tp-map-pickup',
+            html: `<span class="tp-map-pickup-pin">${complete ? '✓' : ''}</span>`,
+            iconSize: [22, 22],
+            iconAnchor: [11, 11],
+            tooltipAnchor: [0, -13],
+        });
     }
 
-    stopIcon(number, complete) {
+    stopIcon(number, complete, selected, dimmed) {
+        const classes = ['tp-map-marker', 'tp-map-stop'];
+        if (complete) {
+            classes.push('tp-map-stop-complete');
+        }
+
+        if (selected) {
+            classes.push('tp-map-stop-selected');
+        }
+
+        if (dimmed) {
+            classes.push('tp-map-stop-dimmed');
+        }
+
         return L.divIcon({
-            className: complete ? 'tp-map-marker tp-map-stop tp-map-stop-complete' : 'tp-map-marker tp-map-stop',
+            className: classes.join(' '),
             html: `<span class="tp-map-stop-pin"><span class="tp-map-stop-number">${complete ? '✓' : Number(number)}</span></span>`,
             iconSize: [30, 38],
             iconAnchor: [15, 38],
@@ -130,6 +160,68 @@ export default class TrackingPageMapComponent extends Component {
         });
     }
 
+    /* ── Full screen ───────────────────────────────────────────────── */
+
+    get fullscreenLabel() {
+        return this.intl.t(this.expanded ? 'tracking-page.page.map-exit-fullscreen' : 'tracking-page.page.map-fullscreen');
+    }
+
+    @action register(element) {
+        this.element = element;
+        document.addEventListener('fullscreenchange', this.onFullscreenChange);
+        document.addEventListener('keydown', this.onKeydown);
+    }
+
+    willDestroy() {
+        super.willDestroy(...arguments);
+        document.removeEventListener('fullscreenchange', this.onFullscreenChange);
+        document.removeEventListener('keydown', this.onKeydown);
+    }
+
+    /**
+     * The browser's full screen where it has one; otherwise the map covers the window.
+     */
+    @action toggleFullscreen() {
+        if (document.fullscreenElement === this.element) {
+            document.exitFullscreen?.();
+            return;
+        }
+
+        if (this.expanded) {
+            this.setExpanded(false);
+            return;
+        }
+
+        const request = this.element?.requestFullscreen?.();
+        if (request) {
+            request.catch(() => this.setExpanded(true));
+        } else {
+            this.setExpanded(true);
+        }
+    }
+
+    @action onFullscreenChange() {
+        this.setExpanded(!!this.element && document.fullscreenElement === this.element);
+    }
+
+    @action onKeydown(event) {
+        if (event.key === 'Escape' && this.expanded && !document.fullscreenElement) {
+            this.setExpanded(false);
+        }
+    }
+
+    setExpanded(expanded) {
+        this.expanded = expanded;
+        next(() => {
+            if (this.map && !this.isDestroyed) {
+                this.map.invalidateSize();
+                this.fitRoute();
+            }
+        });
+    }
+
+    /* ── Map ───────────────────────────────────────────────────────── */
+
     @action setup({ target }) {
         this.map = target;
         this.fitRoute();
@@ -153,4 +245,14 @@ export default class TrackingPageMapComponent extends Component {
             this.map.setView(this.vehicle, 15, { animate: !this.args.reducedMotion });
         }
     }
+
+    /**
+     * Bring the stop the customer picked into view.
+     */
+    @action focusStop() {
+        const stop = this.stops.find((candidate) => candidate.id === this.args.selectedStopId);
+        if (this.map && stop) {
+            this.map.panTo(stop.location, { animate: !this.args.reducedMotion });
+        }
+    }
 }
diff --git a/addon/styles/fleetops-engine.css b/addon/styles/fleetops-engine.css
index 3369581e1..acc9d81fb 100644
--- a/addon/styles/fleetops-engine.css
+++ b/addon/styles/fleetops-engine.css
@@ -13313,6 +13313,21 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     height: 100%;
 }
 
+/* Full screen: the browser's where it has one, otherwise the map covers the window. */
+.tp-map:fullscreen,
+.tp-map-expanded {
+    height: 100%;
+    border: 0;
+    border-radius: 0;
+}
+
+.tp-map-expanded {
+    position: fixed;
+    inset: 0;
+    z-index: 2000;
+    height: 100dvh;
+}
+
 .tp-map-chip {
     position: absolute;
     inset-block-start: 0.75rem;
@@ -13413,13 +13428,33 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     background: var(--tp-neutral);
 }
 
-.tp-map-hub-dot {
-    display: block;
+.tp-map-stop-selected .tp-map-stop-pin {
+    box-shadow: 0 0 0 4px var(--tp-accent-soft), 0 2px 6px rgb(0 0 0 / 25%);
+    transform: translateY(2px) rotate(-45deg) scale(1.15);
+}
+
+.tp-map-stop-dimmed {
+    opacity: 0.55;
+}
+
+.tp-map-pickup-pin {
+    display: flex;
+    align-items: center;
+    justify-content: center;
     width: 100%;
     height: 100%;
     border: 3px solid var(--tp-text);
-    border-radius: 999px;
+    border-radius: 0.375rem;
     background: var(--tp-surface);
+    color: var(--tp-text);
+    font-size: 0.6875rem;
+    font-weight: 700;
+    line-height: 1;
+}
+
+.tp-map-pickup-complete .tp-map-pickup-pin {
+    border-color: var(--tp-neutral);
+    color: var(--tp-neutral);
 }
 
 /* SVG presentation attributes don't resolve CSS variables, so the line takes its
@@ -13429,7 +13464,7 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
 }
 
 .tp-map-route-planned {
-    stroke: var(--tp-muted);
+    stroke-opacity: 0.75;
 }
 
 .tp-root .tp-map-label {
diff --git a/server/src/Support/TrackingPage/TrackingView.php b/server/src/Support/TrackingPage/TrackingView.php
index c2b9e4ea4..9bcb286a0 100644
--- a/server/src/Support/TrackingPage/TrackingView.php
+++ b/server/src/Support/TrackingPage/TrackingView.php
@@ -24,8 +24,9 @@
  * the customer sees.
  *
  * Never sent at any level: internal uuids, notes, order meta, custom fields, files other
- * than proof of delivery, rates or transactions, the sender's address, another
- * customer's stops, items or people, and the driver's surname or phone.
+ * than proof of delivery, rates or transactions, another customer's stops, items or
+ * people, and the driver's surname or phone. Pickups are where the order comes from
+ * (a store, a warehouse) and show by name.
  */
 class TrackingView
 {
@@ -38,11 +39,13 @@ class TrackingView
      */
     public const ISSUE_CODES = ['failed', 'attempt_failed', 'delivery_failed', 'returned', 'return_to_sender'];
 
+    public const STOP_PRECISION = 5;
+
     /**
-     * Pickup coordinates are rounded to about a kilometre: enough to draw where the route starts, not an address.
+     * Status codes a stop's own tracking number is given when it is set up: bookkeeping,
+     * not news for the customer.
      */
-    public const HUB_PRECISION  = 2;
-    public const STOP_PRECISION = 5;
+    public const SETUP_CODES = ['created'];
 
     /**
      * Branding as the page shows it, from the company's config with its own details as fallbacks.
@@ -126,11 +129,11 @@ public function fullView(TrackingTarget $target, array $branding, string $viewer
             'stops'           => $stopsView,
             'focus_stop'      => $target->waypoint?->public_id,
             'eta'             => $this->eta($stopsView, $tracker, $update),
-            'timeline'        => $this->timeline($data),
+            'timeline'        => $this->timeline($data, $stopsView, $own),
             'driver'          => $this->driver($data['driver'], $config),
             'location'        => $location,
-            'map'             => $showMap ? $this->map($stops, $own, $tracker, $location) : null,
-            'items'           => data_get($config, 'visibility.items', true) ? $this->items($entities, $viewer === self::VIEWER_ACCOUNT && data_get($config, 'visibility.item_prices', false) && $scope->isOrderCustomer($order)) : [],
+            'map'             => $showMap ? $this->map($stops, $own, $tracker) : null,
+            'items'           => data_get($config, 'visibility.items', true) ? $this->items($entities, $own, $viewer === self::VIEWER_ACCOUNT && data_get($config, 'visibility.item_prices', false) && $scope->isOrderCustomer($order)) : [],
             'proofs'          => $this->proofs($order, $own, $entities, $scope, $config),
             'instructions'    => [
                 'text'     => $this->instructionsFor($order, $scope),
@@ -187,7 +190,7 @@ protected function stops(Collection $own, Collection $data): array
             $entry = $byId->get($stop->sequence, []);
 
             return [
-                'id'       => $stop->waypoint?->public_id ?? $stop->place?->public_id,
+                'id'       => static::stopId($stop),
                 'type'     => $stop->type,
                 'sequence' => $stop->sequence,
                 'status'   => $stop->status,
@@ -229,17 +232,28 @@ protected function eta(array $stops, array $tracker, TrackingUpdate $update): ?a
     }
 
     /**
-     * The order's and the customer's stops' status entries, newest first.
+     * The order's and the customer's stops' status entries, newest first. A stop's
+     * entries name the stop (`stop`, `place`), so the page can show the selected stop's
+     * alongside the order's; the setup entry each stop's tracking number starts with is
+     * left out.
      */
-    protected function timeline(array $data): array
+    protected function timeline(array $data, array $stopsView, Collection $own): array
     {
         $entries = collect($data['order']['timeline']);
+        $ids     = collect($stopsView)->keyBy('sequence');
+        $places  = $own->keyBy(fn (TrackingStop $stop) => $stop->sequence);
+
         foreach ($data['stops'] as $stop) {
-            $entries = $entries->merge($stop['timeline'] ?? []);
+            $id    = $ids->get($stop['sequence'])['id'] ?? null;
+            $place = $places->get($stop['sequence'])?->place?->name;
+
+            $entries = $entries->merge(collect($stop['timeline'] ?? [])
+                ->reject(fn ($entry) => in_array($entry['code'] ?? null, self::SETUP_CODES, true))
+                ->map(fn ($entry) => [...$entry, 'stop' => $id, 'place' => $place]));
         }
 
         return $entries
-            ->unique(fn ($entry) => ($entry['code'] ?? '') . '|' . ($entry['created_at'] ?? '') . '|' . ($entry['status'] ?? ''))
+            ->unique(fn ($entry) => ($entry['code'] ?? '') . '|' . ($entry['created_at'] ?? '') . '|' . ($entry['status'] ?? '') . '|' . ($entry['stop'] ?? ''))
             ->sortByDesc(fn ($entry) => $entry['created_at'] ?? '')
             ->values()
             ->all();
@@ -259,19 +273,27 @@ protected function driver(?array $driver, array $config): ?array
     }
 
     /**
-     * Where the route starts (to about a kilometre) and, when every stop is this
+     * Where the order is collected and, when every stop it delivers to is this
      * customer's, the route line. On an order with other customers the line would trace
-     * their stops, so it is left out.
+     * their stops, so it is left out. The line is the tracker's: from the vehicle once
+     * it reports, from the first pickup before that.
      */
-    protected function map(Collection $stops, Collection $own, array $tracker, ?array $location): array
+    protected function map(Collection $stops, Collection $own, array $tracker): array
     {
-        $pickup = $stops->first(fn (TrackingStop $stop) => $stop->type === 'pickup');
-        $point  = $pickup?->point();
-        $mine   = $stops->every(fn (TrackingStop $stop) => $stop->type === 'pickup' || $own->contains(fn (TrackingStop $owned) => $owned === $stop));
+        $mine = $stops->every(fn (TrackingStop $stop) => $stop->type === 'pickup' || $own->contains(fn (TrackingStop $owned) => $owned === $stop));
 
         return [
-            'hub'      => $point ? ['latitude' => round($point->getLat(), self::HUB_PRECISION), 'longitude' => round($point->getLng(), self::HUB_PRECISION)] : null,
-            'polyline' => $mine && $location ? data_get($tracker, 'route.polyline') : null,
+            'pickups'  => $stops->filter(fn (TrackingStop $stop) => $stop->type === 'pickup')->map(function (TrackingStop $stop) {
+                $point = $stop->point();
+
+                return $point ? [
+                    'name'      => $stop->place?->name,
+                    'latitude'  => round($point->getLat(), self::STOP_PRECISION),
+                    'longitude' => round($point->getLng(), self::STOP_PRECISION),
+                    'complete'  => $stop->completed,
+                ] : null;
+            })->filter()->values()->all(),
+            'polyline' => $mine ? data_get($tracker, 'route.polyline') : null,
         ];
     }
 
@@ -279,10 +301,13 @@ protected function map(Collection $stops, Collection $own, array $tracker, ?arra
      * The customer's items: those going to their stops, and on an order with no stop
      * customers, the order customer's.
      */
-    protected function items(Collection $entities, bool $prices): array
+    protected function items(Collection $entities, Collection $own, bool $prices): array
     {
+        $stops = static::stopIdsByPlace($own);
+
         return $entities->map(fn (Entity $entity) => array_filter([
             'id'          => $entity->public_id,
+            'stop'        => $entity->destination_uuid ? ($stops[$entity->destination_uuid] ?? null) : null,
             'name'        => $entity->name,
             'description' => $entity->description,
             'quantity'    => data_get($entity, 'meta.quantity'),
@@ -304,8 +329,20 @@ protected function proofs(Order $order, Collection $own, Collection $entities, T
             $subjects[] = $order->uuid;
         }
 
+        $stops = [];
+        foreach ($own as $stop) {
+            if ($stop->type !== 'pickup' && $stop->waypoint?->uuid) {
+                $stops[$stop->waypoint->uuid] = static::stopId($stop);
+            }
+        }
+
+        $byPlace = static::stopIdsByPlace($own);
+        foreach ($entities as $entity) {
+            $stops[$entity->uuid] = $entity->destination_uuid ? ($byPlace[$entity->destination_uuid] ?? null) : null;
+        }
+
         return $this->proofsFor($subjects)
-            ->map(fn (Proof $proof) => ['id' => $proof->public_id, 'type' => static::proofType($proof), 'created_at' => $this->iso($proof->created_at)])
+            ->map(fn (Proof $proof) => ['id' => $proof->public_id, 'type' => static::proofType($proof), 'stop' => $stops[$proof->subject_uuid] ?? null, 'created_at' => $this->iso($proof->created_at)])
             ->filter(fn ($proof) => ($proof['type'] !== 'photo' || data_get($config, 'visibility.pod_photo', true)) && ($proof['type'] !== 'signature' || data_get($config, 'visibility.pod_signature', true)))
             ->values()
             ->all();
@@ -343,7 +380,65 @@ protected function iso(mixed $value): ?string
         return $value ? Carbon::parse($value)->toISOString() : null;
     }
 
+    /**
+     * The id the page knows a stop by: its waypoint's public id, or its place's for an
+     * order with a single dropoff.
+     */
+    public static function stopId(TrackingStop $stop): ?string
+    {
+        return $stop->waypoint?->public_id ?? $stop->place?->public_id;
+    }
+
+    /**
+     * @return array<string, ?string> the customer's stop ids, by place uuid
+     */
+    protected static function stopIdsByPlace(Collection $own): array
+    {
+        $ids = [];
+        foreach ($own as $stop) {
+            if ($stop->type !== 'pickup' && $stop->place?->uuid) {
+                $ids[$stop->place->uuid] = static::stopId($stop);
+            }
+        }
+
+        return $ids;
+    }
+
+    /**
+     * Whether a stop is where the order is collected rather than delivered: the payload's
+     * pickup, a waypoint marked as one, or a waypoint on a storefront order, where the
+     * waypoints are the other stores the order is collected from (storefront creates them
+     * without a type, so they default to dropoffs).
+     */
+    public static function isPickup(TrackingStop $stop, ?string $payloadType): bool
+    {
+        if ($stop->type === 'pickup') {
+            return true;
+        }
+
+        if (!$stop->waypoint) {
+            return false;
+        }
+
+        return strtolower((string) $stop->waypoint->type) === 'pickup' || ($stop->type === 'waypoint' && strtolower((string) $payloadType) === 'storefront');
+    }
+
+    /**
+     * The order's stops, with every pickup typed as one, so the customer's stops, the
+     * stage and the route counts leave them out.
+     */
     protected function stopsFor(Order $order): Collection
+    {
+        $payloadType = $order->payload?->type ?? $order->type;
+
+        return $this->contextStopsFor($order)->each(function (TrackingStop $stop) use ($payloadType) {
+            if (static::isPickup($stop, $payloadType)) {
+                $stop->type = 'pickup';
+            }
+        });
+    }
+
+    protected function contextStopsFor(Order $order): Collection
     {
         return app(TrackingContextBuilder::class)->build($order, TrackingOptions::fromArray([], $order->company_uuid))->stops;
     }
diff --git a/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php b/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php
index cce239c75..66339fc83 100644
--- a/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php
+++ b/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php
@@ -49,7 +49,7 @@ class TrackingViewProbe extends TrackingView
     public ?Collection $proofRows = null;
     public array $proofQueries  = [];
 
-    protected function stopsFor(Order $order): Collection
+    protected function contextStopsFor(Order $order): Collection
     {
         return $this->stops;
     }
@@ -118,6 +118,7 @@ function trackingViewOrder(array $attributes = []): Order
     $driver->setRawAttributes(['uuid' => 'driver-1', 'name' => 'Daniel Okafor', 'phone' => '+15550001111', 'online' => 1, 'heading' => 92, 'location' => new Point(1.30123456, 103.80123456), 'updated_at' => '2026-10-08 08:59:00'], true);
     $order->setRelation('driverAssigned', $driver);
     $order->setRelation('vehicleAssigned', null);
+    $order->setRelation('payload', null);
 
     return $order;
 }
@@ -224,7 +225,9 @@ function trackingViewEntity(string $uuid, ?string $destination, array $extra = [
 
 test('a verified customer sees only their own stop on an order with several customers', function () {
     Carbon::setTestNow(Carbon::parse('2026-10-08 09:00:00'));
-    TrackingPageDatabase::boot();
+    $db = TrackingPageDatabase::boot();
+    TrackingPageDatabase::insert($db, 'tracking_statuses', ['uuid' => 'ts-1', 'tracking_number_uuid' => 'tn-a', 'status' => 'Waypoint Created', 'code' => 'CREATED', 'complete' => 0, 'created_at' => '2026-10-08 08:00:00']);
+    TrackingPageDatabase::insert($db, 'tracking_statuses', ['uuid' => 'ts-2', 'tracking_number_uuid' => 'tn-a', 'status' => 'Out for delivery', 'code' => 'ENROUTE', 'complete' => 0, 'created_at' => '2026-10-08 08:45:00']);
 
     $view           = new TrackingViewProbe();
     $view->stops    = trackingViewStops();
@@ -253,17 +256,20 @@ function trackingViewEntity(string $uuid, ?string $destination, array $extra = [
         ->and($data['eta'])->toBe(['at' => '2026-10-08T14:24:00.000000Z', 'seconds' => 1500, 'confidence' => 'high'])
         ->and($data['driver'])->toBe(['name' => 'Daniel', 'vehicle' => null, 'online' => true])
         ->and($data['location']['latitude'])->toBe(1.3012)
-        ->and($data['map'])->toBe(['hub' => ['latitude' => 1.29, 'longitude' => 103.85], 'polyline' => null])
-        ->and($data['items'])->toBe([['id' => 'entity_a1', 'name' => 'Item a1', 'description' => 'Boxed', 'quantity' => 2]])
+        // The pickup shows by name; the line would trace the other customer's stop.
+        ->and($data['map'])->toBe(['pickups' => [['name' => 'Sender Warehouse', 'latitude' => 1.2876, 'longitude' => 103.8456, 'complete' => true]], 'polyline' => null])
+        ->and($data['items'])->toBe([['id' => 'entity_a1', 'stop' => 'waypoint_wp-a', 'name' => 'Item a1', 'description' => 'Boxed', 'quantity' => 2]])
+        // The stop's own setup entry is left out; the rest name the stop.
+        ->and($data['timeline'])->toBe([['status' => 'Out for delivery', 'code' => 'enroute', 'complete' => false, 'created_at' => '2026-10-08T08:45:00.000000Z', 'stop' => 'waypoint_wp-a', 'place' => 'Maya Flat']])
         ->and($data['instructions'])->toBe(['text' => 'Leave with concierge', 'editable' => true])
         ->and($data['actions'])->toBe(['report' => true, 'driver_contact' => 'company'])
         ->and($data['session'])->toBe(['expires_at' => '2026-10-09T09:00:00.000000Z'])
         ->and($data['stale_after'])->toBe(300)
         ->and($data['proofs'])->toBe([]);
 
-    // Nothing of the other customer, the sender, the driver or the order internals.
+    // Nothing of the other customer, the driver or the order internals.
     $json = json_encode($data);
-    foreach (['Other Customer House', 'waypoint_wp-b', 'Sender Warehouse', 'Okafor', '+15550001111', 'Gate code', 'internal', 'order-1', 'contact-a', 'co-1', 'SGD'] as $leak) {
+    foreach (['Other Customer House', 'waypoint_wp-b', 'Okafor', '+15550001111', 'Gate code', 'internal', 'order-1', 'contact-a', 'co-1', 'SGD'] as $leak) {
         expect($json)->not->toContain($leak);
     }
 });
@@ -297,7 +303,8 @@ function trackingViewEntity(string $uuid, ?string $destination, array $extra = [
         ->and($data['driver'])->toBeNull()
         ->and($data['location'])->toBeNull()
         ->and($data['eta'])->toBeNull()
-        ->and($data['map']['polyline'])->toBeNull()
+        // Every stop is this customer's, so the route line shows with no vehicle on the map.
+        ->and($data['map']['polyline'])->toBe('_p~iF~ps|U_ulLnnqC')
         ->and($data['items'][0])->toMatchArray(['price' => '1500', 'currency' => 'SGD'])
         ->and($data['items'][0]['photo_url'])->toBeString()
         ->and(collect($data['proofs'])->pluck('type')->all())->toBe(['signature', 'scan'])
@@ -348,7 +355,7 @@ protected function findProof(string $publicId): ?Proof
     $view->stops = trackingViewStops(true);
     $view->entities = collect();
     $proof = new Proof();
-    $proof->setRawAttributes(['public_id' => 'proof_a', 'file_uuid' => 'file-a'], true);
+    $proof->setRawAttributes(['public_id' => 'proof_a', 'file_uuid' => 'file-a', 'subject_uuid' => 'wp-a'], true);
     $view->proofRows = collect([$proof]);
     $view->found     = $proof;
 
@@ -357,7 +364,40 @@ protected function findProof(string $publicId): ?Proof
     expect(TrackingView::proofType($signed))->toBe('signature')
         ->and($view->proofFor($target, 'proof_a'))->toBe($proof)
         ->and($view->proofFor($target, 'proof_other'))->toBeNull()
-        ->and($view->proofQueries[0])->toBe(['wp-a']);
+        ->and($view->proofQueries[0])->toBe(['wp-a'])
+        ->and($view->fullView($target, [], TrackingView::VIEWER_VERIFIED)['proofs'][0])->toMatchArray(['id' => 'proof_a', 'stop' => 'waypoint_wp-a']);
+});
+
+test('a storefront order is collected from each store and delivered to the customer', function () {
+    TrackingPageDatabase::boot();
+
+    // The first store is the payload pickup; storefront adds the others as waypoints
+    // with no type, so they read as dropoffs.
+    $order = trackingViewOrder(['type' => 'storefront', 'status' => 'dispatched', 'started' => false]);
+    $order->setRelation('driverAssigned', null);
+    $view        = new TrackingViewProbe();
+    $view->stops = collect([
+        new TrackingStop('place-orchard', 'place_orchard', 'pickup', null, trackingViewPlace('orchard', 'Orchard Grocers', 1.3048, 103.8318), null, false, 1, null),
+        new TrackingStop('place-rochor', 'place_rochor', 'waypoint', null, trackingViewPlace('rochor', 'Rochor Noodle House', 1.3039, 103.8536), trackingViewWaypoint('wp-rochor', null, ['type' => 'dropoff']), false, 2, 'tn-rochor'),
+        new TrackingStop('place-home', 'place_home', 'dropoff', null, trackingViewPlace('home', 'Singapore Home', 1.3007, 103.9106), null, false, 3, null),
+    ]);
+    $view->tracker  = ['route' => ['polyline' => 'abc']];
+    $view->entities = collect();
+
+    $data = $view->fullView(trackingViewTarget($order, new TrackingScope('order-1', Contact::class, 'contact-shipper', $order)), [], TrackingView::VIEWER_STAFF);
+
+    expect($data['stops'])->toHaveCount(1)
+        ->and($data['stops'][0]['place']['name'])->toBe('Singapore Home')
+        ->and(collect($data['map']['pickups'])->pluck('name')->all())->toBe(['Orchard Grocers', 'Rochor Noodle House'])
+        ->and($data['location'])->toBeNull()
+        ->and($data['map']['polyline'])->toBe('abc');
+
+    // Elsewhere, only a waypoint marked as a pickup is one.
+    $marked = new TrackingStop('place-x', 'place_x', 'waypoint', null, null, trackingViewWaypoint('wp-x', null, ['type' => 'pickup']));
+    $drop   = new TrackingStop('place-y', 'place_y', 'waypoint', null, null, trackingViewWaypoint('wp-y', null, ['type' => 'dropoff']));
+    expect(TrackingView::isPickup($marked, null))->toBeTrue()
+        ->and(TrackingView::isPickup($drop, 'default'))->toBeFalse()
+        ->and(TrackingView::isPickup(new TrackingStop('place-z', 'place_z', 'dropoff', null, null), 'storefront'))->toBeFalse();
 });
 
 test('stops, the tracker, items and proofs come from their real sources', function () {
@@ -367,7 +407,7 @@ protected function findProof(string $publicId): ?Proof
     TrackingPageDatabase::insert($db, 'entities', ['uuid' => 'e-b', 'payload_uuid' => 'payload-1', 'destination_uuid' => 'place-b', 'name' => 'Chair']);
     TrackingPageDatabase::insert($db, 'proofs', ['uuid' => 'p-1', 'public_id' => 'proof_one', 'subject_uuid' => 'wp-a', 'created_at' => '2026-10-08 09:00:00']);
 
-    $context = new Fleetbase\FleetOps\Tracking\TrackingContext(trackingViewOrder(), null, null, null, null, collect(['stop']), collect(), collect(), null, null, null);
+    $context = new Fleetbase\FleetOps\Tracking\TrackingContext(trackingViewOrder(), null, null, null, null, trackingViewStops(), collect(), collect(), null, null, null);
     app()->instance(TrackingContextBuilder::class, new class($context) extends TrackingContextBuilder {
         public function __construct(private $context)
         {
@@ -401,7 +441,8 @@ public function track(Order $order, array|Fleetbase\FleetOps\Tracking\TrackingOp
     $scopeA  = new TrackingScope('order-1', Contact::class, 'contact-a', $order);
     $shipper = new TrackingScope('order-1', Contact::class, 'contact-shipper', $order);
 
-    expect($call('stopsFor', $order)->all())->toBe(['stop'])
+    expect($call('contextStopsFor', $order)->pluck('type')->all())->toBe(['pickup', 'waypoint', 'waypoint'])
+        ->and($call('stopsFor', trackingViewOrder(['type' => 'storefront']))->pluck('type')->all())->toBe(['pickup', 'pickup', 'pickup'])
         ->and($call('trackerFor', $order))->toBe(['provider' => 'fake'])
         ->and($call('trackerFor', trackingViewOrder(['status' => 'completed'])))->toBe([]);
 
diff --git a/translations/ar-ae.yml b/translations/ar-ae.yml
index 60d57ebb5..7ad2dac5d 100644
--- a/translations/ar-ae.yml
+++ b/translations/ar-ae.yml
@@ -2249,6 +2249,12 @@ tracking-page:
     map-label: "Map of your delivery: the van on its way to your address."
     map-pickup: "Pickup area"
     map-driver: "Driver"
+    map-pickup-named: "Pickup · {name}"
+    map-fullscreen: "Full screen map"
+    map-exit-fullscreen: "Exit full screen"
+    stop-card-title: "Delivering to"
+    stop-upcoming: "Upcoming"
+    stop-complete: "Delivered"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/bg-bg.yaml b/translations/bg-bg.yaml
index 2ae53a130..40a29f28d 100644
--- a/translations/bg-bg.yaml
+++ b/translations/bg-bg.yaml
@@ -2564,6 +2564,12 @@ tracking-page:
     map-label: "Map of your delivery: the van on its way to your address."
     map-pickup: "Pickup area"
     map-driver: "Driver"
+    map-pickup-named: "Pickup · {name}"
+    map-fullscreen: "Full screen map"
+    map-exit-fullscreen: "Exit full screen"
+    stop-card-title: "Delivering to"
+    stop-upcoming: "Upcoming"
+    stop-complete: "Delivered"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/en-us.yaml b/translations/en-us.yaml
index ce84bac78..6073dab9b 100644
--- a/translations/en-us.yaml
+++ b/translations/en-us.yaml
@@ -3842,6 +3842,12 @@ tracking-page:
     map-label: "Map of your delivery: the van on its way to your address."
     map-pickup: "Pickup area"
     map-driver: "Driver"
+    map-pickup-named: "Pickup · {name}"
+    map-fullscreen: "Full screen map"
+    map-exit-fullscreen: "Exit full screen"
+    stop-card-title: "Delivering to"
+    stop-upcoming: "Upcoming"
+    stop-complete: "Delivered"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/es-pa.yaml b/translations/es-pa.yaml
index 71f71385a..2afa94fad 100644
--- a/translations/es-pa.yaml
+++ b/translations/es-pa.yaml
@@ -2443,6 +2443,12 @@ tracking-page:
     map-label: "Map of your delivery: the van on its way to your address."
     map-pickup: "Pickup area"
     map-driver: "Driver"
+    map-pickup-named: "Pickup · {name}"
+    map-fullscreen: "Full screen map"
+    map-exit-fullscreen: "Exit full screen"
+    stop-card-title: "Delivering to"
+    stop-upcoming: "Upcoming"
+    stop-complete: "Delivered"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/fr-fr.yaml b/translations/fr-fr.yaml
index fc60becab..8544a6eb5 100644
--- a/translations/fr-fr.yaml
+++ b/translations/fr-fr.yaml
@@ -2589,6 +2589,12 @@ tracking-page:
     map-label: "Map of your delivery: the van on its way to your address."
     map-pickup: "Pickup area"
     map-driver: "Driver"
+    map-pickup-named: "Pickup · {name}"
+    map-fullscreen: "Full screen map"
+    map-exit-fullscreen: "Exit full screen"
+    stop-card-title: "Delivering to"
+    stop-upcoming: "Upcoming"
+    stop-complete: "Delivered"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/mn-mn.yaml b/translations/mn-mn.yaml
index 17dab8605..81b7c6efe 100644
--- a/translations/mn-mn.yaml
+++ b/translations/mn-mn.yaml
@@ -2533,6 +2533,12 @@ tracking-page:
     map-label: "Map of your delivery: the van on its way to your address."
     map-pickup: "Pickup area"
     map-driver: "Driver"
+    map-pickup-named: "Pickup · {name}"
+    map-fullscreen: "Full screen map"
+    map-exit-fullscreen: "Exit full screen"
+    stop-card-title: "Delivering to"
+    stop-upcoming: "Upcoming"
+    stop-complete: "Delivered"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/pt-br.yaml b/translations/pt-br.yaml
index 8ad1a272b..61a504d55 100644
--- a/translations/pt-br.yaml
+++ b/translations/pt-br.yaml
@@ -2554,6 +2554,12 @@ tracking-page:
     map-label: "Map of your delivery: the van on its way to your address."
     map-pickup: "Pickup area"
     map-driver: "Driver"
+    map-pickup-named: "Pickup · {name}"
+    map-fullscreen: "Full screen map"
+    map-exit-fullscreen: "Exit full screen"
+    stop-card-title: "Delivering to"
+    stop-upcoming: "Upcoming"
+    stop-complete: "Delivered"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/ru-ru.yaml b/translations/ru-ru.yaml
index 3ab769b87..53a0346ce 100644
--- a/translations/ru-ru.yaml
+++ b/translations/ru-ru.yaml
@@ -2547,6 +2547,12 @@ tracking-page:
     map-label: "Map of your delivery: the van on its way to your address."
     map-pickup: "Pickup area"
     map-driver: "Driver"
+    map-pickup-named: "Pickup · {name}"
+    map-fullscreen: "Full screen map"
+    map-exit-fullscreen: "Exit full screen"
+    stop-card-title: "Delivering to"
+    stop-upcoming: "Upcoming"
+    stop-complete: "Delivered"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/uk-ua.yaml b/translations/uk-ua.yaml
index 9d81ee336..e30df00f0 100644
--- a/translations/uk-ua.yaml
+++ b/translations/uk-ua.yaml
@@ -3690,6 +3690,12 @@ tracking-page:
     map-label: "Map of your delivery: the van on its way to your address."
     map-pickup: "Pickup area"
     map-driver: "Driver"
+    map-pickup-named: "Pickup · {name}"
+    map-fullscreen: "Full screen map"
+    map-exit-fullscreen: "Exit full screen"
+    stop-card-title: "Delivering to"
+    stop-upcoming: "Upcoming"
+    stop-complete: "Delivered"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"
diff --git a/translations/vi-vn.yaml b/translations/vi-vn.yaml
index 20bf668d3..35889d654 100644
--- a/translations/vi-vn.yaml
+++ b/translations/vi-vn.yaml
@@ -2363,6 +2363,12 @@ tracking-page:
     map-label: "Map of your delivery: the van on its way to your address."
     map-pickup: "Pickup area"
     map-driver: "Driver"
+    map-pickup-named: "Pickup · {name}"
+    map-fullscreen: "Full screen map"
+    map-exit-fullscreen: "Exit full screen"
+    stop-card-title: "Delivering to"
+    stop-upcoming: "Upcoming"
+    stop-complete: "Delivered"
     map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
     last-seen: "Last seen {minutes} min ago"
     recenter: "Center the map on the van"

From 7a091cc2cb609d1a1587851bd421ff1228516136 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 13:15:44 +0800
Subject: [PATCH 42/87] fix(tracking-page): wrap the selected pin's box-shadow
 for prettier

---
 addon/styles/fleetops-engine.css | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/addon/styles/fleetops-engine.css b/addon/styles/fleetops-engine.css
index acc9d81fb..ae89e933a 100644
--- a/addon/styles/fleetops-engine.css
+++ b/addon/styles/fleetops-engine.css
@@ -13429,7 +13429,9 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
 }
 
 .tp-map-stop-selected .tp-map-stop-pin {
-    box-shadow: 0 0 0 4px var(--tp-accent-soft), 0 2px 6px rgb(0 0 0 / 25%);
+    box-shadow:
+        0 0 0 4px var(--tp-accent-soft),
+        0 2px 6px rgb(0 0 0 / 25%);
     transform: translateY(2px) rotate(-45deg) scale(1.15);
 }
 

From f08306cc7fbce23b2bf4668420f88788113a5f2e Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 14:14:44 +0800
Subject: [PATCH 43/87] fix(tracking-page): console-style P/1/D markers, store
 markers, no overlapping labels

- Markers match the console's order maps: round, P for the pickup, the
  waypoint's number, D for the dropoff; done stops show a check. The server
  sends each stop's and pickup's marker.
- A storefront store pickup shows its logo, or a store icon.
- Labels that would overlap one already shown are hidden until there is room;
  the marker's title still names it. Pickup labels are the place's name.
- Map buttons are smaller with the icon centred.
- The progress line counts a stage's step as done (a dispatched order is
  waiting on pickup), and every update's dot is filled, matching the updates.
---
 addon/components/tracking-page/full-view.js   |   5 +-
 addon/components/tracking-page/map.hbs        |   4 +-
 addon/components/tracking-page/map.js         | 105 ++++++++++++++----
 addon/styles/fleetops-engine.css              |  87 ++++++++-------
 .../src/Support/TrackingPage/TrackingView.php |  45 +++++++-
 .../Support/TrackingPage/TrackingViewTest.php |  19 +++-
 6 files changed, 194 insertions(+), 71 deletions(-)

diff --git a/addon/components/tracking-page/full-view.js b/addon/components/tracking-page/full-view.js
index caadb5c4b..3b07d9819 100644
--- a/addon/components/tracking-page/full-view.js
+++ b/addon/components/tracking-page/full-view.js
@@ -4,10 +4,11 @@ import { inject as service } from '@ember/service';
 import { action } from '@ember/object';
 
 /**
- * Coarse stages, in order, and the step each one has reached.
+ * Coarse stages, in order, and how many steps each one has completed: a dispatched order
+ * has been created and dispatched, and is waiting on the pickup, as its updates say.
  */
 const STEPS = ['created', 'dispatched', 'started', 'enroute', 'delivered'];
-const REACHED = { preparing: 0, scheduled: 0, dispatched: 1, in_transit: 3, delivered: 5 };
+const REACHED = { preparing: 1, scheduled: 1, dispatched: 2, in_transit: 3, delivered: 5 };
 
 function step(key, state, label, last) {
     return {
diff --git a/addon/components/tracking-page/map.hbs b/addon/components/tracking-page/map.hbs
index 71ec40b3f..5a0fc6b8d 100644
--- a/addon/components/tracking-page/map.hbs
+++ b/addon/components/tracking-page/map.hbs
@@ -1,4 +1,4 @@
-<div class="tp-map {{if this.expanded 'tp-map-expanded'}}" {{did-insert this.register}} {{did-update this.focusStop @selectedStopId}}>
+<div class="tp-map {{if this.expanded 'tp-map-expanded'}}" {{did-insert this.register}} {{did-update this.focusStop @selectedStopId}} {{did-update this.placeLabels @data}}>
     <span class="tp-sr-only">{{@label}}</span>
     <LeafletMap class="tp-map-canvas" @lat={{get this.center 0}} @lng={{get this.center 1}} @zoom={{13}} @zoomControl={{false}} @onLoad={{this.setup}} as |layers|>
         <layers.tile @url={{(leaflet-tile-url)}} />
@@ -8,7 +8,7 @@
             <layers.polyline @locations={{this.plannedRoute}} @className="tp-map-route tp-map-route-planned" @weight={{3}} @dashArray="6 8" @interactive={{false}} />
         {{/if}}
         {{#each this.pickups as |pickup|}}
-            <layers.marker @location={{pickup.location}} @icon={{pickup.icon}} @title={{pickup.label}} @keyboard={{false}} as |marker|>
+            <layers.marker @location={{pickup.location}} @icon={{pickup.icon}} @title={{pickup.title}} @keyboard={{false}} as |marker|>
                 <marker.tooltip @permanent={{true}} @direction="top" @className="tp-map-label tp-map-label-pickup">{{pickup.label}}</marker.tooltip>
             </layers.marker>
         {{/each}}
diff --git a/addon/components/tracking-page/map.js b/addon/components/tracking-page/map.js
index bb1aad3fb..862d7d487 100644
--- a/addon/components/tracking-page/map.js
+++ b/addon/components/tracking-page/map.js
@@ -3,8 +3,21 @@ import { tracked } from '@glimmer/tracking';
 import { inject as service } from '@ember/service';
 import { action } from '@ember/object';
 import { next } from '@ember/runloop';
+import { icon } from '@fortawesome/fontawesome-svg-core';
+import { faStore, faCheck } from '@fortawesome/free-solid-svg-icons';
 import { decodePolyline } from '../../utils/tracking-live-source';
 
+/**
+ * Marker colours, as the console's order maps use them.
+ */
+const PICKUP_COLOR = '#22C55E';
+const DROPOFF_COLOR = '#EF4444';
+const DONE_COLOR = '#6B7280';
+
+function escapeHtml(value) {
+    return String(value ?? '').replace(/[&<>"']/g, (char) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[char]);
+}
+
 /**
  * The live map on the tracking page: where the order is collected, the customer's stops,
  * numbered as the stop cards are, and the vehicle while it is on its way to them. Each
@@ -54,7 +67,7 @@ export default class TrackingPageMapComponent extends Component {
                     number,
                     location: [stop.place.latitude, stop.place.longitude],
                     label: stop.place.name || this.intl.t('tracking-page.page.your-stop', { number }),
-                    icon: this.stopIcon(number, stop.complete, selected, dimmed),
+                    icon: this.stopIcon(stop.marker ?? String(number), stop.complete, selected, dimmed),
                 });
             }
         }
@@ -66,8 +79,9 @@ export default class TrackingPageMapComponent extends Component {
         return (this.data.map?.pickups ?? []).map((pickup) => ({
             ...pickup,
             location: [pickup.latitude, pickup.longitude],
-            label: pickup.name ? this.intl.t('tracking-page.page.map-pickup-named', { name: pickup.name }) : this.intl.t('tracking-page.page.map-pickup'),
-            icon: this.pickupIcon(pickup.complete),
+            label: pickup.name || this.intl.t('tracking-page.page.map-pickup'),
+            title: pickup.name ? this.intl.t('tracking-page.page.map-pickup-named', { name: pickup.name }) : this.intl.t('tracking-page.page.map-pickup'),
+            icon: this.pickupIcon(pickup),
         }));
     }
 
@@ -127,36 +141,84 @@ export default class TrackingPageMapComponent extends Component {
         });
     }
 
-    pickupIcon(complete) {
+    /**
+     * A round marker with a label, as the console's order maps draw them.
+     */
+    markerIcon(content, color, classes = []) {
         return L.divIcon({
-            className: complete ? 'tp-map-marker tp-map-pickup tp-map-pickup-complete' : 'tp-map-marker tp-map-pickup',
-            html: `<span class="tp-map-pickup-pin">${complete ? '✓' : ''}</span>`,
-            iconSize: [22, 22],
-            iconAnchor: [11, 11],
-            tooltipAnchor: [0, -13],
+            className: ['tp-map-marker', 'tp-map-point', ...classes].join(' '),
+            html: `<span class="tp-map-point-dot" style="background:${color}">${content}</span>`,
+            iconSize: [30, 30],
+            iconAnchor: [15, 15],
+            tooltipAnchor: [0, -17],
         });
     }
 
-    stopIcon(number, complete, selected, dimmed) {
-        const classes = ['tp-map-marker', 'tp-map-stop'];
+    /**
+     * P, or the waypoint's number; a storefront store shows its logo, or a store.
+     */
+    pickupIcon(pickup) {
+        if (pickup.complete) {
+            return this.markerIcon(icon(faCheck).html[0], DONE_COLOR, ['tp-map-point-complete']);
+        }
+
+        if (pickup.store?.logo_url) {
+            return this.markerIcon(`<img src="${escapeHtml(pickup.store.logo_url)}" alt="" />`, PICKUP_COLOR, ['tp-map-point-logo']);
+        }
+
+        return this.markerIcon(pickup.store ? icon(faStore).html[0] : escapeHtml(pickup.marker ?? 'P'), PICKUP_COLOR);
+    }
+
+    stopIcon(marker, complete, selected, dimmed) {
+        const classes = [];
         if (complete) {
-            classes.push('tp-map-stop-complete');
+            classes.push('tp-map-point-complete');
         }
 
         if (selected) {
-            classes.push('tp-map-stop-selected');
+            classes.push('tp-map-point-selected');
         }
 
         if (dimmed) {
-            classes.push('tp-map-stop-dimmed');
+            classes.push('tp-map-point-dimmed');
         }
 
-        return L.divIcon({
-            className: classes.join(' '),
-            html: `<span class="tp-map-stop-pin"><span class="tp-map-stop-number">${complete ? '✓' : Number(number)}</span></span>`,
-            iconSize: [30, 38],
-            iconAnchor: [15, 38],
-            tooltipAnchor: [0, -40],
+        const color = complete ? DONE_COLOR : marker === 'D' ? DROPOFF_COLOR : 'var(--tp-accent)';
+
+        return this.markerIcon(complete ? icon(faCheck).html[0] : escapeHtml(marker), color, classes);
+    }
+
+    /* ── Labels ────────────────────────────────────────────────────── */
+
+    /**
+     * Hide the labels that would overlap one already shown, in the order the map gives
+     * them priority: the vehicle, the customer's stops, then the pickups. A hidden label
+     * comes back once there is room, and its marker's title still names it.
+     */
+    @action placeLabels() {
+        if (!this.element) {
+            return;
+        }
+
+        const labels = ['.tp-map-label-vehicle', '.tp-map-label-stop', '.tp-map-label-pickup'].flatMap((selector) => [...this.element.querySelectorAll(selector)]);
+        const shown = [];
+        for (const label of labels) {
+            label.classList.remove('tp-map-label-hidden');
+            const box = label.getBoundingClientRect();
+            const overlaps = shown.some((other) => box.left < other.right + 4 && box.right > other.left - 4 && box.top < other.bottom + 2 && box.bottom > other.top - 2);
+            if (overlaps) {
+                label.classList.add('tp-map-label-hidden');
+            } else {
+                shown.push(box);
+            }
+        }
+    }
+
+    scheduleLabels() {
+        next(() => {
+            if (!this.isDestroyed) {
+                this.placeLabels();
+            }
         });
     }
 
@@ -174,6 +236,7 @@ export default class TrackingPageMapComponent extends Component {
 
     willDestroy() {
         super.willDestroy(...arguments);
+        this.map?.off('zoomend moveend', this.placeLabels);
         document.removeEventListener('fullscreenchange', this.onFullscreenChange);
         document.removeEventListener('keydown', this.onKeydown);
     }
@@ -224,7 +287,9 @@ export default class TrackingPageMapComponent extends Component {
 
     @action setup({ target }) {
         this.map = target;
+        this.map.on('zoomend moveend', this.placeLabels);
         this.fitRoute();
+        this.scheduleLabels();
     }
 
     @action fitRoute() {
diff --git a/addon/styles/fleetops-engine.css b/addon/styles/fleetops-engine.css
index ae89e933a..89f084d37 100644
--- a/addon/styles/fleetops-engine.css
+++ b/addon/styles/fleetops-engine.css
@@ -13361,9 +13361,15 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
 }
 
 .tp-map-button {
-    width: 2.75rem;
-    height: 2.75rem;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 2.25rem;
+    height: 2.25rem;
+    padding: 0;
     border: 0;
+    font-size: 0.875rem;
+    line-height: 1;
     border-radius: 0.75rem;
     background: var(--tp-surface);
     color: var(--tp-text);
@@ -13403,60 +13409,51 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     opacity: 0.5;
 }
 
-.tp-map-stop-pin {
+/* Round markers with a label, as the console's order maps draw them: P, a waypoint's
+   number, D, or a store. */
+.tp-map-point-dot {
     display: flex;
     align-items: center;
     justify-content: center;
-    width: 30px;
-    height: 30px;
-    border: 3px solid var(--tp-surface);
-    border-radius: 999px 999px 999px 0;
-    background: var(--tp-accent);
-    box-shadow: 0 2px 6px rgb(0 0 0 / 25%);
-    transform: translateY(2px) rotate(-45deg);
-}
-
-.tp-map-stop-number {
-    color: var(--tp-ink);
+    width: 100%;
+    height: 100%;
+    overflow: hidden;
+    box-sizing: border-box;
+    border: 2.5px solid #fff;
+    border-radius: 999px;
+    box-shadow: 0 2px 8px rgb(0 0 0 / 45%);
+    color: #fff;
+    font-family: ui-sans-serif, system-ui, sans-serif;
     font-size: 0.8125rem;
     font-weight: 700;
     line-height: 1;
-    transform: rotate(45deg);
-}
-
-.tp-map-stop-complete .tp-map-stop-pin {
-    background: var(--tp-neutral);
 }
 
-.tp-map-stop-selected .tp-map-stop-pin {
-    box-shadow:
-        0 0 0 4px var(--tp-accent-soft),
-        0 2px 6px rgb(0 0 0 / 25%);
-    transform: translateY(2px) rotate(-45deg) scale(1.15);
+.tp-map-point-dot svg {
+    width: 0.8125rem;
+    height: 0.8125rem;
+    fill: currentcolor;
 }
 
-.tp-map-stop-dimmed {
-    opacity: 0.55;
+.tp-map-point-logo .tp-map-point-dot {
+    background: #fff;
 }
 
-.tp-map-pickup-pin {
-    display: flex;
-    align-items: center;
-    justify-content: center;
+.tp-map-point-dot img {
     width: 100%;
     height: 100%;
-    border: 3px solid var(--tp-text);
-    border-radius: 0.375rem;
-    background: var(--tp-surface);
-    color: var(--tp-text);
-    font-size: 0.6875rem;
-    font-weight: 700;
-    line-height: 1;
+    object-fit: cover;
 }
 
-.tp-map-pickup-complete .tp-map-pickup-pin {
-    border-color: var(--tp-neutral);
-    color: var(--tp-neutral);
+.tp-map-point-selected .tp-map-point-dot {
+    box-shadow:
+        0 0 0 4px var(--tp-accent-soft),
+        0 2px 8px rgb(0 0 0 / 45%);
+    transform: scale(1.15);
+}
+
+.tp-map-point-dimmed {
+    opacity: 0.55;
 }
 
 /* SVG presentation attributes don't resolve CSS variables, so the line takes its
@@ -13488,6 +13485,10 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     display: none;
 }
 
+.tp-root .tp-map-label-hidden {
+    visibility: hidden;
+}
+
 .tp-root .tp-map-label-vehicle {
     border-color: var(--tp-accent);
     color: var(--tp-accent);
@@ -13596,6 +13597,12 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     border-radius: 999px;
 }
 
+/* Every update has happened: earlier ones are filled, the latest takes the accent. */
+.tp-timeline-entry .tp-timeline-dot {
+    border-color: var(--tp-neutral);
+    background: var(--tp-neutral);
+}
+
 .tp-timeline-latest .tp-timeline-dot {
     border-color: var(--tp-accent);
     background: var(--tp-accent);
diff --git a/server/src/Support/TrackingPage/TrackingView.php b/server/src/Support/TrackingPage/TrackingView.php
index 9bcb286a0..6231b347f 100644
--- a/server/src/Support/TrackingPage/TrackingView.php
+++ b/server/src/Support/TrackingPage/TrackingView.php
@@ -4,6 +4,7 @@
 
 use Fleetbase\FleetOps\Models\Entity;
 use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Place;
 use Fleetbase\FleetOps\Models\Proof;
 use Fleetbase\FleetOps\Support\TrackingScope;
 use Fleetbase\FleetOps\Support\TrackingUpdate;
@@ -110,7 +111,7 @@ public function fullView(TrackingTarget $target, array $branding, string $viewer
         $entities   = $this->entitiesFor($order, $placeUuids, $scope);
         $showMap    = (bool) data_get($config, 'visibility.map', true);
         $location   = $showMap ? $data['location'] : null;
-        $stopsView  = $this->stops($own, collect($data['stops']));
+        $stopsView  = $this->stops($own, collect($data['stops']), $stops);
 
         return [
             'level'           => $viewer === self::VIEWER_ACCOUNT ? 2 : 1,
@@ -181,17 +182,18 @@ public function stage(Order $order, ?TrackingUpdate $update): string
     /**
      * The customer's stops: where, when and their own status, never the pickup's place.
      */
-    protected function stops(Collection $own, Collection $data): array
+    protected function stops(Collection $own, Collection $data, Collection $all): array
     {
         $byId = $data->keyBy(fn ($stop) => $stop['sequence']);
 
-        return $own->filter(fn (TrackingStop $stop) => $stop->type !== 'pickup')->map(function (TrackingStop $stop) use ($byId) {
+        return $own->filter(fn (TrackingStop $stop) => $stop->type !== 'pickup')->map(function (TrackingStop $stop) use ($byId, $all) {
             $point = $stop->point();
             $entry = $byId->get($stop->sequence, []);
 
             return [
                 'id'       => static::stopId($stop),
                 'type'     => $stop->type,
+                'marker'   => static::markerFor($stop, $all),
                 'sequence' => $stop->sequence,
                 'status'   => $stop->status,
                 'complete' => $stop->completed,
@@ -283,11 +285,13 @@ protected function map(Collection $stops, Collection $own, array $tracker): arra
         $mine = $stops->every(fn (TrackingStop $stop) => $stop->type === 'pickup' || $own->contains(fn (TrackingStop $owned) => $owned === $stop));
 
         return [
-            'pickups'  => $stops->filter(fn (TrackingStop $stop) => $stop->type === 'pickup')->map(function (TrackingStop $stop) {
+            'pickups'  => $stops->filter(fn (TrackingStop $stop) => $stop->type === 'pickup')->map(function (TrackingStop $stop) use ($stops) {
                 $point = $stop->point();
 
                 return $point ? [
                     'name'      => $stop->place?->name,
+                    'marker'    => static::markerFor($stop, $stops),
+                    'store'     => $this->storeFor($stop->place),
                     'latitude'  => round($point->getLat(), self::STOP_PRECISION),
                     'longitude' => round($point->getLng(), self::STOP_PRECISION),
                     'complete'  => $stop->completed,
@@ -389,6 +393,39 @@ public static function stopId(TrackingStop $stop): ?string
         return $stop->waypoint?->public_id ?? $stop->place?->public_id;
     }
 
+    /**
+     * The stop's label on the map, as the console's order maps draw it: P for the
+     * payload's pickup, D for its dropoff, and each waypoint its number in the route.
+     */
+    public static function markerFor(TrackingStop $stop, Collection $stops): string
+    {
+        $isWaypoint = fn (TrackingStop $candidate) => $candidate->waypoint !== null || $candidate->type === 'waypoint';
+        if ($isWaypoint($stop)) {
+            return (string) ($stops->filter($isWaypoint)->values()->search(fn (TrackingStop $candidate) => $candidate === $stop) + 1);
+        }
+
+        return $stop->type === 'pickup' ? 'P' : 'D';
+    }
+
+    /**
+     * The store a pickup is, when it is a storefront store's location: its name and logo
+     * draw the marker.
+     */
+    protected function storeFor(?Place $place): ?array
+    {
+        if (!$place || !str_contains((string) $place->owner_type, 'Storefront')) {
+            return null;
+        }
+
+        try {
+            $store = $place->owner;
+        } catch (\Throwable) {
+            $store = null;
+        }
+
+        return ['logo_url' => data_get($store, 'logo_uuid') ? data_get($store, 'logo_url') : null];
+    }
+
     /**
      * @return array<string, ?string> the customer's stop ids, by place uuid
      */
diff --git a/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php b/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php
index 66339fc83..76370024a 100644
--- a/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php
+++ b/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php
@@ -247,6 +247,7 @@ function trackingViewEntity(string $uuid, ?string $destination, array $extra = [
         ->and($data['stops'])->toHaveCount(1)
         ->and($data['stops'][0])->toMatchArray([
             'id'       => 'waypoint_wp-a',
+            'marker'   => '1',
             'sequence' => 1,
             'complete' => false,
             'place'    => ['name' => 'Maya Flat', 'address' => 'Maya Flat street', 'latitude' => 1.33333, 'longitude' => 103.77778],
@@ -257,7 +258,7 @@ function trackingViewEntity(string $uuid, ?string $destination, array $extra = [
         ->and($data['driver'])->toBe(['name' => 'Daniel', 'vehicle' => null, 'online' => true])
         ->and($data['location']['latitude'])->toBe(1.3012)
         // The pickup shows by name; the line would trace the other customer's stop.
-        ->and($data['map'])->toBe(['pickups' => [['name' => 'Sender Warehouse', 'latitude' => 1.2876, 'longitude' => 103.8456, 'complete' => true]], 'polyline' => null])
+        ->and($data['map'])->toBe(['pickups' => [['name' => 'Sender Warehouse', 'marker' => 'P', 'store' => null, 'latitude' => 1.2876, 'longitude' => 103.8456, 'complete' => true]], 'polyline' => null])
         ->and($data['items'])->toBe([['id' => 'entity_a1', 'stop' => 'waypoint_wp-a', 'name' => 'Item a1', 'description' => 'Boxed', 'quantity' => 2]])
         // The stop's own setup entry is left out; the rest name the stop.
         ->and($data['timeline'])->toBe([['status' => 'Out for delivery', 'code' => 'enroute', 'complete' => false, 'created_at' => '2026-10-08T08:45:00.000000Z', 'stop' => 'waypoint_wp-a', 'place' => 'Maya Flat']])
@@ -375,10 +376,18 @@ protected function findProof(string $publicId): ?Proof
     // with no type, so they read as dropoffs.
     $order = trackingViewOrder(['type' => 'storefront', 'status' => 'dispatched', 'started' => false]);
     $order->setRelation('driverAssigned', null);
+    // Both stores are storefront store locations: one with a logo, one whose store
+    // can't be loaded here.
+    $orchard = trackingViewPlace('orchard', 'Orchard Grocers', 1.3048, 103.8318);
+    $orchard->setRawAttributes([...$orchard->getAttributes(), 'owner_type' => 'Fleetbase\\Storefront\\Models\\Store', 'owner_uuid' => 'store-1'], true);
+    $orchard->setRelation('owner', (object) ['logo_uuid' => 'file-1', 'logo_url' => 'https://cdn.example/orchard.png']);
+    $rochor = trackingViewPlace('rochor', 'Rochor Noodle House', 1.3039, 103.8536);
+    $rochor->setRawAttributes([...$rochor->getAttributes(), 'owner_type' => 'Fleetbase\\Storefront\\Models\\Store', 'owner_uuid' => 'store-2'], true);
+
     $view        = new TrackingViewProbe();
     $view->stops = collect([
-        new TrackingStop('place-orchard', 'place_orchard', 'pickup', null, trackingViewPlace('orchard', 'Orchard Grocers', 1.3048, 103.8318), null, false, 1, null),
-        new TrackingStop('place-rochor', 'place_rochor', 'waypoint', null, trackingViewPlace('rochor', 'Rochor Noodle House', 1.3039, 103.8536), trackingViewWaypoint('wp-rochor', null, ['type' => 'dropoff']), false, 2, 'tn-rochor'),
+        new TrackingStop('place-orchard', 'place_orchard', 'pickup', null, $orchard, null, false, 1, null),
+        new TrackingStop('place-rochor', 'place_rochor', 'waypoint', null, $rochor, trackingViewWaypoint('wp-rochor', null, ['type' => 'dropoff']), false, 2, 'tn-rochor'),
         new TrackingStop('place-home', 'place_home', 'dropoff', null, trackingViewPlace('home', 'Singapore Home', 1.3007, 103.9106), null, false, 3, null),
     ]);
     $view->tracker  = ['route' => ['polyline' => 'abc']];
@@ -389,6 +398,10 @@ protected function findProof(string $publicId): ?Proof
     expect($data['stops'])->toHaveCount(1)
         ->and($data['stops'][0]['place']['name'])->toBe('Singapore Home')
         ->and(collect($data['map']['pickups'])->pluck('name')->all())->toBe(['Orchard Grocers', 'Rochor Noodle House'])
+        // Marked as the console's order maps mark them: P, the waypoint's number, D.
+        ->and(collect($data['map']['pickups'])->pluck('marker')->all())->toBe(['P', '1'])
+        ->and($data['stops'][0]['marker'])->toBe('D')
+        ->and(collect($data['map']['pickups'])->pluck('store')->all())->toBe([['logo_url' => 'https://cdn.example/orchard.png'], ['logo_url' => null]])
         ->and($data['location'])->toBeNull()
         ->and($data['map']['polyline'])->toBe('abc');
 

From af0b39644ae41f61704355990d1a8287a3a25099 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 15:26:10 +0800
Subject: [PATCH 44/87] fix(tracking-page): labels move below rather than hide,
 updates oldest first, console locale switcher, settings placeholders

- A map label that would overlap another moves below its marker instead of
  being hidden.
- Updates read oldest first, so the order's creation leads and the latest
  update closes the list, as the progress line does; earlier days fold above.
  Entries at the same second keep their order.
- The language picker is ember-ui's locale switcher, limited to the page's
  languages and without saving the choice to an account.
- Every text and number field in the tracking page settings (and the admin
  panel) has a placeholder; the selects have one too.
---
 .../admin/tracking-page-settings.hbs          | 10 +++---
 addon/components/tracking-page.hbs            | 17 ++++------
 addon/components/tracking-page.js             | 24 -------------
 addon/components/tracking-page/full-view.hbs  | 10 +++---
 addon/components/tracking-page/full-view.js   | 18 +++++++---
 .../tracking-page/locale-selector.js          | 30 ++++++++++++++++
 addon/components/tracking-page/map.js         | 27 +++++++++------
 addon/styles/fleetops-engine.css              | 34 +++++++++++--------
 addon/templates/settings/tracking-page.hbs    | 13 +++++--
 .../tracking-page/locale-selector.js          |  1 +
 .../src/Support/TrackingPage/TrackingView.php |  3 ++
 translations/ar-ae.yml                        |  5 +++
 translations/bg-bg.yaml                       |  5 +++
 translations/en-us.yaml                       |  5 +++
 translations/es-pa.yaml                       |  5 +++
 translations/fr-fr.yaml                       |  5 +++
 translations/mn-mn.yaml                       |  5 +++
 translations/pt-br.yaml                       |  5 +++
 translations/ru-ru.yaml                       |  5 +++
 translations/uk-ua.yaml                       |  5 +++
 translations/vi-vn.yaml                       |  5 +++
 21 files changed, 158 insertions(+), 79 deletions(-)
 create mode 100644 addon/components/tracking-page/locale-selector.js
 create mode 100644 app/components/tracking-page/locale-selector.js

diff --git a/addon/components/admin/tracking-page-settings.hbs b/addon/components/admin/tracking-page-settings.hbs
index 452035bdd..c56711b8b 100644
--- a/addon/components/admin/tracking-page-settings.hbs
+++ b/addon/components/admin/tracking-page-settings.hbs
@@ -3,13 +3,13 @@
         <div class="flex items-start justify-between gap-4">
             <div>
                 <div class="text-sm font-semibold">Enable the generic tracking page</div>
-                <div class="text-xs text-gray-600 dark:text-gray-300">Serves /track for every organization that allows it. Organizations can also run their own page from their Fleet-Ops settings.</div>
+                <div class="text-xs text-gray-600 dark:text-gray-300">Serves /~/track for every organization that allows it. Organizations can also run their own page from their Fleet-Ops settings.</div>
             </div>
             <Toggle @isToggled={{this.genericEnabled}} @onToggle={{fn (mut this.genericEnabled)}} />
         </div>
         <div>
             <label for="admin-tracking-page-name" class="block text-sm font-semibold mb-1">Display name</label>
-            <input id="admin-tracking-page-name" type="text" class="form-input w-full" value={{this.displayName}} {{on "input" (fn this.setValue "displayName")}} />
+            <input id="admin-tracking-page-name" type="text" class="form-input w-full" value={{this.displayName}} placeholder="Fleetbase" {{on "input" (fn this.setValue "displayName")}} />
             <p class="mt-1 text-xs text-gray-600 dark:text-gray-300">Shown before a lookup. The logo comes from the instance branding.</p>
         </div>
         <div>
@@ -22,15 +22,15 @@
         <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
             <div>
                 <label for="admin-tracking-page-phone" class="block text-sm font-semibold mb-1">Support phone</label>
-                <input id="admin-tracking-page-phone" type="tel" class="form-input w-full" value={{this.supportPhone}} {{on "input" (fn this.setValue "supportPhone")}} />
+                <input id="admin-tracking-page-phone" type="tel" class="form-input w-full" value={{this.supportPhone}} placeholder="+1 555 010 0100" {{on "input" (fn this.setValue "supportPhone")}} />
             </div>
             <div>
                 <label for="admin-tracking-page-email" class="block text-sm font-semibold mb-1">Support email</label>
-                <input id="admin-tracking-page-email" type="email" class="form-input w-full" value={{this.supportEmail}} {{on "input" (fn this.setValue "supportEmail")}} />
+                <input id="admin-tracking-page-email" type="email" class="form-input w-full" value={{this.supportEmail}} placeholder="support@example.com" {{on "input" (fn this.setValue "supportEmail")}} />
             </div>
             <div>
                 <label for="admin-tracking-page-website" class="block text-sm font-semibold mb-1">Website</label>
-                <input id="admin-tracking-page-website" type="url" class="form-input w-full" value={{this.website}} {{on "input" (fn this.setValue "website")}} />
+                <input id="admin-tracking-page-website" type="url" class="form-input w-full" value={{this.website}} placeholder="https://example.com" {{on "input" (fn this.setValue "website")}} />
             </div>
         </div>
         <div class="flex items-start justify-between gap-4">
diff --git a/addon/components/tracking-page.hbs b/addon/components/tracking-page.hbs
index 31b63c549..f56fd6afc 100644
--- a/addon/components/tracking-page.hbs
+++ b/addon/components/tracking-page.hbs
@@ -8,9 +8,12 @@
             {{/if}}
             <span class="tp-brand-name">{{this.company.name}}</span>
         </div>
-        {{#if (or (eq this.screen "public") (eq this.screen "track"))}}
-            <button type="button" class="tp-link-button" {{on "click" this.lookupAnother}}>{{t "tracking-page.page.track-another"}}</button>
-        {{/if}}
+        <div class="tp-header-actions">
+            {{#if (or (eq this.screen "public") (eq this.screen "track"))}}
+                <button type="button" class="tp-link-button" {{on "click" this.lookupAnother}}>{{t "tracking-page.page.track-another"}}</button>
+            {{/if}}
+            <TrackingPage::LocaleSelector class="tp-locale-selector" @locales={{this.company.locales}} @horizontalPosition="right" />
+        </div>
     </header>
 
     <main class="tp-main">
@@ -119,14 +122,6 @@
                 {{#if this.company.support_email}}<a href="mailto:{{this.company.support_email}}">{{this.company.support_email}}</a>{{/if}}
             </div>
         {{/if}}
-        <label class="tp-footer-language">
-            <span>{{t "tracking-page.page.language"}}</span>
-            <select class="tp-select" {{on "change" this.changeLocale}}>
-                {{#each this.localeOptions as |locale|}}
-                    <option value={{locale.code}} selected={{locale.selected}}>{{locale.label}}</option>
-                {{/each}}
-            </select>
-        </label>
         {{#if this.company.powered_by}}
             <FleetbaseAttribution @showPoweredBy={{true}} class="tp-attribution" />
         {{/if}}
diff --git a/addon/components/tracking-page.js b/addon/components/tracking-page.js
index a3e470ee1..910aec9f1 100644
--- a/addon/components/tracking-page.js
+++ b/addon/components/tracking-page.js
@@ -19,20 +19,6 @@ const GENTLE_LIMIT_AFTER = 4;
 /** The code length the server issues. */
 export const CODE_LENGTH = 6;
 
-/** Each locale, labelled in its own language. */
-const LOCALE_LABELS = {
-    'en-us': 'English',
-    'ar-ae': 'العربية',
-    'bg-bg': 'Български',
-    'es-pa': 'Español',
-    'fr-fr': 'Français',
-    'mn-mn': 'Монгол',
-    'pt-br': 'Português',
-    'ru-ru': 'Русский',
-    'uk-ua': 'Українська',
-    'vi-vn': 'Tiếng Việt',
-};
-
 /**
  * The customer tracking page.
  *
@@ -125,12 +111,6 @@ export default class TrackingPageComponent extends Component {
         return this.locale.startsWith('ar') ? 'rtl' : 'ltr';
     }
 
-    get localeOptions() {
-        const enabled = this.company.locales?.length ? this.company.locales : Object.keys(LOCALE_LABELS);
-
-        return enabled.map((code) => ({ code, label: LOCALE_LABELS[code] ?? code, selected: code === this.locale }));
-    }
-
     get number() {
         return (this.data?.tracking_number ?? this.trackingInput ?? '').trim();
     }
@@ -469,10 +449,6 @@ export default class TrackingPageComponent extends Component {
 
     /* ── Page chrome ───────────────────────────────────────────────── */
 
-    @action changeLocale(event) {
-        this.intl.setLocale([event.target.value]);
-    }
-
     @action dismissToast() {
         this.toast = null;
     }
diff --git a/addon/components/tracking-page/full-view.hbs b/addon/components/tracking-page/full-view.hbs
index f2a23a3a2..607d11377 100644
--- a/addon/components/tracking-page/full-view.hbs
+++ b/addon/components/tracking-page/full-view.hbs
@@ -197,6 +197,11 @@
 
         <section class="tp-card tp-stack-xs" aria-labelledby="tp-timeline-title">
             <h2 id="tp-timeline-title" class="tp-h3">{{t "tracking-page.page.updates"}}</h2>
+            {{#if this.hasOlder}}
+                <button type="button" class="tp-button tp-button-small tp-self-start" aria-expanded={{if this.showOlder "true" "false"}} {{on "click" this.toggleOlder}}>
+                    {{#if this.showOlder}}{{t "tracking-page.page.show-fewer"}}{{else}}{{t "tracking-page.page.show-earlier" count=this.olderCount}}{{/if}}
+                </button>
+            {{/if}}
             {{#each this.timelineGroups as |group|}}
                 <div class="tp-eyebrow tp-timeline-day">{{group.day}}</div>
                 <ol class="tp-timeline">
@@ -216,11 +221,6 @@
             {{else}}
                 <p class="tp-muted">{{t "tracking-page.page.no-updates"}}</p>
             {{/each}}
-            {{#if this.hasOlder}}
-                <button type="button" class="tp-button tp-button-small tp-self-start" aria-expanded={{if this.showOlder "true" "false"}} {{on "click" this.toggleOlder}}>
-                    {{#if this.showOlder}}{{t "tracking-page.page.show-fewer"}}{{else}}{{t "tracking-page.page.show-earlier" count=this.olderCount}}{{/if}}
-                </button>
-            {{/if}}
         </section>
 
         {{#if (gt this.items.length 0)}}
diff --git a/addon/components/tracking-page/full-view.js b/addon/components/tracking-page/full-view.js
index 3b07d9819..26270c5dc 100644
--- a/addon/components/tracking-page/full-view.js
+++ b/addon/components/tracking-page/full-view.js
@@ -296,13 +296,21 @@ export default class TrackingPageFullViewComponent extends Component {
         return this.args.company?.support_email;
     }
 
+    /**
+     * Newest first, as the server sends it.
+     */
     get timeline() {
         return this.forCurrentStop(this.data.timeline ?? []);
     }
 
+    /**
+     * The updates as they read, oldest first, so the order's creation leads and the
+     * latest update closes the list, as the progress line does. Earlier days fold away.
+     */
     get timelineGroups() {
         const groups = [];
-        this.timeline.forEach((entry, index) => {
+        const entries = [...this.timeline].reverse();
+        entries.forEach((entry, index) => {
             const day = this.dayLabel(entry.created_at);
             let group = groups[groups.length - 1];
             if (!group || group.day !== day) {
@@ -310,16 +318,16 @@ export default class TrackingPageFullViewComponent extends Component {
                 groups.push(group);
             }
 
-            group.entries.push({ ...entry, time: this.time(entry.created_at), latest: index === 0 });
+            group.entries.push({ ...entry, time: this.time(entry.created_at), latest: index === entries.length - 1 });
         });
 
-        return this.showOlder ? groups : groups.slice(0, 1);
+        return this.showOlder ? groups : groups.slice(-1);
     }
 
     get olderCount() {
-        const first = this.timelineGroups[0]?.entries.length ?? 0;
+        const shown = this.timelineGroups[this.timelineGroups.length - 1]?.entries.length ?? 0;
 
-        return Math.max(0, this.timeline.length - (this.showOlder ? this.timeline.length : first));
+        return Math.max(0, this.timeline.length - (this.showOlder ? this.timeline.length : shown));
     }
 
     get hasOlder() {
diff --git a/addon/components/tracking-page/locale-selector.js b/addon/components/tracking-page/locale-selector.js
new file mode 100644
index 000000000..971ff7779
--- /dev/null
+++ b/addon/components/tracking-page/locale-selector.js
@@ -0,0 +1,30 @@
+import LocaleSelectorTrayComponent from '@fleetbase/ember-ui/components/locale-selector-tray';
+import { inject as service } from '@ember/service';
+import { action } from '@ember/object';
+
+/**
+ * The console's locale switcher, for the tracking page: it offers only the languages the
+ * company's page is in (`@locales`), and switches the page without saving the choice to
+ * an account, since the visitor is most often a customer who isn't signed in.
+ */
+export default class TrackingPageLocaleSelectorComponent extends LocaleSelectorTrayComponent {
+    @service('language') languageService;
+
+    get language() {
+        const all = this.languageService.availableLocales ?? {};
+        const enabled = this.args.locales ?? [];
+        const availableLocales = {};
+        for (const code of Object.keys(all)) {
+            if (all[code] && (enabled.length === 0 || enabled.includes(code))) {
+                availableLocales[code] = all[code];
+            }
+        }
+
+        return { availableLocales, loadAvailableCountries: this.languageService.loadAvailableCountries };
+    }
+
+    @action changeLocale(locale) {
+        this.currentLocale = locale;
+        this.intl.setLocale([locale]);
+    }
+}
diff --git a/addon/components/tracking-page/map.js b/addon/components/tracking-page/map.js
index 862d7d487..04755098e 100644
--- a/addon/components/tracking-page/map.js
+++ b/addon/components/tracking-page/map.js
@@ -191,9 +191,9 @@ export default class TrackingPageMapComponent extends Component {
     /* ── Labels ────────────────────────────────────────────────────── */
 
     /**
-     * Hide the labels that would overlap one already shown, in the order the map gives
-     * them priority: the vehicle, the customer's stops, then the pickups. A hidden label
-     * comes back once there is room, and its marker's title still names it.
+     * Labels sit above their markers. One that would overlap a label already placed, in
+     * the order the map gives them priority (the vehicle, the customer's stops, then the
+     * pickups), moves below its marker instead.
      */
     @action placeLabels() {
         if (!this.element) {
@@ -201,16 +201,21 @@ export default class TrackingPageMapComponent extends Component {
         }
 
         const labels = ['.tp-map-label-vehicle', '.tp-map-label-stop', '.tp-map-label-pickup'].flatMap((selector) => [...this.element.querySelectorAll(selector)]);
-        const shown = [];
+        const placed = [];
+        const overlaps = (box) => placed.some((other) => box.left < other.right + 4 && box.right > other.left - 4 && box.top < other.bottom + 2 && box.bottom > other.top - 2);
         for (const label of labels) {
-            label.classList.remove('tp-map-label-hidden');
-            const box = label.getBoundingClientRect();
-            const overlaps = shown.some((other) => box.left < other.right + 4 && box.right > other.left - 4 && box.top < other.bottom + 2 && box.bottom > other.top - 2);
-            if (overlaps) {
-                label.classList.add('tp-map-label-hidden');
-            } else {
-                shown.push(box);
+            label.classList.remove('tp-map-label-below');
+            label.style.top = '';
+            let box = label.getBoundingClientRect();
+            if (overlaps(box)) {
+                // From above the marker (its centre less 23px) to below it (its centre
+                // plus 21px): the label's height and the marker's 30px, with the gaps.
+                label.classList.add('tp-map-label-below');
+                label.style.top = `${Math.round(box.height + 44)}px`;
+                box = label.getBoundingClientRect();
             }
+
+            placed.push(box);
         }
     }
 
diff --git a/addon/styles/fleetops-engine.css b/addon/styles/fleetops-engine.css
index 89f084d37..4a28d27c1 100644
--- a/addon/styles/fleetops-engine.css
+++ b/addon/styles/fleetops-engine.css
@@ -12569,6 +12569,22 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     border-bottom: 1px solid var(--tp-border);
 }
 
+.tp-header-actions {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+}
+
+/* The console's locale switcher, in the page's own colours. */
+.tp-root .tp-locale-selector .next-org-button-trigger {
+    color: var(--tp-text);
+}
+
+.tp-root .tp-locale-selector .next-org-button-trigger:hover,
+.tp-root .tp-locale-selector .next-org-button-trigger.is-open {
+    background: var(--tp-surface2);
+}
+
 .tp-brand {
     display: flex;
     align-items: center;
@@ -12810,14 +12826,6 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     resize: vertical;
 }
 
-.tp-select {
-    min-height: 2.25rem;
-    padding: 0 0.5rem;
-    border: 1px solid var(--tp-border);
-    border-radius: 0.5rem;
-    background: var(--tp-surface);
-    color: var(--tp-text);
-}
 
 .tp-button {
     display: inline-flex;
@@ -13485,8 +13493,9 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     display: none;
 }
 
-.tp-root .tp-map-label-hidden {
-    visibility: hidden;
+/* Moved below its marker by the map when it would overlap another label. */
+.tp-root .tp-map-label-below {
+    box-shadow: 0 -1px 3px rgb(0 0 0 / 15%);
 }
 
 .tp-root .tp-map-label-vehicle {
@@ -13692,11 +13701,6 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     text-align: center;
 }
 
-.tp-footer-language {
-    display: flex;
-    align-items: center;
-    gap: 0.5rem;
-}
 
 .tp-toast-region {
     position: fixed;
diff --git a/addon/templates/settings/tracking-page.hbs b/addon/templates/settings/tracking-page.hbs
index a0e8037b3..f38e4c0b3 100644
--- a/addon/templates/settings/tracking-page.hbs
+++ b/addon/templates/settings/tracking-page.hbs
@@ -41,6 +41,7 @@
                                         type="text"
                                         class="form-input border-0 rounded-none flex-1 min-w-0"
                                         value={{this.config.org_page.slug}}
+                                        placeholder={{t "tracking-page.settings.placeholder-slug"}}
                                         autocomplete="off"
                                         spellcheck="false"
                                         aria-describedby="tracking-page-slug-status"
@@ -73,6 +74,7 @@
                             <InputGroup @name={{t "tracking-page.settings.links-target"}} @helpText={{t "tracking-page.settings.links-target-help"}}>
                                 <Select
                                     class="w-full"
+                                    @placeholder={{t "tracking-page.settings.placeholder-select"}}
                                     @value={{this.config.links.target}}
                                     @options={{this.linkTargetOptions}}
                                     @optionLabel="label"
@@ -114,6 +116,7 @@
                                         class="form-input w-32 font-mono uppercase"
                                         aria-label={{t "tracking-page.settings.accent-hex"}}
                                         value={{this.config.branding.accent}}
+                                        placeholder="#1F5FA8"
                                         {{on "change" (fn this.updateFromEvent "branding.accent")}}
                                     />
                                     <span class="text-xs {{if this.accentReadable 'text-green-700 dark:text-green-400' 'text-red-700 dark:text-red-400'}}">
@@ -142,15 +145,15 @@
                             <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
                                 <div>
                                     <label for="tracking-page-phone" class="block text-sm font-semibold mb-1">{{t "tracking-page.settings.support-phone"}}</label>
-                                    <input id="tracking-page-phone" type="tel" class="form-input w-full" value={{this.config.branding.support_phone}} {{on "input" (fn this.updateFromEvent "branding.support_phone")}} />
+                                    <input id="tracking-page-phone" type="tel" class="form-input w-full" value={{this.config.branding.support_phone}} placeholder={{t "tracking-page.settings.placeholder-phone"}} {{on "input" (fn this.updateFromEvent "branding.support_phone")}} />
                                 </div>
                                 <div>
                                     <label for="tracking-page-email" class="block text-sm font-semibold mb-1">{{t "tracking-page.settings.support-email"}}</label>
-                                    <input id="tracking-page-email" type="email" class="form-input w-full" value={{this.config.branding.support_email}} {{on "input" (fn this.updateFromEvent "branding.support_email")}} />
+                                    <input id="tracking-page-email" type="email" class="form-input w-full" value={{this.config.branding.support_email}} placeholder={{t "tracking-page.settings.placeholder-email"}} {{on "input" (fn this.updateFromEvent "branding.support_email")}} />
                                 </div>
                                 <div>
                                     <label for="tracking-page-website" class="block text-sm font-semibold mb-1">{{t "tracking-page.settings.website"}}</label>
-                                    <input id="tracking-page-website" type="url" class="form-input w-full" value={{this.config.branding.website}} {{on "input" (fn this.updateFromEvent "branding.website")}} />
+                                    <input id="tracking-page-website" type="url" class="form-input w-full" value={{this.config.branding.website}} placeholder={{t "tracking-page.settings.placeholder-website"}} {{on "input" (fn this.updateFromEvent "branding.website")}} />
                                 </div>
                             </div>
                             <p class="-mt-3 text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.support-help"}}</p>
@@ -167,6 +170,7 @@
                                 <InputGroup @name={{t "tracking-page.settings.theme"}}>
                                     <Select
                                         class="w-full"
+                                        @placeholder={{t "tracking-page.settings.placeholder-select"}}
                                         @value={{this.config.branding.theme}}
                                         @options={{this.themeOptions}}
                                         @optionLabel="label"
@@ -177,6 +181,7 @@
                                 <InputGroup @name={{t "tracking-page.settings.default-language"}}>
                                     <Select
                                         class="w-full"
+                                        @placeholder={{t "tracking-page.settings.placeholder-select"}}
                                         @value={{this.config.branding.default_locale}}
                                         @options={{this.defaultLocaleOptions}}
                                         @optionLabel="label"
@@ -240,6 +245,7 @@
                                     max="168"
                                     class="form-input w-32"
                                     value={{this.config.access.session_hours}}
+                                    placeholder="24"
                                     {{on "change" (fn this.updateNumber "access.session_hours")}}
                                 />
                                 <p class="mt-1 text-xs text-gray-600 dark:text-gray-300">{{t "tracking-page.settings.session-hours-help"}}</p>
@@ -284,6 +290,7 @@
                             <InputGroup @name={{t "tracking-page.settings.driver-contact"}} @helpText={{t "tracking-page.settings.driver-contact-help"}}>
                                 <Select
                                     class="w-full"
+                                    @placeholder={{t "tracking-page.settings.placeholder-select"}}
                                     @value={{this.config.visibility.driver_contact}}
                                     @options={{this.driverContactOptions}}
                                     @optionLabel="label"
diff --git a/app/components/tracking-page/locale-selector.js b/app/components/tracking-page/locale-selector.js
new file mode 100644
index 000000000..e2c784ae6
--- /dev/null
+++ b/app/components/tracking-page/locale-selector.js
@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/locale-selector';
diff --git a/server/src/Support/TrackingPage/TrackingView.php b/server/src/Support/TrackingPage/TrackingView.php
index 6231b347f..90ce61c67 100644
--- a/server/src/Support/TrackingPage/TrackingView.php
+++ b/server/src/Support/TrackingPage/TrackingView.php
@@ -256,6 +256,9 @@ protected function timeline(array $data, array $stopsView, Collection $own): arr
 
         return $entries
             ->unique(fn ($entry) => ($entry['code'] ?? '') . '|' . ($entry['created_at'] ?? '') . '|' . ($entry['status'] ?? '') . '|' . ($entry['stop'] ?? ''))
+            // Entries arrive oldest first; reversed before the (stable) sort, two at the
+            // same second keep their order rather than swapping.
+            ->reverse()
             ->sortByDesc(fn ($entry) => $entry['created_at'] ?? '')
             ->values()
             ->all();
diff --git a/translations/ar-ae.yml b/translations/ar-ae.yml
index 7ad2dac5d..a2ead850e 100644
--- a/translations/ar-ae.yml
+++ b/translations/ar-ae.yml
@@ -2057,6 +2057,11 @@ tracking-page:
     logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
     accent: "Accent colour"
     accent-hex: "Accent colour as a hex value"
+    placeholder-slug: "your-company"
+    placeholder-phone: "+1 555 010 0100"
+    placeholder-email: "support@example.com"
+    placeholder-website: "https://example.com"
+    placeholder-select: "Select an option"
     contrast-ok: "Text on this colour is readable ({ratio}:1)."
     contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
     accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
diff --git a/translations/bg-bg.yaml b/translations/bg-bg.yaml
index 40a29f28d..a0db2649d 100644
--- a/translations/bg-bg.yaml
+++ b/translations/bg-bg.yaml
@@ -2372,6 +2372,11 @@ tracking-page:
     logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
     accent: "Accent colour"
     accent-hex: "Accent colour as a hex value"
+    placeholder-slug: "your-company"
+    placeholder-phone: "+1 555 010 0100"
+    placeholder-email: "support@example.com"
+    placeholder-website: "https://example.com"
+    placeholder-select: "Select an option"
     contrast-ok: "Text on this colour is readable ({ratio}:1)."
     contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
     accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
diff --git a/translations/en-us.yaml b/translations/en-us.yaml
index 6073dab9b..8a51aa3cb 100644
--- a/translations/en-us.yaml
+++ b/translations/en-us.yaml
@@ -3650,6 +3650,11 @@ tracking-page:
     logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
     accent: "Accent colour"
     accent-hex: "Accent colour as a hex value"
+    placeholder-slug: "your-company"
+    placeholder-phone: "+1 555 010 0100"
+    placeholder-email: "support@example.com"
+    placeholder-website: "https://example.com"
+    placeholder-select: "Select an option"
     contrast-ok: "Text on this colour is readable ({ratio}:1)."
     contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
     accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
diff --git a/translations/es-pa.yaml b/translations/es-pa.yaml
index 2afa94fad..48701c581 100644
--- a/translations/es-pa.yaml
+++ b/translations/es-pa.yaml
@@ -2251,6 +2251,11 @@ tracking-page:
     logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
     accent: "Accent colour"
     accent-hex: "Accent colour as a hex value"
+    placeholder-slug: "your-company"
+    placeholder-phone: "+1 555 010 0100"
+    placeholder-email: "support@example.com"
+    placeholder-website: "https://example.com"
+    placeholder-select: "Select an option"
     contrast-ok: "Text on this colour is readable ({ratio}:1)."
     contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
     accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
diff --git a/translations/fr-fr.yaml b/translations/fr-fr.yaml
index 8544a6eb5..31fc887b3 100644
--- a/translations/fr-fr.yaml
+++ b/translations/fr-fr.yaml
@@ -2397,6 +2397,11 @@ tracking-page:
     logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
     accent: "Accent colour"
     accent-hex: "Accent colour as a hex value"
+    placeholder-slug: "your-company"
+    placeholder-phone: "+1 555 010 0100"
+    placeholder-email: "support@example.com"
+    placeholder-website: "https://example.com"
+    placeholder-select: "Select an option"
     contrast-ok: "Text on this colour is readable ({ratio}:1)."
     contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
     accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
diff --git a/translations/mn-mn.yaml b/translations/mn-mn.yaml
index 81b7c6efe..6da2436ff 100644
--- a/translations/mn-mn.yaml
+++ b/translations/mn-mn.yaml
@@ -2341,6 +2341,11 @@ tracking-page:
     logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
     accent: "Accent colour"
     accent-hex: "Accent colour as a hex value"
+    placeholder-slug: "your-company"
+    placeholder-phone: "+1 555 010 0100"
+    placeholder-email: "support@example.com"
+    placeholder-website: "https://example.com"
+    placeholder-select: "Select an option"
     contrast-ok: "Text on this colour is readable ({ratio}:1)."
     contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
     accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
diff --git a/translations/pt-br.yaml b/translations/pt-br.yaml
index 61a504d55..8329dcc0f 100644
--- a/translations/pt-br.yaml
+++ b/translations/pt-br.yaml
@@ -2362,6 +2362,11 @@ tracking-page:
     logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
     accent: "Accent colour"
     accent-hex: "Accent colour as a hex value"
+    placeholder-slug: "your-company"
+    placeholder-phone: "+1 555 010 0100"
+    placeholder-email: "support@example.com"
+    placeholder-website: "https://example.com"
+    placeholder-select: "Select an option"
     contrast-ok: "Text on this colour is readable ({ratio}:1)."
     contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
     accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
diff --git a/translations/ru-ru.yaml b/translations/ru-ru.yaml
index 53a0346ce..4f82615b5 100644
--- a/translations/ru-ru.yaml
+++ b/translations/ru-ru.yaml
@@ -2355,6 +2355,11 @@ tracking-page:
     logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
     accent: "Accent colour"
     accent-hex: "Accent colour as a hex value"
+    placeholder-slug: "your-company"
+    placeholder-phone: "+1 555 010 0100"
+    placeholder-email: "support@example.com"
+    placeholder-website: "https://example.com"
+    placeholder-select: "Select an option"
     contrast-ok: "Text on this colour is readable ({ratio}:1)."
     contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
     accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
diff --git a/translations/uk-ua.yaml b/translations/uk-ua.yaml
index e30df00f0..d18736178 100644
--- a/translations/uk-ua.yaml
+++ b/translations/uk-ua.yaml
@@ -3498,6 +3498,11 @@ tracking-page:
     logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
     accent: "Accent colour"
     accent-hex: "Accent colour as a hex value"
+    placeholder-slug: "your-company"
+    placeholder-phone: "+1 555 010 0100"
+    placeholder-email: "support@example.com"
+    placeholder-website: "https://example.com"
+    placeholder-select: "Select an option"
     contrast-ok: "Text on this colour is readable ({ratio}:1)."
     contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
     accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
diff --git a/translations/vi-vn.yaml b/translations/vi-vn.yaml
index 35889d654..0cfd214da 100644
--- a/translations/vi-vn.yaml
+++ b/translations/vi-vn.yaml
@@ -2171,6 +2171,11 @@ tracking-page:
     logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
     accent: "Accent colour"
     accent-hex: "Accent colour as a hex value"
+    placeholder-slug: "your-company"
+    placeholder-phone: "+1 555 010 0100"
+    placeholder-email: "support@example.com"
+    placeholder-website: "https://example.com"
+    placeholder-select: "Select an option"
     contrast-ok: "Text on this colour is readable ({ratio}:1)."
     contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
     accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."

From 37614849446c891f11484cb01a172f6a4f2dc10f Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 15:31:48 +0800
Subject: [PATCH 45/87] fix(tracking-page): drop blank lines left by the
 removed language select styles

---
 addon/styles/fleetops-engine.css | 2 --
 1 file changed, 2 deletions(-)

diff --git a/addon/styles/fleetops-engine.css b/addon/styles/fleetops-engine.css
index 4a28d27c1..4392f72fa 100644
--- a/addon/styles/fleetops-engine.css
+++ b/addon/styles/fleetops-engine.css
@@ -12826,7 +12826,6 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     resize: vertical;
 }
 
-
 .tp-button {
     display: inline-flex;
     align-items: center;
@@ -13701,7 +13700,6 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     text-align: center;
 }
 
-
 .tp-toast-region {
     position: fixed;
     inset-inline: 1rem;

From 3a00a6cf08983b1af9b637b91bad32ac989fca60 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 15:47:10 +0800
Subject: [PATCH 46/87] fix(map): don't pass null to the default centre
 coordinates input

CoordinatesInput#isPoint reads .type on any object and typeof null is
"object", so with no default centre set the Map settings page threw while
rendering. Pass undefined, as other callers do.
---
 addon/controllers/settings/map.js           | 3 ++-
 tests/unit/controllers/settings/map-test.js | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/addon/controllers/settings/map.js b/addon/controllers/settings/map.js
index 4a15b07ca..dada0fc60 100644
--- a/addon/controllers/settings/map.js
+++ b/addon/controllers/settings/map.js
@@ -98,8 +98,9 @@ export default class SettingsMapController extends Controller {
      * @return {Object|null}
      */
     get defaultMapCenterPoint() {
+        // Not null: CoordinatesInput#isPoint reads `.type` on any object, and typeof null is "object".
         if (!this.hasDefaultMapCenter) {
-            return null;
+            return undefined;
         }
 
         return { type: 'Point', coordinates: [this.defaultMapLongitude, this.defaultMapLatitude] };
diff --git a/tests/unit/controllers/settings/map-test.js b/tests/unit/controllers/settings/map-test.js
index 65a10fee7..33eae86ae 100644
--- a/tests/unit/controllers/settings/map-test.js
+++ b/tests/unit/controllers/settings/map-test.js
@@ -127,7 +127,7 @@ module('Unit | Controller | settings/map', function (hooks) {
         const controller = this.owner.lookup('controller:settings/map');
         await controller.getSettings.last;
 
-        assert.strictEqual(controller.defaultMapCenterPoint, null, 'no centre loaded');
+        assert.strictEqual(controller.defaultMapCenterPoint, undefined, 'no centre loaded; never null, which CoordinatesInput cannot read');
 
         controller.setDefaultMapCenter({ latitude: '-27.47', longitude: '153.02' });
         controller.defaultMapZoom = '11';

From d91f2ef6c0fc3669f0ed9e3b5e3e613201f0e560 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 16:03:26 +0800
Subject: [PATCH 47/87] fix(tracking-page): translate the tracking page and its
 settings; keep the layout left to right

- The tracking-page keys (page and settings, 271) were English in every
  locale file; they are now translated for ar-ae, bg-bg, es-pa, fr-fr, mn-mn,
  pt-br, ru-ru, uk-ua and vi-vn, keeping every placeholder, with each
  language's plural categories.
- The page no longer switches to dir=rtl for Arabic: the mirrored layout put
  the language switcher's menu off screen.
---
 addon/components/tracking-page.hbs            |   4 +-
 addon/components/tracking-page.js             |   4 -
 addon/components/tracking-page/full-view.hbs  |   2 +-
 addon/components/tracking-page/order-list.hbs |   2 +-
 addon/styles/fleetops-engine.css              |   4 -
 translations/ar-ae.yml                        | 534 +++++++++---------
 translations/bg-bg.yaml                       | 534 +++++++++---------
 translations/es-pa.yaml                       | 534 +++++++++---------
 translations/fr-fr.yaml                       | 524 ++++++++---------
 translations/mn-mn.yaml                       | 530 ++++++++---------
 translations/pt-br.yaml                       | 524 ++++++++---------
 translations/ru-ru.yaml                       | 532 ++++++++---------
 translations/uk-ua.yaml                       | 532 ++++++++---------
 translations/vi-vn.yaml                       | 528 ++++++++---------
 14 files changed, 2390 insertions(+), 2398 deletions(-)

diff --git a/addon/components/tracking-page.hbs b/addon/components/tracking-page.hbs
index f56fd6afc..588ac45dc 100644
--- a/addon/components/tracking-page.hbs
+++ b/addon/components/tracking-page.hbs
@@ -1,4 +1,4 @@
-<div class="tp-root {{if this.dark 'tp-dark'}}" style={{this.themeStyle}} dir={{this.dir}} lang={{this.locale}}>
+<div class="tp-root {{if this.dark 'tp-dark'}}" style={{this.themeStyle}} lang={{this.locale}}>
     <header class="tp-header">
         <div class="tp-brand">
             {{#if this.company.logo_url}}
@@ -72,7 +72,7 @@
             <TrackingPage::PublicView @data={{this.data}} @signInUrl={{this.signInUrl}} @onVerify={{this.startVerify}} />
         {{else if (eq this.screen "verify")}}
             <section class="tp-narrow tp-stack">
-                <button type="button" class="tp-back" {{on "click" this.cancelVerify}}><FaIcon @icon="chevron-left" class="tp-flip" /> {{t "tracking-page.page.back"}}</button>
+                <button type="button" class="tp-back" {{on "click" this.cancelVerify}}><FaIcon @icon="chevron-left" /> {{t "tracking-page.page.back"}}</button>
                 <TrackingPage::VerifyPanel
                     @step={{this.verifyStep}}
                     @channels={{this.channels}}
diff --git a/addon/components/tracking-page.js b/addon/components/tracking-page.js
index 910aec9f1..6b8f70d75 100644
--- a/addon/components/tracking-page.js
+++ b/addon/components/tracking-page.js
@@ -107,10 +107,6 @@ export default class TrackingPageComponent extends Component {
         return this.intl.primaryLocale ?? 'en-us';
     }
 
-    get dir() {
-        return this.locale.startsWith('ar') ? 'rtl' : 'ltr';
-    }
-
     get number() {
         return (this.data?.tracking_number ?? this.trackingInput ?? '').trim();
     }
diff --git a/addon/components/tracking-page/full-view.hbs b/addon/components/tracking-page/full-view.hbs
index 607d11377..f8f254640 100644
--- a/addon/components/tracking-page/full-view.hbs
+++ b/addon/components/tracking-page/full-view.hbs
@@ -1,7 +1,7 @@
 <div class="tp-full {{if @data.location 'tp-full-with-map'}}" {{did-insert this.loadProofs}} {{did-update this.loadProofs @data.proofs}}>
     <div class="tp-row-wrap tp-full-chips">
         {{#if @fromList}}
-            <button type="button" class="tp-back" {{on "click" @onBack}}><FaIcon @icon="chevron-left" class="tp-flip" /> {{t "tracking-page.page.your-orders"}}</button>
+            <button type="button" class="tp-back" {{on "click" @onBack}}><FaIcon @icon="chevron-left" /> {{t "tracking-page.page.your-orders"}}</button>
         {{/if}}
         <span class="tp-chip tp-chip-accent"><FaIcon @icon={{this.viewerChip.icon}} /> {{this.viewerChip.label}}</span>
         {{#if this.canSignOut}}
diff --git a/addon/components/tracking-page/order-list.hbs b/addon/components/tracking-page/order-list.hbs
index ca2010559..cb82592ba 100644
--- a/addon/components/tracking-page/order-list.hbs
+++ b/addon/components/tracking-page/order-list.hbs
@@ -20,7 +20,7 @@
                             <span class="tp-small tp-accent-text">{{t (concat "tracking-page.page.stage-" order.stage)}}</span>
                             <span class="tp-mono tp-small tp-muted">{{order.tracking_number}}</span>
                         </span>
-                        <FaIcon @icon="chevron-right" class="tp-muted tp-flip" />
+                        <FaIcon @icon="chevron-right" class="tp-muted" />
                     </button>
                 </li>
             {{/each}}
diff --git a/addon/styles/fleetops-engine.css b/addon/styles/fleetops-engine.css
index 4392f72fa..36b53c4c9 100644
--- a/addon/styles/fleetops-engine.css
+++ b/addon/styles/fleetops-engine.css
@@ -13781,10 +13781,6 @@ body[data-theme='dark'] .resource-list-pill .fleetbase-pill-body .resource-pill-
     background: var(--tp-surface);
 }
 
-.tp-root[dir='rtl'] .tp-flip {
-    transform: scaleX(-1);
-}
-
 @media (width >= 960px) {
     .tp-main {
         padding: 2rem;
diff --git a/translations/ar-ae.yml b/translations/ar-ae.yml
index a2ead850e..659842d9a 100644
--- a/translations/ar-ae.yml
+++ b/translations/ar-ae.yml
@@ -2034,275 +2034,275 @@ common:
   "no": لا
 tracking-page:
   settings:
-    title: "Tracking Page"
-    menu: "Tracking Page"
-    saved: "Tracking page settings saved."
-    load-failed: "We couldn't load the tracking page settings."
-    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
-    pages: "Pages"
-    org-page-enabled: "Your own tracking page"
-    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
-    slug: "Page address"
-    slug-checking: "Checking the address..."
-    open-page: "Open the page"
-    generic-page-allowed: "Allow tracking on the shared page"
-    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
-    links-target: "Links in emails and labels"
-    links-target-help: "Which page your notifications and labels send customers to."
-    links-target-auto: "Your page when it is on, otherwise the shared page"
-    links-target-org: "Always your page"
-    links-target-generic: "Always the shared page"
-    branding: "Branding"
-    display-name: "Display name"
-    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
-    accent: "Accent colour"
-    accent-hex: "Accent colour as a hex value"
-    placeholder-slug: "your-company"
+    title: "صفحة التتبع"
+    menu: "صفحة التتبع"
+    saved: "تم حفظ إعدادات صفحة التتبع."
+    load-failed: "تعذّر تحميل إعدادات صفحة التتبع."
+    load-failed-help: "أعد تحميل الصفحة للمحاولة مرة أخرى. إذا تكرر الأمر، فتأكد من أن لديك صلاحية عرض هذه الإعدادات."
+    pages: "الصفحات"
+    org-page-enabled: "صفحة التتبع الخاصة بك"
+    org-page-enabled-help: "صفحة تتبع تحمل علامتك التجارية على عنوان خاص بها. لا تعرض إلا أرقام التتبع الخاصة بمؤسستك."
+    slug: "عنوان الصفحة"
+    slug-checking: "جارٍ التحقق من العنوان..."
+    open-page: "فتح الصفحة"
+    generic-page-allowed: "السماح بالتتبع على الصفحة المشتركة"
+    generic-page-allowed-help: "يتيح للعملاء البحث عن أرقام التتبع الخاصة بك على {url}. أوقف هذا الخيار لإبقاء التتبع على صفحتك فقط."
+    links-target: "الروابط في رسائل البريد الإلكتروني والملصقات"
+    links-target-help: "الصفحة التي تنقل إليها إشعاراتك وملصقاتك العملاء."
+    links-target-auto: "صفحتك عند تفعيلها، وإلا فالصفحة المشتركة"
+    links-target-org: "صفحتك دائمًا"
+    links-target-generic: "الصفحة المشتركة دائمًا"
+    branding: "العلامة التجارية"
+    display-name: "الاسم المعروض"
+    logo-help: "تستخدم الصفحة شعار مؤسستك. وإن لم يتوفر شعار، تعرض الأحرف الأولى من الاسم المعروض."
+    accent: "اللون المميز"
+    accent-hex: "قيمة اللون المميز بالنظام الست عشري"
+    placeholder-slug: "sharikatak"
     placeholder-phone: "+1 555 010 0100"
     placeholder-email: "support@example.com"
     placeholder-website: "https://example.com"
-    placeholder-select: "Select an option"
-    contrast-ok: "Text on this colour is readable ({ratio}:1)."
-    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
-    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
-    accent-dark: "Accent colour in dark mode"
-    accent-dark-auto: "Automatic"
-    support-phone: "Support phone"
-    support-email: "Support email"
-    website: "Website"
-    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
-    powered-by: "Show \"Powered by Fleetbase\""
-    powered-by-help: "A small line in the page footer."
-    theme: "Light and dark"
-    theme-system: "Follow the customer's device"
-    theme-light: "Always light"
-    default-language: "Default language"
-    languages: "Languages customers can choose"
-    access: "Access"
-    public-status: "Show the status without verification"
-    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
-    channel-sms: "Verify by text message"
-    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
-    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
-    channel-email: "Verify by email"
-    channel-email-help: "Sends a 6-digit code to the email address on the order."
-    session-hours: "Stay verified for (hours)"
-    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
-    account-sign-in: "Let customers sign in"
-    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
-    account-upsell: "Suggest creating an account"
-    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
-    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
-    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
-    visibility: "What verified customers see"
-    visibility-map: "Live map"
-    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
-    visibility-driver_name: "Driver's first name"
-    visibility-driver_name-help: "Only the first name, never a surname or phone number."
-    visibility-vehicle: "Vehicle description"
-    visibility-vehicle-help: "For example \"White Ford Transit\"."
-    visibility-items: "Items in the delivery"
-    visibility-items-help: "Names, descriptions, quantities and photos."
-    visibility-item_prices: "Item prices"
-    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
-    visibility-pod_photo: "Delivery photo"
-    visibility-pod_photo-help: "The photo taken as proof of delivery."
-    visibility-pod_signature: "Signature"
-    visibility-pod_signature-help: "The signature captured as proof of delivery."
-    visibility-instructions_edit: "Let customers add delivery instructions"
-    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
-    visibility-report_problem: "Report a problem"
-    visibility-report_problem-help: "Lets customers send you a message about their delivery."
-    driver-contact: "Calls and messages go to"
-    driver-contact-help: "Who customers reach from the driver card."
-    driver-contact-company: "Your support team"
-    driver-contact-driver: "The driver directly"
-    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
-    preview: "Preview"
-    preview-help: "A sample in light and dark mode. Save to apply the changes."
-    preview-chip: "Verified on this device"
-    preview-headline: "Arriving today"
-    preview-sub: "2:10 to 2:40 pm"
-    preview-button: "Verify it's you"
-    preview-powered-by: "Powered by Fleetbase"
+    placeholder-select: "اختر خيارًا"
+    contrast-ok: "النص على هذا اللون سهل القراءة ({ratio}:1)."
+    contrast-low: "النص على هذا اللون صعب القراءة ({ratio}:1). اختر لونًا أغمق أو أفتح."
+    accent-help: "يُستخدم للأزرار وشريط التقدم والعناصر البارزة. يُختار لون النص فوقه تلقائيًا."
+    accent-dark: "اللون المميز في الوضع الداكن"
+    accent-dark-auto: "تلقائي"
+    support-phone: "هاتف الدعم"
+    support-email: "بريد الدعم الإلكتروني"
+    website: "الموقع الإلكتروني"
+    support-help: "اترك هذه الحقول فارغة لاستخدام بيانات مؤسستك. تصل مكالمات العملاء ورسائلهم إلى هنا."
+    powered-by: "إظهار \"مدعوم من Fleetbase\""
+    powered-by-help: "سطر صغير في تذييل الصفحة."
+    theme: "الوضع الفاتح والداكن"
+    theme-system: "حسب جهاز العميل"
+    theme-light: "فاتح دائمًا"
+    default-language: "اللغة الافتراضية"
+    languages: "اللغات المتاحة للعملاء"
+    access: "الوصول"
+    public-status: "عرض الحالة دون تحقق"
+    public-status-help: "برقم التتبع وحده، يرى العملاء مرحلة التوصيل وتاريخ آخر تحديث. أوقف هذا الخيار لعدم عرض أي شيء حتى يتحققوا من هويتهم."
+    channel-sms: "التحقق عبر رسالة نصية"
+    channel-sms-help: "يرسل رمزًا من 6 أرقام إلى رقم الهاتف المسجل في الطلب."
+    channel-sms-unavailable: "لم يتم إعداد أي مزوّد لخدمة SMS على هذا النظام، لذا لا يمكن إرسال الرموز عبر الرسائل النصية."
+    channel-email: "التحقق عبر البريد الإلكتروني"
+    channel-email-help: "يرسل رمزًا من 6 أرقام إلى البريد الإلكتروني المسجل في الطلب."
+    session-hours: "مدة بقاء التحقق (بالساعات)"
+    session-hours-help: "المدة التي يبقى فيها الجهاز متحققًا منه بعد إدخال رمز صحيح. بين 1 و168 ساعة."
+    account-sign-in: "السماح للعملاء بتسجيل الدخول"
+    account-sign-in-help: "يمكن للعملاء الذين لديهم حساب في بوابة العملاء تسجيل الدخول لرؤية جميع طلباتهم دون رمز."
+    account-upsell: "اقتراح إنشاء حساب"
+    account-upsell-help: "بعد التوصيل، تتم دعوة العملاء الذين تم التحقق منهم وليس لديهم حساب إلى إنشاء حساب."
+    customer-portal-missing: "ثبّت إضافة Customer Portal ليتمكن العملاء من تسجيل الدخول ورؤية جميع طلباتهم."
+    code-rules: "تتكون الرموز من 6 أرقام وتنتهي صلاحيتها بعد 10 دقائق. بعد 3 رموز خاطئة، يتوقف إرسال الرموز لمدة 5 دقائق."
+    visibility: "ما يراه العملاء الذين تم التحقق منهم"
+    visibility-map: "الخريطة المباشرة"
+    visibility-map-help: "المسار وموقع المركبة أثناء توجهها إلى العميل."
+    visibility-driver_name: "الاسم الأول للسائق"
+    visibility-driver_name-help: "الاسم الأول فقط، دون اسم العائلة أو رقم الهاتف أبدًا."
+    visibility-vehicle: "وصف المركبة"
+    visibility-vehicle-help: "مثل \"فورد ترانزيت بيضاء\"."
+    visibility-items: "محتويات الشحنة"
+    visibility-items-help: "الأسماء والأوصاف والكميات والصور."
+    visibility-item_prices: "أسعار المنتجات"
+    visibility-item_prices-help: "تظهر فقط للعملاء المسجلين الذين قدّموا الطلب."
+    visibility-pod_photo: "صورة التسليم"
+    visibility-pod_photo-help: "الصورة الملتقطة كإثبات للتسليم."
+    visibility-pod_signature: "التوقيع"
+    visibility-pod_signature-help: "التوقيع المسجل كإثبات للتسليم."
+    visibility-instructions_edit: "السماح للعملاء بإضافة تعليمات التوصيل"
+    visibility-instructions_edit-help: "مثل رمز البوابة أو مكان ترك الطرد."
+    visibility-report_problem: "الإبلاغ عن مشكلة"
+    visibility-report_problem-help: "يتيح للعملاء إرسال رسالة إليك بشأن توصيل طلبهم."
+    driver-contact: "تصل المكالمات والرسائل إلى"
+    driver-contact-help: "الجهة التي يتواصل معها العملاء من بطاقة السائق."
+    driver-contact-company: "فريق الدعم لديك"
+    driver-contact-driver: "السائق مباشرة"
+    privacy-rules: "مطبّق دائمًا: لا يرى العملاء إلا محطاتهم ومنتجاتهم، وتُخفى الخريطة والسائق بعد التسليم، ولا يظهر موقع السائق إلا أثناء توجهه إليهم."
+    preview: "معاينة"
+    preview-help: "نموذج في الوضعين الفاتح والداكن. احفظ لتطبيق التغييرات."
+    preview-chip: "تم التحقق على هذا الجهاز"
+    preview-headline: "يصل اليوم"
+    preview-sub: "من 2:10 إلى 2:40 م"
+    preview-button: "تحقّق من هويتك"
+    preview-powered-by: "مدعوم من Fleetbase"
   page:
-    track-another: "Track another"
-    unavailable-title: "Tracking isn't available here"
-    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
-    lookup-title: "Track your delivery"
-    lookup-sub: "See where your parcel is and when it will arrive."
-    tracking-number: "Tracking number"
-    tracking-number-placeholder: "e.g. NOR4829301736US"
-    tracking-number-help: "Find it in your confirmation email or on the parcel label."
-    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
-    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
-    looking-up: "Looking it up..."
-    track: "Track"
-    or: "or"
-    your-orders: "Your orders"
-    sign-in: "Sign in to see all your orders"
-    sign-in-account: "Sign in to your account"
-    back: "Back"
-    help: "Need help?"
-    language: "Language"
-    powered-by: "Powered by Fleetbase"
-    dismiss: "Dismiss"
-    chip-limited: "Limited view · Verify to see details"
-    chip-verified: "Verified on this device"
-    chip-account: "Signed in"
-    chip-staff: "Staff preview: what this customer sees"
-    status: "Status"
-    verify-to-see: "Verify to see your delivery"
-    last-update: "Last update: {date}"
-    copy: "Copy"
-    verify-title: "See your full delivery details"
-    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
-    verify-button: "Verify it's you"
-    verify-unlock: "Verify to unlock"
-    locked-map: "Live map"
-    locked-arrival: "Arrival time and driver"
-    locked-details: "Updates, items and proof of delivery"
-    stage-preparing: "Being prepared"
-    stage-scheduled: "Scheduled"
-    stage-dispatched: "Driver assigned"
-    stage-in_transit: "In transit"
-    stage-delivered: "Delivered"
-    stage-issue: "Needs attention"
-    stage-canceled: "Canceled"
-    stage-toast-preparing: "Your order is being prepared"
-    stage-toast-scheduled: "Your delivery is scheduled"
-    stage-toast-dispatched: "A driver has been assigned"
-    stage-toast-in_transit: "Your order is on its way"
-    stage-toast-delivered: "Your order has been delivered"
-    stage-toast-issue: "There's an update on your delivery"
-    stage-toast-canceled: "Your order was canceled"
-    verify-title-short: "Verify it's you"
-    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
-    send-by: "Send the code by"
-    channel-sms: "Text message"
-    channel-email: "Email"
-    send-failed: "We couldn't send a code just now. Please try again."
-    sending: "Sending code..."
-    send-code: "Send code"
-    masked-note: "We only ever show part of your number or email here."
-    no-contact-title: "We can't verify you here"
-    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
-    call: "Call {phone}"
-    renew-title: "Get a new code"
-    renew-expired: "That code has expired. Codes last 10 minutes."
-    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
-    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
-    renew-failed: "Something went wrong. Request a new code to try again."
-    send-new-code: "Send a new code"
-    verified-title: "You're verified"
-    locked-title: "Codes paused"
-    enter-code: "Enter your code"
-    code-sent-sms: "We texted a 6-digit code to {masked}."
-    code-sent-email: "We emailed a 6-digit code to {masked}."
-    code-label: "6-digit code"
-    code-expires: "The code expires in 10 minutes."
-    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
-    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
-    code-success: "Verified. Opening your delivery..."
-    resend-in: "Resend code in {time}"
-    resend: "Resend code"
-    switch-to-sms: "Send by text instead"
-    switch-to-email: "Send by email instead"
-    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
-    verified-toast: "You're verified"
-    verified-toast-help: "This device stays verified for this delivery."
-    signed-out-toast: "Signed out on this device"
-    instructions-saved: "Delivery instructions saved"
-    action-failed: "That didn't work. Please try again."
-    report-sent: "Message sent"
-    report-sent-help: "{name} will get back to you."
-    share-copied: "Link copied"
-    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
-    your-stop: "Stop {number}"
-    your-stops: "Your stops"
-    sign-out: "Not you? Sign out"
-    live: "Live"
-    reconnecting: "Reconnecting... live updates paused"
-    timezone: "Times in your time zone ({zone})"
-    progress: "Delivery progress"
-    step-created: "Created"
-    step-dispatched: "Dispatched"
-    step-started: "Picked up"
-    step-enroute: "En route"
-    step-delivered: "Delivered"
-    step-issue: "Attempt missed"
-    step-canceled: "Canceled"
-    headline-preparing: "Getting your order ready"
-    headline-scheduled: "Scheduled for {date}"
-    headline-dispatched: "A driver has been assigned"
-    headline-delayed: "Running a little late"
-    headline-arriving: "Arriving {day}"
-    headline-in-transit: "On its way"
-    headline-delivered: "Delivered"
-    headline-issue: "There's a problem with your delivery"
-    headline-canceled: "This order was canceled"
-    sub-arriving: "{window} · in about {minutes} min"
-    sub-window: "Delivery window {window}"
+    track-another: "تتبّع شحنة أخرى"
+    unavailable-title: "التتبع غير متاح هنا"
+    unavailable-help: "صفحة التتبع هذه غير مفعّلة. استخدم الرابط في رسالة التوصيل الإلكترونية، أو تواصل مع الشركة التي أرسلت طلبك."
+    lookup-title: "تتبّع شحنتك"
+    lookup-sub: "اعرف مكان طردك وموعد وصوله."
+    tracking-number: "رقم التتبع"
+    tracking-number-placeholder: "مثال: NOR4829301736US"
+    tracking-number-help: "تجده في رسالة التأكيد الإلكترونية أو على ملصق الطرد."
+    lookup-neutral: "لا يمكننا عرض التتبع لهذا الرقم. تأكد من مطابقته لما في رسالتك أو على ملصق الطرد ثم حاول مرة أخرى."
+    lookup-rate: "حاولت عدة مرات متتالية. خذ استراحة قصيرة وحاول مجددًا بعد بضع دقائق."
+    looking-up: "جارٍ البحث..."
+    track: "تتبّع"
+    or: "أو"
+    your-orders: "طلباتك"
+    sign-in: "سجّل الدخول لرؤية جميع طلباتك"
+    sign-in-account: "سجّل الدخول إلى حسابك"
+    back: "رجوع"
+    help: "تحتاج إلى مساعدة؟"
+    language: "اللغة"
+    powered-by: "مدعوم من Fleetbase"
+    dismiss: "إغلاق"
+    chip-limited: "عرض محدود · تحقّق لرؤية التفاصيل"
+    chip-verified: "تم التحقق على هذا الجهاز"
+    chip-account: "تم تسجيل الدخول"
+    chip-staff: "معاينة الموظفين: ما يراه هذا العميل"
+    status: "الحالة"
+    verify-to-see: "تحقّق لرؤية شحنتك"
+    last-update: "آخر تحديث: {date}"
+    copy: "نسخ"
+    verify-title: "اطّلع على جميع تفاصيل شحنتك"
+    verify-help: "حفاظًا على خصوصيتك، تظهر الخريطة وموعد الوصول وتفاصيل التوصيل بعد تحقق سريع. سنرسل رمزًا من 6 أرقام إلى الهاتف أو البريد الإلكتروني المسجل في هذا الطلب."
+    verify-button: "تحقّق من هويتك"
+    verify-unlock: "تحقّق لعرض التفاصيل"
+    locked-map: "الخريطة المباشرة"
+    locked-arrival: "موعد الوصول والسائق"
+    locked-details: "التحديثات والمحتويات وإثبات التسليم"
+    stage-preparing: "قيد التجهيز"
+    stage-scheduled: "مجدول"
+    stage-dispatched: "تم تعيين سائق"
+    stage-in_transit: "في الطريق"
+    stage-delivered: "تم التسليم"
+    stage-issue: "يحتاج إلى متابعة"
+    stage-canceled: "ملغى"
+    stage-toast-preparing: "يجري تجهيز طلبك"
+    stage-toast-scheduled: "تمت جدولة توصيل طلبك"
+    stage-toast-dispatched: "تم تعيين سائق"
+    stage-toast-in_transit: "طلبك في الطريق إليك"
+    stage-toast-delivered: "تم تسليم طلبك"
+    stage-toast-issue: "هناك تحديث بشأن توصيل طلبك"
+    stage-toast-canceled: "تم إلغاء طلبك"
+    verify-title-short: "تحقّق من هويتك"
+    verify-choose-help: "لحماية تفاصيل شحنتك، سنرسل رمزًا من 6 أرقام إلى بيانات الاتصال المسجلة في هذا الطلب."
+    send-by: "إرسال الرمز عبر"
+    channel-sms: "رسالة نصية"
+    channel-email: "البريد الإلكتروني"
+    send-failed: "تعذّر إرسال الرمز الآن. يُرجى المحاولة مرة أخرى."
+    sending: "جارٍ إرسال الرمز..."
+    send-code: "إرسال الرمز"
+    masked-note: "لا نعرض هنا إلا جزءًا من رقمك أو بريدك الإلكتروني."
+    no-contact-title: "لا يمكننا التحقق منك هنا"
+    no-contact-help: "لا يحتوي هذا الطلب على رقم هاتف أو بريد إلكتروني يمكننا إرسال رمز إليه. يمكن لـ {name} مساعدتك في التوصيل."
+    call: "اتصل بـ {phone}"
+    renew-title: "احصل على رمز جديد"
+    renew-expired: "انتهت صلاحية هذا الرمز. الرموز صالحة لمدة 10 دقائق."
+    renew-unlocked: "يمكنك المحاولة مجددًا الآن. سنرسل رمزًا جديدًا، ولن يعمل الرمز القديم بعد الآن."
+    renew-limited: "لقد طلبت عدة رموز. يُرجى الانتظار بضع دقائق قبل طلب رمز آخر."
+    renew-failed: "حدث خطأ ما. اطلب رمزًا جديدًا للمحاولة مرة أخرى."
+    send-new-code: "إرسال رمز جديد"
+    verified-title: "تم التحقق من هويتك"
+    locked-title: "تم إيقاف الرموز مؤقتًا"
+    enter-code: "أدخل الرمز"
+    code-sent-sms: "أرسلنا رمزًا من 6 أرقام في رسالة نصية إلى {masked}."
+    code-sent-email: "أرسلنا رمزًا من 6 أرقام إلى {masked}."
+    code-label: "رمز من 6 أرقام"
+    code-expires: "تنتهي صلاحية الرمز خلال 10 دقائق."
+    code-wrong: "الرمز غير مطابق. {count, plural, zero {لم تتبقَّ أي محاولات.} one {تبقّت محاولة واحدة.} two {تبقّت محاولتان.} few {تبقّت # محاولات.} many {تبقّت # محاولة.} other {تبقّت # محاولة.}}"
+    code-locked: "محاولات كثيرة جدًا. حفاظًا على أمانك، تم إيقاف الرموز مؤقتًا. حاول مجددًا بعد {time}."
+    code-success: "تم التحقق. جارٍ فتح شحنتك..."
+    resend-in: "إعادة إرسال الرمز بعد {time}"
+    resend: "إعادة إرسال الرمز"
+    switch-to-sms: "الإرسال برسالة نصية بدلًا من ذلك"
+    switch-to-email: "الإرسال بالبريد الإلكتروني بدلًا من ذلك"
+    stay-verified: "بعد التحقق، يبقى هذا الجهاز متحققًا منه لمدة {hours} ساعة. يمكنك تسجيل الخروج في أي وقت."
+    verified-toast: "تم التحقق من هويتك"
+    verified-toast-help: "يبقى هذا الجهاز متحققًا منه لهذه الشحنة."
+    signed-out-toast: "تم تسجيل الخروج على هذا الجهاز"
+    instructions-saved: "تم حفظ تعليمات التوصيل"
+    action-failed: "لم تنجح العملية. يُرجى المحاولة مرة أخرى."
+    report-sent: "تم إرسال الرسالة"
+    report-sent-help: "سيتواصل معك {name}."
+    share-copied: "تم نسخ الرابط"
+    share-copied-help: "سيرى أي شخص تشاركه معه عرضًا محدودًا حتى يتحقق من هويته."
+    your-stop: "المحطة {number}"
+    your-stops: "محطاتك"
+    sign-out: "لست أنت؟ سجّل الخروج"
+    live: "مباشر"
+    reconnecting: "جارٍ إعادة الاتصال... التحديثات المباشرة متوقفة مؤقتًا"
+    timezone: "الأوقات حسب منطقتك الزمنية ({zone})"
+    progress: "تقدّم التوصيل"
+    step-created: "تم الإنشاء"
+    step-dispatched: "تم الإرسال"
+    step-started: "تم الاستلام"
+    step-enroute: "في الطريق"
+    step-delivered: "تم التسليم"
+    step-issue: "تعذّر التسليم"
+    step-canceled: "ملغى"
+    headline-preparing: "نجهّز طلبك الآن"
+    headline-scheduled: "مجدول في {date}"
+    headline-dispatched: "تم تعيين سائق"
+    headline-delayed: "متأخر قليلًا"
+    headline-arriving: "يصل {day}"
+    headline-in-transit: "في الطريق إليك"
+    headline-delivered: "تم التسليم"
+    headline-issue: "هناك مشكلة في توصيل طلبك"
+    headline-canceled: "تم إلغاء هذا الطلب"
+    sub-arriving: "{window} · خلال {minutes} دقيقة تقريبًا"
+    sub-window: "موعد التوصيل {window}"
     sub-delivered: "{when}"
-    sub-dispatched: "Live tracking starts as soon as they're on the way."
-    sub-preparing: "We'll let you know when it's on its way."
-    delayed-title: "Running late."
-    delayed-help: "We'll keep your arrival time up to date."
-    stop-of: "Your delivery is stop {position} of {total}"
-    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
-    map: "Map"
-    map-label: "Map of your delivery: the van on its way to your address."
-    map-pickup: "Pickup area"
-    map-driver: "Driver"
-    map-pickup-named: "Pickup · {name}"
-    map-fullscreen: "Full screen map"
-    map-exit-fullscreen: "Exit full screen"
-    stop-card-title: "Delivering to"
-    stop-upcoming: "Upcoming"
-    stop-complete: "Delivered"
-    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
-    last-seen: "Last seen {minutes} min ago"
-    recenter: "Center the map on the van"
-    fit-route: "Show the whole route"
-    eta: "Estimated arrival"
-    in-minutes: "in about {minutes} min"
-    window: "Delivery window"
-    before-yours: "Before yours"
-    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
-    estimate-may-change: "Estimate may change"
-    driver: "Your driver"
-    online: "Online"
-    location-paused: "Location paused"
-    call-short: "Call"
-    message: "Message"
-    contact-note: "Calls and messages go to the {name} support team."
-    proof: "Proof of delivery"
-    open-photo: "Open the delivery photo"
-    open-signature: "Open the signature"
-    open-scan: "Open the scan"
-    proof-photo: "Delivery photo"
-    proof-signature: "Signature"
-    proof-scan: "Scanned at the door"
-    instructions: "Delivery instructions"
-    edit: "Edit"
-    instructions-help: "Gate codes, where to leave it, or who can sign"
-    cancel: "Cancel"
-    save: "Save"
-    no-instructions: "No instructions yet."
-    updates: "Updates"
-    no-updates: "No updates yet."
-    show-fewer: "Show fewer updates"
-    show-earlier: "Show earlier updates ({count})"
-    today: "Today"
-    yesterday: "Yesterday"
-    items: "In this delivery"
-    item: "Item"
-    quantity: "Qty {count}"
-    share: "Share tracking"
-    report: "Report a problem"
-    contact: "Contact {name}"
-    report-label: "What's wrong with your delivery?"
-    send: "Send"
-    close: "Close"
-    no-orders: "No orders yet"
-    no-orders-help: "Deliveries for your account will show up here."
+    sub-dispatched: "يبدأ التتبع المباشر بمجرد انطلاق السائق."
+    sub-preparing: "سنُعلمك عندما يكون طلبك في الطريق."
+    delayed-title: "هناك تأخير."
+    delayed-help: "سنبقي موعد وصولك محدّثًا."
+    stop-of: "شحنتك هي المحطة {position} من {total}"
+    stops-private: "{count, plural, =0 {أنت التالي.} zero {أنت التالي.} one {تبقّت محطة واحدة قبل محطتك.} two {تبقّت محطتان قبل محطتك.} few {تبقّت # محطات قبل محطتك.} many {تبقّت # محطة قبل محطتك.} other {تبقّت # محطة قبل محطتك.}} المحطات الأخرى خاصة، لذا لا ترى إلا محطتك."
+    map: "الخريطة"
+    map-label: "خريطة شحنتك: الشاحنة في طريقها إلى عنوانك."
+    map-pickup: "منطقة الاستلام"
+    map-driver: "السائق"
+    map-pickup-named: "الاستلام · {name}"
+    map-fullscreen: "الخريطة بملء الشاشة"
+    map-exit-fullscreen: "الخروج من ملء الشاشة"
+    stop-card-title: "التوصيل إلى"
+    stop-upcoming: "قادمة"
+    stop-complete: "تم التسليم"
+    map-hidden: "أُخفيت الخريطة بعد تسليم طلبك. نتوقف عن مشاركة موقع السائق عند وصوله إلى بابك."
+    last-seen: "آخر ظهور قبل {minutes} دقيقة"
+    recenter: "توسيط الخريطة على الشاحنة"
+    fit-route: "عرض المسار كاملًا"
+    eta: "موعد الوصول المتوقع"
+    in-minutes: "خلال {minutes} دقيقة تقريبًا"
+    window: "موعد التوصيل"
+    before-yours: "قبل محطتك"
+    stops-count: "{count, plural, =0 {لا يوجد} zero {لا يوجد} one {محطة واحدة} two {محطتان} few {# محطات} many {# محطة} other {# محطة}}"
+    estimate-may-change: "قد يتغير الموعد المتوقع"
+    driver: "سائقك"
+    online: "متصل"
+    location-paused: "الموقع متوقف مؤقتًا"
+    call-short: "اتصال"
+    message: "رسالة"
+    contact-note: "تصل المكالمات والرسائل إلى فريق دعم {name}."
+    proof: "إثبات التسليم"
+    open-photo: "فتح صورة التسليم"
+    open-signature: "فتح التوقيع"
+    open-scan: "فتح المسح"
+    proof-photo: "صورة التسليم"
+    proof-signature: "التوقيع"
+    proof-scan: "تم المسح عند الباب"
+    instructions: "تعليمات التوصيل"
+    edit: "تعديل"
+    instructions-help: "رمز البوابة، أو مكان ترك الطرد، أو من يمكنه التوقيع"
+    cancel: "إلغاء"
+    save: "حفظ"
+    no-instructions: "لا توجد تعليمات بعد."
+    updates: "التحديثات"
+    no-updates: "لا توجد تحديثات بعد."
+    show-fewer: "عرض تحديثات أقل"
+    show-earlier: "عرض التحديثات السابقة ({count})"
+    today: "اليوم"
+    yesterday: "أمس"
+    items: "محتويات هذه الشحنة"
+    item: "منتج"
+    quantity: "الكمية {count}"
+    share: "مشاركة التتبع"
+    report: "الإبلاغ عن مشكلة"
+    contact: "التواصل مع {name}"
+    report-label: "ما المشكلة في شحنتك؟"
+    send: "إرسال"
+    close: "إغلاق"
+    no-orders: "لا توجد طلبات بعد"
+    no-orders-help: "ستظهر هنا الشحنات الخاصة بحسابك."
diff --git a/translations/bg-bg.yaml b/translations/bg-bg.yaml
index a0db2649d..0b1d17e3a 100644
--- a/translations/bg-bg.yaml
+++ b/translations/bg-bg.yaml
@@ -2349,275 +2349,275 @@ trailer:
     other: Друго
 tracking-page:
   settings:
-    title: "Tracking Page"
-    menu: "Tracking Page"
-    saved: "Tracking page settings saved."
-    load-failed: "We couldn't load the tracking page settings."
-    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
-    pages: "Pages"
-    org-page-enabled: "Your own tracking page"
-    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
-    slug: "Page address"
-    slug-checking: "Checking the address..."
-    open-page: "Open the page"
-    generic-page-allowed: "Allow tracking on the shared page"
-    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
-    links-target: "Links in emails and labels"
-    links-target-help: "Which page your notifications and labels send customers to."
-    links-target-auto: "Your page when it is on, otherwise the shared page"
-    links-target-org: "Always your page"
-    links-target-generic: "Always the shared page"
-    branding: "Branding"
-    display-name: "Display name"
-    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
-    accent: "Accent colour"
-    accent-hex: "Accent colour as a hex value"
-    placeholder-slug: "your-company"
+    title: "Страница за проследяване"
+    menu: "Страница за проследяване"
+    saved: "Настройките на страницата за проследяване са запазени."
+    load-failed: "Не успяхме да заредим настройките на страницата за проследяване."
+    load-failed-help: "Презаредете страницата, за да опитате отново. Ако проблемът продължава, проверете дали имате права да преглеждате тези настройки."
+    pages: "Страници"
+    org-page-enabled: "Собствена страница за проследяване"
+    org-page-enabled-help: "Страница за проследяване с вашата марка на собствен адрес. Тя намира само номерата за проследяване на вашата организация."
+    slug: "Адрес на страницата"
+    slug-checking: "Проверка на адреса..."
+    open-page: "Отваряне на страницата"
+    generic-page-allowed: "Разрешаване на проследяване в общата страница"
+    generic-page-allowed-help: "Позволява на клиентите да проверяват вашите номера за проследяване на {url}. Изключете, за да остане проследяването само във вашата страница."
+    links-target: "Връзки в имейли и етикети"
+    links-target-help: "Към коя страница насочват клиентите вашите известия и етикети."
+    links-target-auto: "Вашата страница, когато е включена, иначе общата"
+    links-target-org: "Винаги вашата страница"
+    links-target-generic: "Винаги общата страница"
+    branding: "Брандиране"
+    display-name: "Показвано име"
+    logo-help: "Страницата използва логото на вашата организация. Ако няма лого, показва монограм от показваното име."
+    accent: "Акцентен цвят"
+    accent-hex: "Акцентен цвят като шестнадесетична стойност"
+    placeholder-slug: "vashata-firma"
     placeholder-phone: "+1 555 010 0100"
     placeholder-email: "support@example.com"
     placeholder-website: "https://example.com"
-    placeholder-select: "Select an option"
-    contrast-ok: "Text on this colour is readable ({ratio}:1)."
-    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
-    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
-    accent-dark: "Accent colour in dark mode"
-    accent-dark-auto: "Automatic"
-    support-phone: "Support phone"
-    support-email: "Support email"
-    website: "Website"
-    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
-    powered-by: "Show \"Powered by Fleetbase\""
-    powered-by-help: "A small line in the page footer."
-    theme: "Light and dark"
-    theme-system: "Follow the customer's device"
-    theme-light: "Always light"
-    default-language: "Default language"
-    languages: "Languages customers can choose"
-    access: "Access"
-    public-status: "Show the status without verification"
-    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
-    channel-sms: "Verify by text message"
-    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
-    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
-    channel-email: "Verify by email"
-    channel-email-help: "Sends a 6-digit code to the email address on the order."
-    session-hours: "Stay verified for (hours)"
-    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
-    account-sign-in: "Let customers sign in"
-    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
-    account-upsell: "Suggest creating an account"
-    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
-    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
-    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
-    visibility: "What verified customers see"
-    visibility-map: "Live map"
-    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
-    visibility-driver_name: "Driver's first name"
-    visibility-driver_name-help: "Only the first name, never a surname or phone number."
-    visibility-vehicle: "Vehicle description"
-    visibility-vehicle-help: "For example \"White Ford Transit\"."
-    visibility-items: "Items in the delivery"
-    visibility-items-help: "Names, descriptions, quantities and photos."
-    visibility-item_prices: "Item prices"
-    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
-    visibility-pod_photo: "Delivery photo"
-    visibility-pod_photo-help: "The photo taken as proof of delivery."
-    visibility-pod_signature: "Signature"
-    visibility-pod_signature-help: "The signature captured as proof of delivery."
-    visibility-instructions_edit: "Let customers add delivery instructions"
-    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
-    visibility-report_problem: "Report a problem"
-    visibility-report_problem-help: "Lets customers send you a message about their delivery."
-    driver-contact: "Calls and messages go to"
-    driver-contact-help: "Who customers reach from the driver card."
-    driver-contact-company: "Your support team"
-    driver-contact-driver: "The driver directly"
-    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
-    preview: "Preview"
-    preview-help: "A sample in light and dark mode. Save to apply the changes."
-    preview-chip: "Verified on this device"
-    preview-headline: "Arriving today"
-    preview-sub: "2:10 to 2:40 pm"
-    preview-button: "Verify it's you"
-    preview-powered-by: "Powered by Fleetbase"
+    placeholder-select: "Изберете опция"
+    contrast-ok: "Текстът върху този цвят се чете добре ({ratio}:1)."
+    contrast-low: "Текстът върху този цвят се чете трудно ({ratio}:1). Изберете по-тъмен или по-светъл цвят."
+    accent-help: "Използва се за бутони, лента за напредък и акценти. Цветът на текста върху него се избира автоматично."
+    accent-dark: "Акцентен цвят в тъмен режим"
+    accent-dark-auto: "Автоматично"
+    support-phone: "Телефон за поддръжка"
+    support-email: "Имейл за поддръжка"
+    website: "Уебсайт"
+    support-help: "Оставете полетата празни, за да се използват данните на вашата организация. Тук отиват обажданията и съобщенията на клиентите."
+    powered-by: "Показване на „С технологията на Fleetbase“"
+    powered-by-help: "Малък ред в долната част на страницата."
+    theme: "Светъл и тъмен режим"
+    theme-system: "Според устройството на клиента"
+    theme-light: "Винаги светъл"
+    default-language: "Език по подразбиране"
+    languages: "Езици, от които клиентите могат да избират"
+    access: "Достъп"
+    public-status: "Показване на статуса без потвърждаване"
+    public-status-help: "Само с номер за проследяване клиентите виждат етапа на доставката и датата на последната актуализация. Изключете, за да не се показва нищо, докато не потвърдят самоличността си."
+    channel-sms: "Потвърждаване чрез SMS"
+    channel-sms-help: "Изпраща 6-цифрен код на телефонния номер от поръчката."
+    channel-sms-unavailable: "За тази инстанция няма настроен SMS доставчик, затова кодовете не могат да се изпращат с SMS."
+    channel-email: "Потвърждаване по имейл"
+    channel-email-help: "Изпраща 6-цифрен код на имейл адреса от поръчката."
+    session-hours: "Валидност на потвърждението (часове)"
+    session-hours-help: "Колко време едно устройство остава потвърдено след въвеждане на правилен код. Между 1 и 168 часа."
+    account-sign-in: "Разрешаване на вход за клиенти"
+    account-sign-in-help: "Клиентите с профил в клиентския портал могат да влязат и да виждат всичките си поръчки без код."
+    account-upsell: "Предлагане на създаване на профил"
+    account-upsell-help: "След доставката потвърдените клиенти без профил получават покана да си създадат такъв."
+    customer-portal-missing: "Инсталирайте разширението Customer Portal, за да могат клиентите да влизат и да виждат всичките си поръчки."
+    code-rules: "Кодовете са 6-цифрени и изтичат след 10 минути. След 3 грешни кода изпращането спира за 5 минути."
+    visibility: "Какво виждат потвърдените клиенти"
+    visibility-map: "Карта на живо"
+    visibility-map-help: "Маршрутът и местоположението на превозното средство, докато пътува към клиента."
+    visibility-driver_name: "Малко име на шофьора"
+    visibility-driver_name-help: "Само малкото име, никога фамилия или телефонен номер."
+    visibility-vehicle: "Описание на превозното средство"
+    visibility-vehicle-help: "Например „Бял Ford Transit“."
+    visibility-items: "Артикули в доставката"
+    visibility-items-help: "Имена, описания, количества и снимки."
+    visibility-item_prices: "Цени на артикулите"
+    visibility-item_prices-help: "Показват се само на влезли клиенти, които са направили поръчката."
+    visibility-pod_photo: "Снимка от доставката"
+    visibility-pod_photo-help: "Снимката, направена като доказателство за доставка."
+    visibility-pod_signature: "Подпис"
+    visibility-pod_signature-help: "Подписът, взет като доказателство за доставка."
+    visibility-instructions_edit: "Клиентите могат да добавят указания за доставка"
+    visibility-instructions_edit-help: "Например код за входа или къде да се остави пратката."
+    visibility-report_problem: "Сигнал за проблем"
+    visibility-report_problem-help: "Позволява на клиентите да ви изпратят съобщение за доставката си."
+    driver-contact: "Обажданията и съобщенията отиват към"
+    driver-contact-help: "С кого се свързват клиентите от картата на шофьора."
+    driver-contact-company: "Вашия екип по поддръжка"
+    driver-contact-driver: "Директно към шофьора"
+    privacy-rules: "Винаги в сила: клиентите виждат само своите спирки и артикули, картата и шофьорът се скриват след доставката, а местоположението на шофьора се показва само докато е на път."
+    preview: "Преглед"
+    preview-help: "Пример в светъл и тъмен режим. Запазете, за да приложите промените."
+    preview-chip: "Потвърдено на това устройство"
+    preview-headline: "Пристига днес"
+    preview-sub: "14:10 – 14:40 ч."
+    preview-button: "Потвърдете, че сте вие"
+    preview-powered-by: "С технологията на Fleetbase"
   page:
-    track-another: "Track another"
-    unavailable-title: "Tracking isn't available here"
-    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
-    lookup-title: "Track your delivery"
-    lookup-sub: "See where your parcel is and when it will arrive."
-    tracking-number: "Tracking number"
-    tracking-number-placeholder: "e.g. NOR4829301736US"
-    tracking-number-help: "Find it in your confirmation email or on the parcel label."
-    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
-    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
-    looking-up: "Looking it up..."
-    track: "Track"
-    or: "or"
-    your-orders: "Your orders"
-    sign-in: "Sign in to see all your orders"
-    sign-in-account: "Sign in to your account"
-    back: "Back"
-    help: "Need help?"
-    language: "Language"
-    powered-by: "Powered by Fleetbase"
-    dismiss: "Dismiss"
-    chip-limited: "Limited view · Verify to see details"
-    chip-verified: "Verified on this device"
-    chip-account: "Signed in"
-    chip-staff: "Staff preview: what this customer sees"
-    status: "Status"
-    verify-to-see: "Verify to see your delivery"
-    last-update: "Last update: {date}"
-    copy: "Copy"
-    verify-title: "See your full delivery details"
-    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
-    verify-button: "Verify it's you"
-    verify-unlock: "Verify to unlock"
-    locked-map: "Live map"
-    locked-arrival: "Arrival time and driver"
-    locked-details: "Updates, items and proof of delivery"
-    stage-preparing: "Being prepared"
-    stage-scheduled: "Scheduled"
-    stage-dispatched: "Driver assigned"
-    stage-in_transit: "In transit"
-    stage-delivered: "Delivered"
-    stage-issue: "Needs attention"
-    stage-canceled: "Canceled"
-    stage-toast-preparing: "Your order is being prepared"
-    stage-toast-scheduled: "Your delivery is scheduled"
-    stage-toast-dispatched: "A driver has been assigned"
-    stage-toast-in_transit: "Your order is on its way"
-    stage-toast-delivered: "Your order has been delivered"
-    stage-toast-issue: "There's an update on your delivery"
-    stage-toast-canceled: "Your order was canceled"
-    verify-title-short: "Verify it's you"
-    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
-    send-by: "Send the code by"
-    channel-sms: "Text message"
-    channel-email: "Email"
-    send-failed: "We couldn't send a code just now. Please try again."
-    sending: "Sending code..."
-    send-code: "Send code"
-    masked-note: "We only ever show part of your number or email here."
-    no-contact-title: "We can't verify you here"
-    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
-    call: "Call {phone}"
-    renew-title: "Get a new code"
-    renew-expired: "That code has expired. Codes last 10 minutes."
-    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
-    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
-    renew-failed: "Something went wrong. Request a new code to try again."
-    send-new-code: "Send a new code"
-    verified-title: "You're verified"
-    locked-title: "Codes paused"
-    enter-code: "Enter your code"
-    code-sent-sms: "We texted a 6-digit code to {masked}."
-    code-sent-email: "We emailed a 6-digit code to {masked}."
-    code-label: "6-digit code"
-    code-expires: "The code expires in 10 minutes."
-    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
-    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
-    code-success: "Verified. Opening your delivery..."
-    resend-in: "Resend code in {time}"
-    resend: "Resend code"
-    switch-to-sms: "Send by text instead"
-    switch-to-email: "Send by email instead"
-    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
-    verified-toast: "You're verified"
-    verified-toast-help: "This device stays verified for this delivery."
-    signed-out-toast: "Signed out on this device"
-    instructions-saved: "Delivery instructions saved"
-    action-failed: "That didn't work. Please try again."
-    report-sent: "Message sent"
-    report-sent-help: "{name} will get back to you."
-    share-copied: "Link copied"
-    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
-    your-stop: "Stop {number}"
-    your-stops: "Your stops"
-    sign-out: "Not you? Sign out"
-    live: "Live"
-    reconnecting: "Reconnecting... live updates paused"
-    timezone: "Times in your time zone ({zone})"
-    progress: "Delivery progress"
-    step-created: "Created"
-    step-dispatched: "Dispatched"
-    step-started: "Picked up"
-    step-enroute: "En route"
-    step-delivered: "Delivered"
-    step-issue: "Attempt missed"
-    step-canceled: "Canceled"
-    headline-preparing: "Getting your order ready"
-    headline-scheduled: "Scheduled for {date}"
-    headline-dispatched: "A driver has been assigned"
-    headline-delayed: "Running a little late"
-    headline-arriving: "Arriving {day}"
-    headline-in-transit: "On its way"
-    headline-delivered: "Delivered"
-    headline-issue: "There's a problem with your delivery"
-    headline-canceled: "This order was canceled"
-    sub-arriving: "{window} · in about {minutes} min"
-    sub-window: "Delivery window {window}"
+    track-another: "Проследяване на друга пратка"
+    unavailable-title: "Проследяването не е налично тук"
+    unavailable-help: "Тази страница за проследяване не е включена. Използвайте връзката от имейла за доставката или се свържете с фирмата, изпратила поръчката ви."
+    lookup-title: "Проследете доставката си"
+    lookup-sub: "Вижте къде е пратката ви и кога ще пристигне."
+    tracking-number: "Номер за проследяване"
+    tracking-number-placeholder: "напр. NOR4829301736US"
+    tracking-number-help: "Ще го намерите в имейла за потвърждение или на етикета на пратката."
+    lookup-neutral: "Не можем да покажем проследяване за този номер. Проверете дали съвпада с имейла или етикета на пратката и опитайте отново."
+    lookup-rate: "Направихте няколко опита подред. Починете си малко и опитайте отново след няколко минути."
+    looking-up: "Търсене..."
+    track: "Проследи"
+    or: "или"
+    your-orders: "Вашите поръчки"
+    sign-in: "Влезте, за да видите всичките си поръчки"
+    sign-in-account: "Влезте в профила си"
+    back: "Назад"
+    help: "Нуждаете се от помощ?"
+    language: "Език"
+    powered-by: "С технологията на Fleetbase"
+    dismiss: "Затвори"
+    chip-limited: "Ограничен изглед · Потвърдете, за да видите подробности"
+    chip-verified: "Потвърдено на това устройство"
+    chip-account: "Влезли сте"
+    chip-staff: "Преглед за служители: какво вижда този клиент"
+    status: "Статус"
+    verify-to-see: "Потвърдете, за да видите доставката си"
+    last-update: "Последна актуализация: {date}"
+    copy: "Копирай"
+    verify-title: "Вижте всички подробности за доставката"
+    verify-help: "За вашата поверителност картата, часът на пристигане и подробностите за доставката се отключват след бърза проверка. Ще изпратим 6-цифрен код на телефона или имейла от тази поръчка."
+    verify-button: "Потвърдете, че сте вие"
+    verify-unlock: "Потвърдете, за да отключите"
+    locked-map: "Карта на живо"
+    locked-arrival: "Час на пристигане и шофьор"
+    locked-details: "Актуализации, артикули и доказателство за доставка"
+    stage-preparing: "Подготвя се"
+    stage-scheduled: "Насрочена"
+    stage-dispatched: "Назначен шофьор"
+    stage-in_transit: "На път"
+    stage-delivered: "Доставена"
+    stage-issue: "Нужно е внимание"
+    stage-canceled: "Отменена"
+    stage-toast-preparing: "Поръчката ви се подготвя"
+    stage-toast-scheduled: "Доставката ви е насрочена"
+    stage-toast-dispatched: "Назначен е шофьор"
+    stage-toast-in_transit: "Поръчката ви е на път"
+    stage-toast-delivered: "Поръчката ви е доставена"
+    stage-toast-issue: "Има новина за доставката ви"
+    stage-toast-canceled: "Поръчката ви беше отменена"
+    verify-title-short: "Потвърдете, че сте вие"
+    verify-choose-help: "За да защитим данните за доставката ви, ще изпратим 6-цифрен код до данните за контакт от тази поръчка."
+    send-by: "Изпращане на кода чрез"
+    channel-sms: "SMS"
+    channel-email: "Имейл"
+    send-failed: "Не успяхме да изпратим код в момента. Моля, опитайте отново."
+    sending: "Изпращане на кода..."
+    send-code: "Изпрати код"
+    masked-note: "Тук винаги показваме само част от номера или имейла ви."
+    no-contact-title: "Не можем да ви потвърдим тук"
+    no-contact-help: "Тази поръчка няма телефонен номер или имейл, на който да изпратим код. {name} може да ви помогне с доставката."
+    call: "Обаждане на {phone}"
+    renew-title: "Получете нов код"
+    renew-expired: "Този код е изтекъл. Кодовете са валидни 10 минути."
+    renew-unlocked: "Вече можете да опитате отново. Ще изпратим нов код; старият вече не работи."
+    renew-limited: "Поискахте няколко кода. Моля, изчакайте няколко минути, преди да поискате нов."
+    renew-failed: "Нещо се обърка. Поискайте нов код, за да опитате отново."
+    send-new-code: "Изпрати нов код"
+    verified-title: "Потвърдени сте"
+    locked-title: "Кодовете са спрени"
+    enter-code: "Въведете кода си"
+    code-sent-sms: "Изпратихме 6-цифрен код с SMS на {masked}."
+    code-sent-email: "Изпратихме 6-цифрен код по имейл на {masked}."
+    code-label: "6-цифрен код"
+    code-expires: "Кодът изтича след 10 минути."
+    code-wrong: "Кодът не съвпада. {count, plural, one {Остава # опит.} other {Остават # опита.}}"
+    code-locked: "Твърде много опити. За ваша сигурност кодовете са спрени. Опитайте отново след {time}."
+    code-success: "Потвърдено. Отваряме доставката ви..."
+    resend-in: "Повторно изпращане след {time}"
+    resend: "Изпрати кода отново"
+    switch-to-sms: "Изпрати със SMS"
+    switch-to-email: "Изпрати по имейл"
+    stay-verified: "След потвърждаване това устройство остава потвърдено за {hours} часа. Можете да излезете по всяко време."
+    verified-toast: "Потвърдени сте"
+    verified-toast-help: "Това устройство остава потвърдено за тази доставка."
+    signed-out-toast: "Излязохте на това устройство"
+    instructions-saved: "Указанията за доставка са запазени"
+    action-failed: "Не се получи. Моля, опитайте отново."
+    report-sent: "Съобщението е изпратено"
+    report-sent-help: "{name} ще се свърже с вас."
+    share-copied: "Връзката е копирана"
+    share-copied-help: "Всеки, с когото я споделите, вижда ограничен изглед, докато не потвърди самоличността си."
+    your-stop: "Спирка {number}"
+    your-stops: "Вашите спирки"
+    sign-out: "Не сте вие? Излезте"
+    live: "На живо"
+    reconnecting: "Повторно свързване... актуализациите на живо са спрени"
+    timezone: "Часовете са във вашата часова зона ({zone})"
+    progress: "Напредък на доставката"
+    step-created: "Създадена"
+    step-dispatched: "Изпратена"
+    step-started: "Взета"
+    step-enroute: "На път"
+    step-delivered: "Доставена"
+    step-issue: "Неуспешен опит"
+    step-canceled: "Отменена"
+    headline-preparing: "Подготвяме поръчката ви"
+    headline-scheduled: "Насрочена за {date}"
+    headline-dispatched: "Назначен е шофьор"
+    headline-delayed: "Леко закъснява"
+    headline-arriving: "Пристига {day}"
+    headline-in-transit: "На път"
+    headline-delivered: "Доставена"
+    headline-issue: "Има проблем с доставката ви"
+    headline-canceled: "Тази поръчка беше отменена"
+    sub-arriving: "{window} · след около {minutes} мин"
+    sub-window: "Интервал за доставка: {window}"
     sub-delivered: "{when}"
-    sub-dispatched: "Live tracking starts as soon as they're on the way."
-    sub-preparing: "We'll let you know when it's on its way."
-    delayed-title: "Running late."
-    delayed-help: "We'll keep your arrival time up to date."
-    stop-of: "Your delivery is stop {position} of {total}"
-    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
-    map: "Map"
-    map-label: "Map of your delivery: the van on its way to your address."
-    map-pickup: "Pickup area"
-    map-driver: "Driver"
-    map-pickup-named: "Pickup · {name}"
-    map-fullscreen: "Full screen map"
-    map-exit-fullscreen: "Exit full screen"
-    stop-card-title: "Delivering to"
-    stop-upcoming: "Upcoming"
-    stop-complete: "Delivered"
-    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
-    last-seen: "Last seen {minutes} min ago"
-    recenter: "Center the map on the van"
-    fit-route: "Show the whole route"
-    eta: "Estimated arrival"
-    in-minutes: "in about {minutes} min"
-    window: "Delivery window"
-    before-yours: "Before yours"
-    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
-    estimate-may-change: "Estimate may change"
-    driver: "Your driver"
-    online: "Online"
-    location-paused: "Location paused"
-    call-short: "Call"
-    message: "Message"
-    contact-note: "Calls and messages go to the {name} support team."
-    proof: "Proof of delivery"
-    open-photo: "Open the delivery photo"
-    open-signature: "Open the signature"
-    open-scan: "Open the scan"
-    proof-photo: "Delivery photo"
-    proof-signature: "Signature"
-    proof-scan: "Scanned at the door"
-    instructions: "Delivery instructions"
-    edit: "Edit"
-    instructions-help: "Gate codes, where to leave it, or who can sign"
-    cancel: "Cancel"
-    save: "Save"
-    no-instructions: "No instructions yet."
-    updates: "Updates"
-    no-updates: "No updates yet."
-    show-fewer: "Show fewer updates"
-    show-earlier: "Show earlier updates ({count})"
-    today: "Today"
-    yesterday: "Yesterday"
-    items: "In this delivery"
-    item: "Item"
-    quantity: "Qty {count}"
-    share: "Share tracking"
-    report: "Report a problem"
-    contact: "Contact {name}"
-    report-label: "What's wrong with your delivery?"
-    send: "Send"
-    close: "Close"
-    no-orders: "No orders yet"
-    no-orders-help: "Deliveries for your account will show up here."
+    sub-dispatched: "Проследяването на живо започва веднага щом шофьорът потегли."
+    sub-preparing: "Ще ви уведомим, когато пратката потегли."
+    delayed-title: "Има закъснение."
+    delayed-help: "Ще поддържаме часа на пристигане актуален."
+    stop-of: "Вашата доставка е спирка {position} от {total}"
+    stops-private: "{count, plural, =0 {Вие сте следващи.} one {Остава # спирка преди вашата.} other {Остават # спирки преди вашата.}} Другите спирки са поверителни, затова виждате само своята."
+    map: "Карта"
+    map-label: "Карта на доставката ви: бусът е на път към вашия адрес."
+    map-pickup: "Място на взимане"
+    map-driver: "Шофьор"
+    map-pickup-named: "Взимане · {name}"
+    map-fullscreen: "Карта на цял екран"
+    map-exit-fullscreen: "Изход от цял екран"
+    stop-card-title: "Доставка до"
+    stop-upcoming: "Предстояща"
+    stop-complete: "Доставена"
+    map-hidden: "Картата е скрита, тъй като поръчката ви е доставена. Спираме да споделяме местоположението на шофьора пред вратата ви."
+    last-seen: "Последно видян преди {minutes} мин"
+    recenter: "Центрирай картата върху буса"
+    fit-route: "Покажи целия маршрут"
+    eta: "Очаквано пристигане"
+    in-minutes: "след около {minutes} мин"
+    window: "Интервал за доставка"
+    before-yours: "Преди вашата"
+    stops-count: "{count, plural, =0 {Няма} one {# спирка} other {# спирки}}"
+    estimate-may-change: "Прогнозата може да се промени"
+    driver: "Вашият шофьор"
+    online: "Онлайн"
+    location-paused: "Местоположението е спряно"
+    call-short: "Обади се"
+    message: "Съобщение"
+    contact-note: "Обажданията и съобщенията отиват към екипа по поддръжка на {name}."
+    proof: "Доказателство за доставка"
+    open-photo: "Отвори снимката от доставката"
+    open-signature: "Отвори подписа"
+    open-scan: "Отвори сканирането"
+    proof-photo: "Снимка от доставката"
+    proof-signature: "Подпис"
+    proof-scan: "Сканирано на вратата"
+    instructions: "Указания за доставка"
+    edit: "Редактирай"
+    instructions-help: "Код за входа, къде да се остави или кой може да подпише"
+    cancel: "Отказ"
+    save: "Запази"
+    no-instructions: "Все още няма указания."
+    updates: "Актуализации"
+    no-updates: "Все още няма актуализации."
+    show-fewer: "Покажи по-малко актуализации"
+    show-earlier: "Покажи по-стари актуализации ({count})"
+    today: "Днес"
+    yesterday: "Вчера"
+    items: "В тази доставка"
+    item: "Артикул"
+    quantity: "{count} бр."
+    share: "Сподели проследяването"
+    report: "Сигнал за проблем"
+    contact: "Свържете се с {name}"
+    report-label: "Какъв е проблемът с доставката ви?"
+    send: "Изпрати"
+    close: "Затвори"
+    no-orders: "Все още няма поръчки"
+    no-orders-help: "Тук ще се показват доставките за вашия профил."
diff --git a/translations/es-pa.yaml b/translations/es-pa.yaml
index 48701c581..af2c83abb 100644
--- a/translations/es-pa.yaml
+++ b/translations/es-pa.yaml
@@ -2228,275 +2228,275 @@ trailer:
     other: Otro
 tracking-page:
   settings:
-    title: "Tracking Page"
-    menu: "Tracking Page"
-    saved: "Tracking page settings saved."
-    load-failed: "We couldn't load the tracking page settings."
-    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
-    pages: "Pages"
-    org-page-enabled: "Your own tracking page"
-    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
-    slug: "Page address"
-    slug-checking: "Checking the address..."
-    open-page: "Open the page"
-    generic-page-allowed: "Allow tracking on the shared page"
-    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
-    links-target: "Links in emails and labels"
-    links-target-help: "Which page your notifications and labels send customers to."
-    links-target-auto: "Your page when it is on, otherwise the shared page"
-    links-target-org: "Always your page"
-    links-target-generic: "Always the shared page"
-    branding: "Branding"
-    display-name: "Display name"
-    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
-    accent: "Accent colour"
-    accent-hex: "Accent colour as a hex value"
-    placeholder-slug: "your-company"
+    title: "Página de seguimiento"
+    menu: "Página de seguimiento"
+    saved: "Se guardó la configuración de la página de seguimiento."
+    load-failed: "No pudimos cargar la configuración de la página de seguimiento."
+    load-failed-help: "Recarga la página para intentarlo de nuevo. Si sigue pasando, verifica que tengas permiso para ver esta configuración."
+    pages: "Páginas"
+    org-page-enabled: "Tu propia página de seguimiento"
+    org-page-enabled-help: "Una página de seguimiento con tu marca y su propia dirección. Solo encuentra los números de seguimiento de tu organización."
+    slug: "Dirección de la página"
+    slug-checking: "Verificando la dirección..."
+    open-page: "Abrir la página"
+    generic-page-allowed: "Permitir el seguimiento en la página compartida"
+    generic-page-allowed-help: "Permite que los clientes consulten tus números de seguimiento en {url}. Desactívalo para que el seguimiento esté solo en tu propia página."
+    links-target: "Enlaces en correos y etiquetas"
+    links-target-help: "A qué página llevan a los clientes tus notificaciones y etiquetas."
+    links-target-auto: "Tu página cuando esté activada; si no, la página compartida"
+    links-target-org: "Siempre tu página"
+    links-target-generic: "Siempre la página compartida"
+    branding: "Marca"
+    display-name: "Nombre visible"
+    logo-help: "La página usa el logo de tu organización. Si no tienes uno, muestra un monograma del nombre visible."
+    accent: "Color de acento"
+    accent-hex: "Color de acento en hexadecimal"
+    placeholder-slug: "tu-empresa"
     placeholder-phone: "+1 555 010 0100"
     placeholder-email: "support@example.com"
     placeholder-website: "https://example.com"
-    placeholder-select: "Select an option"
-    contrast-ok: "Text on this colour is readable ({ratio}:1)."
-    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
-    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
-    accent-dark: "Accent colour in dark mode"
-    accent-dark-auto: "Automatic"
-    support-phone: "Support phone"
-    support-email: "Support email"
-    website: "Website"
-    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
-    powered-by: "Show \"Powered by Fleetbase\""
-    powered-by-help: "A small line in the page footer."
-    theme: "Light and dark"
-    theme-system: "Follow the customer's device"
-    theme-light: "Always light"
-    default-language: "Default language"
-    languages: "Languages customers can choose"
-    access: "Access"
-    public-status: "Show the status without verification"
-    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
-    channel-sms: "Verify by text message"
-    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
-    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
-    channel-email: "Verify by email"
-    channel-email-help: "Sends a 6-digit code to the email address on the order."
-    session-hours: "Stay verified for (hours)"
-    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
-    account-sign-in: "Let customers sign in"
-    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
-    account-upsell: "Suggest creating an account"
-    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
-    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
-    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
-    visibility: "What verified customers see"
-    visibility-map: "Live map"
-    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
-    visibility-driver_name: "Driver's first name"
-    visibility-driver_name-help: "Only the first name, never a surname or phone number."
-    visibility-vehicle: "Vehicle description"
-    visibility-vehicle-help: "For example \"White Ford Transit\"."
-    visibility-items: "Items in the delivery"
-    visibility-items-help: "Names, descriptions, quantities and photos."
-    visibility-item_prices: "Item prices"
-    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
-    visibility-pod_photo: "Delivery photo"
-    visibility-pod_photo-help: "The photo taken as proof of delivery."
-    visibility-pod_signature: "Signature"
-    visibility-pod_signature-help: "The signature captured as proof of delivery."
-    visibility-instructions_edit: "Let customers add delivery instructions"
-    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
-    visibility-report_problem: "Report a problem"
-    visibility-report_problem-help: "Lets customers send you a message about their delivery."
-    driver-contact: "Calls and messages go to"
-    driver-contact-help: "Who customers reach from the driver card."
-    driver-contact-company: "Your support team"
-    driver-contact-driver: "The driver directly"
-    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
-    preview: "Preview"
-    preview-help: "A sample in light and dark mode. Save to apply the changes."
-    preview-chip: "Verified on this device"
-    preview-headline: "Arriving today"
-    preview-sub: "2:10 to 2:40 pm"
-    preview-button: "Verify it's you"
-    preview-powered-by: "Powered by Fleetbase"
+    placeholder-select: "Selecciona una opción"
+    contrast-ok: "El texto sobre este color se lee bien ({ratio}:1)."
+    contrast-low: "El texto sobre este color es difícil de leer ({ratio}:1). Elige un color más oscuro o más claro."
+    accent-help: "Se usa en botones, barras de progreso y elementos destacados. El color del texto se elige automáticamente."
+    accent-dark: "Color de acento en modo oscuro"
+    accent-dark-auto: "Automático"
+    support-phone: "Teléfono de soporte"
+    support-email: "Correo de soporte"
+    website: "Sitio web"
+    support-help: "Déjalos vacíos para usar los datos de tu organización. Aquí llegan las llamadas y los mensajes de los clientes."
+    powered-by: "Mostrar \"Con tecnología de Fleetbase\""
+    powered-by-help: "Una línea pequeña en el pie de la página."
+    theme: "Claro y oscuro"
+    theme-system: "Según el dispositivo del cliente"
+    theme-light: "Siempre claro"
+    default-language: "Idioma predeterminado"
+    languages: "Idiomas que pueden elegir los clientes"
+    access: "Acceso"
+    public-status: "Mostrar el estado sin verificación"
+    public-status-help: "Con solo el número de seguimiento, los clientes ven la etapa de la entrega y la fecha de la última actualización. Desactívalo para no mostrar nada hasta que se verifiquen."
+    channel-sms: "Verificar por mensaje de texto"
+    channel-sms-help: "Envía un código de 6 dígitos al teléfono del pedido."
+    channel-sms-unavailable: "Esta instancia no tiene un proveedor de SMS configurado, así que no se pueden enviar códigos por mensaje de texto."
+    channel-email: "Verificar por correo"
+    channel-email-help: "Envía un código de 6 dígitos al correo electrónico del pedido."
+    session-hours: "Mantener la verificación durante (horas)"
+    session-hours-help: "Cuánto tiempo sigue verificado un dispositivo después de ingresar un código correcto. Entre 1 y 168 horas."
+    account-sign-in: "Permitir que los clientes inicien sesión"
+    account-sign-in-help: "Los clientes con cuenta en el portal de clientes pueden iniciar sesión para ver todos sus pedidos sin código."
+    account-upsell: "Sugerir crear una cuenta"
+    account-upsell-help: "Después de la entrega, se invita a los clientes verificados sin cuenta a crear una."
+    customer-portal-missing: "Instala la extensión Customer Portal para que los clientes puedan iniciar sesión y ver todos sus pedidos."
+    code-rules: "Los códigos tienen 6 dígitos y vencen a los 10 minutos. Tras 3 códigos incorrectos, se pausan durante 5 minutos."
+    visibility: "Qué ven los clientes verificados"
+    visibility-map: "Mapa en vivo"
+    visibility-map-help: "La ruta y la posición del vehículo mientras va hacia el cliente."
+    visibility-driver_name: "Nombre del conductor"
+    visibility-driver_name-help: "Solo el nombre, nunca el apellido ni el número de teléfono."
+    visibility-vehicle: "Descripción del vehículo"
+    visibility-vehicle-help: "Por ejemplo, \"Ford Transit blanca\"."
+    visibility-items: "Artículos de la entrega"
+    visibility-items-help: "Nombres, descripciones, cantidades y fotos."
+    visibility-item_prices: "Precios de los artículos"
+    visibility-item_prices-help: "Solo se muestran a los clientes con sesión iniciada que hicieron el pedido."
+    visibility-pod_photo: "Foto de entrega"
+    visibility-pod_photo-help: "La foto tomada como prueba de entrega."
+    visibility-pod_signature: "Firma"
+    visibility-pod_signature-help: "La firma registrada como prueba de entrega."
+    visibility-instructions_edit: "Permitir que los clientes agreguen instrucciones de entrega"
+    visibility-instructions_edit-help: "Por ejemplo, el código del portón o dónde dejar el paquete."
+    visibility-report_problem: "Reportar un problema"
+    visibility-report_problem-help: "Permite que los clientes te envíen un mensaje sobre su entrega."
+    driver-contact: "Las llamadas y los mensajes van a"
+    driver-contact-help: "A quién contactan los clientes desde la tarjeta del conductor."
+    driver-contact-company: "Tu equipo de soporte"
+    driver-contact-driver: "Directamente al conductor"
+    privacy-rules: "Siempre se aplica: los clientes solo ven sus propias paradas y artículos, el mapa y el conductor se ocultan después de la entrega, y la ubicación del conductor solo se muestra mientras va en camino."
+    preview: "Vista previa"
+    preview-help: "Un ejemplo en modo claro y oscuro. Guarda para aplicar los cambios."
+    preview-chip: "Verificado en este dispositivo"
+    preview-headline: "Llega hoy"
+    preview-sub: "De 2:10 a 2:40 p. m."
+    preview-button: "Verifica tu identidad"
+    preview-powered-by: "Con tecnología de Fleetbase"
   page:
-    track-another: "Track another"
-    unavailable-title: "Tracking isn't available here"
-    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
-    lookup-title: "Track your delivery"
-    lookup-sub: "See where your parcel is and when it will arrive."
-    tracking-number: "Tracking number"
-    tracking-number-placeholder: "e.g. NOR4829301736US"
-    tracking-number-help: "Find it in your confirmation email or on the parcel label."
-    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
-    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
-    looking-up: "Looking it up..."
-    track: "Track"
-    or: "or"
-    your-orders: "Your orders"
-    sign-in: "Sign in to see all your orders"
-    sign-in-account: "Sign in to your account"
-    back: "Back"
-    help: "Need help?"
-    language: "Language"
-    powered-by: "Powered by Fleetbase"
-    dismiss: "Dismiss"
-    chip-limited: "Limited view · Verify to see details"
-    chip-verified: "Verified on this device"
-    chip-account: "Signed in"
-    chip-staff: "Staff preview: what this customer sees"
-    status: "Status"
-    verify-to-see: "Verify to see your delivery"
-    last-update: "Last update: {date}"
-    copy: "Copy"
-    verify-title: "See your full delivery details"
-    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
-    verify-button: "Verify it's you"
-    verify-unlock: "Verify to unlock"
-    locked-map: "Live map"
-    locked-arrival: "Arrival time and driver"
-    locked-details: "Updates, items and proof of delivery"
-    stage-preparing: "Being prepared"
-    stage-scheduled: "Scheduled"
-    stage-dispatched: "Driver assigned"
-    stage-in_transit: "In transit"
-    stage-delivered: "Delivered"
-    stage-issue: "Needs attention"
-    stage-canceled: "Canceled"
-    stage-toast-preparing: "Your order is being prepared"
-    stage-toast-scheduled: "Your delivery is scheduled"
-    stage-toast-dispatched: "A driver has been assigned"
-    stage-toast-in_transit: "Your order is on its way"
-    stage-toast-delivered: "Your order has been delivered"
-    stage-toast-issue: "There's an update on your delivery"
-    stage-toast-canceled: "Your order was canceled"
-    verify-title-short: "Verify it's you"
-    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
-    send-by: "Send the code by"
-    channel-sms: "Text message"
-    channel-email: "Email"
-    send-failed: "We couldn't send a code just now. Please try again."
-    sending: "Sending code..."
-    send-code: "Send code"
-    masked-note: "We only ever show part of your number or email here."
-    no-contact-title: "We can't verify you here"
-    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
-    call: "Call {phone}"
-    renew-title: "Get a new code"
-    renew-expired: "That code has expired. Codes last 10 minutes."
-    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
-    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
-    renew-failed: "Something went wrong. Request a new code to try again."
-    send-new-code: "Send a new code"
-    verified-title: "You're verified"
-    locked-title: "Codes paused"
-    enter-code: "Enter your code"
-    code-sent-sms: "We texted a 6-digit code to {masked}."
-    code-sent-email: "We emailed a 6-digit code to {masked}."
-    code-label: "6-digit code"
-    code-expires: "The code expires in 10 minutes."
-    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
-    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
-    code-success: "Verified. Opening your delivery..."
-    resend-in: "Resend code in {time}"
-    resend: "Resend code"
-    switch-to-sms: "Send by text instead"
-    switch-to-email: "Send by email instead"
-    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
-    verified-toast: "You're verified"
-    verified-toast-help: "This device stays verified for this delivery."
-    signed-out-toast: "Signed out on this device"
-    instructions-saved: "Delivery instructions saved"
-    action-failed: "That didn't work. Please try again."
-    report-sent: "Message sent"
-    report-sent-help: "{name} will get back to you."
-    share-copied: "Link copied"
-    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
-    your-stop: "Stop {number}"
-    your-stops: "Your stops"
-    sign-out: "Not you? Sign out"
-    live: "Live"
-    reconnecting: "Reconnecting... live updates paused"
-    timezone: "Times in your time zone ({zone})"
-    progress: "Delivery progress"
-    step-created: "Created"
-    step-dispatched: "Dispatched"
-    step-started: "Picked up"
-    step-enroute: "En route"
-    step-delivered: "Delivered"
-    step-issue: "Attempt missed"
-    step-canceled: "Canceled"
-    headline-preparing: "Getting your order ready"
-    headline-scheduled: "Scheduled for {date}"
-    headline-dispatched: "A driver has been assigned"
-    headline-delayed: "Running a little late"
-    headline-arriving: "Arriving {day}"
-    headline-in-transit: "On its way"
-    headline-delivered: "Delivered"
-    headline-issue: "There's a problem with your delivery"
-    headline-canceled: "This order was canceled"
-    sub-arriving: "{window} · in about {minutes} min"
-    sub-window: "Delivery window {window}"
+    track-another: "Rastrear otro envío"
+    unavailable-title: "El seguimiento no está disponible aquí"
+    unavailable-help: "Esta página de seguimiento no está activada. Usa el enlace del correo de tu entrega o contacta a la empresa que envió tu pedido."
+    lookup-title: "Rastrea tu entrega"
+    lookup-sub: "Mira dónde está tu paquete y cuándo llegará."
+    tracking-number: "Número de seguimiento"
+    tracking-number-placeholder: "p. ej. NOR4829301736US"
+    tracking-number-help: "Lo encuentras en tu correo de confirmación o en la etiqueta del paquete."
+    lookup-neutral: "No podemos mostrar el seguimiento de ese número. Verifica que coincida con tu correo o la etiqueta del paquete e inténtalo de nuevo."
+    lookup-rate: "Ya van varios intentos seguidos. Tómate un breve descanso e inténtalo de nuevo en unos minutos."
+    looking-up: "Buscando..."
+    track: "Rastrear"
+    or: "o"
+    your-orders: "Tus pedidos"
+    sign-in: "Inicia sesión para ver todos tus pedidos"
+    sign-in-account: "Inicia sesión en tu cuenta"
+    back: "Volver"
+    help: "¿Necesitas ayuda?"
+    language: "Idioma"
+    powered-by: "Con tecnología de Fleetbase"
+    dismiss: "Cerrar"
+    chip-limited: "Vista limitada · Verifícate para ver los detalles"
+    chip-verified: "Verificado en este dispositivo"
+    chip-account: "Sesión iniciada"
+    chip-staff: "Vista previa del personal: lo que ve este cliente"
+    status: "Estado"
+    verify-to-see: "Verifícate para ver tu entrega"
+    last-update: "Última actualización: {date}"
+    copy: "Copiar"
+    verify-title: "Mira todos los detalles de tu entrega"
+    verify-help: "Por tu privacidad, el mapa, la hora de llegada y los detalles de la entrega se desbloquean tras una verificación rápida. Te enviaremos un código de 6 dígitos al teléfono o correo de este pedido."
+    verify-button: "Verifica tu identidad"
+    verify-unlock: "Verifícate para desbloquear"
+    locked-map: "Mapa en vivo"
+    locked-arrival: "Hora de llegada y conductor"
+    locked-details: "Actualizaciones, artículos y prueba de entrega"
+    stage-preparing: "En preparación"
+    stage-scheduled: "Programado"
+    stage-dispatched: "Conductor asignado"
+    stage-in_transit: "En tránsito"
+    stage-delivered: "Entregado"
+    stage-issue: "Requiere atención"
+    stage-canceled: "Cancelado"
+    stage-toast-preparing: "Tu pedido se está preparando"
+    stage-toast-scheduled: "Tu entrega está programada"
+    stage-toast-dispatched: "Se asignó un conductor"
+    stage-toast-in_transit: "Tu pedido va en camino"
+    stage-toast-delivered: "Tu pedido fue entregado"
+    stage-toast-issue: "Hay una novedad sobre tu entrega"
+    stage-toast-canceled: "Tu pedido fue cancelado"
+    verify-title-short: "Verifica tu identidad"
+    verify-choose-help: "Para proteger los detalles de tu entrega, te enviaremos un código de 6 dígitos a los datos de contacto de este pedido."
+    send-by: "Enviar el código por"
+    channel-sms: "Mensaje de texto"
+    channel-email: "Correo electrónico"
+    send-failed: "No pudimos enviar un código en este momento. Inténtalo de nuevo."
+    sending: "Enviando código..."
+    send-code: "Enviar código"
+    masked-note: "Aquí solo mostramos parte de tu número o correo."
+    no-contact-title: "No podemos verificarte aquí"
+    no-contact-help: "Este pedido no tiene un teléfono ni un correo al que podamos enviar un código. {name} puede ayudarte con tu entrega."
+    call: "Llamar al {phone}"
+    renew-title: "Obtén un código nuevo"
+    renew-expired: "Ese código venció. Los códigos duran 10 minutos."
+    renew-unlocked: "Ya puedes intentarlo de nuevo. Te enviaremos un código nuevo; el anterior ya no funciona."
+    renew-limited: "Ya pediste varios códigos. Espera unos minutos antes de pedir otro."
+    renew-failed: "Algo salió mal. Pide un código nuevo para intentarlo de nuevo."
+    send-new-code: "Enviar un código nuevo"
+    verified-title: "Ya estás verificado"
+    locked-title: "Códigos en pausa"
+    enter-code: "Ingresa tu código"
+    code-sent-sms: "Te enviamos un código de 6 dígitos por SMS al {masked}."
+    code-sent-email: "Te enviamos un código de 6 dígitos a {masked}."
+    code-label: "Código de 6 dígitos"
+    code-expires: "El código vence en 10 minutos."
+    code-wrong: "Ese código no coincide. {count, plural, one {Te queda # intento.} other {Te quedan # intentos.}}"
+    code-locked: "Demasiados intentos. Por tu seguridad, los códigos están en pausa. Inténtalo de nuevo en {time}."
+    code-success: "Verificado. Abriendo tu entrega..."
+    resend-in: "Reenviar código en {time}"
+    resend: "Reenviar código"
+    switch-to-sms: "Enviar por mensaje de texto"
+    switch-to-email: "Enviar por correo"
+    stay-verified: "Una vez verificado, este dispositivo seguirá verificado durante {hours} horas. Puedes cerrar sesión cuando quieras."
+    verified-toast: "Ya estás verificado"
+    verified-toast-help: "Este dispositivo seguirá verificado para esta entrega."
+    signed-out-toast: "Sesión cerrada en este dispositivo"
+    instructions-saved: "Instrucciones de entrega guardadas"
+    action-failed: "No funcionó. Inténtalo de nuevo."
+    report-sent: "Mensaje enviado"
+    report-sent-help: "{name} te responderá."
+    share-copied: "Enlace copiado"
+    share-copied-help: "Quien lo reciba verá una vista limitada hasta que se verifique."
+    your-stop: "Parada {number}"
+    your-stops: "Tus paradas"
+    sign-out: "¿No eres tú? Cierra sesión"
+    live: "En vivo"
+    reconnecting: "Reconectando... actualizaciones en vivo en pausa"
+    timezone: "Horas en tu zona horaria ({zone})"
+    progress: "Progreso de la entrega"
+    step-created: "Creado"
+    step-dispatched: "Despachado"
+    step-started: "Recogido"
+    step-enroute: "En camino"
+    step-delivered: "Entregado"
+    step-issue: "Intento fallido"
+    step-canceled: "Cancelado"
+    headline-preparing: "Estamos preparando tu pedido"
+    headline-scheduled: "Programado para {date}"
+    headline-dispatched: "Se asignó un conductor"
+    headline-delayed: "Va un poco tarde"
+    headline-arriving: "Llega {day}"
+    headline-in-transit: "En camino"
+    headline-delivered: "Entregado"
+    headline-issue: "Hay un problema con tu entrega"
+    headline-canceled: "Este pedido fue cancelado"
+    sub-arriving: "{window} · en unos {minutes} min"
+    sub-window: "Franja de entrega: {window}"
     sub-delivered: "{when}"
-    sub-dispatched: "Live tracking starts as soon as they're on the way."
-    sub-preparing: "We'll let you know when it's on its way."
-    delayed-title: "Running late."
-    delayed-help: "We'll keep your arrival time up to date."
-    stop-of: "Your delivery is stop {position} of {total}"
-    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
-    map: "Map"
-    map-label: "Map of your delivery: the van on its way to your address."
-    map-pickup: "Pickup area"
-    map-driver: "Driver"
-    map-pickup-named: "Pickup · {name}"
-    map-fullscreen: "Full screen map"
-    map-exit-fullscreen: "Exit full screen"
-    stop-card-title: "Delivering to"
-    stop-upcoming: "Upcoming"
-    stop-complete: "Delivered"
-    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
-    last-seen: "Last seen {minutes} min ago"
-    recenter: "Center the map on the van"
-    fit-route: "Show the whole route"
-    eta: "Estimated arrival"
-    in-minutes: "in about {minutes} min"
-    window: "Delivery window"
-    before-yours: "Before yours"
-    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
-    estimate-may-change: "Estimate may change"
-    driver: "Your driver"
-    online: "Online"
-    location-paused: "Location paused"
-    call-short: "Call"
-    message: "Message"
-    contact-note: "Calls and messages go to the {name} support team."
-    proof: "Proof of delivery"
-    open-photo: "Open the delivery photo"
-    open-signature: "Open the signature"
-    open-scan: "Open the scan"
-    proof-photo: "Delivery photo"
-    proof-signature: "Signature"
-    proof-scan: "Scanned at the door"
-    instructions: "Delivery instructions"
-    edit: "Edit"
-    instructions-help: "Gate codes, where to leave it, or who can sign"
-    cancel: "Cancel"
-    save: "Save"
-    no-instructions: "No instructions yet."
-    updates: "Updates"
-    no-updates: "No updates yet."
-    show-fewer: "Show fewer updates"
-    show-earlier: "Show earlier updates ({count})"
-    today: "Today"
-    yesterday: "Yesterday"
-    items: "In this delivery"
-    item: "Item"
-    quantity: "Qty {count}"
-    share: "Share tracking"
-    report: "Report a problem"
-    contact: "Contact {name}"
-    report-label: "What's wrong with your delivery?"
-    send: "Send"
-    close: "Close"
-    no-orders: "No orders yet"
-    no-orders-help: "Deliveries for your account will show up here."
+    sub-dispatched: "El seguimiento en vivo comienza en cuanto el conductor esté en camino."
+    sub-preparing: "Te avisaremos cuando vaya en camino."
+    delayed-title: "Va con retraso."
+    delayed-help: "Mantendremos actualizada tu hora de llegada."
+    stop-of: "Tu entrega es la parada {position} de {total}"
+    stops-private: "{count, plural, =0 {Eres el siguiente.} one {Falta # parada antes de la tuya.} other {Faltan # paradas antes de la tuya.}} Las demás paradas son privadas, así que solo ves la tuya."
+    map: "Mapa"
+    map-label: "Mapa de tu entrega: la camioneta va en camino a tu dirección."
+    map-pickup: "Zona de recogida"
+    map-driver: "Conductor"
+    map-pickup-named: "Recogida · {name}"
+    map-fullscreen: "Mapa en pantalla completa"
+    map-exit-fullscreen: "Salir de pantalla completa"
+    stop-card-title: "Entrega en"
+    stop-upcoming: "Próxima"
+    stop-complete: "Entregada"
+    map-hidden: "El mapa ya no se muestra porque tu pedido fue entregado. Dejamos de compartir la ubicación del conductor al llegar a tu puerta."
+    last-seen: "Visto hace {minutes} min"
+    recenter: "Centrar el mapa en la camioneta"
+    fit-route: "Ver toda la ruta"
+    eta: "Llegada estimada"
+    in-minutes: "en unos {minutes} min"
+    window: "Franja de entrega"
+    before-yours: "Antes de la tuya"
+    stops-count: "{count, plural, =0 {Ninguna} one {# parada} other {# paradas}}"
+    estimate-may-change: "La estimación puede cambiar"
+    driver: "Tu conductor"
+    online: "En línea"
+    location-paused: "Ubicación en pausa"
+    call-short: "Llamar"
+    message: "Mensaje"
+    contact-note: "Las llamadas y los mensajes van al equipo de soporte de {name}."
+    proof: "Prueba de entrega"
+    open-photo: "Abrir la foto de entrega"
+    open-signature: "Abrir la firma"
+    open-scan: "Abrir el escaneo"
+    proof-photo: "Foto de entrega"
+    proof-signature: "Firma"
+    proof-scan: "Escaneado en la puerta"
+    instructions: "Instrucciones de entrega"
+    edit: "Editar"
+    instructions-help: "Código del portón, dónde dejarlo o quién puede firmar"
+    cancel: "Cancelar"
+    save: "Guardar"
+    no-instructions: "Aún no hay instrucciones."
+    updates: "Actualizaciones"
+    no-updates: "Aún no hay actualizaciones."
+    show-fewer: "Mostrar menos actualizaciones"
+    show-earlier: "Mostrar actualizaciones anteriores ({count})"
+    today: "Hoy"
+    yesterday: "Ayer"
+    items: "En esta entrega"
+    item: "Artículo"
+    quantity: "Cant. {count}"
+    share: "Compartir seguimiento"
+    report: "Reportar un problema"
+    contact: "Contactar a {name}"
+    report-label: "¿Qué problema tiene tu entrega?"
+    send: "Enviar"
+    close: "Cerrar"
+    no-orders: "Aún no hay pedidos"
+    no-orders-help: "Aquí aparecerán las entregas de tu cuenta."
diff --git a/translations/fr-fr.yaml b/translations/fr-fr.yaml
index 31fc887b3..2ba329fab 100644
--- a/translations/fr-fr.yaml
+++ b/translations/fr-fr.yaml
@@ -2374,275 +2374,275 @@ trailer:
     other: Autre
 tracking-page:
   settings:
-    title: "Tracking Page"
-    menu: "Tracking Page"
-    saved: "Tracking page settings saved."
-    load-failed: "We couldn't load the tracking page settings."
-    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
+    title: "Page de suivi"
+    menu: "Page de suivi"
+    saved: "Paramètres de la page de suivi enregistrés."
+    load-failed: "Impossible de charger les paramètres de la page de suivi."
+    load-failed-help: "Rechargez la page pour réessayer. Si le problème persiste, vérifiez que vous avez l'autorisation de consulter ces paramètres."
     pages: "Pages"
-    org-page-enabled: "Your own tracking page"
-    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
-    slug: "Page address"
-    slug-checking: "Checking the address..."
-    open-page: "Open the page"
-    generic-page-allowed: "Allow tracking on the shared page"
-    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
-    links-target: "Links in emails and labels"
-    links-target-help: "Which page your notifications and labels send customers to."
-    links-target-auto: "Your page when it is on, otherwise the shared page"
-    links-target-org: "Always your page"
-    links-target-generic: "Always the shared page"
-    branding: "Branding"
-    display-name: "Display name"
-    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
-    accent: "Accent colour"
-    accent-hex: "Accent colour as a hex value"
-    placeholder-slug: "your-company"
+    org-page-enabled: "Votre propre page de suivi"
+    org-page-enabled-help: "Une page de suivi à vos couleurs, avec sa propre adresse. Elle ne trouve que les numéros de suivi de votre organisation."
+    slug: "Adresse de la page"
+    slug-checking: "Vérification de l'adresse..."
+    open-page: "Ouvrir la page"
+    generic-page-allowed: "Autoriser le suivi sur la page partagée"
+    generic-page-allowed-help: "Permet aux clients de rechercher vos numéros de suivi sur {url}. Désactivez cette option pour limiter le suivi à votre propre page."
+    links-target: "Liens dans les e-mails et les étiquettes"
+    links-target-help: "La page vers laquelle vos notifications et étiquettes dirigent les clients."
+    links-target-auto: "Votre page si elle est activée, sinon la page partagée"
+    links-target-org: "Toujours votre page"
+    links-target-generic: "Toujours la page partagée"
+    branding: "Image de marque"
+    display-name: "Nom affiché"
+    logo-help: "La page utilise le logo de votre organisation. Sans logo, elle affiche un monogramme du nom affiché."
+    accent: "Couleur d'accent"
+    accent-hex: "Couleur d'accent en valeur hexadécimale"
+    placeholder-slug: "votre-entreprise"
     placeholder-phone: "+1 555 010 0100"
     placeholder-email: "support@example.com"
     placeholder-website: "https://example.com"
-    placeholder-select: "Select an option"
-    contrast-ok: "Text on this colour is readable ({ratio}:1)."
-    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
-    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
-    accent-dark: "Accent colour in dark mode"
-    accent-dark-auto: "Automatic"
-    support-phone: "Support phone"
-    support-email: "Support email"
-    website: "Website"
-    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
-    powered-by: "Show \"Powered by Fleetbase\""
-    powered-by-help: "A small line in the page footer."
-    theme: "Light and dark"
-    theme-system: "Follow the customer's device"
-    theme-light: "Always light"
-    default-language: "Default language"
-    languages: "Languages customers can choose"
-    access: "Access"
-    public-status: "Show the status without verification"
-    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
-    channel-sms: "Verify by text message"
-    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
-    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
-    channel-email: "Verify by email"
-    channel-email-help: "Sends a 6-digit code to the email address on the order."
-    session-hours: "Stay verified for (hours)"
-    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
-    account-sign-in: "Let customers sign in"
-    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
-    account-upsell: "Suggest creating an account"
-    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
-    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
-    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
-    visibility: "What verified customers see"
-    visibility-map: "Live map"
-    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
-    visibility-driver_name: "Driver's first name"
-    visibility-driver_name-help: "Only the first name, never a surname or phone number."
-    visibility-vehicle: "Vehicle description"
-    visibility-vehicle-help: "For example \"White Ford Transit\"."
-    visibility-items: "Items in the delivery"
-    visibility-items-help: "Names, descriptions, quantities and photos."
-    visibility-item_prices: "Item prices"
-    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
-    visibility-pod_photo: "Delivery photo"
-    visibility-pod_photo-help: "The photo taken as proof of delivery."
+    placeholder-select: "Sélectionnez une option"
+    contrast-ok: "Le texte sur cette couleur est lisible ({ratio}:1)."
+    contrast-low: "Le texte sur cette couleur est difficile à lire ({ratio}:1). Choisissez une couleur plus foncée ou plus claire."
+    accent-help: "Utilisée pour les boutons, la progression et les mises en avant. La couleur du texte est choisie automatiquement."
+    accent-dark: "Couleur d'accent en mode sombre"
+    accent-dark-auto: "Automatique"
+    support-phone: "Téléphone du support"
+    support-email: "E-mail du support"
+    website: "Site web"
+    support-help: "Laissez vide pour utiliser les coordonnées de votre organisation. Les appels et messages des clients arrivent ici."
+    powered-by: "Afficher « Propulsé par Fleetbase »"
+    powered-by-help: "Une petite ligne en bas de la page."
+    theme: "Clair et sombre"
+    theme-system: "Suivre l'appareil du client"
+    theme-light: "Toujours clair"
+    default-language: "Langue par défaut"
+    languages: "Langues proposées aux clients"
+    access: "Accès"
+    public-status: "Afficher le statut sans vérification"
+    public-status-help: "Avec seulement un numéro de suivi, les clients voient l'étape de livraison et la date de la dernière mise à jour. Désactivez cette option pour ne rien afficher avant la vérification."
+    channel-sms: "Vérification par SMS"
+    channel-sms-help: "Envoie un code à 6 chiffres au numéro de téléphone de la commande."
+    channel-sms-unavailable: "Aucun fournisseur SMS n'est configuré pour cette instance : les codes ne peuvent pas être envoyés par SMS."
+    channel-email: "Vérification par e-mail"
+    channel-email-help: "Envoie un code à 6 chiffres à l'adresse e-mail de la commande."
+    session-hours: "Durée de vérification (heures)"
+    session-hours-help: "Combien de temps un appareil reste vérifié après un code correct. Entre 1 et 168 heures."
+    account-sign-in: "Permettre aux clients de se connecter"
+    account-sign-in-help: "Les clients disposant d'un compte sur le portail client peuvent se connecter pour voir toutes leurs commandes sans code."
+    account-upsell: "Proposer de créer un compte"
+    account-upsell-help: "Après la livraison, les clients vérifiés sans compte sont invités à en créer un."
+    customer-portal-missing: "Installez l'extension Customer Portal pour permettre aux clients de se connecter et de voir toutes leurs commandes."
+    code-rules: "Les codes comportent 6 chiffres et expirent au bout de 10 minutes. Après 3 codes erronés, l'envoi est suspendu pendant 5 minutes."
+    visibility: "Ce que voient les clients vérifiés"
+    visibility-map: "Carte en direct"
+    visibility-map-help: "L'itinéraire et la position du véhicule pendant qu'il se dirige vers le client."
+    visibility-driver_name: "Prénom du chauffeur"
+    visibility-driver_name-help: "Uniquement le prénom, jamais le nom de famille ni le numéro de téléphone."
+    visibility-vehicle: "Description du véhicule"
+    visibility-vehicle-help: "Par exemple « Ford Transit blanc »."
+    visibility-items: "Articles de la livraison"
+    visibility-items-help: "Noms, descriptions, quantités et photos."
+    visibility-item_prices: "Prix des articles"
+    visibility-item_prices-help: "Affichés uniquement aux clients connectés qui ont passé la commande."
+    visibility-pod_photo: "Photo de livraison"
+    visibility-pod_photo-help: "La photo prise comme preuve de livraison."
     visibility-pod_signature: "Signature"
-    visibility-pod_signature-help: "The signature captured as proof of delivery."
-    visibility-instructions_edit: "Let customers add delivery instructions"
-    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
-    visibility-report_problem: "Report a problem"
-    visibility-report_problem-help: "Lets customers send you a message about their delivery."
-    driver-contact: "Calls and messages go to"
-    driver-contact-help: "Who customers reach from the driver card."
-    driver-contact-company: "Your support team"
-    driver-contact-driver: "The driver directly"
-    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
-    preview: "Preview"
-    preview-help: "A sample in light and dark mode. Save to apply the changes."
-    preview-chip: "Verified on this device"
-    preview-headline: "Arriving today"
-    preview-sub: "2:10 to 2:40 pm"
-    preview-button: "Verify it's you"
-    preview-powered-by: "Powered by Fleetbase"
+    visibility-pod_signature-help: "La signature recueillie comme preuve de livraison."
+    visibility-instructions_edit: "Permettre aux clients d'ajouter des instructions de livraison"
+    visibility-instructions_edit-help: "Par exemple un code de portail ou l'endroit où déposer le colis."
+    visibility-report_problem: "Signaler un problème"
+    visibility-report_problem-help: "Permet aux clients de vous envoyer un message au sujet de leur livraison."
+    driver-contact: "Les appels et messages sont adressés à"
+    driver-contact-help: "La personne que les clients contactent depuis la fiche du chauffeur."
+    driver-contact-company: "Votre équipe support"
+    driver-contact-driver: "Directement le chauffeur"
+    privacy-rules: "Toujours appliqué : les clients ne voient que leurs propres arrêts et articles, la carte et le chauffeur sont masqués après la livraison, et la position du chauffeur n'est visible que pendant son trajet."
+    preview: "Aperçu"
+    preview-help: "Un exemple en mode clair et sombre. Enregistrez pour appliquer les modifications."
+    preview-chip: "Vérifié sur cet appareil"
+    preview-headline: "Arrive aujourd'hui"
+    preview-sub: "14 h 10 à 14 h 40"
+    preview-button: "Confirmer votre identité"
+    preview-powered-by: "Propulsé par Fleetbase"
   page:
-    track-another: "Track another"
-    unavailable-title: "Tracking isn't available here"
-    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
-    lookup-title: "Track your delivery"
-    lookup-sub: "See where your parcel is and when it will arrive."
-    tracking-number: "Tracking number"
-    tracking-number-placeholder: "e.g. NOR4829301736US"
-    tracking-number-help: "Find it in your confirmation email or on the parcel label."
-    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
-    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
-    looking-up: "Looking it up..."
-    track: "Track"
-    or: "or"
-    your-orders: "Your orders"
-    sign-in: "Sign in to see all your orders"
-    sign-in-account: "Sign in to your account"
-    back: "Back"
-    help: "Need help?"
-    language: "Language"
-    powered-by: "Powered by Fleetbase"
-    dismiss: "Dismiss"
-    chip-limited: "Limited view · Verify to see details"
-    chip-verified: "Verified on this device"
-    chip-account: "Signed in"
-    chip-staff: "Staff preview: what this customer sees"
-    status: "Status"
-    verify-to-see: "Verify to see your delivery"
-    last-update: "Last update: {date}"
-    copy: "Copy"
-    verify-title: "See your full delivery details"
-    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
-    verify-button: "Verify it's you"
-    verify-unlock: "Verify to unlock"
-    locked-map: "Live map"
-    locked-arrival: "Arrival time and driver"
-    locked-details: "Updates, items and proof of delivery"
-    stage-preparing: "Being prepared"
-    stage-scheduled: "Scheduled"
-    stage-dispatched: "Driver assigned"
-    stage-in_transit: "In transit"
-    stage-delivered: "Delivered"
-    stage-issue: "Needs attention"
-    stage-canceled: "Canceled"
-    stage-toast-preparing: "Your order is being prepared"
-    stage-toast-scheduled: "Your delivery is scheduled"
-    stage-toast-dispatched: "A driver has been assigned"
-    stage-toast-in_transit: "Your order is on its way"
-    stage-toast-delivered: "Your order has been delivered"
-    stage-toast-issue: "There's an update on your delivery"
-    stage-toast-canceled: "Your order was canceled"
-    verify-title-short: "Verify it's you"
-    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
-    send-by: "Send the code by"
-    channel-sms: "Text message"
-    channel-email: "Email"
-    send-failed: "We couldn't send a code just now. Please try again."
-    sending: "Sending code..."
-    send-code: "Send code"
-    masked-note: "We only ever show part of your number or email here."
-    no-contact-title: "We can't verify you here"
-    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
-    call: "Call {phone}"
-    renew-title: "Get a new code"
-    renew-expired: "That code has expired. Codes last 10 minutes."
-    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
-    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
-    renew-failed: "Something went wrong. Request a new code to try again."
-    send-new-code: "Send a new code"
-    verified-title: "You're verified"
-    locked-title: "Codes paused"
-    enter-code: "Enter your code"
-    code-sent-sms: "We texted a 6-digit code to {masked}."
-    code-sent-email: "We emailed a 6-digit code to {masked}."
-    code-label: "6-digit code"
-    code-expires: "The code expires in 10 minutes."
-    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
-    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
-    code-success: "Verified. Opening your delivery..."
-    resend-in: "Resend code in {time}"
-    resend: "Resend code"
-    switch-to-sms: "Send by text instead"
-    switch-to-email: "Send by email instead"
-    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
-    verified-toast: "You're verified"
-    verified-toast-help: "This device stays verified for this delivery."
-    signed-out-toast: "Signed out on this device"
-    instructions-saved: "Delivery instructions saved"
-    action-failed: "That didn't work. Please try again."
-    report-sent: "Message sent"
-    report-sent-help: "{name} will get back to you."
-    share-copied: "Link copied"
-    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
-    your-stop: "Stop {number}"
-    your-stops: "Your stops"
-    sign-out: "Not you? Sign out"
-    live: "Live"
-    reconnecting: "Reconnecting... live updates paused"
-    timezone: "Times in your time zone ({zone})"
-    progress: "Delivery progress"
-    step-created: "Created"
-    step-dispatched: "Dispatched"
-    step-started: "Picked up"
+    track-another: "Suivre un autre colis"
+    unavailable-title: "Le suivi n'est pas disponible ici"
+    unavailable-help: "Cette page de suivi n'est pas activée. Utilisez le lien de votre e-mail de livraison ou contactez l'entreprise qui a expédié votre commande."
+    lookup-title: "Suivez votre livraison"
+    lookup-sub: "Voyez où se trouve votre colis et quand il arrivera."
+    tracking-number: "Numéro de suivi"
+    tracking-number-placeholder: "ex. NOR4829301736US"
+    tracking-number-help: "Vous le trouverez dans votre e-mail de confirmation ou sur l'étiquette du colis."
+    lookup-neutral: "Nous ne pouvons pas afficher le suivi pour ce numéro. Vérifiez qu'il correspond à votre e-mail ou à l'étiquette du colis, puis réessayez."
+    lookup-rate: "Vous avez fait plusieurs essais d'affilée. Faites une petite pause et réessayez dans quelques minutes."
+    looking-up: "Recherche en cours..."
+    track: "Suivre"
+    or: "ou"
+    your-orders: "Vos commandes"
+    sign-in: "Connectez-vous pour voir toutes vos commandes"
+    sign-in-account: "Connectez-vous à votre compte"
+    back: "Retour"
+    help: "Besoin d'aide ?"
+    language: "Langue"
+    powered-by: "Propulsé par Fleetbase"
+    dismiss: "Fermer"
+    chip-limited: "Vue limitée · Vérifiez pour voir les détails"
+    chip-verified: "Vérifié sur cet appareil"
+    chip-account: "Connecté"
+    chip-staff: "Aperçu équipe : ce que voit ce client"
+    status: "Statut"
+    verify-to-see: "Vérifiez pour voir votre livraison"
+    last-update: "Dernière mise à jour : {date}"
+    copy: "Copier"
+    verify-title: "Voir tous les détails de votre livraison"
+    verify-help: "Pour protéger votre vie privée, la carte, l'heure d'arrivée et les détails de livraison se débloquent après une vérification rapide. Nous enverrons un code à 6 chiffres au téléphone ou à l'e-mail de cette commande."
+    verify-button: "Confirmer votre identité"
+    verify-unlock: "Vérifiez pour débloquer"
+    locked-map: "Carte en direct"
+    locked-arrival: "Heure d'arrivée et chauffeur"
+    locked-details: "Mises à jour, articles et preuve de livraison"
+    stage-preparing: "En préparation"
+    stage-scheduled: "Planifiée"
+    stage-dispatched: "Chauffeur attribué"
+    stage-in_transit: "En cours d'acheminement"
+    stage-delivered: "Livrée"
+    stage-issue: "Action requise"
+    stage-canceled: "Annulée"
+    stage-toast-preparing: "Votre commande est en préparation"
+    stage-toast-scheduled: "Votre livraison est planifiée"
+    stage-toast-dispatched: "Un chauffeur a été attribué"
+    stage-toast-in_transit: "Votre commande est en route"
+    stage-toast-delivered: "Votre commande a été livrée"
+    stage-toast-issue: "Du nouveau concernant votre livraison"
+    stage-toast-canceled: "Votre commande a été annulée"
+    verify-title-short: "Confirmer votre identité"
+    verify-choose-help: "Pour protéger les détails de votre livraison, nous enverrons un code à 6 chiffres aux coordonnées de cette commande."
+    send-by: "Envoyer le code par"
+    channel-sms: "SMS"
+    channel-email: "E-mail"
+    send-failed: "Impossible d'envoyer un code pour le moment. Veuillez réessayer."
+    sending: "Envoi du code..."
+    send-code: "Envoyer le code"
+    masked-note: "Nous n'affichons jamais qu'une partie de votre numéro ou de votre e-mail ici."
+    no-contact-title: "Nous ne pouvons pas vous vérifier ici"
+    no-contact-help: "Cette commande n'a aucun numéro de téléphone ni e-mail auquel envoyer un code. {name} peut vous aider pour votre livraison."
+    call: "Appeler le {phone}"
+    renew-title: "Obtenir un nouveau code"
+    renew-expired: "Ce code a expiré. Les codes sont valables 10 minutes."
+    renew-unlocked: "Vous pouvez réessayer maintenant. Nous allons envoyer un nouveau code ; l'ancien ne fonctionne plus."
+    renew-limited: "Vous avez demandé plusieurs codes. Patientez quelques minutes avant d'en demander un autre."
+    renew-failed: "Un problème est survenu. Demandez un nouveau code pour réessayer."
+    send-new-code: "Envoyer un nouveau code"
+    verified-title: "Vous êtes vérifié"
+    locked-title: "Codes suspendus"
+    enter-code: "Saisissez votre code"
+    code-sent-sms: "Nous avons envoyé un code à 6 chiffres par SMS au {masked}."
+    code-sent-email: "Nous avons envoyé un code à 6 chiffres par e-mail à {masked}."
+    code-label: "Code à 6 chiffres"
+    code-expires: "Le code expire dans 10 minutes."
+    code-wrong: "Ce code ne correspond pas. {count, plural, one {# essai restant} other {# essais restants}}."
+    code-locked: "Trop de tentatives. Pour votre sécurité, les codes sont suspendus. Réessayez dans {time}."
+    code-success: "Vérifié. Ouverture de votre livraison..."
+    resend-in: "Renvoyer le code dans {time}"
+    resend: "Renvoyer le code"
+    switch-to-sms: "Envoyer plutôt par SMS"
+    switch-to-email: "Envoyer plutôt par e-mail"
+    stay-verified: "Une fois vérifié, cet appareil le reste pendant {hours} heures. Vous pouvez vous déconnecter à tout moment."
+    verified-toast: "Vous êtes vérifié"
+    verified-toast-help: "Cet appareil reste vérifié pour cette livraison."
+    signed-out-toast: "Déconnecté sur cet appareil"
+    instructions-saved: "Instructions de livraison enregistrées"
+    action-failed: "Cela n'a pas fonctionné. Veuillez réessayer."
+    report-sent: "Message envoyé"
+    report-sent-help: "{name} vous répondra."
+    share-copied: "Lien copié"
+    share-copied-help: "Les personnes avec qui vous le partagez voient une vue limitée jusqu'à ce qu'elles se vérifient."
+    your-stop: "Arrêt {number}"
+    your-stops: "Vos arrêts"
+    sign-out: "Ce n'est pas vous ? Déconnectez-vous"
+    live: "En direct"
+    reconnecting: "Reconnexion... mises à jour en direct suspendues"
+    timezone: "Heures dans votre fuseau horaire ({zone})"
+    progress: "Avancement de la livraison"
+    step-created: "Créée"
+    step-dispatched: "Expédiée"
+    step-started: "Récupérée"
     step-enroute: "En route"
-    step-delivered: "Delivered"
-    step-issue: "Attempt missed"
-    step-canceled: "Canceled"
-    headline-preparing: "Getting your order ready"
-    headline-scheduled: "Scheduled for {date}"
-    headline-dispatched: "A driver has been assigned"
-    headline-delayed: "Running a little late"
-    headline-arriving: "Arriving {day}"
-    headline-in-transit: "On its way"
-    headline-delivered: "Delivered"
-    headline-issue: "There's a problem with your delivery"
-    headline-canceled: "This order was canceled"
-    sub-arriving: "{window} · in about {minutes} min"
-    sub-window: "Delivery window {window}"
+    step-delivered: "Livrée"
+    step-issue: "Tentative manquée"
+    step-canceled: "Annulée"
+    headline-preparing: "Nous préparons votre commande"
+    headline-scheduled: "Prévue le {date}"
+    headline-dispatched: "Un chauffeur a été attribué"
+    headline-delayed: "Un petit retard"
+    headline-arriving: "Arrive {day}"
+    headline-in-transit: "En route"
+    headline-delivered: "Livrée"
+    headline-issue: "Un problème est survenu avec votre livraison"
+    headline-canceled: "Cette commande a été annulée"
+    sub-arriving: "{window} · dans environ {minutes} min"
+    sub-window: "Créneau de livraison {window}"
     sub-delivered: "{when}"
-    sub-dispatched: "Live tracking starts as soon as they're on the way."
-    sub-preparing: "We'll let you know when it's on its way."
-    delayed-title: "Running late."
-    delayed-help: "We'll keep your arrival time up to date."
-    stop-of: "Your delivery is stop {position} of {total}"
-    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
-    map: "Map"
-    map-label: "Map of your delivery: the van on its way to your address."
-    map-pickup: "Pickup area"
-    map-driver: "Driver"
-    map-pickup-named: "Pickup · {name}"
-    map-fullscreen: "Full screen map"
-    map-exit-fullscreen: "Exit full screen"
-    stop-card-title: "Delivering to"
-    stop-upcoming: "Upcoming"
-    stop-complete: "Delivered"
-    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
-    last-seen: "Last seen {minutes} min ago"
-    recenter: "Center the map on the van"
-    fit-route: "Show the whole route"
-    eta: "Estimated arrival"
-    in-minutes: "in about {minutes} min"
-    window: "Delivery window"
-    before-yours: "Before yours"
-    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
-    estimate-may-change: "Estimate may change"
-    driver: "Your driver"
-    online: "Online"
-    location-paused: "Location paused"
-    call-short: "Call"
+    sub-dispatched: "Le suivi en direct commence dès que le chauffeur est en route."
+    sub-preparing: "Nous vous préviendrons dès qu'elle sera en route."
+    delayed-title: "En retard."
+    delayed-help: "Nous tiendrons votre heure d'arrivée à jour."
+    stop-of: "Votre livraison est l'arrêt {position} sur {total}"
+    stops-private: "{count, plural, =0 {Vous êtes le prochain.} one {Encore # arrêt avant le vôtre.} other {Encore # arrêts avant le vôtre.}} Les autres arrêts restent privés : vous ne voyez que le vôtre."
+    map: "Carte"
+    map-label: "Carte de votre livraison : la camionnette en route vers votre adresse."
+    map-pickup: "Zone d'enlèvement"
+    map-driver: "Chauffeur"
+    map-pickup-named: "Enlèvement · {name}"
+    map-fullscreen: "Carte en plein écran"
+    map-exit-fullscreen: "Quitter le plein écran"
+    stop-card-title: "Livraison à"
+    stop-upcoming: "À venir"
+    stop-complete: "Livrée"
+    map-hidden: "La carte est masquée maintenant que votre commande est livrée. Nous cessons de partager la position du chauffeur à votre porte."
+    last-seen: "Vu il y a {minutes} min"
+    recenter: "Centrer la carte sur la camionnette"
+    fit-route: "Afficher tout l'itinéraire"
+    eta: "Arrivée estimée"
+    in-minutes: "dans environ {minutes} min"
+    window: "Créneau de livraison"
+    before-yours: "Avant le vôtre"
+    stops-count: "{count, plural, =0 {Aucun} one {# arrêt} other {# arrêts}}"
+    estimate-may-change: "Estimation susceptible de changer"
+    driver: "Votre chauffeur"
+    online: "En ligne"
+    location-paused: "Position suspendue"
+    call-short: "Appeler"
     message: "Message"
-    contact-note: "Calls and messages go to the {name} support team."
-    proof: "Proof of delivery"
-    open-photo: "Open the delivery photo"
-    open-signature: "Open the signature"
-    open-scan: "Open the scan"
-    proof-photo: "Delivery photo"
+    contact-note: "Les appels et messages sont adressés à l'équipe support de {name}."
+    proof: "Preuve de livraison"
+    open-photo: "Ouvrir la photo de livraison"
+    open-signature: "Ouvrir la signature"
+    open-scan: "Ouvrir le scan"
+    proof-photo: "Photo de livraison"
     proof-signature: "Signature"
-    proof-scan: "Scanned at the door"
-    instructions: "Delivery instructions"
-    edit: "Edit"
-    instructions-help: "Gate codes, where to leave it, or who can sign"
-    cancel: "Cancel"
-    save: "Save"
-    no-instructions: "No instructions yet."
-    updates: "Updates"
-    no-updates: "No updates yet."
-    show-fewer: "Show fewer updates"
-    show-earlier: "Show earlier updates ({count})"
-    today: "Today"
-    yesterday: "Yesterday"
-    items: "In this delivery"
-    item: "Item"
-    quantity: "Qty {count}"
-    share: "Share tracking"
-    report: "Report a problem"
-    contact: "Contact {name}"
-    report-label: "What's wrong with your delivery?"
-    send: "Send"
-    close: "Close"
-    no-orders: "No orders yet"
-    no-orders-help: "Deliveries for your account will show up here."
+    proof-scan: "Scanné à la porte"
+    instructions: "Instructions de livraison"
+    edit: "Modifier"
+    instructions-help: "Codes de portail, où le déposer ou qui peut signer"
+    cancel: "Annuler"
+    save: "Enregistrer"
+    no-instructions: "Aucune instruction pour l'instant."
+    updates: "Mises à jour"
+    no-updates: "Aucune mise à jour pour l'instant."
+    show-fewer: "Afficher moins de mises à jour"
+    show-earlier: "Afficher les mises à jour précédentes ({count})"
+    today: "Aujourd'hui"
+    yesterday: "Hier"
+    items: "Dans cette livraison"
+    item: "Article"
+    quantity: "Qté {count}"
+    share: "Partager le suivi"
+    report: "Signaler un problème"
+    contact: "Contacter {name}"
+    report-label: "Quel est le problème avec votre livraison ?"
+    send: "Envoyer"
+    close: "Fermer"
+    no-orders: "Aucune commande pour l'instant"
+    no-orders-help: "Les livraisons de votre compte apparaîtront ici."
diff --git a/translations/mn-mn.yaml b/translations/mn-mn.yaml
index 6da2436ff..b5dc7fc24 100644
--- a/translations/mn-mn.yaml
+++ b/translations/mn-mn.yaml
@@ -2318,275 +2318,275 @@ trailer:
     other: Бусад
 tracking-page:
   settings:
-    title: "Tracking Page"
-    menu: "Tracking Page"
-    saved: "Tracking page settings saved."
-    load-failed: "We couldn't load the tracking page settings."
-    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
-    pages: "Pages"
-    org-page-enabled: "Your own tracking page"
-    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
-    slug: "Page address"
-    slug-checking: "Checking the address..."
-    open-page: "Open the page"
-    generic-page-allowed: "Allow tracking on the shared page"
-    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
-    links-target: "Links in emails and labels"
-    links-target-help: "Which page your notifications and labels send customers to."
-    links-target-auto: "Your page when it is on, otherwise the shared page"
-    links-target-org: "Always your page"
-    links-target-generic: "Always the shared page"
-    branding: "Branding"
-    display-name: "Display name"
-    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
-    accent: "Accent colour"
-    accent-hex: "Accent colour as a hex value"
-    placeholder-slug: "your-company"
+    title: "Хянах хуудас"
+    menu: "Хянах хуудас"
+    saved: "Хянах хуудасны тохиргоо хадгалагдлаа."
+    load-failed: "Хянах хуудасны тохиргоог ачаалж чадсангүй."
+    load-failed-help: "Дахин оролдохын тулд хуудсаа шинэчилнэ үү. Хэрэв давтагдсаар байвал эдгээр тохиргоог харах эрхтэй эсэхээ шалгана уу."
+    pages: "Хуудсууд"
+    org-page-enabled: "Таны өөрийн хянах хуудас"
+    org-page-enabled-help: "Өөрийн хаягтай, таны брэндээр хийгдсэн хянах хуудас. Зөвхөн таны байгууллагын хянах дугаарыг хайна."
+    slug: "Хуудасны хаяг"
+    slug-checking: "Хаягийг шалгаж байна..."
+    open-page: "Хуудсыг нээх"
+    generic-page-allowed: "Нийтийн хуудсаар хянахыг зөвшөөрөх"
+    generic-page-allowed-help: "Харилцагчид таны хянах дугаарыг {url} хаягаар хайх боломжтой. Зөвхөн өөрийн хуудсаар хянуулахыг хүсвэл унтраана уу."
+    links-target: "Имэйл болон шошгон дээрх холбоос"
+    links-target-help: "Таны мэдэгдэл болон шошго харилцагчдыг аль хуудас руу чиглүүлэх."
+    links-target-auto: "Асаалттай бол таны хуудас, үгүй бол нийтийн хуудас"
+    links-target-org: "Үргэлж таны хуудас"
+    links-target-generic: "Үргэлж нийтийн хуудас"
+    branding: "Брэнд"
+    display-name: "Харагдах нэр"
+    logo-help: "Хуудас таны байгууллагын логог ашиглана. Лого байхгүй бол харагдах нэрийн эхний үсгийг харуулна."
+    accent: "Онцлох өнгө"
+    accent-hex: "Онцлох өнгийн hex утга"
+    placeholder-slug: "tany-kompani"
     placeholder-phone: "+1 555 010 0100"
     placeholder-email: "support@example.com"
     placeholder-website: "https://example.com"
-    placeholder-select: "Select an option"
-    contrast-ok: "Text on this colour is readable ({ratio}:1)."
-    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
-    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
-    accent-dark: "Accent colour in dark mode"
-    accent-dark-auto: "Automatic"
-    support-phone: "Support phone"
-    support-email: "Support email"
-    website: "Website"
-    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
-    powered-by: "Show \"Powered by Fleetbase\""
-    powered-by-help: "A small line in the page footer."
-    theme: "Light and dark"
-    theme-system: "Follow the customer's device"
-    theme-light: "Always light"
-    default-language: "Default language"
-    languages: "Languages customers can choose"
-    access: "Access"
-    public-status: "Show the status without verification"
-    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
-    channel-sms: "Verify by text message"
-    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
-    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
-    channel-email: "Verify by email"
-    channel-email-help: "Sends a 6-digit code to the email address on the order."
-    session-hours: "Stay verified for (hours)"
-    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
-    account-sign-in: "Let customers sign in"
-    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
-    account-upsell: "Suggest creating an account"
-    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
-    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
-    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
-    visibility: "What verified customers see"
-    visibility-map: "Live map"
-    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
-    visibility-driver_name: "Driver's first name"
-    visibility-driver_name-help: "Only the first name, never a surname or phone number."
-    visibility-vehicle: "Vehicle description"
-    visibility-vehicle-help: "For example \"White Ford Transit\"."
-    visibility-items: "Items in the delivery"
-    visibility-items-help: "Names, descriptions, quantities and photos."
-    visibility-item_prices: "Item prices"
-    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
-    visibility-pod_photo: "Delivery photo"
-    visibility-pod_photo-help: "The photo taken as proof of delivery."
-    visibility-pod_signature: "Signature"
-    visibility-pod_signature-help: "The signature captured as proof of delivery."
-    visibility-instructions_edit: "Let customers add delivery instructions"
-    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
-    visibility-report_problem: "Report a problem"
-    visibility-report_problem-help: "Lets customers send you a message about their delivery."
-    driver-contact: "Calls and messages go to"
-    driver-contact-help: "Who customers reach from the driver card."
-    driver-contact-company: "Your support team"
-    driver-contact-driver: "The driver directly"
-    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
-    preview: "Preview"
-    preview-help: "A sample in light and dark mode. Save to apply the changes."
-    preview-chip: "Verified on this device"
-    preview-headline: "Arriving today"
-    preview-sub: "2:10 to 2:40 pm"
-    preview-button: "Verify it's you"
+    placeholder-select: "Сонголт хийнэ үү"
+    contrast-ok: "Энэ өнгөн дээрх текст уншигдахуйц байна ({ratio}:1)."
+    contrast-low: "Энэ өнгөн дээрх текст уншихад хэцүү байна ({ratio}:1). Илүү бараан эсвэл цайвар өнгө сонгоно уу."
+    accent-help: "Товч, явц болон онцлох хэсэгт ашиглагдана. Түүн дээрх текстийн өнгийг автоматаар сонгоно."
+    accent-dark: "Бараан горимын онцлох өнгө"
+    accent-dark-auto: "Автомат"
+    support-phone: "Тусламжийн утас"
+    support-email: "Тусламжийн имэйл"
+    website: "Вэбсайт"
+    support-help: "Байгууллагынхаа мэдээллийг ашиглах бол хоосон үлдээнэ үү. Харилцагчдын дуудлага, мессеж энд ирнэ."
+    powered-by: "\"Powered by Fleetbase\"-ийг харуулах"
+    powered-by-help: "Хуудасны доод хэсэгт жижиг мөр."
+    theme: "Цайвар ба бараан"
+    theme-system: "Харилцагчийн төхөөрөмжийг дагах"
+    theme-light: "Үргэлж цайвар"
+    default-language: "Үндсэн хэл"
+    languages: "Харилцагчдын сонгож болох хэлүүд"
+    access: "Хандалт"
+    public-status: "Баталгаажуулалтгүйгээр төлөвийг харуулах"
+    public-status-help: "Зөвхөн хянах дугаартай үед харилцагчид хүргэлтийн үе шат болон сүүлийн шинэчлэлтийн огноог харна. Баталгаажуулах хүртэл юу ч харуулахгүй байх бол унтраана уу."
+    channel-sms: "SMS-ээр баталгаажуулах"
+    channel-sms-help: "Захиалгад бүртгэлтэй утас руу 6 оронтой код илгээнэ."
+    channel-sms-unavailable: "Энэ системд SMS үйлчилгээ үзүүлэгч тохируулагдаагүй тул кодыг SMS-ээр илгээх боломжгүй."
+    channel-email: "Имэйлээр баталгаажуулах"
+    channel-email-help: "Захиалгад бүртгэлтэй имэйл хаяг руу 6 оронтой код илгээнэ."
+    session-hours: "Баталгаажсан хэвээр байх хугацаа (цаг)"
+    session-hours-help: "Зөв код оруулсны дараа төхөөрөмж хэр удаан баталгаажсан хэвээр байх. 1-ээс 168 цагийн хооронд."
+    account-sign-in: "Харилцагчдыг нэвтрэхийг зөвшөөрөх"
+    account-sign-in-help: "Харилцагчийн порталд бүртгэлтэй харилцагчид нэвтэрч, бүх захиалгаа кодгүйгээр харах боломжтой."
+    account-upsell: "Бүртгэл үүсгэхийг санал болгох"
+    account-upsell-help: "Хүргэлтийн дараа бүртгэлгүй, баталгаажсан харилцагчдыг бүртгэл үүсгэхийг урина."
+    customer-portal-missing: "Харилцагчид нэвтэрч, бүх захиалгаа харах боломжтой болгохын тулд Customer Portal өргөтгөлийг суулгана уу."
+    code-rules: "Код 6 оронтой бөгөөд 10 минутын дараа хүчингүй болно. 3 удаа буруу код оруулбал 5 минут түр зогсооно."
+    visibility: "Баталгаажсан харилцагчид юу харах вэ"
+    visibility-map: "Шууд газрын зураг"
+    visibility-map-help: "Тээврийн хэрэгсэл харилцагч руу явж байх үеийн маршрут болон байршил."
+    visibility-driver_name: "Жолоочийн нэр"
+    visibility-driver_name-help: "Зөвхөн нэр, овог болон утасны дугаарыг хэзээ ч харуулахгүй."
+    visibility-vehicle: "Тээврийн хэрэгслийн тодорхойлолт"
+    visibility-vehicle-help: "Жишээ нь \"Цагаан Ford Transit\"."
+    visibility-items: "Хүргэлтийн бараа"
+    visibility-items-help: "Нэр, тайлбар, тоо ширхэг, зураг."
+    visibility-item_prices: "Барааны үнэ"
+    visibility-item_prices-help: "Зөвхөн захиалга өгсөн, нэвтэрсэн харилцагчдад харагдана."
+    visibility-pod_photo: "Хүргэлтийн зураг"
+    visibility-pod_photo-help: "Хүргэлтийн нотолгоо болгон авсан зураг."
+    visibility-pod_signature: "Гарын үсэг"
+    visibility-pod_signature-help: "Хүргэлтийн нотолгоо болгон авсан гарын үсэг."
+    visibility-instructions_edit: "Харилцагчдад хүргэлтийн заавар нэмэхийг зөвшөөрөх"
+    visibility-instructions_edit-help: "Жишээ нь хаалганы код эсвэл илгээмжийг хаана үлдээх."
+    visibility-report_problem: "Асуудал мэдэгдэх"
+    visibility-report_problem-help: "Харилцагчид хүргэлтийнхээ талаар танд мессеж илгээх боломжтой."
+    driver-contact: "Дуудлага, мессеж хэнд очих вэ"
+    driver-contact-help: "Жолоочийн карт дээрээс харилцагчид хэнтэй холбогдох."
+    driver-contact-company: "Таны тусламжийн баг"
+    driver-contact-driver: "Жолоочтой шууд"
+    privacy-rules: "Үргэлж мөрдөгдөнө: харилцагчид зөвхөн өөрийн зогсоол, бараагаа харна, хүргэлтийн дараа газрын зураг болон жолоочийг нууна, жолоочийн байршлыг зөвхөн замдаа явж байхад харуулна."
+    preview: "Урьдчилан харах"
+    preview-help: "Цайвар ба бараан горимын жишээ. Өөрчлөлтийг хэрэгжүүлэхийн тулд хадгална уу."
+    preview-chip: "Энэ төхөөрөмж дээр баталгаажсан"
+    preview-headline: "Өнөөдөр ирнэ"
+    preview-sub: "14:10-14:40"
+    preview-button: "Өөрийгөө баталгаажуулах"
     preview-powered-by: "Powered by Fleetbase"
   page:
-    track-another: "Track another"
-    unavailable-title: "Tracking isn't available here"
-    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
-    lookup-title: "Track your delivery"
-    lookup-sub: "See where your parcel is and when it will arrive."
-    tracking-number: "Tracking number"
-    tracking-number-placeholder: "e.g. NOR4829301736US"
-    tracking-number-help: "Find it in your confirmation email or on the parcel label."
-    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
-    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
-    looking-up: "Looking it up..."
-    track: "Track"
-    or: "or"
-    your-orders: "Your orders"
-    sign-in: "Sign in to see all your orders"
-    sign-in-account: "Sign in to your account"
-    back: "Back"
-    help: "Need help?"
-    language: "Language"
+    track-another: "Өөр илгээмж хянах"
+    unavailable-title: "Энд хянах боломжгүй байна"
+    unavailable-help: "Энэ хянах хуудас идэвхжээгүй байна. Хүргэлтийн имэйл дэх холбоосыг ашиглах эсвэл захиалгыг тань илгээсэн компанитай холбогдоно уу."
+    lookup-title: "Хүргэлтээ хянах"
+    lookup-sub: "Илгээмж тань хаана байгаа, хэзээ ирэхийг хараарай."
+    tracking-number: "Хянах дугаар"
+    tracking-number-placeholder: "ж.нь NOR4829301736US"
+    tracking-number-help: "Баталгаажуулах имэйл эсвэл илгээмжийн шошгоноос олоорой."
+    lookup-neutral: "Энэ дугаараар хянах мэдээлэл харуулах боломжгүй. Имэйл эсвэл шошгон дээрх дугаартай таарч байгаа эсэхийг шалгаад дахин оролдоно уу."
+    lookup-rate: "Та дараалан хэд хэдэн удаа оролдлоо. Жаахан амраад хэдэн минутын дараа дахин оролдоно уу."
+    looking-up: "Хайж байна..."
+    track: "Хянах"
+    or: "эсвэл"
+    your-orders: "Таны захиалгууд"
+    sign-in: "Бүх захиалгаа харахын тулд нэвтэрнэ үү"
+    sign-in-account: "Бүртгэлдээ нэвтрэх"
+    back: "Буцах"
+    help: "Тусламж хэрэгтэй юу?"
+    language: "Хэл"
     powered-by: "Powered by Fleetbase"
-    dismiss: "Dismiss"
-    chip-limited: "Limited view · Verify to see details"
-    chip-verified: "Verified on this device"
-    chip-account: "Signed in"
-    chip-staff: "Staff preview: what this customer sees"
-    status: "Status"
-    verify-to-see: "Verify to see your delivery"
-    last-update: "Last update: {date}"
-    copy: "Copy"
-    verify-title: "See your full delivery details"
-    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
-    verify-button: "Verify it's you"
-    verify-unlock: "Verify to unlock"
-    locked-map: "Live map"
-    locked-arrival: "Arrival time and driver"
-    locked-details: "Updates, items and proof of delivery"
-    stage-preparing: "Being prepared"
-    stage-scheduled: "Scheduled"
-    stage-dispatched: "Driver assigned"
-    stage-in_transit: "In transit"
-    stage-delivered: "Delivered"
-    stage-issue: "Needs attention"
-    stage-canceled: "Canceled"
-    stage-toast-preparing: "Your order is being prepared"
-    stage-toast-scheduled: "Your delivery is scheduled"
-    stage-toast-dispatched: "A driver has been assigned"
-    stage-toast-in_transit: "Your order is on its way"
-    stage-toast-delivered: "Your order has been delivered"
-    stage-toast-issue: "There's an update on your delivery"
-    stage-toast-canceled: "Your order was canceled"
-    verify-title-short: "Verify it's you"
-    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
-    send-by: "Send the code by"
-    channel-sms: "Text message"
-    channel-email: "Email"
-    send-failed: "We couldn't send a code just now. Please try again."
-    sending: "Sending code..."
-    send-code: "Send code"
-    masked-note: "We only ever show part of your number or email here."
-    no-contact-title: "We can't verify you here"
-    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
-    call: "Call {phone}"
-    renew-title: "Get a new code"
-    renew-expired: "That code has expired. Codes last 10 minutes."
-    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
-    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
-    renew-failed: "Something went wrong. Request a new code to try again."
-    send-new-code: "Send a new code"
-    verified-title: "You're verified"
-    locked-title: "Codes paused"
-    enter-code: "Enter your code"
-    code-sent-sms: "We texted a 6-digit code to {masked}."
-    code-sent-email: "We emailed a 6-digit code to {masked}."
-    code-label: "6-digit code"
-    code-expires: "The code expires in 10 minutes."
-    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
-    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
-    code-success: "Verified. Opening your delivery..."
-    resend-in: "Resend code in {time}"
-    resend: "Resend code"
-    switch-to-sms: "Send by text instead"
-    switch-to-email: "Send by email instead"
-    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
-    verified-toast: "You're verified"
-    verified-toast-help: "This device stays verified for this delivery."
-    signed-out-toast: "Signed out on this device"
-    instructions-saved: "Delivery instructions saved"
-    action-failed: "That didn't work. Please try again."
-    report-sent: "Message sent"
-    report-sent-help: "{name} will get back to you."
-    share-copied: "Link copied"
-    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
-    your-stop: "Stop {number}"
-    your-stops: "Your stops"
-    sign-out: "Not you? Sign out"
-    live: "Live"
-    reconnecting: "Reconnecting... live updates paused"
-    timezone: "Times in your time zone ({zone})"
-    progress: "Delivery progress"
-    step-created: "Created"
-    step-dispatched: "Dispatched"
-    step-started: "Picked up"
-    step-enroute: "En route"
-    step-delivered: "Delivered"
-    step-issue: "Attempt missed"
-    step-canceled: "Canceled"
-    headline-preparing: "Getting your order ready"
-    headline-scheduled: "Scheduled for {date}"
-    headline-dispatched: "A driver has been assigned"
-    headline-delayed: "Running a little late"
-    headline-arriving: "Arriving {day}"
-    headline-in-transit: "On its way"
-    headline-delivered: "Delivered"
-    headline-issue: "There's a problem with your delivery"
-    headline-canceled: "This order was canceled"
-    sub-arriving: "{window} · in about {minutes} min"
-    sub-window: "Delivery window {window}"
+    dismiss: "Хаах"
+    chip-limited: "Хязгаарлагдмал харагдац · Дэлгэрэнгүйг харахын тулд баталгаажуулна уу"
+    chip-verified: "Энэ төхөөрөмж дээр баталгаажсан"
+    chip-account: "Нэвтэрсэн"
+    chip-staff: "Ажилтны урьдчилсан харагдац: энэ харилцагч юу харж байгаа"
+    status: "Төлөв"
+    verify-to-see: "Хүргэлтээ харахын тулд баталгаажуулна уу"
+    last-update: "Сүүлд шинэчилсэн: {date}"
+    copy: "Хуулах"
+    verify-title: "Хүргэлтийнхээ бүрэн мэдээллийг харах"
+    verify-help: "Таны нууцлалыг хамгаалах үүднээс газрын зураг, ирэх цаг болон хүргэлтийн дэлгэрэнгүй мэдээлэл богино шалгалтын дараа нээгдэнэ. Бид энэ захиалгын утас эсвэл имэйл рүү 6 оронтой код илгээнэ."
+    verify-button: "Өөрийгөө баталгаажуулах"
+    verify-unlock: "Нээхийн тулд баталгаажуулна уу"
+    locked-map: "Шууд газрын зураг"
+    locked-arrival: "Ирэх цаг ба жолооч"
+    locked-details: "Шинэчлэл, бараа болон хүргэлтийн нотолгоо"
+    stage-preparing: "Бэлтгэж байна"
+    stage-scheduled: "Товлогдсон"
+    stage-dispatched: "Жолооч томилогдсон"
+    stage-in_transit: "Замд яваа"
+    stage-delivered: "Хүргэгдсэн"
+    stage-issue: "Анхаарал шаардлагатай"
+    stage-canceled: "Цуцлагдсан"
+    stage-toast-preparing: "Таны захиалгыг бэлтгэж байна"
+    stage-toast-scheduled: "Таны хүргэлт товлогдлоо"
+    stage-toast-dispatched: "Жолооч томилогдлоо"
+    stage-toast-in_transit: "Таны захиалга замдаа явж байна"
+    stage-toast-delivered: "Таны захиалга хүргэгдлээ"
+    stage-toast-issue: "Таны хүргэлтэд шинэ мэдээлэл байна"
+    stage-toast-canceled: "Таны захиалга цуцлагдлаа"
+    verify-title-short: "Өөрийгөө баталгаажуулах"
+    verify-choose-help: "Хүргэлтийн мэдээллийг тань хамгаалахын тулд бид энэ захиалгын холбоо барих хаяг руу 6 оронтой код илгээнэ."
+    send-by: "Кодыг илгээх арга"
+    channel-sms: "SMS"
+    channel-email: "Имэйл"
+    send-failed: "Одоогоор код илгээж чадсангүй. Дахин оролдоно уу."
+    sending: "Код илгээж байна..."
+    send-code: "Код илгээх"
+    masked-note: "Бид энд таны дугаар эсвэл имэйлийн зөвхөн хэсгийг харуулдаг."
+    no-contact-title: "Энд таныг баталгаажуулах боломжгүй"
+    no-contact-help: "Энэ захиалгад код илгээх утасны дугаар эсвэл имэйл алга. {name} таны хүргэлтэд туслах боломжтой."
+    call: "{phone} руу залгах"
+    renew-title: "Шинэ код авах"
+    renew-expired: "Тэр кодын хугацаа дууссан. Код 10 минут хүчинтэй."
+    renew-unlocked: "Одоо дахин оролдож болно. Бид шинэ код илгээнэ; хуучин код ажиллахаа больсон."
+    renew-limited: "Та хэд хэдэн код хүссэн байна. Дахин хүсэхээсээ өмнө хэдэн минут хүлээнэ үү."
+    renew-failed: "Алдаа гарлаа. Дахин оролдохын тулд шинэ код хүснэ үү."
+    send-new-code: "Шинэ код илгээх"
+    verified-title: "Та баталгаажлаа"
+    locked-title: "Код түр зогссон"
+    enter-code: "Кодоо оруулна уу"
+    code-sent-sms: "Бид {masked} руу 6 оронтой код SMS-ээр илгээлээ."
+    code-sent-email: "Бид {masked} руу 6 оронтой код имэйлээр илгээлээ."
+    code-label: "6 оронтой код"
+    code-expires: "Код 10 минутын дараа хүчингүй болно."
+    code-wrong: "Код таарсангүй. {count, plural, one {# оролдлого} other {# оролдлого}} үлдлээ."
+    code-locked: "Хэт олон оролдлого хийлээ. Таны аюулгүй байдлын үүднээс кодыг түр зогсоолоо. {time}-ийн дараа дахин оролдоно уу."
+    code-success: "Баталгаажлаа. Хүргэлтийг тань нээж байна..."
+    resend-in: "{time}-ийн дараа дахин илгээх"
+    resend: "Кодыг дахин илгээх"
+    switch-to-sms: "Оронд нь SMS-ээр илгээх"
+    switch-to-email: "Оронд нь имэйлээр илгээх"
+    stay-verified: "Баталгаажсаны дараа энэ төхөөрөмж {hours} цагийн турш баталгаажсан хэвээр байна. Та хүссэн үедээ гарч болно."
+    verified-toast: "Та баталгаажлаа"
+    verified-toast-help: "Энэ төхөөрөмж энэ хүргэлтийн хувьд баталгаажсан хэвээр байна."
+    signed-out-toast: "Энэ төхөөрөмжөөс гарлаа"
+    instructions-saved: "Хүргэлтийн заавар хадгалагдлаа"
+    action-failed: "Амжилтгүй боллоо. Дахин оролдоно уу."
+    report-sent: "Мессеж илгээгдлээ"
+    report-sent-help: "{name} тантай эргэн холбогдоно."
+    share-copied: "Холбоос хуулагдлаа"
+    share-copied-help: "Таны хуваалцсан хүмүүс өөрсдийгөө баталгаажуулах хүртлээ хязгаарлагдмал мэдээлэл харна."
+    your-stop: "{number}-р зогсоол"
+    your-stops: "Таны зогсоолууд"
+    sign-out: "Та биш үү? Гарах"
+    live: "Шууд"
+    reconnecting: "Дахин холбогдож байна... шууд шинэчлэл түр зогссон"
+    timezone: "Таны цагийн бүсээр ({zone})"
+    progress: "Хүргэлтийн явц"
+    step-created: "Үүсгэсэн"
+    step-dispatched: "Илгээсэн"
+    step-started: "Авсан"
+    step-enroute: "Замд яваа"
+    step-delivered: "Хүргэгдсэн"
+    step-issue: "Хүргэж чадаагүй"
+    step-canceled: "Цуцлагдсан"
+    headline-preparing: "Таны захиалгыг бэлтгэж байна"
+    headline-scheduled: "{date}-нд товлогдсон"
+    headline-dispatched: "Жолооч томилогдлоо"
+    headline-delayed: "Бага зэрэг хоцорч байна"
+    headline-arriving: "{day} ирнэ"
+    headline-in-transit: "Замдаа явж байна"
+    headline-delivered: "Хүргэгдсэн"
+    headline-issue: "Таны хүргэлтэд асуудал гарлаа"
+    headline-canceled: "Энэ захиалга цуцлагдсан"
+    sub-arriving: "{window} · ойролцоогоор {minutes} минутын дараа"
+    sub-window: "Хүргэлтийн хугацаа {window}"
     sub-delivered: "{when}"
-    sub-dispatched: "Live tracking starts as soon as they're on the way."
-    sub-preparing: "We'll let you know when it's on its way."
-    delayed-title: "Running late."
-    delayed-help: "We'll keep your arrival time up to date."
-    stop-of: "Your delivery is stop {position} of {total}"
-    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
-    map: "Map"
-    map-label: "Map of your delivery: the van on its way to your address."
-    map-pickup: "Pickup area"
-    map-driver: "Driver"
-    map-pickup-named: "Pickup · {name}"
-    map-fullscreen: "Full screen map"
-    map-exit-fullscreen: "Exit full screen"
-    stop-card-title: "Delivering to"
-    stop-upcoming: "Upcoming"
-    stop-complete: "Delivered"
-    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
-    last-seen: "Last seen {minutes} min ago"
-    recenter: "Center the map on the van"
-    fit-route: "Show the whole route"
-    eta: "Estimated arrival"
-    in-minutes: "in about {minutes} min"
-    window: "Delivery window"
-    before-yours: "Before yours"
-    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
-    estimate-may-change: "Estimate may change"
-    driver: "Your driver"
-    online: "Online"
-    location-paused: "Location paused"
-    call-short: "Call"
-    message: "Message"
-    contact-note: "Calls and messages go to the {name} support team."
-    proof: "Proof of delivery"
-    open-photo: "Open the delivery photo"
-    open-signature: "Open the signature"
-    open-scan: "Open the scan"
-    proof-photo: "Delivery photo"
-    proof-signature: "Signature"
-    proof-scan: "Scanned at the door"
-    instructions: "Delivery instructions"
-    edit: "Edit"
-    instructions-help: "Gate codes, where to leave it, or who can sign"
-    cancel: "Cancel"
-    save: "Save"
-    no-instructions: "No instructions yet."
-    updates: "Updates"
-    no-updates: "No updates yet."
-    show-fewer: "Show fewer updates"
-    show-earlier: "Show earlier updates ({count})"
-    today: "Today"
-    yesterday: "Yesterday"
-    items: "In this delivery"
-    item: "Item"
-    quantity: "Qty {count}"
-    share: "Share tracking"
-    report: "Report a problem"
-    contact: "Contact {name}"
-    report-label: "What's wrong with your delivery?"
-    send: "Send"
-    close: "Close"
-    no-orders: "No orders yet"
-    no-orders-help: "Deliveries for your account will show up here."
+    sub-dispatched: "Жолооч замд гармагц шууд хяналт эхэлнэ."
+    sub-preparing: "Замд гарахад бид танд мэдэгдэнэ."
+    delayed-title: "Хоцорч байна."
+    delayed-help: "Бид таны ирэх цагийг шинэчилсээр байх болно."
+    stop-of: "Таны хүргэлт {total}-аас {position}-р зогсоол"
+    stops-private: "{count, plural, =0 {Дараагийнх нь та.} one {Таныхаас өмнө # зогсоол үлдлээ.} other {Таныхаас өмнө # зогсоол үлдлээ.}} Бусад зогсоол нууц тул та зөвхөн өөрийнхөө зогсоолыг харна."
+    map: "Газрын зураг"
+    map-label: "Таны хүргэлтийн газрын зураг: таны хаяг руу явж буй машин."
+    map-pickup: "Авах цэг"
+    map-driver: "Жолооч"
+    map-pickup-named: "Авах цэг · {name}"
+    map-fullscreen: "Газрын зургийг бүтэн дэлгэцээр"
+    map-exit-fullscreen: "Бүтэн дэлгэцээс гарах"
+    stop-card-title: "Хүргэх хаяг"
+    stop-upcoming: "Удахгүй"
+    stop-complete: "Хүргэгдсэн"
+    map-hidden: "Таны захиалга хүргэгдсэн тул газрын зургийг нууллаа. Бид жолоочийн байршлыг таны үүдэнд хуваалцахаа зогсоодог."
+    last-seen: "{minutes} минутын өмнө харагдсан"
+    recenter: "Газрын зургийг машин дээр төвлөрүүлэх"
+    fit-route: "Маршрутыг бүтнээр харуулах"
+    eta: "Ирэх хугацаа"
+    in-minutes: "ойролцоогоор {minutes} минутын дараа"
+    window: "Хүргэлтийн хугацаа"
+    before-yours: "Таныхаас өмнө"
+    stops-count: "{count, plural, =0 {Байхгүй} one {# зогсоол} other {# зогсоол}}"
+    estimate-may-change: "Тооцоолол өөрчлөгдөж болно"
+    driver: "Таны жолооч"
+    online: "Онлайн"
+    location-paused: "Байршил түр зогссон"
+    call-short: "Залгах"
+    message: "Мессеж"
+    contact-note: "Дуудлага, мессеж {name}-ийн тусламжийн баг руу очно."
+    proof: "Хүргэлтийн нотолгоо"
+    open-photo: "Хүргэлтийн зургийг нээх"
+    open-signature: "Гарын үсгийг нээх"
+    open-scan: "Скан нээх"
+    proof-photo: "Хүргэлтийн зураг"
+    proof-signature: "Гарын үсэг"
+    proof-scan: "Үүдэнд сканнердсан"
+    instructions: "Хүргэлтийн заавар"
+    edit: "Засах"
+    instructions-help: "Хаалганы код, хаана үлдээх, эсвэл хэн гарын үсэг зурж болох"
+    cancel: "Цуцлах"
+    save: "Хадгалах"
+    no-instructions: "Одоогоор заавар алга."
+    updates: "Шинэчлэлүүд"
+    no-updates: "Одоогоор шинэчлэл алга."
+    show-fewer: "Цөөн шинэчлэл харуулах"
+    show-earlier: "Өмнөх шинэчлэлүүдийг харуулах ({count})"
+    today: "Өнөөдөр"
+    yesterday: "Өчигдөр"
+    items: "Энэ хүргэлтэд"
+    item: "Бараа"
+    quantity: "Тоо {count}"
+    share: "Хяналтыг хуваалцах"
+    report: "Асуудал мэдэгдэх"
+    contact: "{name}-тэй холбогдох"
+    report-label: "Таны хүргэлтэд ямар асуудал гарсан бэ?"
+    send: "Илгээх"
+    close: "Хаах"
+    no-orders: "Одоогоор захиалга алга"
+    no-orders-help: "Таны бүртгэлийн хүргэлтүүд энд харагдана."
diff --git a/translations/pt-br.yaml b/translations/pt-br.yaml
index 8329dcc0f..ad5367006 100644
--- a/translations/pt-br.yaml
+++ b/translations/pt-br.yaml
@@ -2339,275 +2339,275 @@ trailer:
     other: Outro
 tracking-page:
   settings:
-    title: "Tracking Page"
-    menu: "Tracking Page"
-    saved: "Tracking page settings saved."
-    load-failed: "We couldn't load the tracking page settings."
-    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
-    pages: "Pages"
-    org-page-enabled: "Your own tracking page"
-    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
-    slug: "Page address"
-    slug-checking: "Checking the address..."
-    open-page: "Open the page"
-    generic-page-allowed: "Allow tracking on the shared page"
-    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
-    links-target: "Links in emails and labels"
-    links-target-help: "Which page your notifications and labels send customers to."
-    links-target-auto: "Your page when it is on, otherwise the shared page"
-    links-target-org: "Always your page"
-    links-target-generic: "Always the shared page"
-    branding: "Branding"
-    display-name: "Display name"
-    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
-    accent: "Accent colour"
-    accent-hex: "Accent colour as a hex value"
-    placeholder-slug: "your-company"
+    title: "Página de rastreamento"
+    menu: "Página de rastreamento"
+    saved: "Configurações da página de rastreamento salvas."
+    load-failed: "Não foi possível carregar as configurações da página de rastreamento."
+    load-failed-help: "Recarregue a página para tentar de novo. Se continuar acontecendo, verifique se você tem permissão para ver essas configurações."
+    pages: "Páginas"
+    org-page-enabled: "Sua própria página de rastreamento"
+    org-page-enabled-help: "Uma página de rastreamento com a sua marca, em um endereço próprio. Ela só encontra os códigos de rastreamento da sua organização."
+    slug: "Endereço da página"
+    slug-checking: "Verificando o endereço..."
+    open-page: "Abrir a página"
+    generic-page-allowed: "Permitir rastreamento na página compartilhada"
+    generic-page-allowed-help: "Permite que os clientes consultem seus códigos de rastreamento em {url}. Desative para manter o rastreamento apenas na sua página."
+    links-target: "Links em e-mails e etiquetas"
+    links-target-help: "Para qual página suas notificações e etiquetas levam os clientes."
+    links-target-auto: "Sua página quando estiver ativa; caso contrário, a página compartilhada"
+    links-target-org: "Sempre a sua página"
+    links-target-generic: "Sempre a página compartilhada"
+    branding: "Identidade visual"
+    display-name: "Nome de exibição"
+    logo-help: "A página usa o logotipo da sua organização. Sem logotipo, ela mostra um monograma do nome de exibição."
+    accent: "Cor de destaque"
+    accent-hex: "Cor de destaque em valor hexadecimal"
+    placeholder-slug: "sua-empresa"
     placeholder-phone: "+1 555 010 0100"
     placeholder-email: "support@example.com"
     placeholder-website: "https://example.com"
-    placeholder-select: "Select an option"
-    contrast-ok: "Text on this colour is readable ({ratio}:1)."
-    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
-    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
-    accent-dark: "Accent colour in dark mode"
-    accent-dark-auto: "Automatic"
-    support-phone: "Support phone"
-    support-email: "Support email"
-    website: "Website"
-    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
-    powered-by: "Show \"Powered by Fleetbase\""
-    powered-by-help: "A small line in the page footer."
-    theme: "Light and dark"
-    theme-system: "Follow the customer's device"
-    theme-light: "Always light"
-    default-language: "Default language"
-    languages: "Languages customers can choose"
-    access: "Access"
-    public-status: "Show the status without verification"
-    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
-    channel-sms: "Verify by text message"
-    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
-    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
-    channel-email: "Verify by email"
-    channel-email-help: "Sends a 6-digit code to the email address on the order."
-    session-hours: "Stay verified for (hours)"
-    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
-    account-sign-in: "Let customers sign in"
-    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
-    account-upsell: "Suggest creating an account"
-    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
-    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
-    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
-    visibility: "What verified customers see"
-    visibility-map: "Live map"
-    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
-    visibility-driver_name: "Driver's first name"
-    visibility-driver_name-help: "Only the first name, never a surname or phone number."
-    visibility-vehicle: "Vehicle description"
-    visibility-vehicle-help: "For example \"White Ford Transit\"."
-    visibility-items: "Items in the delivery"
-    visibility-items-help: "Names, descriptions, quantities and photos."
-    visibility-item_prices: "Item prices"
-    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
-    visibility-pod_photo: "Delivery photo"
-    visibility-pod_photo-help: "The photo taken as proof of delivery."
-    visibility-pod_signature: "Signature"
-    visibility-pod_signature-help: "The signature captured as proof of delivery."
-    visibility-instructions_edit: "Let customers add delivery instructions"
-    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
-    visibility-report_problem: "Report a problem"
-    visibility-report_problem-help: "Lets customers send you a message about their delivery."
-    driver-contact: "Calls and messages go to"
-    driver-contact-help: "Who customers reach from the driver card."
-    driver-contact-company: "Your support team"
-    driver-contact-driver: "The driver directly"
-    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
-    preview: "Preview"
-    preview-help: "A sample in light and dark mode. Save to apply the changes."
-    preview-chip: "Verified on this device"
-    preview-headline: "Arriving today"
-    preview-sub: "2:10 to 2:40 pm"
-    preview-button: "Verify it's you"
+    placeholder-select: "Selecione uma opção"
+    contrast-ok: "O texto nesta cor fica legível ({ratio}:1)."
+    contrast-low: "O texto nesta cor fica difícil de ler ({ratio}:1). Escolha uma cor mais escura ou mais clara."
+    accent-help: "Usada em botões, progresso e destaques. A cor do texto sobre ela é escolhida automaticamente."
+    accent-dark: "Cor de destaque no modo escuro"
+    accent-dark-auto: "Automática"
+    support-phone: "Telefone de suporte"
+    support-email: "E-mail de suporte"
+    website: "Site"
+    support-help: "Deixe em branco para usar os dados da sua organização. As ligações e mensagens dos clientes chegam aqui."
+    powered-by: "Mostrar \"Powered by Fleetbase\""
+    powered-by-help: "Uma linha discreta no rodapé da página."
+    theme: "Claro e escuro"
+    theme-system: "Seguir o dispositivo do cliente"
+    theme-light: "Sempre claro"
+    default-language: "Idioma padrão"
+    languages: "Idiomas que os clientes podem escolher"
+    access: "Acesso"
+    public-status: "Mostrar o status sem verificação"
+    public-status-help: "Só com o código de rastreamento, os clientes veem a etapa da entrega e a data da última atualização. Desative para não mostrar nada até que eles se verifiquem."
+    channel-sms: "Verificar por SMS"
+    channel-sms-help: "Envia um código de 6 dígitos para o telefone do pedido."
+    channel-sms-unavailable: "Nenhum provedor de SMS está configurado nesta instância, então não é possível enviar códigos por SMS."
+    channel-email: "Verificar por e-mail"
+    channel-email-help: "Envia um código de 6 dígitos para o e-mail do pedido."
+    session-hours: "Manter verificado por (horas)"
+    session-hours-help: "Por quanto tempo um dispositivo fica verificado depois de um código correto. Entre 1 e 168 horas."
+    account-sign-in: "Permitir que os clientes entrem na conta"
+    account-sign-in-help: "Clientes com conta no portal do cliente podem entrar para ver todos os pedidos sem código."
+    account-upsell: "Sugerir a criação de uma conta"
+    account-upsell-help: "Após a entrega, clientes verificados sem conta são convidados a criar uma."
+    customer-portal-missing: "Instale a extensão Customer Portal para que os clientes possam entrar e ver todos os pedidos."
+    code-rules: "Os códigos têm 6 dígitos e expiram em 10 minutos. Após 3 códigos errados, o envio fica pausado por 5 minutos."
+    visibility: "O que os clientes verificados veem"
+    visibility-map: "Mapa ao vivo"
+    visibility-map-help: "A rota e a posição do veículo enquanto ele está a caminho do cliente."
+    visibility-driver_name: "Primeiro nome do motorista"
+    visibility-driver_name-help: "Apenas o primeiro nome, nunca o sobrenome ou o telefone."
+    visibility-vehicle: "Descrição do veículo"
+    visibility-vehicle-help: "Por exemplo, \"Ford Transit branca\"."
+    visibility-items: "Itens da entrega"
+    visibility-items-help: "Nomes, descrições, quantidades e fotos."
+    visibility-item_prices: "Preços dos itens"
+    visibility-item_prices-help: "Mostrados apenas para clientes conectados que fizeram o pedido."
+    visibility-pod_photo: "Foto da entrega"
+    visibility-pod_photo-help: "A foto tirada como comprovante de entrega."
+    visibility-pod_signature: "Assinatura"
+    visibility-pod_signature-help: "A assinatura coletada como comprovante de entrega."
+    visibility-instructions_edit: "Permitir que os clientes adicionem instruções de entrega"
+    visibility-instructions_edit-help: "Por exemplo, o código do portão ou onde deixar o pacote."
+    visibility-report_problem: "Informar um problema"
+    visibility-report_problem-help: "Permite que os clientes enviem uma mensagem sobre a entrega."
+    driver-contact: "Ligações e mensagens vão para"
+    driver-contact-help: "Quem os clientes contatam pelo cartão do motorista."
+    driver-contact-company: "Sua equipe de suporte"
+    driver-contact-driver: "Diretamente o motorista"
+    privacy-rules: "Sempre aplicado: os clientes só veem as próprias paradas e itens, o mapa e o motorista ficam ocultos após a entrega e a localização do motorista só aparece enquanto ele está a caminho."
+    preview: "Pré-visualização"
+    preview-help: "Um exemplo nos modos claro e escuro. Salve para aplicar as alterações."
+    preview-chip: "Verificado neste dispositivo"
+    preview-headline: "Chega hoje"
+    preview-sub: "14h10 às 14h40"
+    preview-button: "Confirme que é você"
     preview-powered-by: "Powered by Fleetbase"
   page:
-    track-another: "Track another"
-    unavailable-title: "Tracking isn't available here"
-    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
-    lookup-title: "Track your delivery"
-    lookup-sub: "See where your parcel is and when it will arrive."
-    tracking-number: "Tracking number"
-    tracking-number-placeholder: "e.g. NOR4829301736US"
-    tracking-number-help: "Find it in your confirmation email or on the parcel label."
-    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
-    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
-    looking-up: "Looking it up..."
-    track: "Track"
-    or: "or"
-    your-orders: "Your orders"
-    sign-in: "Sign in to see all your orders"
-    sign-in-account: "Sign in to your account"
-    back: "Back"
-    help: "Need help?"
-    language: "Language"
+    track-another: "Rastrear outro"
+    unavailable-title: "O rastreamento não está disponível aqui"
+    unavailable-help: "Esta página de rastreamento não está ativada. Use o link do e-mail da sua entrega ou fale com a empresa que enviou o seu pedido."
+    lookup-title: "Rastreie sua entrega"
+    lookup-sub: "Veja onde está o seu pacote e quando ele vai chegar."
+    tracking-number: "Código de rastreamento"
+    tracking-number-placeholder: "ex.: NOR4829301736US"
+    tracking-number-help: "Você encontra no e-mail de confirmação ou na etiqueta do pacote."
+    lookup-neutral: "Não conseguimos mostrar o rastreamento desse código. Confira se ele é igual ao do e-mail ou da etiqueta do pacote e tente de novo."
+    lookup-rate: "Foram várias tentativas seguidas. Faça uma pausa e tente de novo em alguns minutos."
+    looking-up: "Buscando..."
+    track: "Rastrear"
+    or: "ou"
+    your-orders: "Seus pedidos"
+    sign-in: "Entre para ver todos os seus pedidos"
+    sign-in-account: "Entre na sua conta"
+    back: "Voltar"
+    help: "Precisa de ajuda?"
+    language: "Idioma"
     powered-by: "Powered by Fleetbase"
-    dismiss: "Dismiss"
-    chip-limited: "Limited view · Verify to see details"
-    chip-verified: "Verified on this device"
-    chip-account: "Signed in"
-    chip-staff: "Staff preview: what this customer sees"
+    dismiss: "Dispensar"
+    chip-limited: "Visualização limitada · Verifique para ver os detalhes"
+    chip-verified: "Verificado neste dispositivo"
+    chip-account: "Conectado"
+    chip-staff: "Pré-visualização da equipe: o que este cliente vê"
     status: "Status"
-    verify-to-see: "Verify to see your delivery"
-    last-update: "Last update: {date}"
-    copy: "Copy"
-    verify-title: "See your full delivery details"
-    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
-    verify-button: "Verify it's you"
-    verify-unlock: "Verify to unlock"
-    locked-map: "Live map"
-    locked-arrival: "Arrival time and driver"
-    locked-details: "Updates, items and proof of delivery"
-    stage-preparing: "Being prepared"
-    stage-scheduled: "Scheduled"
-    stage-dispatched: "Driver assigned"
-    stage-in_transit: "In transit"
-    stage-delivered: "Delivered"
-    stage-issue: "Needs attention"
-    stage-canceled: "Canceled"
-    stage-toast-preparing: "Your order is being prepared"
-    stage-toast-scheduled: "Your delivery is scheduled"
-    stage-toast-dispatched: "A driver has been assigned"
-    stage-toast-in_transit: "Your order is on its way"
-    stage-toast-delivered: "Your order has been delivered"
-    stage-toast-issue: "There's an update on your delivery"
-    stage-toast-canceled: "Your order was canceled"
-    verify-title-short: "Verify it's you"
-    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
-    send-by: "Send the code by"
-    channel-sms: "Text message"
-    channel-email: "Email"
-    send-failed: "We couldn't send a code just now. Please try again."
-    sending: "Sending code..."
-    send-code: "Send code"
-    masked-note: "We only ever show part of your number or email here."
-    no-contact-title: "We can't verify you here"
-    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
-    call: "Call {phone}"
-    renew-title: "Get a new code"
-    renew-expired: "That code has expired. Codes last 10 minutes."
-    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
-    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
-    renew-failed: "Something went wrong. Request a new code to try again."
-    send-new-code: "Send a new code"
-    verified-title: "You're verified"
-    locked-title: "Codes paused"
-    enter-code: "Enter your code"
-    code-sent-sms: "We texted a 6-digit code to {masked}."
-    code-sent-email: "We emailed a 6-digit code to {masked}."
-    code-label: "6-digit code"
-    code-expires: "The code expires in 10 minutes."
-    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
-    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
-    code-success: "Verified. Opening your delivery..."
-    resend-in: "Resend code in {time}"
-    resend: "Resend code"
-    switch-to-sms: "Send by text instead"
-    switch-to-email: "Send by email instead"
-    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
-    verified-toast: "You're verified"
-    verified-toast-help: "This device stays verified for this delivery."
-    signed-out-toast: "Signed out on this device"
-    instructions-saved: "Delivery instructions saved"
-    action-failed: "That didn't work. Please try again."
-    report-sent: "Message sent"
-    report-sent-help: "{name} will get back to you."
-    share-copied: "Link copied"
-    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
-    your-stop: "Stop {number}"
-    your-stops: "Your stops"
-    sign-out: "Not you? Sign out"
-    live: "Live"
-    reconnecting: "Reconnecting... live updates paused"
-    timezone: "Times in your time zone ({zone})"
-    progress: "Delivery progress"
-    step-created: "Created"
-    step-dispatched: "Dispatched"
-    step-started: "Picked up"
-    step-enroute: "En route"
-    step-delivered: "Delivered"
-    step-issue: "Attempt missed"
-    step-canceled: "Canceled"
-    headline-preparing: "Getting your order ready"
-    headline-scheduled: "Scheduled for {date}"
-    headline-dispatched: "A driver has been assigned"
-    headline-delayed: "Running a little late"
-    headline-arriving: "Arriving {day}"
-    headline-in-transit: "On its way"
-    headline-delivered: "Delivered"
-    headline-issue: "There's a problem with your delivery"
-    headline-canceled: "This order was canceled"
-    sub-arriving: "{window} · in about {minutes} min"
-    sub-window: "Delivery window {window}"
+    verify-to-see: "Verifique para ver sua entrega"
+    last-update: "Última atualização: {date}"
+    copy: "Copiar"
+    verify-title: "Veja todos os detalhes da sua entrega"
+    verify-help: "Para proteger sua privacidade, o mapa, o horário de chegada e os detalhes da entrega são liberados após uma verificação rápida. Vamos enviar um código de 6 dígitos para o telefone ou e-mail deste pedido."
+    verify-button: "Confirme que é você"
+    verify-unlock: "Verifique para liberar"
+    locked-map: "Mapa ao vivo"
+    locked-arrival: "Horário de chegada e motorista"
+    locked-details: "Atualizações, itens e comprovante de entrega"
+    stage-preparing: "Em preparação"
+    stage-scheduled: "Agendado"
+    stage-dispatched: "Motorista designado"
+    stage-in_transit: "Em trânsito"
+    stage-delivered: "Entregue"
+    stage-issue: "Requer atenção"
+    stage-canceled: "Cancelado"
+    stage-toast-preparing: "Seu pedido está sendo preparado"
+    stage-toast-scheduled: "Sua entrega está agendada"
+    stage-toast-dispatched: "Um motorista foi designado"
+    stage-toast-in_transit: "Seu pedido está a caminho"
+    stage-toast-delivered: "Seu pedido foi entregue"
+    stage-toast-issue: "Há uma novidade sobre sua entrega"
+    stage-toast-canceled: "Seu pedido foi cancelado"
+    verify-title-short: "Confirme que é você"
+    verify-choose-help: "Para proteger os detalhes da sua entrega, vamos enviar um código de 6 dígitos para o contato cadastrado neste pedido."
+    send-by: "Enviar o código por"
+    channel-sms: "SMS"
+    channel-email: "E-mail"
+    send-failed: "Não conseguimos enviar um código agora. Tente de novo."
+    sending: "Enviando código..."
+    send-code: "Enviar código"
+    masked-note: "Aqui mostramos apenas parte do seu número ou e-mail."
+    no-contact-title: "Não conseguimos verificar você aqui"
+    no-contact-help: "Este pedido não tem telefone nem e-mail para onde possamos enviar um código. {name} pode ajudar você com a entrega."
+    call: "Ligar para {phone}"
+    renew-title: "Receber um novo código"
+    renew-expired: "Esse código expirou. Os códigos valem por 10 minutos."
+    renew-unlocked: "Você já pode tentar de novo. Vamos enviar um novo código; o antigo não funciona mais."
+    renew-limited: "Você pediu vários códigos. Aguarde alguns minutos antes de pedir outro."
+    renew-failed: "Algo deu errado. Peça um novo código para tentar de novo."
+    send-new-code: "Enviar um novo código"
+    verified-title: "Você foi verificado"
+    locked-title: "Códigos pausados"
+    enter-code: "Digite seu código"
+    code-sent-sms: "Enviamos um código de 6 dígitos por SMS para {masked}."
+    code-sent-email: "Enviamos um código de 6 dígitos por e-mail para {masked}."
+    code-label: "Código de 6 dígitos"
+    code-expires: "O código expira em 10 minutos."
+    code-wrong: "Esse código não confere. {count, plural, one {Resta # tentativa} other {Restam # tentativas}}."
+    code-locked: "Muitas tentativas. Para sua segurança, os códigos estão pausados. Tente de novo em {time}."
+    code-success: "Verificado. Abrindo sua entrega..."
+    resend-in: "Reenviar código em {time}"
+    resend: "Reenviar código"
+    switch-to-sms: "Enviar por SMS"
+    switch-to-email: "Enviar por e-mail"
+    stay-verified: "Depois de verificado, este dispositivo continua verificado por {hours} horas. Você pode sair a qualquer momento."
+    verified-toast: "Você foi verificado"
+    verified-toast-help: "Este dispositivo continua verificado para esta entrega."
+    signed-out-toast: "Você saiu neste dispositivo"
+    instructions-saved: "Instruções de entrega salvas"
+    action-failed: "Não deu certo. Tente de novo."
+    report-sent: "Mensagem enviada"
+    report-sent-help: "{name} vai responder você."
+    share-copied: "Link copiado"
+    share-copied-help: "Quem receber o link verá uma visualização limitada até se verificar."
+    your-stop: "Parada {number}"
+    your-stops: "Suas paradas"
+    sign-out: "Não é você? Sair"
+    live: "Ao vivo"
+    reconnecting: "Reconectando... atualizações ao vivo pausadas"
+    timezone: "Horários no seu fuso horário ({zone})"
+    progress: "Andamento da entrega"
+    step-created: "Criado"
+    step-dispatched: "Despachado"
+    step-started: "Coletado"
+    step-enroute: "A caminho"
+    step-delivered: "Entregue"
+    step-issue: "Tentativa não realizada"
+    step-canceled: "Cancelado"
+    headline-preparing: "Preparando seu pedido"
+    headline-scheduled: "Agendado para {date}"
+    headline-dispatched: "Um motorista foi designado"
+    headline-delayed: "Um pouco atrasado"
+    headline-arriving: "Chega {day}"
+    headline-in-transit: "A caminho"
+    headline-delivered: "Entregue"
+    headline-issue: "Houve um problema com sua entrega"
+    headline-canceled: "Este pedido foi cancelado"
+    sub-arriving: "{window} · em cerca de {minutes} min"
+    sub-window: "Janela de entrega {window}"
     sub-delivered: "{when}"
-    sub-dispatched: "Live tracking starts as soon as they're on the way."
-    sub-preparing: "We'll let you know when it's on its way."
-    delayed-title: "Running late."
-    delayed-help: "We'll keep your arrival time up to date."
-    stop-of: "Your delivery is stop {position} of {total}"
-    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
-    map: "Map"
-    map-label: "Map of your delivery: the van on its way to your address."
-    map-pickup: "Pickup area"
-    map-driver: "Driver"
-    map-pickup-named: "Pickup · {name}"
-    map-fullscreen: "Full screen map"
-    map-exit-fullscreen: "Exit full screen"
-    stop-card-title: "Delivering to"
-    stop-upcoming: "Upcoming"
-    stop-complete: "Delivered"
-    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
-    last-seen: "Last seen {minutes} min ago"
-    recenter: "Center the map on the van"
-    fit-route: "Show the whole route"
-    eta: "Estimated arrival"
-    in-minutes: "in about {minutes} min"
-    window: "Delivery window"
-    before-yours: "Before yours"
-    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
-    estimate-may-change: "Estimate may change"
-    driver: "Your driver"
+    sub-dispatched: "O rastreamento ao vivo começa assim que o motorista sair."
+    sub-preparing: "Avisaremos quando estiver a caminho."
+    delayed-title: "Atrasado."
+    delayed-help: "Vamos manter seu horário de chegada atualizado."
+    stop-of: "Sua entrega é a parada {position} de {total}"
+    stops-private: "{count, plural, =0 {Você é o próximo.} one {Falta # parada antes da sua.} other {Faltam # paradas antes da sua.}} As outras paradas são privadas, então você só vê a sua."
+    map: "Mapa"
+    map-label: "Mapa da sua entrega: a van a caminho do seu endereço."
+    map-pickup: "Área de coleta"
+    map-driver: "Motorista"
+    map-pickup-named: "Coleta · {name}"
+    map-fullscreen: "Mapa em tela cheia"
+    map-exit-fullscreen: "Sair da tela cheia"
+    stop-card-title: "Entrega para"
+    stop-upcoming: "Próxima"
+    stop-complete: "Entregue"
+    map-hidden: "O mapa foi ocultado porque seu pedido já foi entregue. Paramos de compartilhar a localização do motorista na sua porta."
+    last-seen: "Visto há {minutes} min"
+    recenter: "Centralizar o mapa na van"
+    fit-route: "Mostrar a rota inteira"
+    eta: "Chegada prevista"
+    in-minutes: "em cerca de {minutes} min"
+    window: "Janela de entrega"
+    before-yours: "Antes da sua"
+    stops-count: "{count, plural, =0 {Nenhuma} one {# parada} other {# paradas}}"
+    estimate-may-change: "A previsão pode mudar"
+    driver: "Seu motorista"
     online: "Online"
-    location-paused: "Location paused"
-    call-short: "Call"
-    message: "Message"
-    contact-note: "Calls and messages go to the {name} support team."
-    proof: "Proof of delivery"
-    open-photo: "Open the delivery photo"
-    open-signature: "Open the signature"
-    open-scan: "Open the scan"
-    proof-photo: "Delivery photo"
-    proof-signature: "Signature"
-    proof-scan: "Scanned at the door"
-    instructions: "Delivery instructions"
-    edit: "Edit"
-    instructions-help: "Gate codes, where to leave it, or who can sign"
-    cancel: "Cancel"
-    save: "Save"
-    no-instructions: "No instructions yet."
-    updates: "Updates"
-    no-updates: "No updates yet."
-    show-fewer: "Show fewer updates"
-    show-earlier: "Show earlier updates ({count})"
-    today: "Today"
-    yesterday: "Yesterday"
-    items: "In this delivery"
+    location-paused: "Localização pausada"
+    call-short: "Ligar"
+    message: "Mensagem"
+    contact-note: "Ligações e mensagens vão para a equipe de suporte de {name}."
+    proof: "Comprovante de entrega"
+    open-photo: "Abrir a foto da entrega"
+    open-signature: "Abrir a assinatura"
+    open-scan: "Abrir a leitura"
+    proof-photo: "Foto da entrega"
+    proof-signature: "Assinatura"
+    proof-scan: "Lido na porta"
+    instructions: "Instruções de entrega"
+    edit: "Editar"
+    instructions-help: "Código do portão, onde deixar ou quem pode assinar"
+    cancel: "Cancelar"
+    save: "Salvar"
+    no-instructions: "Nenhuma instrução ainda."
+    updates: "Atualizações"
+    no-updates: "Nenhuma atualização ainda."
+    show-fewer: "Mostrar menos atualizações"
+    show-earlier: "Mostrar atualizações anteriores ({count})"
+    today: "Hoje"
+    yesterday: "Ontem"
+    items: "Nesta entrega"
     item: "Item"
-    quantity: "Qty {count}"
-    share: "Share tracking"
-    report: "Report a problem"
-    contact: "Contact {name}"
-    report-label: "What's wrong with your delivery?"
-    send: "Send"
-    close: "Close"
-    no-orders: "No orders yet"
-    no-orders-help: "Deliveries for your account will show up here."
+    quantity: "Qtd. {count}"
+    share: "Compartilhar rastreamento"
+    report: "Informar um problema"
+    contact: "Falar com {name}"
+    report-label: "Qual é o problema com sua entrega?"
+    send: "Enviar"
+    close: "Fechar"
+    no-orders: "Nenhum pedido ainda"
+    no-orders-help: "As entregas da sua conta vão aparecer aqui."
diff --git a/translations/ru-ru.yaml b/translations/ru-ru.yaml
index 4f82615b5..921cfabe2 100644
--- a/translations/ru-ru.yaml
+++ b/translations/ru-ru.yaml
@@ -2332,275 +2332,275 @@ trailer:
     other: Другое
 tracking-page:
   settings:
-    title: "Tracking Page"
-    menu: "Tracking Page"
-    saved: "Tracking page settings saved."
-    load-failed: "We couldn't load the tracking page settings."
-    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
-    pages: "Pages"
-    org-page-enabled: "Your own tracking page"
-    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
-    slug: "Page address"
-    slug-checking: "Checking the address..."
-    open-page: "Open the page"
-    generic-page-allowed: "Allow tracking on the shared page"
-    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
-    links-target: "Links in emails and labels"
-    links-target-help: "Which page your notifications and labels send customers to."
-    links-target-auto: "Your page when it is on, otherwise the shared page"
-    links-target-org: "Always your page"
-    links-target-generic: "Always the shared page"
-    branding: "Branding"
-    display-name: "Display name"
-    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
-    accent: "Accent colour"
-    accent-hex: "Accent colour as a hex value"
-    placeholder-slug: "your-company"
+    title: "Страница отслеживания"
+    menu: "Страница отслеживания"
+    saved: "Настройки страницы отслеживания сохранены."
+    load-failed: "Не удалось загрузить настройки страницы отслеживания."
+    load-failed-help: "Обновите страницу, чтобы попробовать снова. Если ошибка повторяется, проверьте, есть ли у вас доступ к этим настройкам."
+    pages: "Страницы"
+    org-page-enabled: "Собственная страница отслеживания"
+    org-page-enabled-help: "Страница отслеживания с вашим брендингом по отдельному адресу. На ней находятся только трек-номера вашей организации."
+    slug: "Адрес страницы"
+    slug-checking: "Проверяем адрес..."
+    open-page: "Открыть страницу"
+    generic-page-allowed: "Разрешить отслеживание на общей странице"
+    generic-page-allowed-help: "Клиенты смогут искать ваши трек-номера на {url}. Отключите, чтобы отслеживание работало только на вашей странице."
+    links-target: "Ссылки в письмах и на этикетках"
+    links-target-help: "На какую страницу ведут клиентов ваши уведомления и этикетки."
+    links-target-auto: "Ваша страница, если она включена, иначе общая"
+    links-target-org: "Всегда ваша страница"
+    links-target-generic: "Всегда общая страница"
+    branding: "Брендинг"
+    display-name: "Отображаемое название"
+    logo-help: "На странице используется логотип вашей организации. Если его нет, показывается монограмма из отображаемого названия."
+    accent: "Акцентный цвет"
+    accent-hex: "Акцентный цвет в формате HEX"
+    placeholder-slug: "vasha-kompaniya"
     placeholder-phone: "+1 555 010 0100"
     placeholder-email: "support@example.com"
     placeholder-website: "https://example.com"
-    placeholder-select: "Select an option"
-    contrast-ok: "Text on this colour is readable ({ratio}:1)."
-    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
-    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
-    accent-dark: "Accent colour in dark mode"
-    accent-dark-auto: "Automatic"
-    support-phone: "Support phone"
-    support-email: "Support email"
-    website: "Website"
-    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
-    powered-by: "Show \"Powered by Fleetbase\""
-    powered-by-help: "A small line in the page footer."
-    theme: "Light and dark"
-    theme-system: "Follow the customer's device"
-    theme-light: "Always light"
-    default-language: "Default language"
-    languages: "Languages customers can choose"
-    access: "Access"
-    public-status: "Show the status without verification"
-    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
-    channel-sms: "Verify by text message"
-    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
-    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
-    channel-email: "Verify by email"
-    channel-email-help: "Sends a 6-digit code to the email address on the order."
-    session-hours: "Stay verified for (hours)"
-    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
-    account-sign-in: "Let customers sign in"
-    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
-    account-upsell: "Suggest creating an account"
-    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
-    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
-    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
-    visibility: "What verified customers see"
-    visibility-map: "Live map"
-    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
-    visibility-driver_name: "Driver's first name"
-    visibility-driver_name-help: "Only the first name, never a surname or phone number."
-    visibility-vehicle: "Vehicle description"
-    visibility-vehicle-help: "For example \"White Ford Transit\"."
-    visibility-items: "Items in the delivery"
-    visibility-items-help: "Names, descriptions, quantities and photos."
-    visibility-item_prices: "Item prices"
-    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
-    visibility-pod_photo: "Delivery photo"
-    visibility-pod_photo-help: "The photo taken as proof of delivery."
-    visibility-pod_signature: "Signature"
-    visibility-pod_signature-help: "The signature captured as proof of delivery."
-    visibility-instructions_edit: "Let customers add delivery instructions"
-    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
-    visibility-report_problem: "Report a problem"
-    visibility-report_problem-help: "Lets customers send you a message about their delivery."
-    driver-contact: "Calls and messages go to"
-    driver-contact-help: "Who customers reach from the driver card."
-    driver-contact-company: "Your support team"
-    driver-contact-driver: "The driver directly"
-    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
-    preview: "Preview"
-    preview-help: "A sample in light and dark mode. Save to apply the changes."
-    preview-chip: "Verified on this device"
-    preview-headline: "Arriving today"
-    preview-sub: "2:10 to 2:40 pm"
-    preview-button: "Verify it's you"
-    preview-powered-by: "Powered by Fleetbase"
+    placeholder-select: "Выберите вариант"
+    contrast-ok: "Текст на этом цвете хорошо читается ({ratio}:1)."
+    contrast-low: "Текст на этом цвете плохо читается ({ratio}:1). Выберите цвет темнее или светлее."
+    accent-help: "Используется для кнопок, индикатора прогресса и выделений. Цвет текста на нём подбирается автоматически."
+    accent-dark: "Акцентный цвет в тёмной теме"
+    accent-dark-auto: "Автоматически"
+    support-phone: "Телефон поддержки"
+    support-email: "Email поддержки"
+    website: "Сайт"
+    support-help: "Оставьте поля пустыми, чтобы использовать данные вашей организации. Сюда поступают звонки и сообщения клиентов."
+    powered-by: "Показывать «Работает на Fleetbase»"
+    powered-by-help: "Небольшая строка в нижней части страницы."
+    theme: "Светлая и тёмная тема"
+    theme-system: "Как на устройстве клиента"
+    theme-light: "Всегда светлая"
+    default-language: "Язык по умолчанию"
+    languages: "Языки, доступные клиентам"
+    access: "Доступ"
+    public-status: "Показывать статус без подтверждения"
+    public-status-help: "По одному трек-номеру клиенты видят этап доставки и дату последнего обновления. Отключите, чтобы ничего не показывать до подтверждения."
+    channel-sms: "Подтверждение по SMS"
+    channel-sms-help: "Отправляет 6-значный код на номер телефона из заказа."
+    channel-sms-unavailable: "Для этого экземпляра не настроен SMS-провайдер, поэтому коды нельзя отправить по SMS."
+    channel-email: "Подтверждение по email"
+    channel-email-help: "Отправляет 6-значный код на email из заказа."
+    session-hours: "Срок действия подтверждения (часы)"
+    session-hours-help: "Сколько устройство остаётся подтверждённым после ввода верного кода. От 1 до 168 часов."
+    account-sign-in: "Разрешить клиентам вход"
+    account-sign-in-help: "Клиенты с аккаунтом в клиентском портале могут войти и видеть все свои заказы без кода."
+    account-upsell: "Предлагать создать аккаунт"
+    account-upsell-help: "После доставки подтверждённым клиентам без аккаунта предлагается его создать."
+    customer-portal-missing: "Установите расширение Customer Portal, чтобы клиенты могли входить и видеть все свои заказы."
+    code-rules: "Коды состоят из 6 цифр и действуют 10 минут. После 3 неверных кодов отправка приостанавливается на 5 минут."
+    visibility: "Что видят подтверждённые клиенты"
+    visibility-map: "Карта в реальном времени"
+    visibility-map-help: "Маршрут и положение машины, пока она едет к клиенту."
+    visibility-driver_name: "Имя водителя"
+    visibility-driver_name-help: "Только имя — без фамилии и номера телефона."
+    visibility-vehicle: "Описание машины"
+    visibility-vehicle-help: "Например, «Белый Ford Transit»."
+    visibility-items: "Товары в доставке"
+    visibility-items-help: "Названия, описания, количество и фото."
+    visibility-item_prices: "Цены товаров"
+    visibility-item_prices-help: "Видны только вошедшим клиентам, оформившим заказ."
+    visibility-pod_photo: "Фото доставки"
+    visibility-pod_photo-help: "Фото, сделанное как подтверждение доставки."
+    visibility-pod_signature: "Подпись"
+    visibility-pod_signature-help: "Подпись, полученная как подтверждение доставки."
+    visibility-instructions_edit: "Разрешить клиентам добавлять инструкции к доставке"
+    visibility-instructions_edit-help: "Например, код от ворот или где оставить посылку."
+    visibility-report_problem: "Сообщить о проблеме"
+    visibility-report_problem-help: "Клиенты смогут отправить вам сообщение о своей доставке."
+    driver-contact: "Звонки и сообщения получает"
+    driver-contact-help: "С кем клиенты связываются из карточки водителя."
+    driver-contact-company: "Ваша служба поддержки"
+    driver-contact-driver: "Водитель напрямую"
+    privacy-rules: "Применяется всегда: клиенты видят только свои остановки и товары, карта и водитель скрываются после доставки, а местоположение водителя показывается, только пока он в пути."
+    preview: "Предпросмотр"
+    preview-help: "Пример в светлой и тёмной теме. Сохраните, чтобы применить изменения."
+    preview-chip: "Подтверждено на этом устройстве"
+    preview-headline: "Прибудет сегодня"
+    preview-sub: "14:10–14:40"
+    preview-button: "Подтвердите, что это вы"
+    preview-powered-by: "Работает на Fleetbase"
   page:
-    track-another: "Track another"
-    unavailable-title: "Tracking isn't available here"
-    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
-    lookup-title: "Track your delivery"
-    lookup-sub: "See where your parcel is and when it will arrive."
-    tracking-number: "Tracking number"
-    tracking-number-placeholder: "e.g. NOR4829301736US"
-    tracking-number-help: "Find it in your confirmation email or on the parcel label."
-    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
-    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
-    looking-up: "Looking it up..."
-    track: "Track"
-    or: "or"
-    your-orders: "Your orders"
-    sign-in: "Sign in to see all your orders"
-    sign-in-account: "Sign in to your account"
-    back: "Back"
-    help: "Need help?"
-    language: "Language"
-    powered-by: "Powered by Fleetbase"
-    dismiss: "Dismiss"
-    chip-limited: "Limited view · Verify to see details"
-    chip-verified: "Verified on this device"
-    chip-account: "Signed in"
-    chip-staff: "Staff preview: what this customer sees"
-    status: "Status"
-    verify-to-see: "Verify to see your delivery"
-    last-update: "Last update: {date}"
-    copy: "Copy"
-    verify-title: "See your full delivery details"
-    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
-    verify-button: "Verify it's you"
-    verify-unlock: "Verify to unlock"
-    locked-map: "Live map"
-    locked-arrival: "Arrival time and driver"
-    locked-details: "Updates, items and proof of delivery"
-    stage-preparing: "Being prepared"
-    stage-scheduled: "Scheduled"
-    stage-dispatched: "Driver assigned"
-    stage-in_transit: "In transit"
-    stage-delivered: "Delivered"
-    stage-issue: "Needs attention"
-    stage-canceled: "Canceled"
-    stage-toast-preparing: "Your order is being prepared"
-    stage-toast-scheduled: "Your delivery is scheduled"
-    stage-toast-dispatched: "A driver has been assigned"
-    stage-toast-in_transit: "Your order is on its way"
-    stage-toast-delivered: "Your order has been delivered"
-    stage-toast-issue: "There's an update on your delivery"
-    stage-toast-canceled: "Your order was canceled"
-    verify-title-short: "Verify it's you"
-    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
-    send-by: "Send the code by"
-    channel-sms: "Text message"
+    track-another: "Отследить другой"
+    unavailable-title: "Отслеживание здесь недоступно"
+    unavailable-help: "Эта страница отслеживания не включена. Воспользуйтесь ссылкой из письма о доставке или свяжитесь с компанией, отправившей заказ."
+    lookup-title: "Отследите доставку"
+    lookup-sub: "Узнайте, где ваша посылка и когда она прибудет."
+    tracking-number: "Трек-номер"
+    tracking-number-placeholder: "например, NOR4829301736US"
+    tracking-number-help: "Его можно найти в письме с подтверждением или на этикетке посылки."
+    lookup-neutral: "Мы не можем показать отслеживание по этому номеру. Сверьте его с письмом или этикеткой и попробуйте снова."
+    lookup-rate: "Слишком много попыток подряд. Сделайте небольшой перерыв и попробуйте через несколько минут."
+    looking-up: "Ищем..."
+    track: "Отследить"
+    or: "или"
+    your-orders: "Ваши заказы"
+    sign-in: "Войдите, чтобы видеть все заказы"
+    sign-in-account: "Войти в аккаунт"
+    back: "Назад"
+    help: "Нужна помощь?"
+    language: "Язык"
+    powered-by: "Работает на Fleetbase"
+    dismiss: "Закрыть"
+    chip-limited: "Ограниченный просмотр · Подтвердите, чтобы увидеть детали"
+    chip-verified: "Подтверждено на этом устройстве"
+    chip-account: "Вы вошли"
+    chip-staff: "Просмотр для сотрудника: так видит клиент"
+    status: "Статус"
+    verify-to-see: "Подтвердите, чтобы увидеть доставку"
+    last-update: "Последнее обновление: {date}"
+    copy: "Копировать"
+    verify-title: "Посмотрите все детали доставки"
+    verify-help: "Ради вашей конфиденциальности карта, время прибытия и детали доставки открываются после быстрой проверки. Мы отправим 6-значный код на телефон или email из этого заказа."
+    verify-button: "Подтвердите, что это вы"
+    verify-unlock: "Подтвердите, чтобы открыть"
+    locked-map: "Карта в реальном времени"
+    locked-arrival: "Время прибытия и водитель"
+    locked-details: "Обновления, товары и подтверждение доставки"
+    stage-preparing: "Готовится"
+    stage-scheduled: "Запланировано"
+    stage-dispatched: "Водитель назначен"
+    stage-in_transit: "В пути"
+    stage-delivered: "Доставлено"
+    stage-issue: "Требует внимания"
+    stage-canceled: "Отменено"
+    stage-toast-preparing: "Ваш заказ готовится"
+    stage-toast-scheduled: "Ваша доставка запланирована"
+    stage-toast-dispatched: "Водитель назначен"
+    stage-toast-in_transit: "Ваш заказ в пути"
+    stage-toast-delivered: "Ваш заказ доставлен"
+    stage-toast-issue: "Есть новости о вашей доставке"
+    stage-toast-canceled: "Ваш заказ отменён"
+    verify-title-short: "Подтвердите, что это вы"
+    verify-choose-help: "Чтобы защитить данные о доставке, мы отправим 6-значный код на контакты из этого заказа."
+    send-by: "Отправить код через"
+    channel-sms: "SMS"
     channel-email: "Email"
-    send-failed: "We couldn't send a code just now. Please try again."
-    sending: "Sending code..."
-    send-code: "Send code"
-    masked-note: "We only ever show part of your number or email here."
-    no-contact-title: "We can't verify you here"
-    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
-    call: "Call {phone}"
-    renew-title: "Get a new code"
-    renew-expired: "That code has expired. Codes last 10 minutes."
-    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
-    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
-    renew-failed: "Something went wrong. Request a new code to try again."
-    send-new-code: "Send a new code"
-    verified-title: "You're verified"
-    locked-title: "Codes paused"
-    enter-code: "Enter your code"
-    code-sent-sms: "We texted a 6-digit code to {masked}."
-    code-sent-email: "We emailed a 6-digit code to {masked}."
-    code-label: "6-digit code"
-    code-expires: "The code expires in 10 minutes."
-    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
-    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
-    code-success: "Verified. Opening your delivery..."
-    resend-in: "Resend code in {time}"
-    resend: "Resend code"
-    switch-to-sms: "Send by text instead"
-    switch-to-email: "Send by email instead"
-    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
-    verified-toast: "You're verified"
-    verified-toast-help: "This device stays verified for this delivery."
-    signed-out-toast: "Signed out on this device"
-    instructions-saved: "Delivery instructions saved"
-    action-failed: "That didn't work. Please try again."
-    report-sent: "Message sent"
-    report-sent-help: "{name} will get back to you."
-    share-copied: "Link copied"
-    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
-    your-stop: "Stop {number}"
-    your-stops: "Your stops"
-    sign-out: "Not you? Sign out"
-    live: "Live"
-    reconnecting: "Reconnecting... live updates paused"
-    timezone: "Times in your time zone ({zone})"
-    progress: "Delivery progress"
-    step-created: "Created"
-    step-dispatched: "Dispatched"
-    step-started: "Picked up"
-    step-enroute: "En route"
-    step-delivered: "Delivered"
-    step-issue: "Attempt missed"
-    step-canceled: "Canceled"
-    headline-preparing: "Getting your order ready"
-    headline-scheduled: "Scheduled for {date}"
-    headline-dispatched: "A driver has been assigned"
-    headline-delayed: "Running a little late"
-    headline-arriving: "Arriving {day}"
-    headline-in-transit: "On its way"
-    headline-delivered: "Delivered"
-    headline-issue: "There's a problem with your delivery"
-    headline-canceled: "This order was canceled"
-    sub-arriving: "{window} · in about {minutes} min"
-    sub-window: "Delivery window {window}"
+    send-failed: "Сейчас не удалось отправить код. Попробуйте ещё раз."
+    sending: "Отправляем код..."
+    send-code: "Отправить код"
+    masked-note: "Здесь мы показываем только часть вашего номера или email."
+    no-contact-title: "Здесь не получится подтвердить личность"
+    no-contact-help: "В этом заказе нет телефона или email, на которые можно отправить код. {name} поможет вам с доставкой."
+    call: "Позвонить {phone}"
+    renew-title: "Получить новый код"
+    renew-expired: "Срок действия кода истёк. Код действует 10 минут."
+    renew-unlocked: "Можно попробовать снова. Мы отправим новый код, старый больше не действует."
+    renew-limited: "Вы запросили несколько кодов. Подождите несколько минут, прежде чем запросить ещё один."
+    renew-failed: "Что-то пошло не так. Запросите новый код и попробуйте снова."
+    send-new-code: "Отправить новый код"
+    verified-title: "Вы подтверждены"
+    locked-title: "Коды приостановлены"
+    enter-code: "Введите код"
+    code-sent-sms: "Мы отправили 6-значный код по SMS на {masked}."
+    code-sent-email: "Мы отправили 6-значный код на {masked}."
+    code-label: "6-значный код"
+    code-expires: "Код действует 10 минут."
+    code-wrong: "Код не подходит. {count, plural, one {Осталась # попытка} few {Осталось # попытки} many {Осталось # попыток} other {Осталось # попытки}}."
+    code-locked: "Слишком много попыток. Для вашей безопасности коды приостановлены. Попробуйте снова через {time}."
+    code-success: "Подтверждено. Открываем вашу доставку..."
+    resend-in: "Отправить код повторно через {time}"
+    resend: "Отправить код повторно"
+    switch-to-sms: "Отправить по SMS"
+    switch-to-email: "Отправить по email"
+    stay-verified: "После подтверждения это устройство остаётся подтверждённым на {hours} ч. Вы можете выйти в любой момент."
+    verified-toast: "Вы подтверждены"
+    verified-toast-help: "Это устройство остаётся подтверждённым для этой доставки."
+    signed-out-toast: "Вы вышли на этом устройстве"
+    instructions-saved: "Инструкции к доставке сохранены"
+    action-failed: "Не получилось. Попробуйте ещё раз."
+    report-sent: "Сообщение отправлено"
+    report-sent-help: "{name} свяжется с вами."
+    share-copied: "Ссылка скопирована"
+    share-copied-help: "Все, с кем вы поделитесь ссылкой, увидят ограниченный просмотр, пока не подтвердят себя."
+    your-stop: "Остановка {number}"
+    your-stops: "Ваши остановки"
+    sign-out: "Это не вы? Выйти"
+    live: "В реальном времени"
+    reconnecting: "Переподключение... обновления приостановлены"
+    timezone: "Время в вашем часовом поясе ({zone})"
+    progress: "Ход доставки"
+    step-created: "Создан"
+    step-dispatched: "Отправлен"
+    step-started: "Забран"
+    step-enroute: "В пути"
+    step-delivered: "Доставлен"
+    step-issue: "Попытка не удалась"
+    step-canceled: "Отменён"
+    headline-preparing: "Готовим ваш заказ"
+    headline-scheduled: "Запланировано на {date}"
+    headline-dispatched: "Водитель назначен"
+    headline-delayed: "Немного задерживается"
+    headline-arriving: "Прибудет {day}"
+    headline-in-transit: "В пути"
+    headline-delivered: "Доставлено"
+    headline-issue: "С вашей доставкой возникла проблема"
+    headline-canceled: "Этот заказ отменён"
+    sub-arriving: "{window} · примерно через {minutes} мин"
+    sub-window: "Окно доставки {window}"
     sub-delivered: "{when}"
-    sub-dispatched: "Live tracking starts as soon as they're on the way."
-    sub-preparing: "We'll let you know when it's on its way."
-    delayed-title: "Running late."
-    delayed-help: "We'll keep your arrival time up to date."
-    stop-of: "Your delivery is stop {position} of {total}"
-    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
-    map: "Map"
-    map-label: "Map of your delivery: the van on its way to your address."
-    map-pickup: "Pickup area"
-    map-driver: "Driver"
-    map-pickup-named: "Pickup · {name}"
-    map-fullscreen: "Full screen map"
-    map-exit-fullscreen: "Exit full screen"
-    stop-card-title: "Delivering to"
-    stop-upcoming: "Upcoming"
-    stop-complete: "Delivered"
-    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
-    last-seen: "Last seen {minutes} min ago"
-    recenter: "Center the map on the van"
-    fit-route: "Show the whole route"
-    eta: "Estimated arrival"
-    in-minutes: "in about {minutes} min"
-    window: "Delivery window"
-    before-yours: "Before yours"
-    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
-    estimate-may-change: "Estimate may change"
-    driver: "Your driver"
-    online: "Online"
-    location-paused: "Location paused"
-    call-short: "Call"
-    message: "Message"
-    contact-note: "Calls and messages go to the {name} support team."
-    proof: "Proof of delivery"
-    open-photo: "Open the delivery photo"
-    open-signature: "Open the signature"
-    open-scan: "Open the scan"
-    proof-photo: "Delivery photo"
-    proof-signature: "Signature"
-    proof-scan: "Scanned at the door"
-    instructions: "Delivery instructions"
-    edit: "Edit"
-    instructions-help: "Gate codes, where to leave it, or who can sign"
-    cancel: "Cancel"
-    save: "Save"
-    no-instructions: "No instructions yet."
-    updates: "Updates"
-    no-updates: "No updates yet."
-    show-fewer: "Show fewer updates"
-    show-earlier: "Show earlier updates ({count})"
-    today: "Today"
-    yesterday: "Yesterday"
-    items: "In this delivery"
-    item: "Item"
-    quantity: "Qty {count}"
-    share: "Share tracking"
-    report: "Report a problem"
-    contact: "Contact {name}"
-    report-label: "What's wrong with your delivery?"
-    send: "Send"
-    close: "Close"
-    no-orders: "No orders yet"
-    no-orders-help: "Deliveries for your account will show up here."
+    sub-dispatched: "Отслеживание в реальном времени начнётся, как только водитель выедет."
+    sub-preparing: "Мы сообщим, когда заказ будет в пути."
+    delayed-title: "Задерживается."
+    delayed-help: "Мы будем обновлять время прибытия."
+    stop-of: "Ваша доставка — остановка {position} из {total}"
+    stops-private: "{count, plural, =0 {Вы следующий.} one {Перед вами # остановка.} few {Перед вами # остановки.} many {Перед вами # остановок.} other {Перед вами # остановки.}} Другие остановки скрыты — вы видите только свою."
+    map: "Карта"
+    map-label: "Карта вашей доставки: машина едет к вашему адресу."
+    map-pickup: "Место забора"
+    map-driver: "Водитель"
+    map-pickup-named: "Забор · {name}"
+    map-fullscreen: "Карта на весь экран"
+    map-exit-fullscreen: "Выйти из полноэкранного режима"
+    stop-card-title: "Доставка по адресу"
+    stop-upcoming: "Предстоит"
+    stop-complete: "Доставлено"
+    map-hidden: "Карта скрыта, так как заказ доставлен. У вашей двери мы прекращаем показывать местоположение водителя."
+    last-seen: "Обновлено {minutes} мин назад"
+    recenter: "Показать машину в центре карты"
+    fit-route: "Показать весь маршрут"
+    eta: "Ожидаемое прибытие"
+    in-minutes: "примерно через {minutes} мин"
+    window: "Окно доставки"
+    before-yours: "Перед вами"
+    stops-count: "{count, plural, =0 {Нет} one {# остановка} few {# остановки} many {# остановок} other {# остановки}}"
+    estimate-may-change: "Время может измениться"
+    driver: "Ваш водитель"
+    online: "На связи"
+    location-paused: "Местоположение приостановлено"
+    call-short: "Позвонить"
+    message: "Написать"
+    contact-note: "Звонки и сообщения поступают в службу поддержки {name}."
+    proof: "Подтверждение доставки"
+    open-photo: "Открыть фото доставки"
+    open-signature: "Открыть подпись"
+    open-scan: "Открыть скан"
+    proof-photo: "Фото доставки"
+    proof-signature: "Подпись"
+    proof-scan: "Отсканировано у двери"
+    instructions: "Инструкции к доставке"
+    edit: "Изменить"
+    instructions-help: "Код от ворот, где оставить посылку или кто может расписаться"
+    cancel: "Отмена"
+    save: "Сохранить"
+    no-instructions: "Инструкций пока нет."
+    updates: "Обновления"
+    no-updates: "Обновлений пока нет."
+    show-fewer: "Показать меньше обновлений"
+    show-earlier: "Показать предыдущие обновления ({count})"
+    today: "Сегодня"
+    yesterday: "Вчера"
+    items: "В этой доставке"
+    item: "Товар"
+    quantity: "Кол-во: {count}"
+    share: "Поделиться отслеживанием"
+    report: "Сообщить о проблеме"
+    contact: "Связаться с {name}"
+    report-label: "Что не так с вашей доставкой?"
+    send: "Отправить"
+    close: "Закрыть"
+    no-orders: "Заказов пока нет"
+    no-orders-help: "Здесь появятся доставки для вашего аккаунта."
diff --git a/translations/uk-ua.yaml b/translations/uk-ua.yaml
index d18736178..bb518634e 100644
--- a/translations/uk-ua.yaml
+++ b/translations/uk-ua.yaml
@@ -3475,275 +3475,275 @@ resource-summary:
         zones: Зони
 tracking-page:
   settings:
-    title: "Tracking Page"
-    menu: "Tracking Page"
-    saved: "Tracking page settings saved."
-    load-failed: "We couldn't load the tracking page settings."
-    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
-    pages: "Pages"
-    org-page-enabled: "Your own tracking page"
-    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
-    slug: "Page address"
-    slug-checking: "Checking the address..."
-    open-page: "Open the page"
-    generic-page-allowed: "Allow tracking on the shared page"
-    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
-    links-target: "Links in emails and labels"
-    links-target-help: "Which page your notifications and labels send customers to."
-    links-target-auto: "Your page when it is on, otherwise the shared page"
-    links-target-org: "Always your page"
-    links-target-generic: "Always the shared page"
-    branding: "Branding"
-    display-name: "Display name"
-    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
-    accent: "Accent colour"
-    accent-hex: "Accent colour as a hex value"
-    placeholder-slug: "your-company"
+    title: "Сторінка відстеження"
+    menu: "Сторінка відстеження"
+    saved: "Налаштування сторінки відстеження збережено."
+    load-failed: "Не вдалося завантажити налаштування сторінки відстеження."
+    load-failed-help: "Оновіть сторінку, щоб спробувати ще раз. Якщо помилка повторюється, перевірте, чи маєте ви доступ до цих налаштувань."
+    pages: "Сторінки"
+    org-page-enabled: "Власна сторінка відстеження"
+    org-page-enabled-help: "Сторінка відстеження з вашим брендингом за окремою адресою. На ній знаходяться лише трек-номери вашої організації."
+    slug: "Адреса сторінки"
+    slug-checking: "Перевіряємо адресу..."
+    open-page: "Відкрити сторінку"
+    generic-page-allowed: "Дозволити відстеження на спільній сторінці"
+    generic-page-allowed-help: "Клієнти зможуть шукати ваші трек-номери на {url}. Вимкніть, щоб відстеження працювало лише на вашій сторінці."
+    links-target: "Посилання в листах і на етикетках"
+    links-target-help: "На яку сторінку ведуть клієнтів ваші сповіщення та етикетки."
+    links-target-auto: "Ваша сторінка, якщо вона увімкнена, інакше спільна"
+    links-target-org: "Завжди ваша сторінка"
+    links-target-generic: "Завжди спільна сторінка"
+    branding: "Брендинг"
+    display-name: "Назва для показу"
+    logo-help: "На сторінці використовується логотип вашої організації. Якщо його немає, показується монограма з назви для показу."
+    accent: "Акцентний колір"
+    accent-hex: "Акцентний колір у форматі HEX"
+    placeholder-slug: "vasha-kompaniia"
     placeholder-phone: "+1 555 010 0100"
     placeholder-email: "support@example.com"
     placeholder-website: "https://example.com"
-    placeholder-select: "Select an option"
-    contrast-ok: "Text on this colour is readable ({ratio}:1)."
-    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
-    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
-    accent-dark: "Accent colour in dark mode"
-    accent-dark-auto: "Automatic"
-    support-phone: "Support phone"
-    support-email: "Support email"
-    website: "Website"
-    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
-    powered-by: "Show \"Powered by Fleetbase\""
-    powered-by-help: "A small line in the page footer."
-    theme: "Light and dark"
-    theme-system: "Follow the customer's device"
-    theme-light: "Always light"
-    default-language: "Default language"
-    languages: "Languages customers can choose"
-    access: "Access"
-    public-status: "Show the status without verification"
-    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
-    channel-sms: "Verify by text message"
-    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
-    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
-    channel-email: "Verify by email"
-    channel-email-help: "Sends a 6-digit code to the email address on the order."
-    session-hours: "Stay verified for (hours)"
-    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
-    account-sign-in: "Let customers sign in"
-    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
-    account-upsell: "Suggest creating an account"
-    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
-    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
-    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
-    visibility: "What verified customers see"
-    visibility-map: "Live map"
-    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
-    visibility-driver_name: "Driver's first name"
-    visibility-driver_name-help: "Only the first name, never a surname or phone number."
-    visibility-vehicle: "Vehicle description"
-    visibility-vehicle-help: "For example \"White Ford Transit\"."
-    visibility-items: "Items in the delivery"
-    visibility-items-help: "Names, descriptions, quantities and photos."
-    visibility-item_prices: "Item prices"
-    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
-    visibility-pod_photo: "Delivery photo"
-    visibility-pod_photo-help: "The photo taken as proof of delivery."
-    visibility-pod_signature: "Signature"
-    visibility-pod_signature-help: "The signature captured as proof of delivery."
-    visibility-instructions_edit: "Let customers add delivery instructions"
-    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
-    visibility-report_problem: "Report a problem"
-    visibility-report_problem-help: "Lets customers send you a message about their delivery."
-    driver-contact: "Calls and messages go to"
-    driver-contact-help: "Who customers reach from the driver card."
-    driver-contact-company: "Your support team"
-    driver-contact-driver: "The driver directly"
-    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
-    preview: "Preview"
-    preview-help: "A sample in light and dark mode. Save to apply the changes."
-    preview-chip: "Verified on this device"
-    preview-headline: "Arriving today"
-    preview-sub: "2:10 to 2:40 pm"
-    preview-button: "Verify it's you"
-    preview-powered-by: "Powered by Fleetbase"
+    placeholder-select: "Виберіть варіант"
+    contrast-ok: "Текст на цьому кольорі добре читається ({ratio}:1)."
+    contrast-low: "Текст на цьому кольорі погано читається ({ratio}:1). Виберіть темніший або світліший колір."
+    accent-help: "Використовується для кнопок, індикатора прогресу та виділень. Колір тексту на ньому добирається автоматично."
+    accent-dark: "Акцентний колір у темній темі"
+    accent-dark-auto: "Автоматично"
+    support-phone: "Телефон підтримки"
+    support-email: "Email підтримки"
+    website: "Вебсайт"
+    support-help: "Залиште поля порожніми, щоб використовувати дані вашої організації. Сюди надходять дзвінки й повідомлення клієнтів."
+    powered-by: "Показувати «Працює на Fleetbase»"
+    powered-by-help: "Невеликий рядок унизу сторінки."
+    theme: "Світла й темна тема"
+    theme-system: "Як на пристрої клієнта"
+    theme-light: "Завжди світла"
+    default-language: "Мова за замовчуванням"
+    languages: "Мови, доступні клієнтам"
+    access: "Доступ"
+    public-status: "Показувати статус без підтвердження"
+    public-status-help: "За самим трек-номером клієнти бачать етап доставки та дату останнього оновлення. Вимкніть, щоб нічого не показувати до підтвердження."
+    channel-sms: "Підтвердження через SMS"
+    channel-sms-help: "Надсилає 6-значний код на номер телефону із замовлення."
+    channel-sms-unavailable: "Для цього екземпляра не налаштовано SMS-провайдера, тому коди не можна надіслати через SMS."
+    channel-email: "Підтвердження через email"
+    channel-email-help: "Надсилає 6-значний код на email із замовлення."
+    session-hours: "Термін дії підтвердження (години)"
+    session-hours-help: "Скільки пристрій залишається підтвердженим після введення правильного коду. Від 1 до 168 годин."
+    account-sign-in: "Дозволити клієнтам вхід"
+    account-sign-in-help: "Клієнти з акаунтом у клієнтському порталі можуть увійти й бачити всі свої замовлення без коду."
+    account-upsell: "Пропонувати створити акаунт"
+    account-upsell-help: "Після доставки підтвердженим клієнтам без акаунта пропонується його створити."
+    customer-portal-missing: "Установіть розширення Customer Portal, щоб клієнти могли входити й бачити всі свої замовлення."
+    code-rules: "Коди складаються з 6 цифр і діють 10 хвилин. Після 3 неправильних кодів надсилання призупиняється на 5 хвилин."
+    visibility: "Що бачать підтверджені клієнти"
+    visibility-map: "Карта в реальному часі"
+    visibility-map-help: "Маршрут і положення авто, поки воно їде до клієнта."
+    visibility-driver_name: "Ім'я водія"
+    visibility-driver_name-help: "Лише ім'я — без прізвища та номера телефону."
+    visibility-vehicle: "Опис авто"
+    visibility-vehicle-help: "Наприклад, «Білий Ford Transit»."
+    visibility-items: "Товари в доставці"
+    visibility-items-help: "Назви, описи, кількість і фото."
+    visibility-item_prices: "Ціни товарів"
+    visibility-item_prices-help: "Видно лише клієнтам, які увійшли та оформили замовлення."
+    visibility-pod_photo: "Фото доставки"
+    visibility-pod_photo-help: "Фото, зроблене як підтвердження доставки."
+    visibility-pod_signature: "Підпис"
+    visibility-pod_signature-help: "Підпис, отриманий як підтвердження доставки."
+    visibility-instructions_edit: "Дозволити клієнтам додавати інструкції до доставки"
+    visibility-instructions_edit-help: "Наприклад, код від воріт або де залишити посилку."
+    visibility-report_problem: "Повідомити про проблему"
+    visibility-report_problem-help: "Клієнти зможуть надіслати вам повідомлення про свою доставку."
+    driver-contact: "Дзвінки й повідомлення отримує"
+    driver-contact-help: "З ким клієнти зв'язуються з картки водія."
+    driver-contact-company: "Ваша служба підтримки"
+    driver-contact-driver: "Водій напряму"
+    privacy-rules: "Застосовується завжди: клієнти бачать лише свої зупинки й товари, карта та водій приховуються після доставки, а місцезнаходження водія показується, лише поки він у дорозі."
+    preview: "Попередній перегляд"
+    preview-help: "Приклад у світлій і темній темі. Збережіть, щоб застосувати зміни."
+    preview-chip: "Підтверджено на цьому пристрої"
+    preview-headline: "Прибуде сьогодні"
+    preview-sub: "14:10–14:40"
+    preview-button: "Підтвердьте, що це ви"
+    preview-powered-by: "Працює на Fleetbase"
   page:
-    track-another: "Track another"
-    unavailable-title: "Tracking isn't available here"
-    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
-    lookup-title: "Track your delivery"
-    lookup-sub: "See where your parcel is and when it will arrive."
-    tracking-number: "Tracking number"
-    tracking-number-placeholder: "e.g. NOR4829301736US"
-    tracking-number-help: "Find it in your confirmation email or on the parcel label."
-    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
-    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
-    looking-up: "Looking it up..."
-    track: "Track"
-    or: "or"
-    your-orders: "Your orders"
-    sign-in: "Sign in to see all your orders"
-    sign-in-account: "Sign in to your account"
-    back: "Back"
-    help: "Need help?"
-    language: "Language"
-    powered-by: "Powered by Fleetbase"
-    dismiss: "Dismiss"
-    chip-limited: "Limited view · Verify to see details"
-    chip-verified: "Verified on this device"
-    chip-account: "Signed in"
-    chip-staff: "Staff preview: what this customer sees"
-    status: "Status"
-    verify-to-see: "Verify to see your delivery"
-    last-update: "Last update: {date}"
-    copy: "Copy"
-    verify-title: "See your full delivery details"
-    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
-    verify-button: "Verify it's you"
-    verify-unlock: "Verify to unlock"
-    locked-map: "Live map"
-    locked-arrival: "Arrival time and driver"
-    locked-details: "Updates, items and proof of delivery"
-    stage-preparing: "Being prepared"
-    stage-scheduled: "Scheduled"
-    stage-dispatched: "Driver assigned"
-    stage-in_transit: "In transit"
-    stage-delivered: "Delivered"
-    stage-issue: "Needs attention"
-    stage-canceled: "Canceled"
-    stage-toast-preparing: "Your order is being prepared"
-    stage-toast-scheduled: "Your delivery is scheduled"
-    stage-toast-dispatched: "A driver has been assigned"
-    stage-toast-in_transit: "Your order is on its way"
-    stage-toast-delivered: "Your order has been delivered"
-    stage-toast-issue: "There's an update on your delivery"
-    stage-toast-canceled: "Your order was canceled"
-    verify-title-short: "Verify it's you"
-    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
-    send-by: "Send the code by"
-    channel-sms: "Text message"
+    track-another: "Відстежити інше"
+    unavailable-title: "Відстеження тут недоступне"
+    unavailable-help: "Цю сторінку відстеження не ввімкнено. Скористайтеся посиланням із листа про доставку або зверніться до компанії, яка надіслала замовлення."
+    lookup-title: "Відстежте доставку"
+    lookup-sub: "Дізнайтеся, де ваша посилка і коли вона прибуде."
+    tracking-number: "Трек-номер"
+    tracking-number-placeholder: "наприклад, NOR4829301736US"
+    tracking-number-help: "Його можна знайти в листі з підтвердженням або на етикетці посилки."
+    lookup-neutral: "Ми не можемо показати відстеження за цим номером. Звірте його з листом або етикеткою та спробуйте ще раз."
+    lookup-rate: "Забагато спроб поспіль. Зробіть невелику перерву й спробуйте за кілька хвилин."
+    looking-up: "Шукаємо..."
+    track: "Відстежити"
+    or: "або"
+    your-orders: "Ваші замовлення"
+    sign-in: "Увійдіть, щоб бачити всі замовлення"
+    sign-in-account: "Увійти в акаунт"
+    back: "Назад"
+    help: "Потрібна допомога?"
+    language: "Мова"
+    powered-by: "Працює на Fleetbase"
+    dismiss: "Закрити"
+    chip-limited: "Обмежений перегляд · Підтвердьте, щоб побачити деталі"
+    chip-verified: "Підтверджено на цьому пристрої"
+    chip-account: "Ви увійшли"
+    chip-staff: "Перегляд для співробітника: так бачить клієнт"
+    status: "Статус"
+    verify-to-see: "Підтвердьте, щоб побачити доставку"
+    last-update: "Останнє оновлення: {date}"
+    copy: "Копіювати"
+    verify-title: "Перегляньте всі деталі доставки"
+    verify-help: "Задля вашої конфіденційності карта, час прибуття та деталі доставки відкриваються після швидкої перевірки. Ми надішлемо 6-значний код на телефон або email із цього замовлення."
+    verify-button: "Підтвердьте, що це ви"
+    verify-unlock: "Підтвердьте, щоб відкрити"
+    locked-map: "Карта в реальному часі"
+    locked-arrival: "Час прибуття та водій"
+    locked-details: "Оновлення, товари й підтвердження доставки"
+    stage-preparing: "Готується"
+    stage-scheduled: "Заплановано"
+    stage-dispatched: "Водія призначено"
+    stage-in_transit: "У дорозі"
+    stage-delivered: "Доставлено"
+    stage-issue: "Потребує уваги"
+    stage-canceled: "Скасовано"
+    stage-toast-preparing: "Ваше замовлення готується"
+    stage-toast-scheduled: "Вашу доставку заплановано"
+    stage-toast-dispatched: "Водія призначено"
+    stage-toast-in_transit: "Ваше замовлення в дорозі"
+    stage-toast-delivered: "Ваше замовлення доставлено"
+    stage-toast-issue: "Є новини щодо вашої доставки"
+    stage-toast-canceled: "Ваше замовлення скасовано"
+    verify-title-short: "Підтвердьте, що це ви"
+    verify-choose-help: "Щоб захистити дані про доставку, ми надішлемо 6-значний код на контакти з цього замовлення."
+    send-by: "Надіслати код через"
+    channel-sms: "SMS"
     channel-email: "Email"
-    send-failed: "We couldn't send a code just now. Please try again."
-    sending: "Sending code..."
-    send-code: "Send code"
-    masked-note: "We only ever show part of your number or email here."
-    no-contact-title: "We can't verify you here"
-    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
-    call: "Call {phone}"
-    renew-title: "Get a new code"
-    renew-expired: "That code has expired. Codes last 10 minutes."
-    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
-    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
-    renew-failed: "Something went wrong. Request a new code to try again."
-    send-new-code: "Send a new code"
-    verified-title: "You're verified"
-    locked-title: "Codes paused"
-    enter-code: "Enter your code"
-    code-sent-sms: "We texted a 6-digit code to {masked}."
-    code-sent-email: "We emailed a 6-digit code to {masked}."
-    code-label: "6-digit code"
-    code-expires: "The code expires in 10 minutes."
-    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
-    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
-    code-success: "Verified. Opening your delivery..."
-    resend-in: "Resend code in {time}"
-    resend: "Resend code"
-    switch-to-sms: "Send by text instead"
-    switch-to-email: "Send by email instead"
-    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
-    verified-toast: "You're verified"
-    verified-toast-help: "This device stays verified for this delivery."
-    signed-out-toast: "Signed out on this device"
-    instructions-saved: "Delivery instructions saved"
-    action-failed: "That didn't work. Please try again."
-    report-sent: "Message sent"
-    report-sent-help: "{name} will get back to you."
-    share-copied: "Link copied"
-    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
-    your-stop: "Stop {number}"
-    your-stops: "Your stops"
-    sign-out: "Not you? Sign out"
-    live: "Live"
-    reconnecting: "Reconnecting... live updates paused"
-    timezone: "Times in your time zone ({zone})"
-    progress: "Delivery progress"
-    step-created: "Created"
-    step-dispatched: "Dispatched"
-    step-started: "Picked up"
-    step-enroute: "En route"
-    step-delivered: "Delivered"
-    step-issue: "Attempt missed"
-    step-canceled: "Canceled"
-    headline-preparing: "Getting your order ready"
-    headline-scheduled: "Scheduled for {date}"
-    headline-dispatched: "A driver has been assigned"
-    headline-delayed: "Running a little late"
-    headline-arriving: "Arriving {day}"
-    headline-in-transit: "On its way"
-    headline-delivered: "Delivered"
-    headline-issue: "There's a problem with your delivery"
-    headline-canceled: "This order was canceled"
-    sub-arriving: "{window} · in about {minutes} min"
-    sub-window: "Delivery window {window}"
+    send-failed: "Зараз не вдалося надіслати код. Спробуйте ще раз."
+    sending: "Надсилаємо код..."
+    send-code: "Надіслати код"
+    masked-note: "Тут ми показуємо лише частину вашого номера або email."
+    no-contact-title: "Тут не вдасться підтвердити особу"
+    no-contact-help: "У цьому замовленні немає телефону чи email, на які можна надіслати код. {name} допоможе вам із доставкою."
+    call: "Зателефонувати {phone}"
+    renew-title: "Отримати новий код"
+    renew-expired: "Термін дії коду минув. Код діє 10 хвилин."
+    renew-unlocked: "Можна спробувати знову. Ми надішлемо новий код, старий більше не діє."
+    renew-limited: "Ви запросили кілька кодів. Зачекайте кілька хвилин, перш ніж запросити ще один."
+    renew-failed: "Щось пішло не так. Запросіть новий код і спробуйте ще раз."
+    send-new-code: "Надіслати новий код"
+    verified-title: "Вас підтверджено"
+    locked-title: "Коди призупинено"
+    enter-code: "Введіть код"
+    code-sent-sms: "Ми надіслали 6-значний код через SMS на {masked}."
+    code-sent-email: "Ми надіслали 6-значний код на {masked}."
+    code-label: "6-значний код"
+    code-expires: "Код діє 10 хвилин."
+    code-wrong: "Код не підходить. {count, plural, one {Залишилася # спроба} few {Залишилося # спроби} many {Залишилося # спроб} other {Залишилося # спроби}}."
+    code-locked: "Забагато спроб. Задля вашої безпеки коди призупинено. Спробуйте знову через {time}."
+    code-success: "Підтверджено. Відкриваємо вашу доставку..."
+    resend-in: "Надіслати код повторно через {time}"
+    resend: "Надіслати код повторно"
+    switch-to-sms: "Надіслати через SMS"
+    switch-to-email: "Надіслати через email"
+    stay-verified: "Після підтвердження цей пристрій залишається підтвердженим протягом {hours} год. Ви можете вийти будь-коли."
+    verified-toast: "Вас підтверджено"
+    verified-toast-help: "Цей пристрій залишається підтвердженим для цієї доставки."
+    signed-out-toast: "Ви вийшли на цьому пристрої"
+    instructions-saved: "Інструкції до доставки збережено"
+    action-failed: "Не вийшло. Спробуйте ще раз."
+    report-sent: "Повідомлення надіслано"
+    report-sent-help: "{name} зв'яжеться з вами."
+    share-copied: "Посилання скопійовано"
+    share-copied-help: "Усі, з ким ви поділитеся посиланням, бачитимуть обмежений перегляд, доки не підтвердять себе."
+    your-stop: "Зупинка {number}"
+    your-stops: "Ваші зупинки"
+    sign-out: "Це не ви? Вийти"
+    live: "Наживо"
+    reconnecting: "Повторне підключення... оновлення призупинено"
+    timezone: "Час у вашому часовому поясі ({zone})"
+    progress: "Хід доставки"
+    step-created: "Створено"
+    step-dispatched: "Відправлено"
+    step-started: "Забрано"
+    step-enroute: "У дорозі"
+    step-delivered: "Доставлено"
+    step-issue: "Спроба невдала"
+    step-canceled: "Скасовано"
+    headline-preparing: "Готуємо ваше замовлення"
+    headline-scheduled: "Заплановано на {date}"
+    headline-dispatched: "Водія призначено"
+    headline-delayed: "Трохи запізнюється"
+    headline-arriving: "Прибуде {day}"
+    headline-in-transit: "У дорозі"
+    headline-delivered: "Доставлено"
+    headline-issue: "З вашою доставкою виникла проблема"
+    headline-canceled: "Це замовлення скасовано"
+    sub-arriving: "{window} · приблизно за {minutes} хв"
+    sub-window: "Вікно доставки {window}"
     sub-delivered: "{when}"
-    sub-dispatched: "Live tracking starts as soon as they're on the way."
-    sub-preparing: "We'll let you know when it's on its way."
-    delayed-title: "Running late."
-    delayed-help: "We'll keep your arrival time up to date."
-    stop-of: "Your delivery is stop {position} of {total}"
-    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
-    map: "Map"
-    map-label: "Map of your delivery: the van on its way to your address."
-    map-pickup: "Pickup area"
-    map-driver: "Driver"
-    map-pickup-named: "Pickup · {name}"
-    map-fullscreen: "Full screen map"
-    map-exit-fullscreen: "Exit full screen"
-    stop-card-title: "Delivering to"
-    stop-upcoming: "Upcoming"
-    stop-complete: "Delivered"
-    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
-    last-seen: "Last seen {minutes} min ago"
-    recenter: "Center the map on the van"
-    fit-route: "Show the whole route"
-    eta: "Estimated arrival"
-    in-minutes: "in about {minutes} min"
-    window: "Delivery window"
-    before-yours: "Before yours"
-    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
-    estimate-may-change: "Estimate may change"
-    driver: "Your driver"
-    online: "Online"
-    location-paused: "Location paused"
-    call-short: "Call"
-    message: "Message"
-    contact-note: "Calls and messages go to the {name} support team."
-    proof: "Proof of delivery"
-    open-photo: "Open the delivery photo"
-    open-signature: "Open the signature"
-    open-scan: "Open the scan"
-    proof-photo: "Delivery photo"
-    proof-signature: "Signature"
-    proof-scan: "Scanned at the door"
-    instructions: "Delivery instructions"
-    edit: "Edit"
-    instructions-help: "Gate codes, where to leave it, or who can sign"
-    cancel: "Cancel"
-    save: "Save"
-    no-instructions: "No instructions yet."
-    updates: "Updates"
-    no-updates: "No updates yet."
-    show-fewer: "Show fewer updates"
-    show-earlier: "Show earlier updates ({count})"
-    today: "Today"
-    yesterday: "Yesterday"
-    items: "In this delivery"
-    item: "Item"
-    quantity: "Qty {count}"
-    share: "Share tracking"
-    report: "Report a problem"
-    contact: "Contact {name}"
-    report-label: "What's wrong with your delivery?"
-    send: "Send"
-    close: "Close"
-    no-orders: "No orders yet"
-    no-orders-help: "Deliveries for your account will show up here."
+    sub-dispatched: "Відстеження в реальному часі почнеться, щойно водій вирушить."
+    sub-preparing: "Ми повідомимо, коли замовлення буде в дорозі."
+    delayed-title: "Запізнюється."
+    delayed-help: "Ми оновлюватимемо час прибуття."
+    stop-of: "Ваша доставка — зупинка {position} з {total}"
+    stops-private: "{count, plural, =0 {Ви наступні.} one {Перед вами # зупинка.} few {Перед вами # зупинки.} many {Перед вами # зупинок.} other {Перед вами # зупинки.}} Інші зупинки приховано — ви бачите лише свою."
+    map: "Карта"
+    map-label: "Карта вашої доставки: авто їде до вашої адреси."
+    map-pickup: "Місце забору"
+    map-driver: "Водій"
+    map-pickup-named: "Забір · {name}"
+    map-fullscreen: "Карта на весь екран"
+    map-exit-fullscreen: "Вийти з повноекранного режиму"
+    stop-card-title: "Доставка за адресою"
+    stop-upcoming: "Попереду"
+    stop-complete: "Доставлено"
+    map-hidden: "Карту приховано, оскільки замовлення доставлено. Біля ваших дверей ми припиняємо показувати місцезнаходження водія."
+    last-seen: "Оновлено {minutes} хв тому"
+    recenter: "Показати авто в центрі карти"
+    fit-route: "Показати весь маршрут"
+    eta: "Очікуване прибуття"
+    in-minutes: "приблизно за {minutes} хв"
+    window: "Вікно доставки"
+    before-yours: "Перед вами"
+    stops-count: "{count, plural, =0 {Немає} one {# зупинка} few {# зупинки} many {# зупинок} other {# зупинки}}"
+    estimate-may-change: "Час може змінитися"
+    driver: "Ваш водій"
+    online: "На зв'язку"
+    location-paused: "Місцезнаходження призупинено"
+    call-short: "Зателефонувати"
+    message: "Написати"
+    contact-note: "Дзвінки й повідомлення надходять до служби підтримки {name}."
+    proof: "Підтвердження доставки"
+    open-photo: "Відкрити фото доставки"
+    open-signature: "Відкрити підпис"
+    open-scan: "Відкрити скан"
+    proof-photo: "Фото доставки"
+    proof-signature: "Підпис"
+    proof-scan: "Відскановано біля дверей"
+    instructions: "Інструкції до доставки"
+    edit: "Змінити"
+    instructions-help: "Код від воріт, де залишити посилку або хто може розписатися"
+    cancel: "Скасувати"
+    save: "Зберегти"
+    no-instructions: "Інструкцій поки немає."
+    updates: "Оновлення"
+    no-updates: "Оновлень поки немає."
+    show-fewer: "Показати менше оновлень"
+    show-earlier: "Показати попередні оновлення ({count})"
+    today: "Сьогодні"
+    yesterday: "Учора"
+    items: "У цій доставці"
+    item: "Товар"
+    quantity: "К-сть: {count}"
+    share: "Поділитися відстеженням"
+    report: "Повідомити про проблему"
+    contact: "Зв'язатися з {name}"
+    report-label: "Що не так із вашою доставкою?"
+    send: "Надіслати"
+    close: "Закрити"
+    no-orders: "Замовлень поки немає"
+    no-orders-help: "Тут з'являться доставки для вашого акаунта."
diff --git a/translations/vi-vn.yaml b/translations/vi-vn.yaml
index 0cfd214da..e7f0dabb1 100644
--- a/translations/vi-vn.yaml
+++ b/translations/vi-vn.yaml
@@ -2148,275 +2148,275 @@ trailer:
     other: Khác
 tracking-page:
   settings:
-    title: "Tracking Page"
-    menu: "Tracking Page"
-    saved: "Tracking page settings saved."
-    load-failed: "We couldn't load the tracking page settings."
-    load-failed-help: "Reload the page to try again. If it keeps happening, check that you have permission to view these settings."
-    pages: "Pages"
-    org-page-enabled: "Your own tracking page"
-    org-page-enabled-help: "A tracking page with your branding at its own address. It only finds your organization's tracking numbers."
-    slug: "Page address"
-    slug-checking: "Checking the address..."
-    open-page: "Open the page"
-    generic-page-allowed: "Allow tracking on the shared page"
-    generic-page-allowed-help: "Lets customers look up your tracking numbers at {url}. Turn it off to keep tracking on your own page only."
-    links-target: "Links in emails and labels"
-    links-target-help: "Which page your notifications and labels send customers to."
-    links-target-auto: "Your page when it is on, otherwise the shared page"
-    links-target-org: "Always your page"
-    links-target-generic: "Always the shared page"
-    branding: "Branding"
-    display-name: "Display name"
-    logo-help: "The page uses your organization logo. Without one it shows a monogram of the display name."
-    accent: "Accent colour"
-    accent-hex: "Accent colour as a hex value"
-    placeholder-slug: "your-company"
+    title: "Trang theo dõi"
+    menu: "Trang theo dõi"
+    saved: "Đã lưu cài đặt trang theo dõi."
+    load-failed: "Không thể tải cài đặt trang theo dõi."
+    load-failed-help: "Tải lại trang để thử lại. Nếu lỗi vẫn tiếp diễn, hãy kiểm tra xem bạn có quyền xem các cài đặt này không."
+    pages: "Trang"
+    org-page-enabled: "Trang theo dõi riêng của bạn"
+    org-page-enabled-help: "Trang theo dõi mang thương hiệu của bạn tại một địa chỉ riêng. Trang chỉ tìm được mã vận đơn của tổ chức bạn."
+    slug: "Địa chỉ trang"
+    slug-checking: "Đang kiểm tra địa chỉ..."
+    open-page: "Mở trang"
+    generic-page-allowed: "Cho phép theo dõi trên trang chung"
+    generic-page-allowed-help: "Cho phép khách hàng tra cứu mã vận đơn của bạn tại {url}. Tắt đi để chỉ theo dõi trên trang riêng của bạn."
+    links-target: "Liên kết trong email và nhãn"
+    links-target-help: "Trang mà thông báo và nhãn của bạn dẫn khách hàng đến."
+    links-target-auto: "Trang của bạn khi đang bật, nếu không thì trang chung"
+    links-target-org: "Luôn dùng trang của bạn"
+    links-target-generic: "Luôn dùng trang chung"
+    branding: "Thương hiệu"
+    display-name: "Tên hiển thị"
+    logo-help: "Trang dùng logo của tổ chức bạn. Nếu không có logo, trang sẽ hiển thị chữ viết tắt của tên hiển thị."
+    accent: "Màu nhấn"
+    accent-hex: "Màu nhấn dạng mã hex"
+    placeholder-slug: "cong-ty-cua-ban"
     placeholder-phone: "+1 555 010 0100"
     placeholder-email: "support@example.com"
     placeholder-website: "https://example.com"
-    placeholder-select: "Select an option"
-    contrast-ok: "Text on this colour is readable ({ratio}:1)."
-    contrast-low: "Text on this colour is hard to read ({ratio}:1). Choose a darker or lighter colour."
-    accent-help: "Used for buttons, progress and highlights. The text colour on it is chosen automatically."
-    accent-dark: "Accent colour in dark mode"
-    accent-dark-auto: "Automatic"
-    support-phone: "Support phone"
-    support-email: "Support email"
-    website: "Website"
-    support-help: "Leave these empty to use your organization's details. Customers' calls and messages go here."
-    powered-by: "Show \"Powered by Fleetbase\""
-    powered-by-help: "A small line in the page footer."
-    theme: "Light and dark"
-    theme-system: "Follow the customer's device"
-    theme-light: "Always light"
-    default-language: "Default language"
-    languages: "Languages customers can choose"
-    access: "Access"
-    public-status: "Show the status without verification"
-    public-status-help: "With only a tracking number, customers see the delivery stage and the date of the last update. Turn it off to show nothing until they verify."
-    channel-sms: "Verify by text message"
-    channel-sms-help: "Sends a 6-digit code to the phone number on the order."
-    channel-sms-unavailable: "No SMS provider is configured for this instance, so codes can't be sent by text message."
-    channel-email: "Verify by email"
-    channel-email-help: "Sends a 6-digit code to the email address on the order."
-    session-hours: "Stay verified for (hours)"
-    session-hours-help: "How long a device stays verified after a correct code. Between 1 and 168 hours."
-    account-sign-in: "Let customers sign in"
-    account-sign-in-help: "Customers with a customer portal account can sign in to see all their orders without a code."
-    account-upsell: "Suggest creating an account"
-    account-upsell-help: "After delivery, verified customers without an account are invited to create one."
-    customer-portal-missing: "Install the Customer Portal extension to let customers sign in and see all their orders."
-    code-rules: "Codes have 6 digits and expire after 10 minutes. After 3 wrong codes, codes pause for 5 minutes."
-    visibility: "What verified customers see"
-    visibility-map: "Live map"
-    visibility-map-help: "The route and the vehicle's position while it is on its way to the customer."
-    visibility-driver_name: "Driver's first name"
-    visibility-driver_name-help: "Only the first name, never a surname or phone number."
-    visibility-vehicle: "Vehicle description"
-    visibility-vehicle-help: "For example \"White Ford Transit\"."
-    visibility-items: "Items in the delivery"
-    visibility-items-help: "Names, descriptions, quantities and photos."
-    visibility-item_prices: "Item prices"
-    visibility-item_prices-help: "Shown only to signed-in customers who placed the order."
-    visibility-pod_photo: "Delivery photo"
-    visibility-pod_photo-help: "The photo taken as proof of delivery."
-    visibility-pod_signature: "Signature"
-    visibility-pod_signature-help: "The signature captured as proof of delivery."
-    visibility-instructions_edit: "Let customers add delivery instructions"
-    visibility-instructions_edit-help: "For example a gate code or where to leave the parcel."
-    visibility-report_problem: "Report a problem"
-    visibility-report_problem-help: "Lets customers send you a message about their delivery."
-    driver-contact: "Calls and messages go to"
-    driver-contact-help: "Who customers reach from the driver card."
-    driver-contact-company: "Your support team"
-    driver-contact-driver: "The driver directly"
-    privacy-rules: "Always applied: customers only ever see their own stops and items, the map and driver are hidden after delivery, and the driver's location is shown only while they are on the way."
-    preview: "Preview"
-    preview-help: "A sample in light and dark mode. Save to apply the changes."
-    preview-chip: "Verified on this device"
-    preview-headline: "Arriving today"
-    preview-sub: "2:10 to 2:40 pm"
-    preview-button: "Verify it's you"
+    placeholder-select: "Chọn một tùy chọn"
+    contrast-ok: "Chữ trên màu này dễ đọc ({ratio}:1)."
+    contrast-low: "Chữ trên màu này khó đọc ({ratio}:1). Hãy chọn màu tối hơn hoặc sáng hơn."
+    accent-help: "Dùng cho nút, tiến trình và phần làm nổi bật. Màu chữ trên nền này được chọn tự động."
+    accent-dark: "Màu nhấn ở chế độ tối"
+    accent-dark-auto: "Tự động"
+    support-phone: "Số điện thoại hỗ trợ"
+    support-email: "Email hỗ trợ"
+    website: "Trang web"
+    support-help: "Để trống để dùng thông tin của tổ chức bạn. Cuộc gọi và tin nhắn của khách hàng sẽ được chuyển đến đây."
+    powered-by: "Hiển thị \"Powered by Fleetbase\""
+    powered-by-help: "Một dòng nhỏ ở chân trang."
+    theme: "Sáng và tối"
+    theme-system: "Theo thiết bị của khách hàng"
+    theme-light: "Luôn sáng"
+    default-language: "Ngôn ngữ mặc định"
+    languages: "Ngôn ngữ khách hàng có thể chọn"
+    access: "Quyền truy cập"
+    public-status: "Hiển thị trạng thái mà không cần xác minh"
+    public-status-help: "Chỉ với mã vận đơn, khách hàng sẽ thấy giai đoạn giao hàng và ngày cập nhật gần nhất. Tắt đi để không hiển thị gì cho đến khi họ xác minh."
+    channel-sms: "Xác minh qua tin nhắn"
+    channel-sms-help: "Gửi mã 6 chữ số đến số điện thoại trong đơn hàng."
+    channel-sms-unavailable: "Hệ thống này chưa cấu hình nhà cung cấp SMS nên không thể gửi mã qua tin nhắn."
+    channel-email: "Xác minh qua email"
+    channel-email-help: "Gửi mã 6 chữ số đến địa chỉ email trong đơn hàng."
+    session-hours: "Thời gian giữ xác minh (giờ)"
+    session-hours-help: "Thời gian thiết bị vẫn được xác minh sau khi nhập đúng mã. Từ 1 đến 168 giờ."
+    account-sign-in: "Cho phép khách hàng đăng nhập"
+    account-sign-in-help: "Khách hàng có tài khoản cổng khách hàng có thể đăng nhập để xem tất cả đơn hàng mà không cần mã."
+    account-upsell: "Gợi ý tạo tài khoản"
+    account-upsell-help: "Sau khi giao hàng, khách hàng đã xác minh nhưng chưa có tài khoản sẽ được mời tạo tài khoản."
+    customer-portal-missing: "Cài đặt tiện ích Customer Portal để khách hàng có thể đăng nhập và xem tất cả đơn hàng của họ."
+    code-rules: "Mã gồm 6 chữ số và hết hạn sau 10 phút. Sau 3 lần nhập sai, việc gửi mã sẽ tạm dừng 5 phút."
+    visibility: "Những gì khách hàng đã xác minh thấy"
+    visibility-map: "Bản đồ trực tiếp"
+    visibility-map-help: "Lộ trình và vị trí xe khi đang trên đường đến khách hàng."
+    visibility-driver_name: "Tên tài xế"
+    visibility-driver_name-help: "Chỉ hiển thị tên, không bao giờ hiển thị họ hay số điện thoại."
+    visibility-vehicle: "Mô tả xe"
+    visibility-vehicle-help: "Ví dụ \"Ford Transit màu trắng\"."
+    visibility-items: "Hàng hóa trong đơn giao"
+    visibility-items-help: "Tên, mô tả, số lượng và ảnh."
+    visibility-item_prices: "Giá hàng hóa"
+    visibility-item_prices-help: "Chỉ hiển thị cho khách hàng đã đăng nhập và là người đặt đơn."
+    visibility-pod_photo: "Ảnh giao hàng"
+    visibility-pod_photo-help: "Ảnh chụp làm bằng chứng giao hàng."
+    visibility-pod_signature: "Chữ ký"
+    visibility-pod_signature-help: "Chữ ký được ghi nhận làm bằng chứng giao hàng."
+    visibility-instructions_edit: "Cho phép khách hàng thêm hướng dẫn giao hàng"
+    visibility-instructions_edit-help: "Ví dụ mã cổng hoặc nơi để gói hàng."
+    visibility-report_problem: "Báo cáo sự cố"
+    visibility-report_problem-help: "Cho phép khách hàng gửi tin nhắn cho bạn về đơn giao của họ."
+    driver-contact: "Cuộc gọi và tin nhắn được chuyển đến"
+    driver-contact-help: "Người mà khách hàng liên hệ từ thẻ tài xế."
+    driver-contact-company: "Đội hỗ trợ của bạn"
+    driver-contact-driver: "Trực tiếp tài xế"
+    privacy-rules: "Luôn áp dụng: khách hàng chỉ thấy điểm dừng và hàng hóa của chính họ, bản đồ và tài xế được ẩn sau khi giao hàng, và vị trí tài xế chỉ hiển thị khi đang trên đường đến."
+    preview: "Xem trước"
+    preview-help: "Mẫu ở chế độ sáng và tối. Lưu để áp dụng thay đổi."
+    preview-chip: "Đã xác minh trên thiết bị này"
+    preview-headline: "Đến trong hôm nay"
+    preview-sub: "14:10 đến 14:40"
+    preview-button: "Xác minh danh tính"
     preview-powered-by: "Powered by Fleetbase"
   page:
-    track-another: "Track another"
-    unavailable-title: "Tracking isn't available here"
-    unavailable-help: "This tracking page isn't switched on. Use the link in your delivery email, or contact the company that sent your order."
-    lookup-title: "Track your delivery"
-    lookup-sub: "See where your parcel is and when it will arrive."
-    tracking-number: "Tracking number"
-    tracking-number-placeholder: "e.g. NOR4829301736US"
-    tracking-number-help: "Find it in your confirmation email or on the parcel label."
-    lookup-neutral: "We can't show tracking for that number. Check it matches your email or parcel label and try again."
-    lookup-rate: "That's a few tries in a row. Take a short break and try again in a few minutes."
-    looking-up: "Looking it up..."
-    track: "Track"
-    or: "or"
-    your-orders: "Your orders"
-    sign-in: "Sign in to see all your orders"
-    sign-in-account: "Sign in to your account"
-    back: "Back"
-    help: "Need help?"
-    language: "Language"
+    track-another: "Theo dõi đơn khác"
+    unavailable-title: "Không thể theo dõi tại đây"
+    unavailable-help: "Trang theo dõi này chưa được bật. Hãy dùng liên kết trong email giao hàng hoặc liên hệ công ty đã gửi đơn hàng cho bạn."
+    lookup-title: "Theo dõi đơn giao"
+    lookup-sub: "Xem gói hàng của bạn đang ở đâu và khi nào sẽ đến."
+    tracking-number: "Mã vận đơn"
+    tracking-number-placeholder: "VD: NOR4829301736US"
+    tracking-number-help: "Bạn có thể tìm thấy mã trong email xác nhận hoặc trên nhãn gói hàng."
+    lookup-neutral: "Chúng tôi không thể hiển thị thông tin theo dõi cho mã này. Hãy kiểm tra xem mã có khớp với email hoặc nhãn gói hàng không rồi thử lại."
+    lookup-rate: "Bạn đã thử nhiều lần liên tiếp. Hãy nghỉ một chút và thử lại sau vài phút."
+    looking-up: "Đang tra cứu..."
+    track: "Theo dõi"
+    or: "hoặc"
+    your-orders: "Đơn hàng của bạn"
+    sign-in: "Đăng nhập để xem tất cả đơn hàng"
+    sign-in-account: "Đăng nhập vào tài khoản"
+    back: "Quay lại"
+    help: "Cần trợ giúp?"
+    language: "Ngôn ngữ"
     powered-by: "Powered by Fleetbase"
-    dismiss: "Dismiss"
-    chip-limited: "Limited view · Verify to see details"
-    chip-verified: "Verified on this device"
-    chip-account: "Signed in"
-    chip-staff: "Staff preview: what this customer sees"
-    status: "Status"
-    verify-to-see: "Verify to see your delivery"
-    last-update: "Last update: {date}"
-    copy: "Copy"
-    verify-title: "See your full delivery details"
-    verify-help: "For your privacy, the map, arrival time and delivery details unlock after a quick check. We'll send a 6-digit code to the phone or email on this order."
-    verify-button: "Verify it's you"
-    verify-unlock: "Verify to unlock"
-    locked-map: "Live map"
-    locked-arrival: "Arrival time and driver"
-    locked-details: "Updates, items and proof of delivery"
-    stage-preparing: "Being prepared"
-    stage-scheduled: "Scheduled"
-    stage-dispatched: "Driver assigned"
-    stage-in_transit: "In transit"
-    stage-delivered: "Delivered"
-    stage-issue: "Needs attention"
-    stage-canceled: "Canceled"
-    stage-toast-preparing: "Your order is being prepared"
-    stage-toast-scheduled: "Your delivery is scheduled"
-    stage-toast-dispatched: "A driver has been assigned"
-    stage-toast-in_transit: "Your order is on its way"
-    stage-toast-delivered: "Your order has been delivered"
-    stage-toast-issue: "There's an update on your delivery"
-    stage-toast-canceled: "Your order was canceled"
-    verify-title-short: "Verify it's you"
-    verify-choose-help: "To protect your delivery details, we'll send a 6-digit code to the contact details on this order."
-    send-by: "Send the code by"
-    channel-sms: "Text message"
+    dismiss: "Bỏ qua"
+    chip-limited: "Xem giới hạn · Xác minh để xem chi tiết"
+    chip-verified: "Đã xác minh trên thiết bị này"
+    chip-account: "Đã đăng nhập"
+    chip-staff: "Xem trước cho nhân viên: những gì khách hàng này thấy"
+    status: "Trạng thái"
+    verify-to-see: "Xác minh để xem đơn giao"
+    last-update: "Cập nhật gần nhất: {date}"
+    copy: "Sao chép"
+    verify-title: "Xem đầy đủ chi tiết đơn giao"
+    verify-help: "Để bảo vệ quyền riêng tư của bạn, bản đồ, thời gian đến và chi tiết giao hàng sẽ mở sau một bước kiểm tra nhanh. Chúng tôi sẽ gửi mã 6 chữ số đến số điện thoại hoặc email trong đơn hàng này."
+    verify-button: "Xác minh danh tính"
+    verify-unlock: "Xác minh để mở khóa"
+    locked-map: "Bản đồ trực tiếp"
+    locked-arrival: "Thời gian đến và tài xế"
+    locked-details: "Cập nhật, hàng hóa và bằng chứng giao hàng"
+    stage-preparing: "Đang chuẩn bị"
+    stage-scheduled: "Đã lên lịch"
+    stage-dispatched: "Đã có tài xế"
+    stage-in_transit: "Đang vận chuyển"
+    stage-delivered: "Đã giao"
+    stage-issue: "Cần chú ý"
+    stage-canceled: "Đã hủy"
+    stage-toast-preparing: "Đơn hàng của bạn đang được chuẩn bị"
+    stage-toast-scheduled: "Đơn giao của bạn đã được lên lịch"
+    stage-toast-dispatched: "Đã có tài xế nhận đơn"
+    stage-toast-in_transit: "Đơn hàng của bạn đang trên đường đến"
+    stage-toast-delivered: "Đơn hàng của bạn đã được giao"
+    stage-toast-issue: "Có cập nhật về đơn giao của bạn"
+    stage-toast-canceled: "Đơn hàng của bạn đã bị hủy"
+    verify-title-short: "Xác minh danh tính"
+    verify-choose-help: "Để bảo vệ thông tin giao hàng, chúng tôi sẽ gửi mã 6 chữ số đến thông tin liên hệ trong đơn hàng này."
+    send-by: "Gửi mã qua"
+    channel-sms: "Tin nhắn"
     channel-email: "Email"
-    send-failed: "We couldn't send a code just now. Please try again."
-    sending: "Sending code..."
-    send-code: "Send code"
-    masked-note: "We only ever show part of your number or email here."
-    no-contact-title: "We can't verify you here"
-    no-contact-help: "This order has no phone number or email we can send a code to. {name} can help you with your delivery."
-    call: "Call {phone}"
-    renew-title: "Get a new code"
-    renew-expired: "That code has expired. Codes last 10 minutes."
-    renew-unlocked: "You can try again now. We'll send a new code; the old one no longer works."
-    renew-limited: "You've asked for several codes. Please wait a few minutes before requesting another."
-    renew-failed: "Something went wrong. Request a new code to try again."
-    send-new-code: "Send a new code"
-    verified-title: "You're verified"
-    locked-title: "Codes paused"
-    enter-code: "Enter your code"
-    code-sent-sms: "We texted a 6-digit code to {masked}."
-    code-sent-email: "We emailed a 6-digit code to {masked}."
-    code-label: "6-digit code"
-    code-expires: "The code expires in 10 minutes."
-    code-wrong: "That code didn't match. {count, plural, one {# attempt} other {# attempts}} left."
-    code-locked: "Too many attempts. For your security, codes are paused. Try again in {time}."
-    code-success: "Verified. Opening your delivery..."
-    resend-in: "Resend code in {time}"
-    resend: "Resend code"
-    switch-to-sms: "Send by text instead"
-    switch-to-email: "Send by email instead"
-    stay-verified: "Once verified, this device stays verified for {hours} hours. You can sign out at any time."
-    verified-toast: "You're verified"
-    verified-toast-help: "This device stays verified for this delivery."
-    signed-out-toast: "Signed out on this device"
-    instructions-saved: "Delivery instructions saved"
-    action-failed: "That didn't work. Please try again."
-    report-sent: "Message sent"
-    report-sent-help: "{name} will get back to you."
-    share-copied: "Link copied"
-    share-copied-help: "Anyone you share it with sees a limited view until they verify themselves."
-    your-stop: "Stop {number}"
-    your-stops: "Your stops"
-    sign-out: "Not you? Sign out"
-    live: "Live"
-    reconnecting: "Reconnecting... live updates paused"
-    timezone: "Times in your time zone ({zone})"
-    progress: "Delivery progress"
-    step-created: "Created"
-    step-dispatched: "Dispatched"
-    step-started: "Picked up"
-    step-enroute: "En route"
-    step-delivered: "Delivered"
-    step-issue: "Attempt missed"
-    step-canceled: "Canceled"
-    headline-preparing: "Getting your order ready"
-    headline-scheduled: "Scheduled for {date}"
-    headline-dispatched: "A driver has been assigned"
-    headline-delayed: "Running a little late"
-    headline-arriving: "Arriving {day}"
-    headline-in-transit: "On its way"
-    headline-delivered: "Delivered"
-    headline-issue: "There's a problem with your delivery"
-    headline-canceled: "This order was canceled"
-    sub-arriving: "{window} · in about {minutes} min"
-    sub-window: "Delivery window {window}"
+    send-failed: "Hiện không thể gửi mã. Vui lòng thử lại."
+    sending: "Đang gửi mã..."
+    send-code: "Gửi mã"
+    masked-note: "Chúng tôi chỉ hiển thị một phần số điện thoại hoặc email của bạn tại đây."
+    no-contact-title: "Không thể xác minh tại đây"
+    no-contact-help: "Đơn hàng này không có số điện thoại hoặc email để gửi mã. {name} có thể hỗ trợ bạn về đơn giao."
+    call: "Gọi {phone}"
+    renew-title: "Nhận mã mới"
+    renew-expired: "Mã đã hết hạn. Mã có hiệu lực trong 10 phút."
+    renew-unlocked: "Bạn có thể thử lại ngay. Chúng tôi sẽ gửi mã mới; mã cũ không còn hiệu lực."
+    renew-limited: "Bạn đã yêu cầu nhiều mã. Vui lòng đợi vài phút trước khi yêu cầu mã khác."
+    renew-failed: "Đã xảy ra lỗi. Hãy yêu cầu mã mới để thử lại."
+    send-new-code: "Gửi mã mới"
+    verified-title: "Bạn đã được xác minh"
+    locked-title: "Tạm dừng gửi mã"
+    enter-code: "Nhập mã của bạn"
+    code-sent-sms: "Chúng tôi đã nhắn mã 6 chữ số đến {masked}."
+    code-sent-email: "Chúng tôi đã gửi email mã 6 chữ số đến {masked}."
+    code-label: "Mã 6 chữ số"
+    code-expires: "Mã sẽ hết hạn sau 10 phút."
+    code-wrong: "Mã không khớp. Còn {count, plural, other {# lần thử}}."
+    code-locked: "Quá nhiều lần thử. Để bảo mật, việc gửi mã đã tạm dừng. Hãy thử lại sau {time}."
+    code-success: "Đã xác minh. Đang mở đơn giao của bạn..."
+    resend-in: "Gửi lại mã sau {time}"
+    resend: "Gửi lại mã"
+    switch-to-sms: "Gửi qua tin nhắn"
+    switch-to-email: "Gửi qua email"
+    stay-verified: "Sau khi xác minh, thiết bị này sẽ giữ trạng thái xác minh trong {hours} giờ. Bạn có thể đăng xuất bất cứ lúc nào."
+    verified-toast: "Bạn đã được xác minh"
+    verified-toast-help: "Thiết bị này vẫn được xác minh cho đơn giao này."
+    signed-out-toast: "Đã đăng xuất trên thiết bị này"
+    instructions-saved: "Đã lưu hướng dẫn giao hàng"
+    action-failed: "Thao tác không thành công. Vui lòng thử lại."
+    report-sent: "Đã gửi tin nhắn"
+    report-sent-help: "{name} sẽ phản hồi bạn."
+    share-copied: "Đã sao chép liên kết"
+    share-copied-help: "Người nhận liên kết sẽ chỉ thấy thông tin giới hạn cho đến khi họ tự xác minh."
+    your-stop: "Điểm dừng {number}"
+    your-stops: "Điểm dừng của bạn"
+    sign-out: "Không phải bạn? Đăng xuất"
+    live: "Trực tiếp"
+    reconnecting: "Đang kết nối lại... tạm dừng cập nhật trực tiếp"
+    timezone: "Thời gian theo múi giờ của bạn ({zone})"
+    progress: "Tiến trình giao hàng"
+    step-created: "Đã tạo"
+    step-dispatched: "Đã điều phối"
+    step-started: "Đã lấy hàng"
+    step-enroute: "Đang trên đường"
+    step-delivered: "Đã giao"
+    step-issue: "Giao không thành công"
+    step-canceled: "Đã hủy"
+    headline-preparing: "Đang chuẩn bị đơn hàng của bạn"
+    headline-scheduled: "Đã lên lịch vào {date}"
+    headline-dispatched: "Đã có tài xế nhận đơn"
+    headline-delayed: "Sẽ đến muộn một chút"
+    headline-arriving: "Sẽ đến {day}"
+    headline-in-transit: "Đang trên đường đến"
+    headline-delivered: "Đã giao"
+    headline-issue: "Đơn giao của bạn gặp sự cố"
+    headline-canceled: "Đơn hàng này đã bị hủy"
+    sub-arriving: "{window} · khoảng {minutes} phút nữa"
+    sub-window: "Khung giờ giao {window}"
     sub-delivered: "{when}"
-    sub-dispatched: "Live tracking starts as soon as they're on the way."
-    sub-preparing: "We'll let you know when it's on its way."
-    delayed-title: "Running late."
-    delayed-help: "We'll keep your arrival time up to date."
-    stop-of: "Your delivery is stop {position} of {total}"
-    stops-private: "{count, plural, =0 {You're next.} one {# stop to go before yours.} other {# stops to go before yours.}} Other stops stay private, so you only see your own."
-    map: "Map"
-    map-label: "Map of your delivery: the van on its way to your address."
-    map-pickup: "Pickup area"
-    map-driver: "Driver"
-    map-pickup-named: "Pickup · {name}"
-    map-fullscreen: "Full screen map"
-    map-exit-fullscreen: "Exit full screen"
-    stop-card-title: "Delivering to"
-    stop-upcoming: "Upcoming"
-    stop-complete: "Delivered"
-    map-hidden: "The map is hidden now your order is delivered. We stop sharing the driver's location at your door."
-    last-seen: "Last seen {minutes} min ago"
-    recenter: "Center the map on the van"
-    fit-route: "Show the whole route"
-    eta: "Estimated arrival"
-    in-minutes: "in about {minutes} min"
-    window: "Delivery window"
-    before-yours: "Before yours"
-    stops-count: "{count, plural, =0 {None} one {# stop} other {# stops}}"
-    estimate-may-change: "Estimate may change"
-    driver: "Your driver"
-    online: "Online"
-    location-paused: "Location paused"
-    call-short: "Call"
-    message: "Message"
-    contact-note: "Calls and messages go to the {name} support team."
-    proof: "Proof of delivery"
-    open-photo: "Open the delivery photo"
-    open-signature: "Open the signature"
-    open-scan: "Open the scan"
-    proof-photo: "Delivery photo"
-    proof-signature: "Signature"
-    proof-scan: "Scanned at the door"
-    instructions: "Delivery instructions"
-    edit: "Edit"
-    instructions-help: "Gate codes, where to leave it, or who can sign"
-    cancel: "Cancel"
-    save: "Save"
-    no-instructions: "No instructions yet."
-    updates: "Updates"
-    no-updates: "No updates yet."
-    show-fewer: "Show fewer updates"
-    show-earlier: "Show earlier updates ({count})"
-    today: "Today"
-    yesterday: "Yesterday"
-    items: "In this delivery"
-    item: "Item"
-    quantity: "Qty {count}"
-    share: "Share tracking"
-    report: "Report a problem"
-    contact: "Contact {name}"
-    report-label: "What's wrong with your delivery?"
-    send: "Send"
-    close: "Close"
-    no-orders: "No orders yet"
-    no-orders-help: "Deliveries for your account will show up here."
+    sub-dispatched: "Theo dõi trực tiếp sẽ bắt đầu ngay khi tài xế lên đường."
+    sub-preparing: "Chúng tôi sẽ báo cho bạn khi đơn hàng lên đường."
+    delayed-title: "Đang bị trễ."
+    delayed-help: "Chúng tôi sẽ liên tục cập nhật thời gian đến."
+    stop-of: "Đơn giao của bạn là điểm dừng {position}/{total}"
+    stops-private: "{count, plural, =0 {Bạn là điểm tiếp theo.} other {Còn # điểm dừng trước bạn.}} Các điểm dừng khác được giữ kín, bạn chỉ thấy điểm của mình."
+    map: "Bản đồ"
+    map-label: "Bản đồ đơn giao: xe đang trên đường đến địa chỉ của bạn."
+    map-pickup: "Khu vực lấy hàng"
+    map-driver: "Tài xế"
+    map-pickup-named: "Lấy hàng · {name}"
+    map-fullscreen: "Bản đồ toàn màn hình"
+    map-exit-fullscreen: "Thoát toàn màn hình"
+    stop-card-title: "Giao đến"
+    stop-upcoming: "Sắp tới"
+    stop-complete: "Đã giao"
+    map-hidden: "Bản đồ đã được ẩn vì đơn hàng đã giao. Chúng tôi ngừng chia sẻ vị trí tài xế khi đến cửa nhà bạn."
+    last-seen: "Cập nhật {minutes} phút trước"
+    recenter: "Đưa xe về giữa bản đồ"
+    fit-route: "Hiển thị toàn bộ lộ trình"
+    eta: "Thời gian đến dự kiến"
+    in-minutes: "khoảng {minutes} phút nữa"
+    window: "Khung giờ giao"
+    before-yours: "Trước bạn"
+    stops-count: "{count, plural, =0 {Không có} other {# điểm dừng}}"
+    estimate-may-change: "Thời gian dự kiến có thể thay đổi"
+    driver: "Tài xế của bạn"
+    online: "Trực tuyến"
+    location-paused: "Tạm dừng vị trí"
+    call-short: "Gọi"
+    message: "Nhắn tin"
+    contact-note: "Cuộc gọi và tin nhắn sẽ được chuyển đến đội hỗ trợ của {name}."
+    proof: "Bằng chứng giao hàng"
+    open-photo: "Mở ảnh giao hàng"
+    open-signature: "Mở chữ ký"
+    open-scan: "Mở bản quét"
+    proof-photo: "Ảnh giao hàng"
+    proof-signature: "Chữ ký"
+    proof-scan: "Đã quét tại cửa"
+    instructions: "Hướng dẫn giao hàng"
+    edit: "Sửa"
+    instructions-help: "Mã cổng, nơi để hàng hoặc người có thể ký nhận"
+    cancel: "Hủy"
+    save: "Lưu"
+    no-instructions: "Chưa có hướng dẫn."
+    updates: "Cập nhật"
+    no-updates: "Chưa có cập nhật."
+    show-fewer: "Ẩn bớt cập nhật"
+    show-earlier: "Xem các cập nhật trước ({count})"
+    today: "Hôm nay"
+    yesterday: "Hôm qua"
+    items: "Trong đơn giao này"
+    item: "Mặt hàng"
+    quantity: "SL {count}"
+    share: "Chia sẻ theo dõi"
+    report: "Báo cáo sự cố"
+    contact: "Liên hệ {name}"
+    report-label: "Đơn giao của bạn gặp vấn đề gì?"
+    send: "Gửi"
+    close: "Đóng"
+    no-orders: "Chưa có đơn hàng"
+    no-orders-help: "Các đơn giao của tài khoản bạn sẽ hiển thị tại đây."

From 6e17057fd98a8a079986c0ca3394e34cc8a03270 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 22:13:56 +0800
Subject: [PATCH 48/87] fix(tracking-number): only publish the tracking page
 url when there is a tracking number

TrackingCode::pageUrl() takes a string, so a tracking number row without a
number threw a TypeError and the resource answered 500. Leave the url key out
in that case, the same way qr_code_content already does.
---
 server/src/Http/Resources/v1/TrackingNumber.php   | 2 +-
 server/tests/CompactResourceSerializationTest.php | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/server/src/Http/Resources/v1/TrackingNumber.php b/server/src/Http/Resources/v1/TrackingNumber.php
index 6522ecd7f..327011fd7 100644
--- a/server/src/Http/Resources/v1/TrackingNumber.php
+++ b/server/src/Http/Resources/v1/TrackingNumber.php
@@ -38,7 +38,7 @@ public function toArray($request)
             // Labels printed before it encode the owner uuid; resolvers accept both.
             'qr_code_content' => $this->when($this->tracking_number, fn () => TrackingCode::qrContent($this->tracking_number, Utils::get($this->owner, 'public_id'))),
             'barcode'         => $this->barcode,
-            'url'             => TrackingCode::pageUrl($this->tracking_number, $this->company_uuid),
+            'url'             => $this->when($this->tracking_number, fn () => TrackingCode::pageUrl($this->tracking_number, $this->company_uuid)),
             'type'            => Utils::getTypeFromClassName($this->owner_type),
             'updated_at'      => $this->updated_at,
             'created_at'      => $this->created_at,
diff --git a/server/tests/CompactResourceSerializationTest.php b/server/tests/CompactResourceSerializationTest.php
index a11e10d51..658f68a7b 100644
--- a/server/tests/CompactResourceSerializationTest.php
+++ b/server/tests/CompactResourceSerializationTest.php
@@ -2838,5 +2838,7 @@ public function environment(...$environments)
         ->and($payload['url'])->toBe('https://console.fleetbase.test/~/track/TN-SCAN')
         ->and($payload['qr_code'])->toBe('qr-data')
         // Nothing to scan without a tracking number: the key is absent, not null.
-        ->and(array_key_exists('qr_code_content', $withoutNumber))->toBeFalse();
+        ->and(array_key_exists('qr_code_content', $withoutNumber))->toBeFalse()
+        // Nor is there a tracking page to link to.
+        ->and(array_key_exists('url', $withoutNumber))->toBeFalse();
 });

From a0b64b6f1631a2953bc0fab31891ca8e86152cad Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 22:16:46 +0800
Subject: [PATCH 49/87] test: follow the tracking page links, customer access
 link and label code images

- Notification buttons link the tracking page at ~/track/{number} since the
  tracking page work; assert that instead of the old track-order link.
- The customer credentials email links customer-access/{slug} (922b4ad7).
- The tracking number observer renders both label images through
  generateCodeImages() now that generateBarcode() is gone.
- TrackingCode::pageUrl() goes through Utils::consoleUrl(), which needs
  app()->environment(); run it on a container that has one.
---
 .../CustomerContactIdentitySafetyTest.php     |  2 +-
 .../NotificationAndMailContractsTest.php      |  9 +++------
 .../TerminalOrderNotificationsTest.php        |  6 +++---
 server/tests/Unit/Support/QuerySeamsTest.php  |  6 +++++-
 .../tests/Unit/Support/TrackingCodeTest.php   | 20 ++++++++++++++++---
 5 files changed, 29 insertions(+), 14 deletions(-)

diff --git a/server/tests/CustomerContactIdentitySafetyTest.php b/server/tests/CustomerContactIdentitySafetyTest.php
index b2d6ecf68..a2d4a9937 100644
--- a/server/tests/CustomerContactIdentitySafetyTest.php
+++ b/server/tests/CustomerContactIdentitySafetyTest.php
@@ -74,7 +74,7 @@
         ->not->toContain('send_invite');
 
     expect($customerCredentials)->toContain('customer portal access is ready')
-        ->and($customerCredentials)->toContain("Utils::consoleUrl(\$accessUrlSlug ?: 'customer-portal')")
+        ->and($customerCredentials)->toContain("Utils::consoleUrl(\$accessUrlSlug ? 'customer-access/' . \$accessUrlSlug : 'customer-portal')")
         ->and($customerEmail)->toContain('Your customer portal access is ready')
         ->and($customerEmail)->toContain('Sign in to customer portal')
         ->and($customerEmail)->toContain('Temporary password:')
diff --git a/server/tests/NotificationAndMailContractsTest.php b/server/tests/NotificationAndMailContractsTest.php
index 0e3e01016..a2f0f419c 100644
--- a/server/tests/NotificationAndMailContractsTest.php
+++ b/server/tests/NotificationAndMailContractsTest.php
@@ -370,8 +370,7 @@ public function track(Order $order, mixed $options): array
         ->and($mail->subject)->toBe('Order TN-FAILED dispatch has failed!')
         ->and($mail->introLines)->toBe(['No driver accepted the order'])
         ->and($mail->actionText)->toBe('Track Order')
-        ->and($mail->actionUrl)->toContain('track-order')
-        ->and($mail->actionUrl)->toContain('TN-FAILED');
+        ->and($mail->actionUrl)->toEndWith('/~/track/TN-FAILED');
 });
 
 test('order dispatched notification exposes channels array and mail payloads', function () {
@@ -449,8 +448,7 @@ public function track(Order $order, mixed $options): array
         ->and($mail->subject)->toBe('New order TN-ASSIGNED assigned!')
         ->and($mail->introLines)->toBe(['You have a new order assigned, tap for details.'])
         ->and($mail->actionText)->toBe('Track Order')
-        ->and($mail->actionUrl)->toContain('track-order')
-        ->and($mail->actionUrl)->toContain('TN-ASSIGNED');
+        ->and($mail->actionUrl)->toEndWith('/~/track/TN-ASSIGNED');
 
     $scheduledOrder      = notificationTestOrderWithRelations(['scheduled_at' => '2026-08-01 10:30:00']);
     $scheduled           = new OrderAssigned($scheduledOrder);
@@ -599,8 +597,7 @@ public function track(Order $order, mixed $options): array
             'No further action is necessary.',
         ])
         ->and($mail->actionText)->toBe('Track Order')
-        ->and($mail->actionUrl)->toContain('track-order')
-        ->and($mail->actionUrl)->toContain('WP-COMPLETE');
+        ->and($mail->actionUrl)->toEndWith('/~/track/WP-COMPLETE');
 });
 
 test('work order dispatched mail exposes subject and markdown context', function () {
diff --git a/server/tests/Unit/Notifications/TerminalOrderNotificationsTest.php b/server/tests/Unit/Notifications/TerminalOrderNotificationsTest.php
index 8e93b1c0d..da3dd567d 100644
--- a/server/tests/Unit/Notifications/TerminalOrderNotificationsTest.php
+++ b/server/tests/Unit/Notifications/TerminalOrderNotificationsTest.php
@@ -141,7 +141,7 @@ public function environment(...$environments)
             'No further action is necessary.'
         )
         ->and($mail->actionText)->toBe('Track Order')
-        ->and($mail->actionUrl)->toContain('order=ORDER-TRACK');
+        ->and($mail->actionUrl)->toBe('https://console.fleetbase.test/~/track/ORDER-TRACK');
 });
 
 test('failed order notification formats mail and array payloads from waypoint tracking', function () {
@@ -166,7 +166,7 @@ public function environment(...$environments)
             'No further action is necessary.'
         )
         ->and($mail->actionText)->toBe('Track Order')
-        ->and($mail->actionUrl)->toContain('order=WP-FAILED');
+        ->and($mail->actionUrl)->toBe('https://console.fleetbase.test/~/track/WP-FAILED');
 });
 
 test('dispatched order notification formats mail from waypoint tracking fallback', function () {
@@ -181,5 +181,5 @@ public function environment(...$environments)
         ->and($mail->subject)->toBe('Order WP-DISPATCHED has been dispatched!')
         ->and($mail->introLines)->toBe(['An order has just been dispatched to you and is ready to be started.'])
         ->and($mail->actionText)->toBe('Track Order')
-        ->and($mail->actionUrl)->toContain('order=WP-DISPATCHED');
+        ->and($mail->actionUrl)->toBe('https://console.fleetbase.test/~/track/WP-DISPATCHED');
 });
diff --git a/server/tests/Unit/Support/QuerySeamsTest.php b/server/tests/Unit/Support/QuerySeamsTest.php
index c3abd629f..45dad48e8 100644
--- a/server/tests/Unit/Support/QuerySeamsTest.php
+++ b/server/tests/Unit/Support/QuerySeamsTest.php
@@ -217,7 +217,11 @@ public function __call($method, $arguments)
 
     // Numbers are generated for the record's region
     expect(fleetopsQuerySeamInvoke($observer, $class, 'generateTrackingNumber', [$trackingNumber]))->toBeString()
-        ->and(fleetopsQuerySeamInvoke($observer, $class, 'generateBarcode', ['tn-seam-1', 'C39']))->toBe('generated-barcode');
+        // Both label images are rendered from the tracking number
+        ->and(fleetopsQuerySeamInvoke($observer, $class, 'generateCodeImages', ['tn-seam-1', 'order_public']))->toBe([
+            'qr_code' => 'generated-barcode',
+            'barcode' => 'generated-barcode',
+        ]);
 
     // Statuses are persisted through the model
     $status = fleetopsQuerySeamInvoke($observer, $class, 'createTrackingStatus', [[
diff --git a/server/tests/Unit/Support/TrackingCodeTest.php b/server/tests/Unit/Support/TrackingCodeTest.php
index 3da49f92e..916efcd0e 100644
--- a/server/tests/Unit/Support/TrackingCodeTest.php
+++ b/server/tests/Unit/Support/TrackingCodeTest.php
@@ -146,7 +146,21 @@
 });
 
 test('tracking page links name the company page when its settings send links there', function () {
-    app()->instance(Fleetbase\FleetOps\Support\TrackingPage\TrackingResolver::class, new class extends Fleetbase\FleetOps\Support\TrackingPage\TrackingResolver {
+    // Page links are built by Utils::consoleUrl(), which needs app()->environment(). The
+    // bare container this suite runs on has no such method, so swap in one that does.
+    $previousContainer = Illuminate\Container\Container::getInstance();
+    $container         = new class extends Illuminate\Container\Container {
+        public function environment(...$environments)
+        {
+            return in_array('testing', $environments, true) || $environments === [] ? 'testing' : false;
+        }
+    };
+    $container->instance('config', new Illuminate\Config\Repository([
+        'fleetbase' => ['console' => ['host' => 'console.fleetbase.test', 'subdomain' => null, 'secure' => true]],
+    ]));
+    Illuminate\Container\Container::setInstance($container);
+
+    $container->instance(Fleetbase\FleetOps\Support\TrackingPage\TrackingResolver::class, new class extends Fleetbase\FleetOps\Support\TrackingPage\TrackingResolver {
         public function linkSlugFor(string $companyUuid): ?string
         {
             if ($companyUuid === 'broken') {
@@ -162,8 +176,8 @@ public function linkSlugFor(string $companyUuid): ?string
             ->and(TrackingCode::pageUrl('NOR1', 'co-2'))->toEndWith('/~/track/NOR1')
             ->and(TrackingCode::pageUrl('NOR1', 'broken'))->toEndWith('/~/track/NOR1')
             ->and(TrackingCode::pageUrl('NOR1'))->toEndWith('/~/track/NOR1')
-            ->and(TrackingCode::pageUrl('A B/1'))->toEndWith('/~/track/A%20B%2F1');
+            ->and(TrackingCode::pageUrl('A B/1'))->toBe('https://console.fleetbase.test/~/track/A%20B%2F1');
     } finally {
-        app()->forgetInstance(Fleetbase\FleetOps\Support\TrackingPage\TrackingResolver::class);
+        Illuminate\Container\Container::setInstance($previousContainer);
     }
 });

From e2fddb9df9aeb5aaa93f7e19d4896533da04f965 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 22:17:40 +0800
Subject: [PATCH 50/87] test(telematics): clear the prune compaction watermark
 between runs

d88257cb made the pruner remember, per scope, how far compaction got. The
watermark lives in the cache, which outlives each test, so a later test's
rows sat below an earlier test's watermark and were never compacted.
---
 .../tests/Unit/Console/PruneTelematicsDataCommandTest.php   | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server/tests/Unit/Console/PruneTelematicsDataCommandTest.php b/server/tests/Unit/Console/PruneTelematicsDataCommandTest.php
index 9a06a0c4a..ca543ae13 100644
--- a/server/tests/Unit/Console/PruneTelematicsDataCommandTest.php
+++ b/server/tests/Unit/Console/PruneTelematicsDataCommandTest.php
@@ -61,6 +61,12 @@ public function __call($method, $arguments)
         (require $migration)->up();
     }
 
+    // Each run remembers how far compaction got per scope; a watermark left by an earlier
+    // test would hide the rows this one inserts below it.
+    foreach (['company-1', 'company-2', 'orphans'] as $scope) {
+        Illuminate\Support\Facades\Cache::forget(PruneTelematicsData::WATERMARK_PREFIX . $scope);
+    }
+
     Carbon::setTestNow('2026-09-23 12:00:00 UTC');
     DB::table('companies')->insert([
         ['id' => 1, 'uuid' => 'company-1', 'public_id' => 'company_one'],

From 765d1b9d49e496027fc36ade80c7d747aefb55e0 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 22:23:07 +0800
Subject: [PATCH 51/87] test(socket-auth): switch socket authentication on and
 fix the order fixtures

- core-api 1.6.69 gates socket authentication on
  broadcasting.connections.socketcluster.auth_enabled as well as the key;
  the publisher, tracking channel and replay tests set only the key, so
  authentication stayed off. Set both, and reset both after each test.
- Multi-row orders inserts gave rows different keys, which a single
  INSERT cannot take; every row now names the same columns.
- Service quotes are read through their expiry scope, so the socket
  channels fixture needs an expired_at column.
---
 .../PositionControllerReplayChannelTest.php   |  8 +++-
 .../tests/Unit/Support/SocketChannelsTest.php | 10 +++--
 .../Unit/Support/TrackingChannelTest.php      |  6 ++-
 .../Unit/Support/TrackingPublisherTest.php    | 42 ++++++++++---------
 4 files changed, 40 insertions(+), 26 deletions(-)

diff --git a/server/tests/Feature/Http/Internal/PositionControllerReplayChannelTest.php b/server/tests/Feature/Http/Internal/PositionControllerReplayChannelTest.php
index 261a5b323..2bf1b573f 100644
--- a/server/tests/Feature/Http/Internal/PositionControllerReplayChannelTest.php
+++ b/server/tests/Feature/Http/Internal/PositionControllerReplayChannelTest.php
@@ -33,7 +33,11 @@ public function authorize(?SocketPrincipal $principal, string $channel): Channel
 
 function positionReplayChannelBoot(bool $enabled): PositionReplayChannelAuthorizerFake
 {
-    config(['broadcasting.connections.socketcluster.auth_key' => $enabled ? 'fleetops-position-replay-test-key-0123456789' : null]);
+    // Socket authentication needs both the switch and the signing key.
+    config([
+        'broadcasting.connections.socketcluster.auth_enabled' => $enabled,
+        'broadcasting.connections.socketcluster.auth_key'     => $enabled ? 'fleetops-position-replay-test-key-0123456789' : null,
+    ]);
 
     $pdo = new PDO('sqlite::memory:');
     $pdo->sqliteCreateFunction('ST_PointFromText', fn ($wkt, $srid = 0, $axisOrder = null) => $wkt);
@@ -82,7 +86,7 @@ function positionReplayChannelUser(): User
 }
 
 afterEach(function () {
-    config(['broadcasting.connections.socketcluster.auth_key' => null]);
+    config(['broadcasting.connections.socketcluster.auth_enabled' => false, 'broadcasting.connections.socketcluster.auth_key' => null]);
 });
 
 test('a replay to a channel the user may subscribe to is started', function () {
diff --git a/server/tests/Unit/Support/SocketChannelsTest.php b/server/tests/Unit/Support/SocketChannelsTest.php
index b404cbfca..25243e3b9 100644
--- a/server/tests/Unit/Support/SocketChannelsTest.php
+++ b/server/tests/Unit/Support/SocketChannelsTest.php
@@ -50,6 +50,8 @@
     'uuid', 'public_id', 'company_uuid', 'customer_uuid', 'customer_type', 'driver_assigned_uuid', 'vehicle_assigned_uuid',
     'payload_uuid', 'vehicle_uuid', 'user_uuid', 'attachable_uuid', 'attachable_type', 'subject_uuid', 'subject_type',
     'status', 'name', 'email', 'type', 'asset_class', 'started', 'started_at', 'place_uuid', 'service_area_uuid', '_key',
+    // Service quotes are always read through their expiry scope.
+    'expired_at',
 ];
 
 function socketChannelsBoot(): SQLiteConnection
@@ -121,15 +123,15 @@ function socketChannelsBoot(): SQLiteConnection
     ]);
     $connection->table('orders')->insert([
         // driver-a1 drives contact-a1's active order in vehicle-a1
-        ['uuid' => 'order-a1', 'public_id' => 'order_a1', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a1', 'driver_assigned_uuid' => 'driver-a1', 'vehicle_assigned_uuid' => 'vehicle-a1', 'status' => 'started'],
+        ['uuid' => 'order-a1', 'public_id' => 'order_a1', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a1', 'driver_assigned_uuid' => 'driver-a1', 'vehicle_assigned_uuid' => 'vehicle-a1', 'status' => 'started', 'payload_uuid' => null],
         // driver-a2's order for contact-a2, on which driver-a1 carries an entity
         ['uuid' => 'order-a2', 'public_id' => 'order_a2', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a2', 'driver_assigned_uuid' => 'driver-a2', 'vehicle_assigned_uuid' => 'vehicle-a2', 'status' => 'dispatched', 'payload_uuid' => 'payload-a2'],
         // contact-a1's completed order with driver-a2
-        ['uuid' => 'order-a3', 'public_id' => 'order_a3', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a1', 'driver_assigned_uuid' => 'driver-a2', 'vehicle_assigned_uuid' => 'vehicle-a2', 'status' => 'completed'],
+        ['uuid' => 'order-a3', 'public_id' => 'order_a3', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a1', 'driver_assigned_uuid' => 'driver-a2', 'vehicle_assigned_uuid' => 'vehicle-a2', 'status' => 'completed', 'payload_uuid' => null],
         // driver-a2's order with nothing to do with driver-a1
-        ['uuid' => 'order-a4', 'public_id' => 'order_a4', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a2', 'driver_assigned_uuid' => 'driver-a2', 'status' => 'started', 'payload_uuid' => 'payload-a4'],
+        ['uuid' => 'order-a4', 'public_id' => 'order_a4', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a2', 'driver_assigned_uuid' => 'driver-a2', 'status' => 'started', 'payload_uuid' => 'payload-a4', 'vehicle_assigned_uuid' => null],
         // contact-a1's active order with driver-a3 and no vehicle assigned to the order
-        ['uuid' => 'order-a5', 'public_id' => 'order_a5', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a1', 'driver_assigned_uuid' => 'driver-a3', 'status' => 'created'],
+        ['uuid' => 'order-a5', 'public_id' => 'order_a5', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-a1', 'driver_assigned_uuid' => 'driver-a3', 'status' => 'created', 'vehicle_assigned_uuid' => null, 'payload_uuid' => null],
     ]);
     $connection->table('entities')->insert([
         ['uuid' => 'entity-a2', 'public_id' => 'entity_a2', 'company_uuid' => 'company-a', 'payload_uuid' => 'payload-a2', 'driver_assigned_uuid' => 'driver-a1'],
diff --git a/server/tests/Unit/Support/TrackingChannelTest.php b/server/tests/Unit/Support/TrackingChannelTest.php
index ef612beef..14543a2cf 100644
--- a/server/tests/Unit/Support/TrackingChannelTest.php
+++ b/server/tests/Unit/Support/TrackingChannelTest.php
@@ -67,7 +67,11 @@ function trackingChannelBase32(string $bytes): string
 
 function trackingChannelEnable(?string $key = TRACKING_CHANNEL_KEY): void
 {
-    config(['broadcasting.connections.socketcluster.auth_key' => $key]);
+    // Socket authentication needs both the switch and the signing key.
+    config([
+        'broadcasting.connections.socketcluster.auth_enabled' => $key !== null,
+        'broadcasting.connections.socketcluster.auth_key'     => $key,
+    ]);
 }
 
 afterEach(function () {
diff --git a/server/tests/Unit/Support/TrackingPublisherTest.php b/server/tests/Unit/Support/TrackingPublisherTest.php
index c913840f8..b588b462a 100644
--- a/server/tests/Unit/Support/TrackingPublisherTest.php
+++ b/server/tests/Unit/Support/TrackingPublisherTest.php
@@ -105,7 +105,11 @@ public function track(Order $order, array|TrackingOptions $options = []): array
 
 function trackingPublisherBoot(bool $enabled = true): SQLiteConnection
 {
-    config(['broadcasting.connections.socketcluster.auth_key' => $enabled ? TRACKING_PUBLISHER_KEY : null]);
+    // Socket authentication needs both the switch and the signing key.
+    config([
+        'broadcasting.connections.socketcluster.auth_enabled' => $enabled,
+        'broadcasting.connections.socketcluster.auth_key'     => $enabled ? TRACKING_PUBLISHER_KEY : null,
+    ]);
     config(['broadcasting.connections.socketcluster.publish_url' => 'http://socket.test:8001']);
     config(['broadcasting.connections.socketcluster.options' => ['host' => 'socket.test', 'port' => 8000, 'secure' => false, 'path' => '/socketcluster/', 'query' => []]]);
     Cache::flush();
@@ -140,13 +144,13 @@ function trackingPublisherBoot(bool $enabled = true): SQLiteConnection
         ['uuid' => 'driver-2', 'company_uuid' => 'company-1', 'user_uuid' => 'user-2', 'vehicle_uuid' => 'vehicle-2'],
     ]);
     $connection->table('orders')->insert([
-        ['uuid' => 'order-started', 'payload_uuid' => 'payload-1', 'driver_assigned_uuid' => 'driver-1', 'status' => 'enroute', 'started' => '1'],
-        ['uuid' => 'order-status', 'payload_uuid' => 'payload-2', 'driver_assigned_uuid' => 'driver-1', 'status' => 'started', 'started' => null],
-        ['uuid' => 'order-timestamp', 'payload_uuid' => 'payload-3', 'driver_assigned_uuid' => 'driver-1', 'status' => 'arrived', 'started' => '0', 'started_at' => '2026-10-06 09:00:00'],
-        ['uuid' => 'order-completed', 'payload_uuid' => 'payload-4', 'driver_assigned_uuid' => 'driver-1', 'status' => 'completed', 'started' => '1'],
-        ['uuid' => 'order-waiting', 'payload_uuid' => 'payload-5', 'driver_assigned_uuid' => 'driver-1', 'status' => 'dispatched', 'started' => '0'],
-        ['uuid' => 'order-other-driver', 'payload_uuid' => 'payload-6', 'driver_assigned_uuid' => 'driver-2', 'status' => 'started', 'started' => '1'],
-        ['uuid' => 'order-vehicle', 'payload_uuid' => 'payload-7', 'driver_assigned_uuid' => null, 'vehicle_assigned_uuid' => 'vehicle-1', 'status' => 'started', 'started' => '1'],
+        ['uuid' => 'order-started', 'payload_uuid' => 'payload-1', 'driver_assigned_uuid' => 'driver-1', 'status' => 'enroute', 'started' => '1', 'vehicle_assigned_uuid' => null, 'started_at' => null],
+        ['uuid' => 'order-status', 'payload_uuid' => 'payload-2', 'driver_assigned_uuid' => 'driver-1', 'status' => 'started', 'started' => null, 'vehicle_assigned_uuid' => null, 'started_at' => null],
+        ['uuid' => 'order-timestamp', 'payload_uuid' => 'payload-3', 'driver_assigned_uuid' => 'driver-1', 'status' => 'arrived', 'started' => '0', 'started_at' => '2026-10-06 09:00:00', 'vehicle_assigned_uuid' => null],
+        ['uuid' => 'order-completed', 'payload_uuid' => 'payload-4', 'driver_assigned_uuid' => 'driver-1', 'status' => 'completed', 'started' => '1', 'vehicle_assigned_uuid' => null, 'started_at' => null],
+        ['uuid' => 'order-waiting', 'payload_uuid' => 'payload-5', 'driver_assigned_uuid' => 'driver-1', 'status' => 'dispatched', 'started' => '0', 'vehicle_assigned_uuid' => null, 'started_at' => null],
+        ['uuid' => 'order-other-driver', 'payload_uuid' => 'payload-6', 'driver_assigned_uuid' => 'driver-2', 'status' => 'started', 'started' => '1', 'vehicle_assigned_uuid' => null, 'started_at' => null],
+        ['uuid' => 'order-vehicle', 'payload_uuid' => 'payload-7', 'driver_assigned_uuid' => null, 'vehicle_assigned_uuid' => 'vehicle-1', 'status' => 'started', 'started' => '1', 'started_at' => null],
     ]);
     $connection->table('orders')->insert(['uuid' => 'order-job', 'company_uuid' => 'company-1', 'customer_uuid' => 'contact-1111', 'customer_type' => TRACKING_PUBLISHER_CONTACT, 'payload_uuid' => 'payload-8', 'status' => 'enroute', 'started' => '1']);
 
@@ -218,14 +222,14 @@ function trackingPublisherUseStops(Collection $stops, array|Throwable $tracker =
 }
 
 afterEach(function () {
-    config(['broadcasting.connections.socketcluster.auth_key' => null]);
+    config(['broadcasting.connections.socketcluster.auth_enabled' => false, 'broadcasting.connections.socketcluster.auth_key' => null]);
     Http::swap(new HttpFactory());
 });
 
 test('nothing is queued or published while socket authentication is off', function () {
     trackingPublisherBoot(false);
-    $publisher = new TrackingPublisherProbe();
-    $order     = trackingPublisherOrder();
+    $publisher     = new TrackingPublisherProbe();
+    $order         = trackingPublisherOrder();
     $order->status = 'completed';
     $order->syncChanges();
 
@@ -260,7 +264,7 @@ function trackingPublisherUseStops(Collection $stops, array|Throwable $tracker =
         ->and($save(['status' => 'completed', 'distance' => 1]))->toBeTrue()
         ->and($save(['notes' => 'Leave at the door']))->toBeFalse();
 
-    $unsaved = trackingPublisherOrder(['uuid' => null]);
+    $unsaved         = trackingPublisherOrder(['uuid' => null]);
     $unsaved->status = 'started';
     $unsaved->syncChanges();
     expect($publisher->orderChanged($unsaved))->toBeFalse();
@@ -276,14 +280,14 @@ function trackingPublisherUseStops(Collection $stops, array|Throwable $tracker =
     trackingPublisherBoot();
     $listener = new PublishTrackingUpdates();
 
-    $waypointEvent = (new ReflectionClass(WaypointActivityChanged::class))->newInstanceWithoutConstructor();
+    $waypointEvent           = (new ReflectionClass(WaypointActivityChanged::class))->newInstanceWithoutConstructor();
     $waypointEvent->waypoint = trackingPublisherWaypoint('waypoint_own', null);
-    $entityEvent = (new ReflectionClass(EntityCompleted::class))->newInstanceWithoutConstructor();
-    $entityEvent->entity = trackingPublisherModel(Entity::class, ['uuid' => 'entity-1', 'payload_uuid' => 'payload-2']);
-    $orphanEvent = (new ReflectionClass(EntityCompleted::class))->newInstanceWithoutConstructor();
-    $orphanEvent->entity = trackingPublisherModel(Entity::class, ['uuid' => 'entity-2', 'payload_uuid' => 'payload-none']);
-    $looseEvent = (new ReflectionClass(EntityCompleted::class))->newInstanceWithoutConstructor();
-    $looseEvent->entity = trackingPublisherModel(Entity::class, ['uuid' => 'entity-3', 'payload_uuid' => null]);
+    $entityEvent             = (new ReflectionClass(EntityCompleted::class))->newInstanceWithoutConstructor();
+    $entityEvent->entity     = trackingPublisherModel(Entity::class, ['uuid' => 'entity-1', 'payload_uuid' => 'payload-2']);
+    $orphanEvent             = (new ReflectionClass(EntityCompleted::class))->newInstanceWithoutConstructor();
+    $orphanEvent->entity     = trackingPublisherModel(Entity::class, ['uuid' => 'entity-2', 'payload_uuid' => 'payload-none']);
+    $looseEvent              = (new ReflectionClass(EntityCompleted::class))->newInstanceWithoutConstructor();
+    $looseEvent->entity      = trackingPublisherModel(Entity::class, ['uuid' => 'entity-3', 'payload_uuid' => null]);
 
     expect($listener->handle($waypointEvent))->toBeTrue()
         ->and($listener->handle($entityEvent))->toBeTrue()

From 5744c2002e62da5f6dbd65bbc3a56871f9b4e8c3 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 22:35:00 +0800
Subject: [PATCH 52/87] fix(tracking-page): give tracking sessions and grants a
 deleted_at column

TrackingSession and TrackingSessionGrant extend Fleetbase\Models\Model,
which soft deletes, so every query on them filters on deleted_at. The
tables were created without it, so each session or grant lookup failed
with an unknown column and no visitor could finish verifying. A new
migration adds the column to both tables where it is missing.

The access tests now run with model events on, as the app does, so new
sessions get the uuid their grants are found by, and count verification
codes the way the code reads them: voided and used codes are trashed.
---
 ...deleted_at_to_tracking_sessions_tables.php | 32 +++++++++++++++++++
 server/tests/Support/TrackingPageDatabase.php |  3 ++
 .../TrackingPage/TrackingAccessTest.php       | 29 ++++++++++++++---
 3 files changed, 60 insertions(+), 4 deletions(-)
 create mode 100644 server/migrations/2026_10_12_000001_add_deleted_at_to_tracking_sessions_tables.php

diff --git a/server/migrations/2026_10_12_000001_add_deleted_at_to_tracking_sessions_tables.php b/server/migrations/2026_10_12_000001_add_deleted_at_to_tracking_sessions_tables.php
new file mode 100644
index 000000000..b2c5fd612
--- /dev/null
+++ b/server/migrations/2026_10_12_000001_add_deleted_at_to_tracking_sessions_tables.php
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * TrackingSession and TrackingSessionGrant extend Fleetbase\Models\Model, which soft
+ * deletes, so every query on them reads `deleted_at`. The tables were created without
+ * it, which made each session and grant lookup fail and no visitor could verify.
+ */
+return new class extends Migration {
+    private const TABLES = ['tracking_sessions', 'tracking_session_grants'];
+
+    public function up(): void
+    {
+        foreach (self::TABLES as $table) {
+            if (Schema::hasTable($table) && !Schema::hasColumn($table, 'deleted_at')) {
+                Schema::table($table, fn (Blueprint $blueprint) => $blueprint->softDeletes());
+            }
+        }
+    }
+
+    public function down(): void
+    {
+        foreach (self::TABLES as $table) {
+            if (Schema::hasTable($table) && Schema::hasColumn($table, 'deleted_at')) {
+                Schema::table($table, fn (Blueprint $blueprint) => $blueprint->dropSoftDeletes());
+            }
+        }
+    }
+};
diff --git a/server/tests/Support/TrackingPageDatabase.php b/server/tests/Support/TrackingPageDatabase.php
index 7dcb25704..3146de902 100644
--- a/server/tests/Support/TrackingPageDatabase.php
+++ b/server/tests/Support/TrackingPageDatabase.php
@@ -172,6 +172,8 @@ public static function boot(): SQLiteConnection
             $table->timestamp('revoked_at')->nullable();
             $table->timestamp('created_at')->nullable();
             $table->timestamp('updated_at')->nullable();
+            // Fleetbase models soft delete (2026_10_12_000001_add_deleted_at_to_tracking_sessions_tables).
+            $table->timestamp('deleted_at')->nullable();
         });
         $schema->create('tracking_session_grants', function ($table) {
             $table->increments('id');
@@ -185,6 +187,7 @@ public static function boot(): SQLiteConnection
             $table->timestamp('expires_at')->nullable();
             $table->timestamp('created_at')->nullable();
             $table->timestamp('updated_at')->nullable();
+            $table->timestamp('deleted_at')->nullable();
         });
 
         return $connection;
diff --git a/server/tests/Unit/Support/TrackingPage/TrackingAccessTest.php b/server/tests/Unit/Support/TrackingPage/TrackingAccessTest.php
index 9efa27b2b..70ae31558 100644
--- a/server/tests/Unit/Support/TrackingPage/TrackingAccessTest.php
+++ b/server/tests/Unit/Support/TrackingPage/TrackingAccessTest.php
@@ -6,6 +6,7 @@
 use Fleetbase\FleetOps\Support\TrackingPage\TrackingAccess;
 use Fleetbase\FleetOps\Support\TrackingScope;
 use Fleetbase\Models\VerificationCode;
+use Fleetbase\Scopes\ExpiryScope;
 use Fleetbase\Tests\Support\TrackingPageDatabase;
 use Illuminate\Cache\ArrayStore;
 use Illuminate\Cache\RateLimiter;
@@ -21,8 +22,25 @@
 afterEach(function () {
     Carbon::setTestNow();
     EloquentModel::unsetConnectionResolver();
+    EloquentModel::unsetEventDispatcher();
 });
 
+/**
+ * The tracking page tables, with model events on so sessions, grants and codes get their
+ * uuids (a grant is found through its session's uuid) as they do in the app.
+ */
+function trackingAccessDatabase(): void
+{
+    TrackingPageDatabase::boot();
+    EloquentModel::setEventDispatcher(new Illuminate\Events\Dispatcher());
+    app()->instance('responsecache', new class {
+        public function __call($method, $arguments)
+        {
+            return null;
+        }
+    });
+}
+
 function trackingAccess(): TrackingAccess
 {
     return new TrackingAccess(new RateLimiter(new Repository(new ArrayStore())));
@@ -87,14 +105,17 @@ function trackingRequest(array $cookies = [], string $ip = '203.0.113.7'): Reque
 });
 
 test('codes are issued hashed, checked, and pause the scope after three wrong ones', function () {
-    TrackingPageDatabase::boot();
+    trackingAccessDatabase();
     $access = trackingAccess();
     $scope  = trackingScope();
 
     $first  = $access->issueCode($scope, null, 'sms');
     $second = $access->issueCode($scope, null, 'email');
 
-    expect(VerificationCode::withoutGlobalScopes()->count())->toBe(1)
+    // Codes soft delete, like every Fleetbase model: a voided or used code is trashed, and
+    // the code lookups (which only lift the expiry scope) never see it again.
+    expect(VerificationCode::withoutGlobalScope(ExpiryScope::class)->count())->toBe(1)
+        ->and(VerificationCode::onlyTrashed()->withoutGlobalScope(ExpiryScope::class)->value('meta')['channel'] ?? null)->toBe('sms')
         ->and($second->plainCode)->toMatch('/^\d{6}$/')
         ->and($second->code)->not->toBe($second->plainCode)
         ->and($second->getMeta('scope'))->toBe($scope->key())
@@ -106,7 +127,7 @@ function trackingRequest(array $cookies = [], string $ip = '203.0.113.7'): Reque
         ->and($access->pausedFor($scope))->toBe(0);
 
     expect($access->checkCode($scope, $second->plainCode))->toBe(['status' => VerificationCode::CHECK_VALID, 'channel' => 'email'])
-        ->and(VerificationCode::withoutGlobalScopes()->count())->toBe(0)
+        ->and(VerificationCode::withoutGlobalScope(ExpiryScope::class)->count())->toBe(0)
         ->and($access->checkCode($scope, $second->plainCode))->toBe(['status' => VerificationCode::CHECK_EXPIRED]);
 
     $third = $access->issueCode($scope, null, 'sms');
@@ -119,7 +140,7 @@ function trackingRequest(array $cookies = [], string $ip = '203.0.113.7'): Reque
 });
 
 test('a correct code gives the device a session and a grant for that customer only', function () {
-    TrackingPageDatabase::boot();
+    trackingAccessDatabase();
     Carbon::setTestNow(Carbon::parse('2026-10-08 09:00:00'));
     $access = trackingAccess();
     $scope  = trackingScope();

From 336ea32b857561b0b1f30a0e11f9cf15f2f16a0a Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 22:35:00 +0800
Subject: [PATCH 53/87] test(tracking-page): boot the database for the order's
 date casts and name the driver through their user

The coarse stage tests read the order's datetime casts, which need a
connection for the date format. A driver's name comes from their user
record, so the fixture sets the user rather than a raw name column.
---
 .../Support/TrackingPage/TrackingViewTest.php  | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php b/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php
index 76370024a..4614c856d 100644
--- a/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php
+++ b/server/tests/Unit/Support/TrackingPage/TrackingViewTest.php
@@ -44,10 +44,10 @@ class TrackingViewDriver extends Driver
 class TrackingViewProbe extends TrackingView
 {
     public Collection $stops;
-    public array $tracker       = [];
-    public ?Collection $entities = null;
+    public array $tracker         = [];
+    public ?Collection $entities  = null;
     public ?Collection $proofRows = null;
-    public array $proofQueries  = [];
+    public array $proofQueries    = [];
 
     protected function contextStopsFor(Order $order): Collection
     {
@@ -116,6 +116,10 @@ function trackingViewOrder(array $attributes = []): Order
 
     $driver = new TrackingViewDriver();
     $driver->setRawAttributes(['uuid' => 'driver-1', 'name' => 'Daniel Okafor', 'phone' => '+15550001111', 'online' => 1, 'heading' => 92, 'location' => new Point(1.30123456, 103.80123456), 'updated_at' => '2026-10-08 08:59:00'], true);
+    // A driver's name is their user's.
+    $user = new Fleetbase\Models\User();
+    $user->setRawAttributes(['uuid' => 'user-driver-1', 'name' => 'Daniel Okafor'], true);
+    $driver->setRelation('user', $user);
     $order->setRelation('driverAssigned', $driver);
     $order->setRelation('vehicleAssigned', null);
     $order->setRelation('payload', null);
@@ -189,6 +193,8 @@ function trackingViewEntity(string $uuid, ?string $destination, array $extra = [
 });
 
 test('the coarse stage follows the order and the customer stops', function () {
+    // The order's date casts read the date format from its connection.
+    TrackingPageDatabase::boot();
     $view   = new TrackingViewProbe();
     $scopeA = new TrackingScope('order-1', Contact::class, 'contact-a');
     $update = fn (Order $order, bool $complete = false) => new Fleetbase\FleetOps\Support\TrackingUpdate($order, $scopeA, trackingViewStops($complete));
@@ -204,6 +210,8 @@ function trackingViewEntity(string $uuid, ?string $destination, array $extra = [
 });
 
 test('a tracking number alone shows the stage, the last update and how to verify', function () {
+    // The order's date casts read the date format from its connection.
+    TrackingPageDatabase::boot();
     $view        = new TrackingViewProbe();
     $view->stops = trackingViewStops();
     $scopeA      = new TrackingScope('order-1', Contact::class, 'contact-a');
@@ -353,9 +361,9 @@ protected function findProof(string $publicId): ?Proof
             return $this->found;
         }
     };
-    $view->stops = trackingViewStops(true);
+    $view->stops    = trackingViewStops(true);
     $view->entities = collect();
-    $proof = new Proof();
+    $proof          = new Proof();
     $proof->setRawAttributes(['public_id' => 'proof_a', 'file_uuid' => 'file-a', 'subject_uuid' => 'wp-a'], true);
     $view->proofRows = collect([$proof]);
     $view->found     = $proof;

From 9792af6e2f2eb364bec15c7b0fef63e5b18c4861 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 23:17:12 +0800
Subject: [PATCH 54/87] feat(api-cache): declare the tables cached lists embed

Cached API lists hold every relation their query eager loads, and the
whereHas filters that decide membership, but their keys were only
versioned by the model's own table. Declare `$apiCacheDependencies` on
the cached models (Order, Driver, Vehicle, Device, DeviceEvent, Vendor,
ServiceArea) so a write to an embedded table invalidates the list. The
property is read by fleetbase/core-api#301; until that is released it is
unused.

Waypoint, FleetDriver, FleetVehicle and AssetConnection had no cache
trait, so their writes bumped nothing. They now use HasApiModelCache,
which only registers the invalidation hooks: they have no
HasApiModelBehavior, so none of them gains a cached list.
---
 server/src/Models/AssetConnection.php |  3 +++
 server/src/Models/Device.php          | 12 ++++++++++
 server/src/Models/DeviceEvent.php     |  7 ++++++
 server/src/Models/Driver.php          | 11 +++++++++
 server/src/Models/FleetDriver.php     |  3 +++
 server/src/Models/FleetVehicle.php    |  3 +++
 server/src/Models/Order.php           | 32 +++++++++++++++++++++++++++
 server/src/Models/ServiceArea.php     |  7 ++++++
 server/src/Models/Vehicle.php         | 13 +++++++++++
 server/src/Models/Vendor.php          |  7 ++++++
 server/src/Models/Waypoint.php        |  3 +++
 11 files changed, 101 insertions(+)

diff --git a/server/src/Models/AssetConnection.php b/server/src/Models/AssetConnection.php
index 204e53216..08c01dd6e 100644
--- a/server/src/Models/AssetConnection.php
+++ b/server/src/Models/AssetConnection.php
@@ -5,6 +5,7 @@
 use Fleetbase\Casts\Json;
 use Fleetbase\Casts\PolymorphicType;
 use Fleetbase\Models\Model;
+use Fleetbase\Traits\HasApiModelCache;
 use Fleetbase\Traits\HasPublicId;
 use Fleetbase\Traits\HasUuid;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
@@ -14,6 +15,8 @@
 class AssetConnection extends Model
 {
     use HasUuid;
+    // Writes bump the asset_connections API cache version, which cached vehicle lists filter on.
+    use HasApiModelCache;
     use HasPublicId;
     use SoftDeletes;
 
diff --git a/server/src/Models/Device.php b/server/src/Models/Device.php
index 06feb64f0..118650efc 100644
--- a/server/src/Models/Device.php
+++ b/server/src/Models/Device.php
@@ -56,6 +56,18 @@ class Device extends Model
      */
     protected $table = 'devices';
 
+    /**
+     * Relation paths and tables the cached device lists embed (fleetbase/core-api#301).
+     *
+     * Lists load telematic, warranty and attachable and count sensors.
+     * attachable is a morphTo to a vehicle or trailer, so its tables are named.
+     * photo (public list) is left out: files is written by every upload, and a
+     * new photo is set by writing the device's own photo_uuid.
+     *
+     * @var string[]
+     */
+    protected $apiCacheDependencies = ['telematic', 'warranty', 'sensors', 'vehicles', 'assets'];
+
     /**
      * The type of public Id to generate.
      *
diff --git a/server/src/Models/DeviceEvent.php b/server/src/Models/DeviceEvent.php
index 6c5b2a5b9..5b5d4a16f 100644
--- a/server/src/Models/DeviceEvent.php
+++ b/server/src/Models/DeviceEvent.php
@@ -46,6 +46,13 @@ class DeviceEvent extends Model
      */
     protected $table = 'device_events';
 
+    /**
+     * Relation paths the cached device event lists embed (fleetbase/core-api#301).
+     *
+     * @var string[]
+     */
+    protected $apiCacheDependencies = ['device', 'device.telematic'];
+
     /**
      * The type of public Id to generate.
      *
diff --git a/server/src/Models/Driver.php b/server/src/Models/Driver.php
index c796257fa..63164b526 100644
--- a/server/src/Models/Driver.php
+++ b/server/src/Models/Driver.php
@@ -171,6 +171,17 @@ class Driver extends Model
      */
     protected $with = [];
 
+    /**
+     * Relation paths the cached driver lists depend on (fleetbase/core-api#301).
+     *
+     * Lists eager load nothing, but which drivers they hold depends on the
+     * user (existence, name, email and phone search), the vehicle (vehicle
+     * search) and the fleets (fleet filter, through fleet_drivers).
+     *
+     * @var string[]
+     */
+    protected $apiCacheDependencies = ['user', 'vehicle', 'fleets'];
+
     /**
      * Dynamic attributes that are appended to object.
      *
diff --git a/server/src/Models/FleetDriver.php b/server/src/Models/FleetDriver.php
index e1e5d9fcc..3b61ffaff 100644
--- a/server/src/Models/FleetDriver.php
+++ b/server/src/Models/FleetDriver.php
@@ -3,12 +3,15 @@
 namespace Fleetbase\FleetOps\Models;
 
 use Fleetbase\Models\Model;
+use Fleetbase\Traits\HasApiModelCache;
 use Fleetbase\Traits\HasUuid;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
 class FleetDriver extends Model
 {
     use HasUuid;
+    // Writes bump the fleet_drivers API cache version, which cached driver lists filter on.
+    use HasApiModelCache;
 
     /**
      * The database table used by the model.
diff --git a/server/src/Models/FleetVehicle.php b/server/src/Models/FleetVehicle.php
index 74dd1ec75..037452ca5 100644
--- a/server/src/Models/FleetVehicle.php
+++ b/server/src/Models/FleetVehicle.php
@@ -3,12 +3,15 @@
 namespace Fleetbase\FleetOps\Models;
 
 use Fleetbase\Models\Model;
+use Fleetbase\Traits\HasApiModelCache;
 use Fleetbase\Traits\HasUuid;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
 class FleetVehicle extends Model
 {
     use HasUuid;
+    // Writes bump the fleet_vehicles API cache version, which cached vehicle lists filter on.
+    use HasApiModelCache;
 
     /**
      * The database table used by the model.
diff --git a/server/src/Models/Order.php b/server/src/Models/Order.php
index 378d29795..8f404281b 100644
--- a/server/src/Models/Order.php
+++ b/server/src/Models/Order.php
@@ -196,6 +196,38 @@ class Order extends Model
      */
     protected $with = [];
 
+    /**
+     * Relation paths and tables the cached order lists embed, so a write to any
+     * of them invalidates those lists (fleetbase/core-api#301).
+     *
+     * They mirror OrderFilter::queryForInternal()'s eager loads and whereHas
+     * membership, the payload relation's own `with`, Payload's `$with` and the
+     * public query's loads. customer and facilitator are morphTo relations, so
+     * their tables (contacts, vendors, integrated_vendors) are named instead;
+     * a vendor loads its place, which payload.pickup already covers. files
+     * (customer photo, vendor logo) is left out: every upload writes it, and a
+     * new photo is set by writing the contact's or vendor's own row.
+     *
+     * @var string[]
+     */
+    protected $apiCacheDependencies = [
+        'payload',
+        'payload.pickup',
+        'payload.dropoff',
+        'payload.return',
+        'payload.entities',
+        'payload.waypoints',
+        'payload.firstWaypointMarker.place',
+        'payload.lastWaypointMarker.place',
+        'trackingNumber',
+        'trackingStatuses',
+        'driverAssigned',
+        'vehicleAssigned',
+        'contacts',
+        'vendors',
+        'integrated_vendors',
+    ];
+
     /**
      * The attributes that should be cast to native types.
      *
diff --git a/server/src/Models/ServiceArea.php b/server/src/Models/ServiceArea.php
index d910afb2c..6f3d9738d 100644
--- a/server/src/Models/ServiceArea.php
+++ b/server/src/Models/ServiceArea.php
@@ -91,6 +91,13 @@ class ServiceArea extends Model
      */
     protected $with = ['zones'];
 
+    /**
+     * Relation paths the cached service area lists embed through `$with` (fleetbase/core-api#301).
+     *
+     * @var string[]
+     */
+    protected $apiCacheDependencies = ['zones'];
+
     /**
      * Dynamic attributes that are appended to object.
      *
diff --git a/server/src/Models/Vehicle.php b/server/src/Models/Vehicle.php
index 250b440d9..72813a3db 100644
--- a/server/src/Models/Vehicle.php
+++ b/server/src/Models/Vehicle.php
@@ -81,6 +81,19 @@ class Vehicle extends Model
      */
     protected $with = [];
 
+    /**
+     * Relation paths the cached vehicle lists embed or filter on (fleetbase/core-api#301).
+     *
+     * The public list loads vendor (with its place), category, warranty and
+     * driver; driver, devices, current trailers (through asset_connections) and
+     * fleets (through fleet_vehicles) decide which vehicles the filters return.
+     * photo is left out: files is written by every upload, and a new photo is
+     * set by writing the vehicle's own photo_uuid.
+     *
+     * @var string[]
+     */
+    protected $apiCacheDependencies = ['vendor', 'vendor.place', 'category', 'warranty', 'driver', 'devices', 'currentTrailers', 'fleets'];
+
     /**
      * Get the activity log options for the model.
      */
diff --git a/server/src/Models/Vendor.php b/server/src/Models/Vendor.php
index 079367acb..f76217355 100644
--- a/server/src/Models/Vendor.php
+++ b/server/src/Models/Vendor.php
@@ -117,6 +117,13 @@ class Vendor extends Model
      */
     protected $with = ['place'];
 
+    /**
+     * Relation paths the cached vendor lists embed through `$with` (fleetbase/core-api#301).
+     *
+     * @var string[]
+     */
+    protected $apiCacheDependencies = ['place'];
+
     /**
      * Get the activity log options for the model.
      */
diff --git a/server/src/Models/Waypoint.php b/server/src/Models/Waypoint.php
index bfb895df3..1d74a449b 100644
--- a/server/src/Models/Waypoint.php
+++ b/server/src/Models/Waypoint.php
@@ -8,6 +8,7 @@
 use Fleetbase\FleetOps\Traits\HasTrackingNumber;
 use Fleetbase\FleetOps\Traits\PayloadAccessors;
 use Fleetbase\Models\Model;
+use Fleetbase\Traits\HasApiModelCache;
 use Fleetbase\Traits\HasPublicId;
 use Fleetbase\Traits\HasUuid;
 use Fleetbase\Traits\TracksApiCredential;
@@ -20,6 +21,8 @@
 class Waypoint extends Model
 {
     use HasUuid;
+    // Writes bump the waypoints API cache version, which cached order lists embed.
+    use HasApiModelCache;
     use HasPublicId;
     use TracksApiCredential;
     use HasTrackingNumber;

From 8ba73cf2c4b91368138446baedf9263fac24b585 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 23:17:30 +0800
Subject: [PATCH 55/87] fix(api-cache): invalidate order lists after quiet
 order writes

Order writes that skip model events left the cached order lists, and the
order's own cached lookups, on the old version: dispatching, attaching a
route, purchase rate or transaction, setting distance and time,
scheduling, bulk driver assignment and unassignment, unassigning a
deleted driver's or a vehicle's orders, saving recipient instructions
and recording operational alerts. Each now invalidates the orders cache
for the order's company after the write. The writes themselves stay
quiet.
---
 server/src/Console/Commands/ProcessOperationalAlerts.php   | 1 +
 .../src/Http/Controllers/Internal/v1/DriverController.php  | 1 +
 .../src/Http/Controllers/Internal/v1/OrderController.php   | 2 ++
 .../src/Http/Controllers/Internal/v1/VehicleController.php | 1 +
 server/src/Http/Controllers/Public/TrackingController.php  | 1 +
 server/src/Models/Order.php                                | 6 ++++++
 server/src/Observers/DriverObserver.php                    | 7 ++++++-
 7 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/server/src/Console/Commands/ProcessOperationalAlerts.php b/server/src/Console/Commands/ProcessOperationalAlerts.php
index c9ae5eab7..8f1110fcf 100644
--- a/server/src/Console/Commands/ProcessOperationalAlerts.php
+++ b/server/src/Console/Commands/ProcessOperationalAlerts.php
@@ -189,6 +189,7 @@ protected function notifyOnce(Order $order, string $key, string $notificationCla
                 'context'     => $context,
             ]);
             $order->saveQuietly();
+            $order->invalidateApiCache();
         }
 
         return true;
diff --git a/server/src/Http/Controllers/Internal/v1/DriverController.php b/server/src/Http/Controllers/Internal/v1/DriverController.php
index 87d591cee..aee020d4b 100644
--- a/server/src/Http/Controllers/Internal/v1/DriverController.php
+++ b/server/src/Http/Controllers/Internal/v1/DriverController.php
@@ -595,6 +595,7 @@ protected function clearDriverAssignmentsForOrders($orders): void
             'driver_assigned_uuid' => null,
             'updated_at'           => now(),
         ]);
+        Order::invalidateApiCacheManually(session('company'));
     }
 
     protected function freshOrders($orders, array $with)
diff --git a/server/src/Http/Controllers/Internal/v1/OrderController.php b/server/src/Http/Controllers/Internal/v1/OrderController.php
index 1375bc8d3..169c815cf 100644
--- a/server/src/Http/Controllers/Internal/v1/OrderController.php
+++ b/server/src/Http/Controllers/Internal/v1/OrderController.php
@@ -776,6 +776,7 @@ protected function assignDriverToOrders($orderUuids, Driver $driver): void
             'driver_assigned_uuid' => $driver->uuid,
             'updated_at'           => now(),
         ]);
+        Order::invalidateApiCacheManually(session('company'));
     }
 
     protected function dispatchBulkAssignedDriverNotification(array $orderUuids, Driver $driver): void
@@ -2005,6 +2006,7 @@ public function scheduleOrder(Request $request)
         }
 
         $order->saveQuietly();
+        $order->invalidateApiCache();
 
         return response()->json([
             'status'       => 'OK',
diff --git a/server/src/Http/Controllers/Internal/v1/VehicleController.php b/server/src/Http/Controllers/Internal/v1/VehicleController.php
index b8f113d93..25712b6cb 100644
--- a/server/src/Http/Controllers/Internal/v1/VehicleController.php
+++ b/server/src/Http/Controllers/Internal/v1/VehicleController.php
@@ -186,6 +186,7 @@ public function unassignOrders(Request $request, string $id): JsonResponse
                 'updated_at'            => now(),
             ]);
         });
+        Order::invalidateApiCacheManually(session('company'));
 
         return response()->json([
             'status'  => 'ok',
diff --git a/server/src/Http/Controllers/Public/TrackingController.php b/server/src/Http/Controllers/Public/TrackingController.php
index eaba4c722..758c3436f 100644
--- a/server/src/Http/Controllers/Public/TrackingController.php
+++ b/server/src/Http/Controllers/Public/TrackingController.php
@@ -340,6 +340,7 @@ protected function saveInstructions(Order $order, TrackingScope $scope, string $
         $instructions[sha1($scope->key())] = $text;
         $order->setMeta('recipient_instructions', $instructions);
         $order->saveQuietly();
+        $order->invalidateApiCache();
     }
 
     protected function dataUrl(string $raw): string
diff --git a/server/src/Models/Order.php b/server/src/Models/Order.php
index 8f404281b..f2e306ae5 100644
--- a/server/src/Models/Order.php
+++ b/server/src/Models/Order.php
@@ -1091,6 +1091,7 @@ public function setRoute(Route|array|null $attributes = [])
         $route->save();
 
         $this->updateQuietly(['route_uuid' => $route->uuid]);
+        $this->invalidateApiCache();
 
         return $this;
     }
@@ -1226,6 +1227,7 @@ public function attachPurchaseRate(PurchaseRate $purchaseRate): bool
         ]);
 
         if ($attached) {
+            $this->invalidateApiCache();
             $this->setRelation('purchaseRate', $purchaseRate);
 
             if ($purchaseRate->transaction_uuid) {
@@ -1288,6 +1290,7 @@ public function createOrderTransactionWithoutServiceQuote(): ?Transaction
             ]);
 
             $this->updateQuietly(['transaction_uuid' => $transaction->uuid]);
+            $this->invalidateApiCache();
         } catch (\Throwable $e) {
         }
 
@@ -1327,6 +1330,7 @@ public function dispatch(bool $save = true): self
         if ($save) {
             $this->saveQuietly();
             $this->flushAttributesCache();
+            $this->invalidateApiCache();
         }
 
         dispatch(fn () => event(new OrderDispatched($this)))->afterCommit();
@@ -1814,6 +1818,7 @@ public function setPreliminaryDistanceAndTime()
         $matrix = Utils::getPreliminaryDistanceMatrix($origin, $destination);
 
         $this->updateQuietly(['distance' => $matrix->distance, 'time' => $matrix->time]);
+        $this->invalidateApiCache();
 
         return $this;
     }
@@ -1851,6 +1856,7 @@ public function setDistanceAndTime(array $options = []): self
                 'distance' => $matrix->distance,
                 'time'     => $matrix->time,
             ]);
+            $this->invalidateApiCache();
         }
 
         return $this;
diff --git a/server/src/Observers/DriverObserver.php b/server/src/Observers/DriverObserver.php
index ba806dc83..6d124eb50 100644
--- a/server/src/Observers/DriverObserver.php
+++ b/server/src/Observers/DriverObserver.php
@@ -79,7 +79,12 @@ protected function invalidateLiveCache(): void
 
     protected function unassignOrders(Driver $driver): int
     {
-        return Order::where(['driver_assigned_uuid' => $driver->uuid])->update(['driver_assigned_uuid' => null]);
+        $unassigned = Order::where(['driver_assigned_uuid' => $driver->uuid])->update(['driver_assigned_uuid' => null]);
+        if ($unassigned > 0) {
+            Order::invalidateApiCacheManually($driver->company_uuid);
+        }
+
+        return $unassigned;
     }
 
     protected function findDriverUser(Driver $driver): ?User

From bfd5b87ecf2dbcace12756cac6c222412af1dd09 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 23:17:42 +0800
Subject: [PATCH 56/87] fix(api-cache): invalidate embedded tables after writes
 that skip events

Raw inserts, query builder updates and deletes, and quiet saves bump no
cache version, so lists embedding those tables kept serving stale rows.
Invalidate the written table after each of them:

- waypoints: raw insert, payload waypoint removal, orchestrator resequence
- payloads: current waypoint and pickup/dropoff/return writes, service
  stop tracking numbers
- tracking numbers and statuses: raw inserts, status pointer updates, and
  the owner's status and tracking number columns
- entities and places: raw inserts and payload reassignment
- drivers: vehicle unassignment and deletes cascaded from vehicles and users
- fleet memberships, trailer detach, contact and issue quiet saves,
  customer reassignment to a vendor
- order delete and restore cascades (payloads, entities, waypoints,
  tracking numbers and statuses)
- telematics: a sweep that changes the connection status; the sync meta
  it rewrites every minute does not invalidate

The writes themselves stay quiet.
---
 .../Controllers/Api/v1/FleetController.php     | 14 ++++++++++----
 .../Internal/v1/ContactController.php          |  3 +++
 .../Internal/v1/FleetController.php            | 18 ++++++++++++++++--
 .../Internal/v1/IssueController.php            |  2 ++
 .../Internal/v1/OrchestrationController.php    | 14 +++++++++++---
 .../Internal/v1/TrailerController.php          |  1 +
 server/src/Models/Contact.php                  |  1 +
 server/src/Models/Driver.php                   |  1 +
 server/src/Models/Entity.php                   |  7 +++++++
 server/src/Models/Payload.php                  |  6 ++++++
 server/src/Models/Place.php                    |  5 +++++
 server/src/Models/TrackingNumber.php           |  5 +++++
 server/src/Models/TrackingStatus.php           |  6 ++++++
 server/src/Models/Vehicle.php                  |  1 +
 server/src/Models/Waypoint.php                 |  5 +++++
 server/src/Observers/CompanyUserObserver.php   |  5 ++++-
 server/src/Observers/OrderObserver.php         | 16 ++++++++++++++++
 server/src/Observers/UserObserver.php          |  5 ++++-
 server/src/Observers/VehicleObserver.php       |  7 ++++++-
 .../src/Support/ResolvesOrderServiceStops.php  |  5 +++++
 .../src/Support/Telematics/Telemetry/Inbox.php |  9 ++++++++-
 server/src/Traits/HasTrackingNumber.php        |  2 ++
 22 files changed, 125 insertions(+), 13 deletions(-)

diff --git a/server/src/Http/Controllers/Api/v1/FleetController.php b/server/src/Http/Controllers/Api/v1/FleetController.php
index 16e7a0594..42b8d3b71 100644
--- a/server/src/Http/Controllers/Api/v1/FleetController.php
+++ b/server/src/Http/Controllers/Api/v1/FleetController.php
@@ -434,10 +434,13 @@ protected function assignMembership(string $pivotClass, array $attributes): void
 
     protected function removeVehicleFromFleet(Fleet $fleet, Vehicle $vehicle): void
     {
-        FleetVehicle::where([
+        // Deleted without model events; fleet_vehicles rows carry no company
+        if (FleetVehicle::where([
             'fleet_uuid'   => $fleet->uuid,
             'vehicle_uuid' => $vehicle->uuid,
-        ])->delete();
+        ])->delete()) {
+            FleetVehicle::invalidateApiCacheManually();
+        }
     }
 
     protected function assignDriverToFleet(Fleet $fleet, Driver $driver): void
@@ -450,10 +453,13 @@ protected function assignDriverToFleet(Fleet $fleet, Driver $driver): void
 
     protected function removeDriverFromFleet(Fleet $fleet, Driver $driver): void
     {
-        FleetDriver::where([
+        // Deleted without model events; fleet_drivers rows carry no company
+        if (FleetDriver::where([
             'fleet_uuid'  => $fleet->uuid,
             'driver_uuid' => $driver->uuid,
-        ])->delete();
+        ])->delete()) {
+            FleetDriver::invalidateApiCacheManually();
+        }
     }
 
     protected function vehicleMembershipPayload(Fleet $fleet, Vehicle $vehicle, bool $assigned): array
diff --git a/server/src/Http/Controllers/Internal/v1/ContactController.php b/server/src/Http/Controllers/Internal/v1/ContactController.php
index f4b3346f2..ecfdf21fd 100644
--- a/server/src/Http/Controllers/Internal/v1/ContactController.php
+++ b/server/src/Http/Controllers/Internal/v1/ContactController.php
@@ -19,6 +19,7 @@
 use Fleetbase\Http\Requests\ExportRequest;
 use Fleetbase\Http\Requests\ImportRequest;
 use Fleetbase\Models\User;
+use Fleetbase\Support\ApiModelCache;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Mail;
@@ -266,6 +267,7 @@ protected function migrateContactCustomerContextToVendor(Contact $contact, Vendo
     protected function bulkUpdateCustomerContext(string $modelClass, array $filter, array $replacement): void
     {
         $modelClass::where($filter)->update($replacement);
+        ApiModelCache::invalidateModelCache(new $modelClass(), session('company'));
     }
 
     protected function customerPortalIssuesForContact(Contact $contact)
@@ -350,6 +352,7 @@ protected function sendCustomerCredentialsMail(User $user, string $password, Con
     protected function saveContactMetaQuietly(Contact $contact, array $meta): void
     {
         $contact->forceFill(['meta' => $meta])->saveQuietly();
+        $contact->invalidateApiCache();
     }
 
     protected function isCustomerPortalInstalled(): bool
diff --git a/server/src/Http/Controllers/Internal/v1/FleetController.php b/server/src/Http/Controllers/Internal/v1/FleetController.php
index ba5962321..e66c1e1fe 100644
--- a/server/src/Http/Controllers/Internal/v1/FleetController.php
+++ b/server/src/Http/Controllers/Internal/v1/FleetController.php
@@ -250,10 +250,17 @@ protected static function createFleetDriverAssignment(string $fleetUuid, string
 
     protected static function deleteFleetDriverAssignment(string $fleetUuid, string $driverUuid): mixed
     {
-        return FleetDriver::where([
+        $deleted = FleetDriver::where([
             'fleet_uuid'  => $fleetUuid,
             'driver_uuid' => $driverUuid,
         ])->delete();
+
+        // Deleted without model events; fleet_drivers rows carry no company
+        if ($deleted) {
+            FleetDriver::invalidateApiCacheManually();
+        }
+
+        return $deleted;
     }
 
     protected static function fleetVehicleAssignmentExists(string $fleetUuid, string $vehicleUuid): bool
@@ -274,10 +281,17 @@ protected static function createFleetVehicleAssignment(string $fleetUuid, string
 
     protected static function deleteFleetVehicleAssignment(string $fleetUuid, string $vehicleUuid): mixed
     {
-        return FleetVehicle::where([
+        $deleted = FleetVehicle::where([
             'fleet_uuid'   => $fleetUuid,
             'vehicle_uuid' => $vehicleUuid,
         ])->delete();
+
+        // Deleted without model events; fleet_vehicles rows carry no company
+        if ($deleted) {
+            FleetVehicle::invalidateApiCacheManually();
+        }
+
+        return $deleted;
     }
 
     protected static function invalidateOperationsMonitor(): void
diff --git a/server/src/Http/Controllers/Internal/v1/IssueController.php b/server/src/Http/Controllers/Internal/v1/IssueController.php
index 3195f4ed3..bdd9fb98c 100644
--- a/server/src/Http/Controllers/Internal/v1/IssueController.php
+++ b/server/src/Http/Controllers/Internal/v1/IssueController.php
@@ -38,6 +38,7 @@ public function afterSave(Request $request, Issue $issue)
             if ($assignee && $assignee->type === 'customer') {
                 $issue->assigned_to_uuid = null;
                 $issue->saveQuietly();
+                $issue->invalidateApiCache();
             }
         }
 
@@ -58,6 +59,7 @@ public function afterSave(Request $request, Issue $issue)
             if ($order) {
                 $issue->order_uuid = $order->uuid;
                 $issue->saveQuietly();
+                $issue->invalidateApiCache();
             }
         }
     }
diff --git a/server/src/Http/Controllers/Internal/v1/OrchestrationController.php b/server/src/Http/Controllers/Internal/v1/OrchestrationController.php
index cfccd48b5..6db6bdab8 100644
--- a/server/src/Http/Controllers/Internal/v1/OrchestrationController.php
+++ b/server/src/Http/Controllers/Internal/v1/OrchestrationController.php
@@ -13,6 +13,7 @@
 use Fleetbase\FleetOps\Models\Place;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Models\Waypoint;
 use Fleetbase\FleetOps\Orchestration\Contracts\OrchestrationEngineInterface;
 use Fleetbase\FleetOps\Orchestration\Engines\DriverAssignmentEngine;
 use Fleetbase\FleetOps\Orchestration\Engines\RouteSequencingEngine;
@@ -489,9 +490,10 @@ public function commit(Request $request): JsonResponse
             return response()->json(['error' => 'No assignments provided.'], 422);
         }
 
-        $committed = [];
-        $failed    = [];
-        $manifests = [];
+        $committed   = [];
+        $failed      = [];
+        $manifests   = [];
+        $resequenced = false;
 
         $this->beginOrchestrationTransaction();
         try {
@@ -576,6 +578,7 @@ public function commit(Request $request): JsonResponse
                     if (!empty($assignment['waypoint_sequence']) && $order->payload) {
                         foreach ($assignment['waypoint_sequence'] as $seq => $waypointId) {
                             $this->updateWaypointSequence($order->payload_uuid, $waypointId, $seq);
+                            $resequenced = true;
                         }
                     }
 
@@ -597,6 +600,11 @@ public function commit(Request $request): JsonResponse
             return response()->json(['error' => 'Commit failed: ' . $e->getMessage()], 500);
         }
 
+        // Waypoint sequences are written without model events
+        if ($resequenced) {
+            Waypoint::invalidateApiCacheManually($companyUuid);
+        }
+
         return response()->json([
             'committed' => $committed,
             'failed'    => $failed,
diff --git a/server/src/Http/Controllers/Internal/v1/TrailerController.php b/server/src/Http/Controllers/Internal/v1/TrailerController.php
index 841ab10e8..41420ded5 100644
--- a/server/src/Http/Controllers/Internal/v1/TrailerController.php
+++ b/server/src/Http/Controllers/Internal/v1/TrailerController.php
@@ -166,6 +166,7 @@ public function detach(string $id)
             'updated_by_uuid'           => session('user'),
             'updated_at'                => now(),
         ]));
+        AssetConnection::invalidateApiCacheManually(session('company'));
 
         return response()->json([
             'status'  => 'ok',
diff --git a/server/src/Models/Contact.php b/server/src/Models/Contact.php
index 28decd7e6..9f0af9374 100644
--- a/server/src/Models/Contact.php
+++ b/server/src/Models/Contact.php
@@ -417,6 +417,7 @@ public function repairCustomerTypeInvariant(bool $quiet = false): ?User
                 ]);
                 $user->forceFill(['type' => 'customer'])->saveQuietly();
                 $this->forceFill(['user_uuid' => $user->uuid])->saveQuietly();
+                $this->invalidateApiCache();
             } else {
                 $user = $this->createUser();
             }
diff --git a/server/src/Models/Driver.php b/server/src/Models/Driver.php
index 63164b526..f445a0006 100644
--- a/server/src/Models/Driver.php
+++ b/server/src/Models/Driver.php
@@ -683,6 +683,7 @@ public function assignVehicle(Vehicle $vehicle): self
     {
         // Unassign vehicle from other drivers
         static::where('vehicle_uuid', $vehicle->uuid)->update(['vehicle_uuid' => null]);
+        static::invalidateApiCacheManually($vehicle->company_uuid ?? $this->company_uuid);
 
         // Set this vehicle to the driver instance
         $this->setVehicle($vehicle);
diff --git a/server/src/Models/Entity.php b/server/src/Models/Entity.php
index 224d15ec0..b45b8d9a1 100644
--- a/server/src/Models/Entity.php
+++ b/server/src/Models/Entity.php
@@ -9,6 +9,7 @@
 use Fleetbase\FleetOps\Traits\HasTrackingNumber;
 use Fleetbase\FleetOps\Traits\PayloadAccessors;
 use Fleetbase\Models\Model;
+use Fleetbase\Support\ApiModelCache;
 use Fleetbase\Traits\HasApiModelBehavior;
 use Fleetbase\Traits\HasCustomFields;
 use Fleetbase\Traits\HasInternalId;
@@ -437,6 +438,7 @@ public static function insertGetUuid($values = [], ?Payload $payload = null)
             Entity::where('uuid', $values['uuid'])->update([
                 'payload_uuid' => $payload->uuid,
             ]);
+            ApiModelCache::invalidateModelCache(new static(), $payload->company_uuid ?? session('company'));
 
             return $values['uuid'];
         }
@@ -482,6 +484,11 @@ public static function insertGetUuid($values = [], ?Payload $payload = null)
             static::where('uuid', $uuid)->update(['tracking_number_uuid' => $trackingNumberId]);
         }
 
+        // Inserted and updated without model events
+        if ($result) {
+            ApiModelCache::invalidateModelCache($instance, $values['company_uuid']);
+        }
+
         return $result ? $uuid : false;
     }
 
diff --git a/server/src/Models/Payload.php b/server/src/Models/Payload.php
index de158cc0f..cb690f625 100644
--- a/server/src/Models/Payload.php
+++ b/server/src/Models/Payload.php
@@ -12,6 +12,7 @@
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\LaravelMysqlSpatial\Types\Point;
 use Fleetbase\Models\Model;
+use Fleetbase\Support\ApiModelCache;
 use Fleetbase\Traits\HasApiModelBehavior;
 use Fleetbase\Traits\HasMetaAttributes;
 use Fleetbase\Traits\HasPublicId;
@@ -365,6 +366,7 @@ public function setCurrentWaypoint(Place|Waypoint $destination, bool $save = tru
         $this->current_waypoint_uuid = $destination->uuid;
         if ($save) {
             DB::table($this->getTable())->where('uuid', $this->uuid)->update(['current_waypoint_uuid' => $destination->uuid]);
+            ApiModelCache::invalidateModelCache($this, $this->company_uuid);
         }
 
         return $this;
@@ -868,6 +870,7 @@ public function getOrder()
     public function removeWaypoints()
     {
         Waypoint::where('payload_uuid', $this->uuid)->delete();
+        Waypoint::invalidateApiCacheManually($this->company_uuid);
         $this->setRelation('waypoints', collect());
 
         return $this;
@@ -895,6 +898,7 @@ public function removePlace($property, array $options = [])
 
         if ($save) {
             $this->updateQuietly([$attr => null]);
+            ApiModelCache::invalidateModelCache($this, $this->company_uuid);
         }
 
         if (is_callable($callback)) {
@@ -928,6 +932,7 @@ public function setPlace($property, Place $place, array $options = [])
         // If optioned to save
         if ($save) {
             $this->updateQuietly([$attr => $id]);
+            ApiModelCache::invalidateModelCache($this, $this->company_uuid);
         }
 
         if (is_callable($callback)) {
@@ -1000,6 +1005,7 @@ public function setFirstWaypoint(?Activity $activity = null, $location = null)
 
         $this->current_waypoint_uuid = $destination->uuid;
         $this->saveQuietly();
+        ApiModelCache::invalidateModelCache($this, $this->company_uuid);
         $this->updateWaypointActivity($activity, $location);
 
         return $this->load('currentWaypoint');
diff --git a/server/src/Models/Place.php b/server/src/Models/Place.php
index 898259e5f..1c3e8ea27 100644
--- a/server/src/Models/Place.php
+++ b/server/src/Models/Place.php
@@ -873,6 +873,11 @@ public static function insertGetUuid($values = [])
 
         $result = static::insert($values);
 
+        // Inserted without model events
+        if ($result) {
+            static::invalidateApiCacheManually($values['company_uuid']);
+        }
+
         return $result ? $uuid : false;
     }
 
diff --git a/server/src/Models/TrackingNumber.php b/server/src/Models/TrackingNumber.php
index 68ae9bd15..a5c9f0c77 100644
--- a/server/src/Models/TrackingNumber.php
+++ b/server/src/Models/TrackingNumber.php
@@ -8,6 +8,7 @@
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\LaravelMysqlSpatial\Eloquent\SpatialTrait;
 use Fleetbase\Models\Model;
+use Fleetbase\Support\ApiModelCache;
 use Fleetbase\Traits\HasApiModelBehavior;
 use Fleetbase\Traits\HasPublicId;
 use Fleetbase\Traits\HasUuid;
@@ -387,8 +388,12 @@ public static function insertGetUuid($values = [], ?Model $owner = null)
 
             // silent update
             static::updateOwnerStatusColumn($owner, $initialCode ?? 'created');
+            ApiModelCache::invalidateModelCache($owner, data_get($owner, 'company_uuid', $values['company_uuid']));
         }
 
+        // Inserted and updated without model events
+        ApiModelCache::invalidateModelCache($instance, $values['company_uuid']);
+
         return $uuid;
     }
 
diff --git a/server/src/Models/TrackingStatus.php b/server/src/Models/TrackingStatus.php
index b866a52b3..4166c62ae 100644
--- a/server/src/Models/TrackingStatus.php
+++ b/server/src/Models/TrackingStatus.php
@@ -7,6 +7,7 @@
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\LaravelMysqlSpatial\Eloquent\SpatialTrait;
 use Fleetbase\Models\Model;
+use Fleetbase\Support\ApiModelCache;
 use Fleetbase\Traits\HasApiModelBehavior;
 use Fleetbase\Traits\HasMetaAttributes;
 use Fleetbase\Traits\HasPublicId;
@@ -177,6 +178,11 @@ public static function insertGetUuid($values = [], ?TrackingNumber $trackingNumb
 
         $result = static::insertTrackingStatus($values);
 
+        // Inserted without model events
+        if ($result) {
+            ApiModelCache::invalidateModelCache($instance, $values['company_uuid']);
+        }
+
         return $result ? $uuid : false;
     }
 
diff --git a/server/src/Models/Vehicle.php b/server/src/Models/Vehicle.php
index 72813a3db..9f817dfb7 100644
--- a/server/src/Models/Vehicle.php
+++ b/server/src/Models/Vehicle.php
@@ -642,6 +642,7 @@ public function assignDriver(Driver $driver)
     public function unassignDriver(): self
     {
         Driver::where('vehicle_uuid', $this->uuid)->update(['vehicle_uuid' => null]);
+        Driver::invalidateApiCacheManually($this->company_uuid);
         $this->unsetRelation('driver');
 
         return $this;
diff --git a/server/src/Models/Waypoint.php b/server/src/Models/Waypoint.php
index 1d74a449b..227c87156 100644
--- a/server/src/Models/Waypoint.php
+++ b/server/src/Models/Waypoint.php
@@ -235,6 +235,11 @@ public static function insertGetUuid($values = [], ?Payload $payload = null)
             static::updateTrackingNumberUuid($uuid, $trackingNumberId);
         }
 
+        // Inserted and updated without model events
+        if ($result) {
+            static::invalidateApiCacheManually($values['company_uuid']);
+        }
+
         return $result ? $uuid : false;
     }
 
diff --git a/server/src/Observers/CompanyUserObserver.php b/server/src/Observers/CompanyUserObserver.php
index 016830b0f..378c0fe37 100644
--- a/server/src/Observers/CompanyUserObserver.php
+++ b/server/src/Observers/CompanyUserObserver.php
@@ -34,7 +34,10 @@ public function updated(CompanyUser $companyUser)
 
     protected function deleteDrivers(string $userUuid): void
     {
-        Driver::where('user_uuid', $userUuid)->delete();
+        // A user's drivers can belong to several companies, so this invalidates every company's driver lists
+        if (Driver::where('user_uuid', $userUuid)->delete()) {
+            Driver::invalidateApiCacheManually();
+        }
     }
 
     protected function findDriver(string $userUuid): ?Driver
diff --git a/server/src/Observers/OrderObserver.php b/server/src/Observers/OrderObserver.php
index a5b8a8496..796c908c7 100644
--- a/server/src/Observers/OrderObserver.php
+++ b/server/src/Observers/OrderObserver.php
@@ -10,6 +10,7 @@
 use Fleetbase\FleetOps\Models\Waypoint;
 use Fleetbase\FleetOps\Support\LiveCacheService;
 use Fleetbase\FleetOps\Support\TrackingPublisher;
+use Fleetbase\Support\ApiModelCache;
 use Illuminate\Support\Facades\Cache;
 
 class OrderObserver
@@ -126,6 +127,8 @@ protected function cascadeDelete(Order $order): void
         $trackingNumbers = TrackingNumber::where(fn ($query) => $query->whereIn('uuid', $tree['tracking_numbers'])->orWhereIn('owner_uuid', $tree['owners']))->pluck('uuid')->all();
         TrackingStatus::whereIn('tracking_number_uuid', $trackingNumbers)->update(['deleted_at' => $deletedAt]);
         TrackingNumber::whereIn('uuid', $trackingNumbers)->update(['deleted_at' => $deletedAt]);
+
+        $this->invalidateChildApiCaches($order);
     }
 
     /**
@@ -147,6 +150,19 @@ protected function cascadeRestore(Order $order, string $deletedAt): void
             $trashed(Entity::class)->whereIn('uuid', $tree['entities'])->update(['deleted_at' => null]);
             $trashed(Waypoint::class)->whereIn('uuid', $tree['waypoints'])->update(['deleted_at' => null]);
         }
+
+        $this->invalidateChildApiCaches($order);
+    }
+
+    /**
+     * The cascades write their tables without model events, so invalidate the API
+     * caches of every table they touch.
+     */
+    protected function invalidateChildApiCaches(Order $order): void
+    {
+        foreach ([Payload::class, Entity::class, Waypoint::class, TrackingNumber::class, TrackingStatus::class] as $modelClass) {
+            ApiModelCache::invalidateModelCache(new $modelClass(), $order->company_uuid);
+        }
     }
 
     /**
diff --git a/server/src/Observers/UserObserver.php b/server/src/Observers/UserObserver.php
index 71f8e7b4c..7c7a3d8b9 100644
--- a/server/src/Observers/UserObserver.php
+++ b/server/src/Observers/UserObserver.php
@@ -20,6 +20,9 @@ public function deleted(User $user)
 
     protected function deleteDrivers(string $userUuid): void
     {
-        Driver::where('user_uuid', $userUuid)->delete();
+        // A user's drivers can belong to several companies, so this invalidates every company's driver lists
+        if (Driver::where('user_uuid', $userUuid)->delete()) {
+            Driver::invalidateApiCacheManually();
+        }
     }
 }
diff --git a/server/src/Observers/VehicleObserver.php b/server/src/Observers/VehicleObserver.php
index 761d345f9..1af205e18 100644
--- a/server/src/Observers/VehicleObserver.php
+++ b/server/src/Observers/VehicleObserver.php
@@ -83,7 +83,12 @@ protected function findDriver(string $identifier): ?Driver
 
     protected function deleteDriversAssignedTo(Vehicle $vehicle): mixed
     {
-        return Driver::where(['vehicle_uuid' => $vehicle->uuid])->delete();
+        $deleted = Driver::where(['vehicle_uuid' => $vehicle->uuid])->delete();
+        if ($deleted) {
+            Driver::invalidateApiCacheManually($vehicle->company_uuid);
+        }
+
+        return $deleted;
     }
 
     protected function invalidateLiveCache(): void
diff --git a/server/src/Support/ResolvesOrderServiceStops.php b/server/src/Support/ResolvesOrderServiceStops.php
index cf3aa83a1..17c2d3b12 100644
--- a/server/src/Support/ResolvesOrderServiceStops.php
+++ b/server/src/Support/ResolvesOrderServiceStops.php
@@ -15,6 +15,7 @@
 use Fleetbase\FleetOps\Models\TrackingStatus;
 use Fleetbase\FleetOps\Models\Waypoint;
 use Fleetbase\LaravelMysqlSpatial\Types\Point;
+use Fleetbase\Support\ApiModelCache;
 use Fleetbase\Support\TemplateString;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
@@ -185,6 +186,7 @@ protected function setPayloadCurrentServiceStop(Payload $payload, array $stop):
 
         $payload->current_waypoint_uuid = $place->uuid;
         $payload->saveQuietly();
+        ApiModelCache::invalidateModelCache($payload, $payload->company_uuid);
         $payload->setRelation('currentWaypoint', $place);
 
         if (($stop['waypoint'] ?? null) instanceof Waypoint) {
@@ -254,6 +256,7 @@ protected function updateCurrentServiceStopActivity(Order $order, Activity $acti
             $activityId = $waypoint->insertActivity($activity, $location, $proof);
             if ($activityId && $waypoint->tracking_number_uuid) {
                 DB::table((new TrackingNumber())->getTable())->where('uuid', $waypoint->tracking_number_uuid)->update(['status_uuid' => $activityId]);
+                ApiModelCache::invalidateModelCache(new TrackingNumber(), $payload->company_uuid ?? $order->company_uuid);
                 if ($waypoint->relationLoaded('trackingNumber')) {
                     $waypoint->trackingNumber->status_uuid = $activityId;
                     $waypoint->trackingNumber->unsetRelation('status');
@@ -391,6 +394,7 @@ protected function endpointServiceStopTrackingNumber(Order $order, Payload $payl
         // @codeCoverageIgnoreEnd
 
         DB::table($payload->getTable())->where('uuid', $payload->uuid)->update([$column => $trackingNumberUuid]);
+        ApiModelCache::invalidateModelCache($payload, $payload->company_uuid ?? $order->company_uuid);
         $payload->{$column} = $trackingNumberUuid;
 
         return TrackingNumber::where('uuid', $trackingNumberUuid)->first();
@@ -417,6 +421,7 @@ protected function insertEndpointServiceStopActivity(Order $order, Payload $payl
 
         if ($activityId) {
             DB::table($trackingNumber->getTable())->where('uuid', $trackingNumber->uuid)->update(['status_uuid' => $activityId]);
+            ApiModelCache::invalidateModelCache($trackingNumber, $payload->company_uuid ?? $order->company_uuid);
             $trackingNumber->status_uuid = $activityId;
         }
 
diff --git a/server/src/Support/Telematics/Telemetry/Inbox.php b/server/src/Support/Telematics/Telemetry/Inbox.php
index b1e998409..34b43b3e8 100644
--- a/server/src/Support/Telematics/Telemetry/Inbox.php
+++ b/server/src/Support/Telematics/Telemetry/Inbox.php
@@ -4,6 +4,7 @@
 
 use Fleetbase\FleetOps\Jobs\ProcessTelematicDelivery;
 use Fleetbase\FleetOps\Models\Telematic;
+use Fleetbase\Support\ApiModelCache;
 use Illuminate\Support\Facades\Crypt;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
@@ -98,10 +99,16 @@ public static function finishRun(?string $id): void
                 return;
             }
             // Written without model events: sweeps run every minute and the model logs every save.
+            $connectionStatus = in_array($connection->status, ['error', 'synchronizing'], true) ? 'active' : $connection->status;
             DB::table('telematics')->where('uuid', $connection->uuid)->update([
-                'status' => in_array($connection->status, ['error', 'synchronizing'], true) ? 'active' : $connection->status,
+                'status' => $connectionStatus,
                 'meta'   => json_encode(array_merge($meta, $result), JSON_THROW_ON_ERROR),
             ]);
+            // Cached device lists embed the telematic. Only a status change invalidates
+            // them: the sync meta changes on every sweep and may lag by the list TTL.
+            if ($connectionStatus !== $connection->status) {
+                ApiModelCache::invalidateModelCache($connection, $connection->company_uuid);
+            }
         });
     }
 }
diff --git a/server/src/Traits/HasTrackingNumber.php b/server/src/Traits/HasTrackingNumber.php
index 44945b649..ab931862c 100644
--- a/server/src/Traits/HasTrackingNumber.php
+++ b/server/src/Traits/HasTrackingNumber.php
@@ -9,6 +9,7 @@
 use Fleetbase\FleetOps\Models\TrackingStatus;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\LaravelMysqlSpatial\Types\Point;
+use Fleetbase\Support\ApiModelCache;
 use Fleetbase\Support\TemplateString;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\DB;
@@ -28,6 +29,7 @@ public static function bootHasTrackingNumber(): void
             ], $model);
 
             DB::table($model->getTable())->where('uuid', $model->uuid)->update(['tracking_number_uuid' => $trackingNumberId]);
+            ApiModelCache::invalidateModelCache($model, data_get($model, 'company_uuid', session('company')));
 
             if ($model->isFillable('tracking_number_uuid')) {
                 $model->tracking_number_uuid = $trackingNumberId;

From 62c7091a2a271904d81ef354e29e50009d8f6c33 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 23:17:52 +0800
Subject: [PATCH 57/87] fix(api-cache): invalidate driver and vehicle lists
 after location and online writes

The driver and vehicle track endpoints write location quietly on every
ping, so cached driver, vehicle and order lists (and storefront lists
that embed vehicles) showed a location up to the list TTL old.
Invalidating on every ping would keep those lists from ever being served
from cache, so ApiCacheThrottle invalidates a table at most once a
minute per company: a ping costs one Cache::add, and a cached location
is at most a minute old. The online toggle is infrequent and
invalidates on every call.
---
 .../Controllers/Api/v1/DriverController.php   |  9 +++++
 .../Controllers/Api/v1/VehicleController.php  |  3 ++
 server/src/Support/ApiCacheThrottle.php       | 39 +++++++++++++++++++
 3 files changed, 51 insertions(+)
 create mode 100644 server/src/Support/ApiCacheThrottle.php

diff --git a/server/src/Http/Controllers/Api/v1/DriverController.php b/server/src/Http/Controllers/Api/v1/DriverController.php
index 82d0d6b16..124373721 100644
--- a/server/src/Http/Controllers/Api/v1/DriverController.php
+++ b/server/src/Http/Controllers/Api/v1/DriverController.php
@@ -21,6 +21,7 @@
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Support\ApiCacheThrottle;
 use Fleetbase\FleetOps\Support\GeofenceIntersectionService;
 use Fleetbase\FleetOps\Support\OSRM;
 use Fleetbase\FleetOps\Support\ProfileAccountManager;
@@ -374,6 +375,12 @@ public function track(string $id, Request $request)
             }
         }
 
+        // Location writes are quiet and frequent: invalidate cached lists at most once a window
+        ApiCacheThrottle::invalidate($driver, $driver->company_uuid);
+        if ($vehicle) {
+            ApiCacheThrottle::invalidate($vehicle, $vehicle->company_uuid);
+        }
+
         broadcast(new DriverLocationChanged($driver));
         app(TrackingPublisher::class)->driverMoved($driver);
 
@@ -433,11 +440,13 @@ public function toggleOnline(string $id, Request $request)
 
         // Perform a single update call
         $driver->updateQuietly(['online' => $onlineValue]);
+        $driver->invalidateApiCache();
 
         // Update vehicle online too
         $driver->loadMissing('vehicle');
         if ($vehicle = $driver->vehicle) {
             $vehicle->updateQuietly(['online' => $onlineValue]);
+            $vehicle->invalidateApiCache();
         }
 
         // Return the updated resource
diff --git a/server/src/Http/Controllers/Api/v1/VehicleController.php b/server/src/Http/Controllers/Api/v1/VehicleController.php
index 099d1b9ab..387d8a2d2 100644
--- a/server/src/Http/Controllers/Api/v1/VehicleController.php
+++ b/server/src/Http/Controllers/Api/v1/VehicleController.php
@@ -17,6 +17,7 @@
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Models\Warranty;
+use Fleetbase\FleetOps\Support\ApiCacheThrottle;
 use Fleetbase\FleetOps\Support\GeofenceIntersectionService;
 use Fleetbase\FleetOps\Support\TrackingPublisher;
 use Fleetbase\FleetOps\Support\Utils;
@@ -297,6 +298,8 @@ public function track(string $id, Request $request)
 
         $vehicle->updateQuietly($positionData);
         $vehicle->createPosition($positionData);
+        // Location writes are quiet and frequent: invalidate cached lists at most once a window
+        ApiCacheThrottle::invalidate($vehicle, $vehicle->company_uuid);
 
         broadcast(new VehicleLocationChanged($vehicle));
         app(TrackingPublisher::class)->vehicleMoved($vehicle);
diff --git a/server/src/Support/ApiCacheThrottle.php b/server/src/Support/ApiCacheThrottle.php
new file mode 100644
index 000000000..97fd4080a
--- /dev/null
+++ b/server/src/Support/ApiCacheThrottle.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support;
+
+use Fleetbase\Support\ApiModelCache;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Cache;
+
+/**
+ * Invalidates API caches at most once per window for writes too frequent to
+ * invalidate on every call.
+ *
+ * Location pings write drivers and vehicles every few seconds per device, and
+ * order lists embed both, so invalidating on each ping would keep those lists
+ * from ever being served from cache. Throttled, a ping costs one Cache::add,
+ * and cached lists show a location at most a window old.
+ */
+class ApiCacheThrottle
+{
+    /**
+     * Seconds between invalidations for location writes.
+     */
+    public const LOCATION_WINDOW = 60;
+
+    /**
+     * Invalidate the model's table for the company unless that was done within the window.
+     */
+    public static function invalidate(Model $model, ?string $companyUuid, int $seconds = self::LOCATION_WINDOW): void
+    {
+        if (!ApiModelCache::isCachingEnabled()) {
+            return;
+        }
+
+        $key = 'fleetops:api_cache_throttle:' . $model->getTable() . ':' . ($companyUuid ?? 'all');
+        if (Cache::add($key, true, $seconds)) {
+            ApiModelCache::invalidateModelCache($model, $companyUuid);
+        }
+    }
+}

From a2562a24d90c42ac8cf820b31d361e848fc1312e Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 23:17:52 +0800
Subject: [PATCH 58/87] test(api-cache): cover dependency declarations and
 quiet write invalidation

Walk every declared relation path through the real models and check
that named tables are exactly the morphTo targets' tables, so a renamed
relation fails here rather than in production (fleetbase/core-api#301
throws on unresolvable entries only in debug). Check that the newly
hooked models bump their table on writes, that Order::dispatch(), raw
waypoint and tracking status inserts and waypoint removal invalidate,
and that throttled invalidation runs once per window.

The tests read the property directly and use only released core-api
APIs, since CI installs the released package.
---
 .../Unit/Support/ApiCacheDependenciesTest.php | 234 ++++++++++++++++++
 1 file changed, 234 insertions(+)
 create mode 100644 server/tests/Unit/Support/ApiCacheDependenciesTest.php

diff --git a/server/tests/Unit/Support/ApiCacheDependenciesTest.php b/server/tests/Unit/Support/ApiCacheDependenciesTest.php
new file mode 100644
index 000000000..eeed07026
--- /dev/null
+++ b/server/tests/Unit/Support/ApiCacheDependenciesTest.php
@@ -0,0 +1,234 @@
+<?php
+
+use Fleetbase\FleetOps\Models\AssetConnection;
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Device;
+use Fleetbase\FleetOps\Models\DeviceEvent;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\FleetDriver;
+use Fleetbase\FleetOps\Models\FleetVehicle;
+use Fleetbase\FleetOps\Models\IntegratedVendor;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Payload;
+use Fleetbase\FleetOps\Models\ServiceArea;
+use Fleetbase\FleetOps\Models\TrackingStatus;
+use Fleetbase\FleetOps\Models\Trailer;
+use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\ApiCacheThrottle;
+use Fleetbase\Tests\Support\TrackingPageDatabase;
+use Illuminate\Cache\ArrayStore;
+use Illuminate\Cache\Repository;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
+use Illuminate\Database\Eloquent\Relations\Relation;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Events\Dispatcher;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Str;
+
+if (!function_exists('Fleetbase\FleetOps\Models\dispatch')) {
+    // Order::dispatch() queues its domain event; only the write and its invalidation matter here
+    eval('namespace Fleetbase\FleetOps\Models; function dispatch($job) { return new class { public function afterCommit() { return $this; } }; }');
+}
+
+beforeEach(function () {
+    Cache::swap(new Repository(new ArrayStore()));
+    session(['company' => 'co-1']);
+});
+
+afterEach(function () {
+    Carbon::setTestNow();
+    EloquentModel::unsetConnectionResolver();
+    EloquentModel::unsetEventDispatcher();
+});
+
+/**
+ * The model's declared dependencies, read from the property because
+ * getApiCacheDependencies() only exists from fleetbase/core-api#301 on.
+ */
+function apiCacheDeclaredDependencies(EloquentModel $model): array
+{
+    $property = new ReflectionProperty($model, 'apiCacheDependencies');
+    $property->setAccessible(true);
+
+    return $property->getValue($model);
+}
+
+/**
+ * The relation method a dependency segment names, matched the way core does (as written, camel or snake case).
+ */
+function apiCacheRelationMethod(EloquentModel $model, string $segment): ?string
+{
+    foreach (array_unique([$segment, Str::camel($segment), Str::snake($segment)]) as $method) {
+        if (!method_exists($model, $method)) {
+            continue;
+        }
+
+        $reflection = new ReflectionMethod($model, $method);
+        if ($reflection->isPublic() && !$reflection->isStatic() && $reflection->getNumberOfRequiredParameters() === 0) {
+            return $method;
+        }
+    }
+
+    return null;
+}
+
+function apiCacheQueryVersion(string $table, ?string $companyUuid): int
+{
+    return (int) Cache::get("api_query_version:{$table}:{$companyUuid}", 0);
+}
+
+function apiCacheDatabase(): SQLiteConnection
+{
+    $db     = TrackingPageDatabase::boot();
+    $schema = $db->getSchemaBuilder();
+
+    // Model hooks bind to the dispatcher present when a class boots
+    EloquentModel::setEventDispatcher(new Dispatcher());
+    EloquentModel::clearBootedModels();
+    // Core models clear the HTTP response cache on writes
+    app()->instance('responsecache', new class {
+        public function __call($method, $arguments)
+        {
+            return null;
+        }
+    });
+
+    foreach (['fleet_drivers' => 'driver_uuid', 'fleet_vehicles' => 'vehicle_uuid'] as $table => $member) {
+        $schema->create($table, function ($table) use ($member) {
+            $table->increments('id');
+            $table->string('uuid')->nullable();
+            $table->string('fleet_uuid')->nullable();
+            $table->string($member)->nullable();
+            $table->timestamps();
+            $table->softDeletes();
+        });
+    }
+
+    $schema->create('asset_connections', function ($table) {
+        $table->increments('id');
+        $table->string('uuid')->nullable();
+        $table->string('public_id')->nullable();
+        $table->string('company_uuid')->nullable();
+        foreach (['connector_type', 'connector_uuid', 'connected_type', 'connected_uuid', 'relationship_type'] as $column) {
+            $table->string($column)->nullable();
+        }
+        $table->timestamps();
+        $table->softDeletes();
+    });
+
+    $schema->table('orders', function ($table) {
+        $table->timestamp('dispatched_at')->nullable();
+    });
+
+    return $db;
+}
+
+test('declared api cache dependencies resolve to relations or to the tables of morphTo targets', function (string $modelClass, array $morphTargets) {
+    TrackingPageDatabase::boot();
+
+    $model    = new $modelClass();
+    $declared = apiCacheDeclaredDependencies($model);
+    $named    = [];
+
+    expect($declared)->not->toBeEmpty();
+
+    foreach ($declared as $path) {
+        $current  = $model;
+        $segments = explode('.', $path);
+
+        foreach ($segments as $segment) {
+            $method = apiCacheRelationMethod($current, $segment);
+
+            // core treats a single segment naming no method as a table name
+            if ($method === null && count($segments) === 1) {
+                $named[] = $path;
+                continue 2;
+            }
+
+            expect($method)->not->toBeNull("{$modelClass} dependency {$path} has no relation {$segment}");
+
+            $relation = Relation::noConstraints(fn () => $current->newInstance()->{$method}());
+
+            expect($relation)->toBeInstanceOf(Relation::class)
+                ->and($relation)->not->toBeInstanceOf(MorphTo::class);
+
+            $current = $relation->getRelated();
+        }
+    }
+
+    expect($named)->toEqualCanonicalizing(array_map(fn (string $target) => (new $target())->getTable(), $morphTargets));
+})->with([
+    'order'        => [Order::class, [Contact::class, Vendor::class, IntegratedVendor::class]],
+    'driver'       => [Driver::class, []],
+    'vehicle'      => [Vehicle::class, []],
+    'device'       => [Device::class, [Vehicle::class, Trailer::class]],
+    'device event' => [DeviceEvent::class, []],
+    'vendor'       => [Vendor::class, []],
+    'service area' => [ServiceArea::class, []],
+]);
+
+test('models only embedded by cached lists invalidate their table on writes', function () {
+    $db = apiCacheDatabase();
+
+    $fleetDriver = FleetDriver::create(['fleet_uuid' => 'fleet-1', 'driver_uuid' => 'driver-1']);
+    expect(apiCacheQueryVersion('fleet_drivers', null))->toBe(1);
+
+    $fleetDriver->delete();
+    expect(apiCacheQueryVersion('fleet_drivers', null))->toBe(2);
+
+    FleetVehicle::create(['fleet_uuid' => 'fleet-1', 'vehicle_uuid' => 'vehicle-1']);
+    expect(apiCacheQueryVersion('fleet_vehicles', null))->toBe(1);
+
+    AssetConnection::create(['company_uuid' => 'co-1', 'connector_type' => Vehicle::class, 'connector_uuid' => 'vehicle-1', 'connected_type' => Trailer::class, 'connected_uuid' => 'trailer-1']);
+    expect(apiCacheQueryVersion('asset_connections', 'co-1'))->toBe(1);
+
+    TrackingPageDatabase::insert($db, 'waypoints', ['uuid' => 'wp-1', 'company_uuid' => 'co-1', 'payload_uuid' => 'payload-1', 'order' => 0]);
+    Waypoint::where('uuid', 'wp-1')->first()->update(['order' => 1]);
+    expect(apiCacheQueryVersion('waypoints', 'co-1'))->toBe(1);
+});
+
+test('writes that skip model events invalidate the tables they write', function () {
+    $db = apiCacheDatabase();
+
+    // Order::dispatch() saves quietly
+    TrackingPageDatabase::insert($db, 'orders', ['uuid' => 'order-1', 'company_uuid' => 'co-1', 'dispatched' => false]);
+    Order::where('uuid', 'order-1')->first()->dispatch();
+    expect(apiCacheQueryVersion('orders', 'co-1'))->toBe(1)
+        ->and($db->table('orders')->where('uuid', 'order-1')->value('dispatched'))->toBe(1);
+
+    // Waypoint::insertGetUuid() inserts with the query builder
+    $waypointUuid = Waypoint::insertGetUuid(['place_uuid' => 'place-1', 'order' => 0]);
+    expect($waypointUuid)->toBeString()
+        ->and(apiCacheQueryVersion('waypoints', 'co-1'))->toBe(1);
+
+    // Payload::removeWaypoints() deletes with the query builder
+    TrackingPageDatabase::insert($db, 'payloads', ['uuid' => 'payload-1', 'company_uuid' => 'co-1']);
+    $payload = new Payload();
+    $payload->setRawAttributes(['uuid' => 'payload-1', 'company_uuid' => 'co-1'], true);
+    $payload->removeWaypoints();
+    expect(apiCacheQueryVersion('waypoints', 'co-1'))->toBe(2);
+
+    // TrackingStatus::insertGetUuid() inserts with the query builder
+    expect(TrackingStatus::insertGetUuid(['tracking_number_uuid' => 'tn-1', 'status' => 'Created']))->toBeString()
+        ->and(apiCacheQueryVersion('tracking_statuses', 'co-1'))->toBe(1);
+});
+
+test('throttled invalidation runs at most once per window and table', function () {
+    Carbon::setTestNow('2026-10-12 12:00:00');
+
+    ApiCacheThrottle::invalidate(new Vehicle(), 'co-1');
+    ApiCacheThrottle::invalidate(new Vehicle(), 'co-1');
+    ApiCacheThrottle::invalidate(new Driver(), 'co-1');
+
+    expect(apiCacheQueryVersion('vehicles', 'co-1'))->toBe(1)
+        ->and(apiCacheQueryVersion('drivers', 'co-1'))->toBe(1);
+
+    Carbon::setTestNow(Carbon::now()->addSeconds(ApiCacheThrottle::LOCATION_WINDOW + 1));
+    ApiCacheThrottle::invalidate(new Vehicle(), 'co-1');
+
+    expect(apiCacheQueryVersion('vehicles', 'co-1'))->toBe(2);
+});

From 41d0b1af78822650465752a50b3cf295837e7f69 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 23:37:07 +0800
Subject: [PATCH 59/87] test(telematics): cover the prune compaction watermark
 and a cache outage

A complete compaction sweep records its watermark and the next run skips
rows below it; when the cache is unavailable the sweep still runs over the
whole window. Restores line coverage of PruneTelematicsData to 100%.
---
 .../PruneTelematicsDataCommandTest.php        | 45 +++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/server/tests/Unit/Console/PruneTelematicsDataCommandTest.php b/server/tests/Unit/Console/PruneTelematicsDataCommandTest.php
index ca543ae13..ac1aaee63 100644
--- a/server/tests/Unit/Console/PruneTelematicsDataCommandTest.php
+++ b/server/tests/Unit/Console/PruneTelematicsDataCommandTest.php
@@ -328,6 +328,51 @@ public function lock($name, $seconds = 0, $owner = null)
     }
 });
 
+test('compaction resumes from the last complete sweep and survives a cache outage', function () {
+    fleetopsPruneBoot();
+    DB::table('device_events')->insert([fleetopsPruneEvent('e-aged', 'company-1', 10)]);
+
+    $command                     = new PruneTelematicsDataProbe();
+    $command->options['company'] = 'company_one';
+    $command->options['table']   = ['device_events'];
+    $command->policies           = ['company-1' => ['event_retention_days' => 30, 'event_compact_after_days' => 7]];
+
+    // A complete sweep records how far it got.
+    expect($command->handle())->toBe(0)
+        ->and(DB::table('device_events')->whereNull('payload')->count())->toBe(1)
+        ->and(Illuminate\Support\Facades\Cache::get(PruneTelematicsData::WATERMARK_PREFIX . 'company-1'))->toBe('2026-09-16 12:00:00');
+
+    // Rows below the watermark were compacted by that sweep, so the next run does not revisit them.
+    DB::table('device_events')->insert([fleetopsPruneEvent('e-below-watermark', 'company-1', 20)]);
+    $command->messages = [];
+    expect($command->handle())->toBe(0)
+        ->and(DB::table('device_events')->where('uuid', 'e-below-watermark')->value('payload'))->not->toBeNull()
+        ->and($command->messages)->toBe([['info', 'Telematics prune complete: deleted=0 compacted=0 batches=0']]);
+
+    // Without a cache the sweep still runs, over the whole window.
+    $originalCache = Illuminate\Support\Facades\Cache::getFacadeRoot();
+    try {
+        Illuminate\Support\Facades\Cache::swap(new class(new Illuminate\Cache\ArrayStore()) extends Illuminate\Cache\Repository {
+            public function get($key, $default = null): mixed
+            {
+                throw new RuntimeException('cache down');
+            }
+
+            public function forever($key, $value)
+            {
+                throw new RuntimeException('cache down');
+            }
+        });
+
+        $command->messages = [];
+        expect($command->handle())->toBe(0)
+            ->and(DB::table('device_events')->whereNull('payload')->count())->toBe(2)
+            ->and($command->messages)->toContain(['info', 'company_one device_events: deleted=0 compacted=1 batches=1']);
+    } finally {
+        Illuminate\Support\Facades\Cache::swap($originalCache);
+    }
+});
+
 test('prune resolves the live company policy when none is injected', function () {
     fleetopsPruneBoot();
     Fleetbase\FleetOps\Support\Telematics\Retention\RetentionPolicy::flush();

From fcafea67a0465729d36f17ef79c9bfb74711222c Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Mon, 12 Oct 2026 23:38:34 +0800
Subject: [PATCH 60/87] fix(tracking): link the tracking page itself when a
 notification has no tracking number

The Track Order buttons pass a nullable tracking number to
TrackingCode::pageUrl(string), so an order without one threw a TypeError
while building the mail.
---
 server/src/Support/TrackingCode.php            | 5 +++--
 server/tests/Unit/Support/TrackingCodeTest.php | 5 ++++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/server/src/Support/TrackingCode.php b/server/src/Support/TrackingCode.php
index 84be3c83e..84db1e5e5 100644
--- a/server/src/Support/TrackingCode.php
+++ b/server/src/Support/TrackingCode.php
@@ -45,8 +45,9 @@ class TrackingCode
      * The tracking page link for emails, notifications and the API: the company's own page
      * (`~/t/{slug}/{number}`) when its settings send links there, otherwise the shared page
      * (`~/track/{number}`). QR codes keep {@see PATH}, which labels already printed carry.
+     * Without a tracking number it links the page itself, where the number can be entered.
      */
-    public static function pageUrl(string $trackingNumber, ?string $companyUuid = null): string
+    public static function pageUrl(?string $trackingNumber, ?string $companyUuid = null): string
     {
         try {
             $slug = $companyUuid ? app(TrackingPage\TrackingResolver::class)->linkSlugFor($companyUuid) : null;
@@ -56,7 +57,7 @@ public static function pageUrl(string $trackingNumber, ?string $companyUuid = nu
 
         $base = $slug ? '~/t/' . rawurlencode($slug) : '~/track';
 
-        return Utils::consoleUrl($base . '/' . rawurlencode($trackingNumber), []);
+        return Utils::consoleUrl(filled($trackingNumber) ? $base . '/' . rawurlencode($trackingNumber) : $base, []);
     }
 
     /**
diff --git a/server/tests/Unit/Support/TrackingCodeTest.php b/server/tests/Unit/Support/TrackingCodeTest.php
index 916efcd0e..8e37a4761 100644
--- a/server/tests/Unit/Support/TrackingCodeTest.php
+++ b/server/tests/Unit/Support/TrackingCodeTest.php
@@ -176,7 +176,10 @@ public function linkSlugFor(string $companyUuid): ?string
             ->and(TrackingCode::pageUrl('NOR1', 'co-2'))->toEndWith('/~/track/NOR1')
             ->and(TrackingCode::pageUrl('NOR1', 'broken'))->toEndWith('/~/track/NOR1')
             ->and(TrackingCode::pageUrl('NOR1'))->toEndWith('/~/track/NOR1')
-            ->and(TrackingCode::pageUrl('A B/1'))->toBe('https://console.fleetbase.test/~/track/A%20B%2F1');
+            ->and(TrackingCode::pageUrl('A B/1'))->toBe('https://console.fleetbase.test/~/track/A%20B%2F1')
+            // Notifications pass a nullable number; without one the link opens the page itself.
+            ->and(TrackingCode::pageUrl(null))->toBe('https://console.fleetbase.test/~/track')
+            ->and(TrackingCode::pageUrl('', 'co-1'))->toEndWith('/~/t/northwind');
     } finally {
         Illuminate\Container\Container::setInstance($previousContainer);
     }

From 6d457f04369e62e962fcba967384e3e9cdce1b36 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 06:23:02 +0800
Subject: [PATCH 61/87] fix(vehicles): deleting a vehicle unassigns its drivers
 instead of deleting them

VehicleObserver::deleted soft-deleted every driver holding the vehicle,
although its comment says it unassigns them. Clear their vehicle_uuid
instead.
---
 server/src/Observers/VehicleObserver.php      | 10 +--
 server/tests/ObserverContractsTest.php        |  2 +-
 .../Observers/ObserverListenerSeamsTest.php   |  6 +-
 .../Observers/VehicleObserverDeleteTest.php   | 67 +++++++++++++++++++
 4 files changed, 76 insertions(+), 9 deletions(-)
 create mode 100644 server/tests/Unit/Observers/VehicleObserverDeleteTest.php

diff --git a/server/src/Observers/VehicleObserver.php b/server/src/Observers/VehicleObserver.php
index 1af205e18..1c9f504e8 100644
--- a/server/src/Observers/VehicleObserver.php
+++ b/server/src/Observers/VehicleObserver.php
@@ -66,7 +66,7 @@ public function updating(Vehicle $vehicle)
     public function deleted(Vehicle $vehicle)
     {
         // Unassign the deleted vehicle from matching driver/(s)
-        $this->deleteDriversAssignedTo($vehicle);
+        $this->unassignDriversFrom($vehicle);
 
         $this->invalidateLiveCache();
     }
@@ -81,14 +81,14 @@ protected function findDriver(string $identifier): ?Driver
         return Driver::where('uuid', $identifier)->whereNull('deleted_at')->withoutGlobalScopes()->first();
     }
 
-    protected function deleteDriversAssignedTo(Vehicle $vehicle): mixed
+    protected function unassignDriversFrom(Vehicle $vehicle): int
     {
-        $deleted = Driver::where(['vehicle_uuid' => $vehicle->uuid])->delete();
-        if ($deleted) {
+        $unassigned = Driver::where(['vehicle_uuid' => $vehicle->uuid])->update(['vehicle_uuid' => null]);
+        if ($unassigned) {
             Driver::invalidateApiCacheManually($vehicle->company_uuid);
         }
 
-        return $deleted;
+        return $unassigned;
     }
 
     protected function invalidateLiveCache(): void
diff --git a/server/tests/ObserverContractsTest.php b/server/tests/ObserverContractsTest.php
index d4e4f98c5..3a048ea3e 100644
--- a/server/tests/ObserverContractsTest.php
+++ b/server/tests/ObserverContractsTest.php
@@ -286,7 +286,7 @@ protected function findDriver(string $identifier): ?Driver
         return $this->driver && $identifier === $this->identifier ? $this->driver : null;
     }
 
-    protected function deleteDriversAssignedTo(Vehicle $vehicle): mixed
+    protected function unassignDriversFrom(Vehicle $vehicle): int
     {
         $this->deleted[] = $vehicle->uuid;
 
diff --git a/server/tests/Unit/Observers/ObserverListenerSeamsTest.php b/server/tests/Unit/Observers/ObserverListenerSeamsTest.php
index 03223f571..48e7277ea 100644
--- a/server/tests/Unit/Observers/ObserverListenerSeamsTest.php
+++ b/server/tests/Unit/Observers/ObserverListenerSeamsTest.php
@@ -142,12 +142,12 @@ function fleetopsObserverSeamInvoke(string $class, string $method, array $argume
     expect(fleetopsObserverSeamInvoke(Fleetbase\FleetOps\Observers\VehicleObserver::class, 'findDriver', ['driver-veh-1'])?->uuid)->toBe('driver-veh-1')
         ->and(fleetopsObserverSeamInvoke(Fleetbase\FleetOps\Observers\VehicleObserver::class, 'findDriver', ['driver-missing']))->toBeNull();
 
-    // Deleting a vehicle releases only the drivers assigned to it
+    // Deleting a vehicle unassigns only the drivers assigned to it, and keeps them
     $vehicle = new Vehicle();
     $vehicle->setRawAttributes(['uuid' => 'vehicle-seam-1'], true);
-    fleetopsObserverSeamInvoke(Fleetbase\FleetOps\Observers\VehicleObserver::class, 'deleteDriversAssignedTo', [$vehicle]);
+    fleetopsObserverSeamInvoke(Fleetbase\FleetOps\Observers\VehicleObserver::class, 'unassignDriversFrom', [$vehicle]);
 
-    expect($connection->table('drivers')->whereNull('deleted_at')->pluck('uuid')->all())->toBe(['driver-veh-2']);
+    expect($connection->table('drivers')->whereNull('deleted_at')->pluck('vehicle_uuid', 'uuid')->all())->toBe(['driver-veh-1' => null, 'driver-veh-2' => 'vehicle-other']);
 });
 
 test('fleet observer clears the parent reference from child fleets', function () {
diff --git a/server/tests/Unit/Observers/VehicleObserverDeleteTest.php b/server/tests/Unit/Observers/VehicleObserverDeleteTest.php
new file mode 100644
index 000000000..1fbf7a3fa
--- /dev/null
+++ b/server/tests/Unit/Observers/VehicleObserverDeleteTest.php
@@ -0,0 +1,67 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Observers\VehicleObserver;
+use Fleetbase\Tests\Support\TrackingPageDatabase;
+use Illuminate\Cache\ArrayStore;
+use Illuminate\Cache\Repository;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Support\Facades\Cache;
+
+beforeEach(function () {
+    Cache::swap(new Repository(new ArrayStore()));
+    session(['company' => 'co-1']);
+});
+
+afterEach(function () {
+    EloquentModel::unsetConnectionResolver();
+});
+
+function vehicleObserverDeleteDatabase(): SQLiteConnection
+{
+    $db = TrackingPageDatabase::boot();
+
+    $db->getSchemaBuilder()->create('users', function ($table) {
+        $table->increments('id');
+        $table->string('uuid')->nullable();
+        $table->string('company_uuid')->nullable();
+        $table->timestamps();
+        $table->softDeletes();
+    });
+    $db->getSchemaBuilder()->create('drivers', function ($table) {
+        $table->increments('id');
+        $table->string('uuid')->nullable();
+        $table->string('company_uuid')->nullable();
+        $table->string('user_uuid')->nullable();
+        $table->string('vehicle_uuid')->nullable();
+        $table->timestamps();
+        $table->softDeletes();
+    });
+
+    foreach (['user-1', 'user-2', 'user-3'] as $user) {
+        TrackingPageDatabase::insert($db, 'users', ['uuid' => $user, 'company_uuid' => 'co-1']);
+    }
+    TrackingPageDatabase::insert($db, 'drivers', ['uuid' => 'driver-1', 'company_uuid' => 'co-1', 'user_uuid' => 'user-1', 'vehicle_uuid' => 'vehicle-1']);
+    TrackingPageDatabase::insert($db, 'drivers', ['uuid' => 'driver-2', 'company_uuid' => 'co-1', 'user_uuid' => 'user-2', 'vehicle_uuid' => 'vehicle-1']);
+    TrackingPageDatabase::insert($db, 'drivers', ['uuid' => 'driver-3', 'company_uuid' => 'co-1', 'user_uuid' => 'user-3', 'vehicle_uuid' => 'vehicle-2']);
+
+    return $db;
+}
+
+test('deleting a vehicle unassigns its drivers without deleting them', function () {
+    $db = vehicleObserverDeleteDatabase();
+
+    $vehicle = new Vehicle();
+    $vehicle->setRawAttributes(['uuid' => 'vehicle-1', 'company_uuid' => 'co-1'], true);
+
+    (new VehicleObserver())->deleted($vehicle);
+
+    $drivers = $db->table('drivers')->orderBy('uuid')->get(['uuid', 'vehicle_uuid', 'deleted_at'])->map(fn ($row) => (array) $row)->all();
+
+    expect($drivers)->toBe([
+        ['uuid' => 'driver-1', 'vehicle_uuid' => null, 'deleted_at' => null],
+        ['uuid' => 'driver-2', 'vehicle_uuid' => null, 'deleted_at' => null],
+        ['uuid' => 'driver-3', 'vehicle_uuid' => 'vehicle-2', 'deleted_at' => null],
+    ]);
+});

From 934104fd13dba45470e35c0435a8cf98f5847414 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 06:23:27 +0800
Subject: [PATCH 62/87] fix(drivers): assigning a driver the vehicle it already
 holds keeps it

assignVehicle cleared vehicle_uuid on every driver holding the vehicle,
this driver included, then saved a model that was not dirty, so the
cleared value stayed. Skip this driver when unassigning the others.
---
 server/src/Models/Driver.php                  |  7 +-
 .../Unit/Models/DriverAssignVehicleTest.php   | 81 +++++++++++++++++++
 2 files changed, 86 insertions(+), 2 deletions(-)
 create mode 100644 server/tests/Unit/Models/DriverAssignVehicleTest.php

diff --git a/server/src/Models/Driver.php b/server/src/Models/Driver.php
index f445a0006..5d1b23273 100644
--- a/server/src/Models/Driver.php
+++ b/server/src/Models/Driver.php
@@ -681,8 +681,11 @@ public function unassignCurrentJob(): bool
      */
     public function assignVehicle(Vehicle $vehicle): self
     {
-        // Unassign vehicle from other drivers
-        static::where('vehicle_uuid', $vehicle->uuid)->update(['vehicle_uuid' => null]);
+        // Unassign vehicle from other drivers. This driver is skipped: when it already holds the
+        // vehicle the save below isn't dirty, so it would not write the vehicle back
+        static::where('vehicle_uuid', $vehicle->uuid)
+            ->when($this->uuid, fn ($query) => $query->where('uuid', '!=', $this->uuid))
+            ->update(['vehicle_uuid' => null]);
         static::invalidateApiCacheManually($vehicle->company_uuid ?? $this->company_uuid);
 
         // Set this vehicle to the driver instance
diff --git a/server/tests/Unit/Models/DriverAssignVehicleTest.php b/server/tests/Unit/Models/DriverAssignVehicleTest.php
new file mode 100644
index 000000000..640878f9d
--- /dev/null
+++ b/server/tests/Unit/Models/DriverAssignVehicleTest.php
@@ -0,0 +1,81 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\Tests\Support\TrackingPageDatabase;
+use Illuminate\Cache\ArrayStore;
+use Illuminate\Cache\Repository;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Support\Facades\Cache;
+
+beforeEach(function () {
+    Cache::swap(new Repository(new ArrayStore()));
+    session(['company' => 'co-1']);
+});
+
+afterEach(function () {
+    EloquentModel::unsetConnectionResolver();
+});
+
+function driverAssignVehicleDatabase(): SQLiteConnection
+{
+    $db = TrackingPageDatabase::boot();
+
+    $db->getSchemaBuilder()->create('users', function ($table) {
+        $table->increments('id');
+        $table->string('uuid')->nullable();
+        $table->string('company_uuid')->nullable();
+        $table->timestamps();
+        $table->softDeletes();
+    });
+    $db->getSchemaBuilder()->create('drivers', function ($table) {
+        $table->increments('id');
+        $table->string('uuid')->nullable();
+        $table->string('public_id')->nullable();
+        $table->string('company_uuid')->nullable();
+        $table->string('user_uuid')->nullable();
+        $table->string('vehicle_uuid')->nullable();
+        $table->timestamps();
+        $table->softDeletes();
+    });
+
+    foreach (['user-1', 'user-2'] as $user) {
+        TrackingPageDatabase::insert($db, 'users', ['uuid' => $user, 'company_uuid' => 'co-1']);
+    }
+    TrackingPageDatabase::insert($db, 'drivers', ['uuid' => 'driver-1', 'company_uuid' => 'co-1', 'user_uuid' => 'user-1', 'vehicle_uuid' => 'vehicle-1']);
+    TrackingPageDatabase::insert($db, 'drivers', ['uuid' => 'driver-2', 'company_uuid' => 'co-1', 'user_uuid' => 'user-2']);
+
+    return $db;
+}
+
+function driverAssignVehicleVehicle(): Vehicle
+{
+    $vehicle = new Vehicle();
+    $vehicle->setRawAttributes(['uuid' => 'vehicle-1', 'company_uuid' => 'co-1'], true);
+    $vehicle->exists = true;
+
+    return $vehicle;
+}
+
+function driverAssignVehicleAssignments(SQLiteConnection $db): array
+{
+    return $db->table('drivers')->orderBy('uuid')->pluck('vehicle_uuid', 'uuid')->all();
+}
+
+test('assigning a driver the vehicle it already has keeps the assignment', function () {
+    $db = driverAssignVehicleDatabase();
+
+    Driver::where('uuid', 'driver-1')->first()->assignVehicle(driverAssignVehicleVehicle());
+
+    expect(driverAssignVehicleAssignments($db))->toBe(['driver-1' => 'vehicle-1', 'driver-2' => null]);
+});
+
+test('assigning a vehicle to another driver moves it from its current driver', function () {
+    $db = driverAssignVehicleDatabase();
+
+    $driver = Driver::where('uuid', 'driver-2')->first()->assignVehicle(driverAssignVehicleVehicle());
+
+    expect(driverAssignVehicleAssignments($db))->toBe(['driver-1' => null, 'driver-2' => 'vehicle-1'])
+        ->and($driver->vehicle->uuid)->toBe('vehicle-1');
+});

From aee826574c4e811ff548a3a830c7465bb9172b07 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 06:24:37 +0800
Subject: [PATCH 63/87] fix(drivers): a company membership change only touches
 that company's driver

CompanyUserObserver matched drivers by user alone, so removing a user from
one organization deleted their driver profiles in every organization, and a
status change could land on another organization's driver. Match on the
membership's company too, as HandleUserRemovedFromCompany already does.
---
 server/src/Observers/CompanyUserObserver.php  | 17 ++++++++--------
 server/tests/ObserverContractsTest.php        |  4 ++--
 ...CompanyUserAndServiceAreaObserversTest.php | 20 +++++++++++++++++++
 3 files changed, 30 insertions(+), 11 deletions(-)

diff --git a/server/src/Observers/CompanyUserObserver.php b/server/src/Observers/CompanyUserObserver.php
index 378c0fe37..1b5832485 100644
--- a/server/src/Observers/CompanyUserObserver.php
+++ b/server/src/Observers/CompanyUserObserver.php
@@ -14,8 +14,8 @@ class CompanyUserObserver
      */
     public function deleted(CompanyUser $companyUser)
     {
-        // if the company user deleted is a driver, delete their driver record to
-        $this->deleteDrivers($companyUser->user_uuid);
+        // if the company user deleted is a driver, delete their driver record in that company
+        $this->deleteDrivers($companyUser->user_uuid, $companyUser->company_uuid);
     }
 
     /**
@@ -26,22 +26,21 @@ public function deleted(CompanyUser $companyUser)
     public function updated(CompanyUser $companyUser)
     {
         // If the company user has any driver assosciated update status to same as company_users
-        $driver = $this->findDriver($companyUser->user_uuid);
+        $driver = $this->findDriver($companyUser->user_uuid, $companyUser->company_uuid);
         if ($driver && $companyUser->wasChanged('status')) {
             $driver->update(['status' => $companyUser->status]);
         }
     }
 
-    protected function deleteDrivers(string $userUuid): void
+    protected function deleteDrivers(string $userUuid, ?string $companyUuid): void
     {
-        // A user's drivers can belong to several companies, so this invalidates every company's driver lists
-        if (Driver::where('user_uuid', $userUuid)->delete()) {
-            Driver::invalidateApiCacheManually();
+        if (Driver::where(['user_uuid' => $userUuid, 'company_uuid' => $companyUuid])->delete()) {
+            Driver::invalidateApiCacheManually($companyUuid);
         }
     }
 
-    protected function findDriver(string $userUuid): ?Driver
+    protected function findDriver(string $userUuid, ?string $companyUuid): ?Driver
     {
-        return Driver::where('user_uuid', $userUuid)->first();
+        return Driver::where(['user_uuid' => $userUuid, 'company_uuid' => $companyUuid])->first();
     }
 }
diff --git a/server/tests/ObserverContractsTest.php b/server/tests/ObserverContractsTest.php
index 3a048ea3e..015a004ac 100644
--- a/server/tests/ObserverContractsTest.php
+++ b/server/tests/ObserverContractsTest.php
@@ -536,12 +536,12 @@ class FleetOpsCompanyUserObserverProbe extends CompanyUserObserver
     public array $deleted  = [];
     public ?Driver $driver = null;
 
-    protected function deleteDrivers(string $userUuid): void
+    protected function deleteDrivers(string $userUuid, ?string $companyUuid): void
     {
         $this->deleted[] = $userUuid;
     }
 
-    protected function findDriver(string $userUuid): ?Driver
+    protected function findDriver(string $userUuid, ?string $companyUuid): ?Driver
     {
         return $this->driver;
     }
diff --git a/server/tests/Unit/Observers/FleetOpsCompanyUserAndServiceAreaObserversTest.php b/server/tests/Unit/Observers/FleetOpsCompanyUserAndServiceAreaObserversTest.php
index 30c7f5aab..b993795c2 100644
--- a/server/tests/Unit/Observers/FleetOpsCompanyUserAndServiceAreaObserversTest.php
+++ b/server/tests/Unit/Observers/FleetOpsCompanyUserAndServiceAreaObserversTest.php
@@ -104,6 +104,26 @@ function fleetopsObserversCompanyUser(array $attributes = []): CompanyUser
     expect($connection->table('drivers')->value('status'))->toBe('suspended');
 });
 
+test('company user changes only touch the driver profile in that company', function () {
+    $connection = fleetopsObserversBoot();
+    $connection->table('users')->insert(['uuid' => 'user-1', 'company_uuid' => 'company-1']);
+    $connection->table('drivers')->insert([
+        ['uuid' => 'driver-other', 'company_uuid' => 'company-2', 'user_uuid' => 'user-1', 'status' => 'active'],
+        ['uuid' => 'driver-1', 'company_uuid' => 'company-1', 'user_uuid' => 'user-1', 'status' => 'active'],
+    ]);
+
+    $companyUser         = fleetopsObserversCompanyUser();
+    $companyUser->status = 'suspended';
+    $companyUser->syncChanges();
+    (new CompanyUserObserver())->updated($companyUser);
+
+    expect($connection->table('drivers')->pluck('status', 'uuid')->all())->toBe(['driver-other' => 'active', 'driver-1' => 'suspended']);
+
+    (new CompanyUserObserver())->deleted($companyUser);
+
+    expect($connection->table('drivers')->whereNull('deleted_at')->pluck('uuid')->all())->toBe(['driver-other']);
+});
+
 test('service area deletion cascades to zones and border derives from country', function () {
     $connection = fleetopsObserversBoot();
     $connection->table('zones')->insert(['uuid' => 'zone-1', 'company_uuid' => 'company-1', 'service_area_uuid' => 'sa-1', 'name' => 'Zone 1']);

From 866d96459fb0a429a8d6646d9128cae2a7db7be1 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 06:27:15 +0800
Subject: [PATCH 64/87] fix(drivers): delete drivers through the model when
 their user or membership goes

UserObserver, CompanyUserObserver and HandleUserRemovedFromCompany deleted
drivers with a query builder delete, so DriverObserver never ran: orders
stayed assigned to the deleted driver and a managed login account was never
released. Delete each driver through the model instead; its deleted event
also invalidates the API cache, so the manual invalidation goes.
---
 .../HandleUserRemovedFromCompany.php          |   3 +-
 server/src/Observers/CompanyUserObserver.php  |   5 +-
 server/src/Observers/UserObserver.php         |   6 +-
 server/tests/EventContractsTest.php           |   5 +
 .../HandleUserRemovedFromCompanyTest.php      |   5 +
 .../Observers/DriverDeletionCleanupTest.php   | 158 ++++++++++++++++++
 6 files changed, 174 insertions(+), 8 deletions(-)
 create mode 100644 server/tests/Unit/Observers/DriverDeletionCleanupTest.php

diff --git a/server/src/Listeners/HandleUserRemovedFromCompany.php b/server/src/Listeners/HandleUserRemovedFromCompany.php
index 8fbaacb47..1be031760 100644
--- a/server/src/Listeners/HandleUserRemovedFromCompany.php
+++ b/server/src/Listeners/HandleUserRemovedFromCompany.php
@@ -26,7 +26,8 @@ public function handle(UserRemovedFromCompany $event)
 
     protected function deleteDriversForCompanyUser(string $companyUuid, string $userUuid): void
     {
-        $this->driverQueryForCompanyUser($companyUuid, $userUuid)->delete();
+        // Delete each driver through the model so DriverObserver cleans up after it
+        $this->driverQueryForCompanyUser($companyUuid, $userUuid)->get()->each->delete();
     }
 
     protected function driverQueryForCompanyUser(string $companyUuid, string $userUuid): mixed
diff --git a/server/src/Observers/CompanyUserObserver.php b/server/src/Observers/CompanyUserObserver.php
index 1b5832485..7998d7586 100644
--- a/server/src/Observers/CompanyUserObserver.php
+++ b/server/src/Observers/CompanyUserObserver.php
@@ -34,9 +34,8 @@ public function updated(CompanyUser $companyUser)
 
     protected function deleteDrivers(string $userUuid, ?string $companyUuid): void
     {
-        if (Driver::where(['user_uuid' => $userUuid, 'company_uuid' => $companyUuid])->delete()) {
-            Driver::invalidateApiCacheManually($companyUuid);
-        }
+        // Delete each driver through the model so DriverObserver cleans up after it
+        Driver::where(['user_uuid' => $userUuid, 'company_uuid' => $companyUuid])->get()->each->delete();
     }
 
     protected function findDriver(string $userUuid, ?string $companyUuid): ?Driver
diff --git a/server/src/Observers/UserObserver.php b/server/src/Observers/UserObserver.php
index 7c7a3d8b9..21bebc6f5 100644
--- a/server/src/Observers/UserObserver.php
+++ b/server/src/Observers/UserObserver.php
@@ -20,9 +20,7 @@ public function deleted(User $user)
 
     protected function deleteDrivers(string $userUuid): void
     {
-        // A user's drivers can belong to several companies, so this invalidates every company's driver lists
-        if (Driver::where('user_uuid', $userUuid)->delete()) {
-            Driver::invalidateApiCacheManually();
-        }
+        // Delete each driver through the model so DriverObserver cleans up after it
+        Driver::where('user_uuid', $userUuid)->get()->each->delete();
     }
 }
diff --git a/server/tests/EventContractsTest.php b/server/tests/EventContractsTest.php
index 044b758de..78c4ccf61 100644
--- a/server/tests/EventContractsTest.php
+++ b/server/tests/EventContractsTest.php
@@ -233,6 +233,11 @@ class FleetOpsUserRemovedDriverDeleteQueryFake
 {
     public bool $deleted = false;
 
+    public function get(): Illuminate\Support\Collection
+    {
+        return collect([$this]);
+    }
+
     public function delete(): void
     {
         $this->deleted = true;
diff --git a/server/tests/Unit/Listeners/HandleUserRemovedFromCompanyTest.php b/server/tests/Unit/Listeners/HandleUserRemovedFromCompanyTest.php
index 8d9c2591a..b730384eb 100644
--- a/server/tests/Unit/Listeners/HandleUserRemovedFromCompanyTest.php
+++ b/server/tests/Unit/Listeners/HandleUserRemovedFromCompanyTest.php
@@ -21,6 +21,11 @@ class FleetOpsUserRemovedCompanyDriverQueryFake
 {
     public bool $deleted = false;
 
+    public function get(): Illuminate\Support\Collection
+    {
+        return collect([$this]);
+    }
+
     public function delete(): void
     {
         $this->deleted = true;
diff --git a/server/tests/Unit/Observers/DriverDeletionCleanupTest.php b/server/tests/Unit/Observers/DriverDeletionCleanupTest.php
new file mode 100644
index 000000000..7c632d474
--- /dev/null
+++ b/server/tests/Unit/Observers/DriverDeletionCleanupTest.php
@@ -0,0 +1,158 @@
+<?php
+
+if (!function_exists('Fleetbase\\Observers\\event')) {
+    // The webhook observer announces each deletion; only the cleanup matters here
+    eval('namespace Fleetbase\Observers; function event($event = null, $payload = []) { return []; }');
+}
+
+// The lifecycle event the webhook observer builds names the model with a core-api macro
+if (!Illuminate\Support\Str::hasMacro('humanize')) {
+    Illuminate\Support\Str::macro('humanize', fn ($value, $uppercase = true) => str_replace('_', ' ', Illuminate\Support\Str::snake((string) $value)));
+}
+
+use Fleetbase\Events\UserRemovedFromCompany;
+use Fleetbase\FleetOps\Listeners\HandleUserRemovedFromCompany;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Observers\CompanyUserObserver;
+use Fleetbase\FleetOps\Observers\DriverObserver;
+use Fleetbase\FleetOps\Observers\UserObserver;
+use Fleetbase\Models\Company;
+use Fleetbase\Models\CompanyUser;
+use Fleetbase\Models\User;
+use Fleetbase\Tests\Support\TrackingPageDatabase;
+use Illuminate\Cache\ArrayStore;
+use Illuminate\Cache\Repository;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Events\Dispatcher;
+use Illuminate\Support\Facades\Cache;
+
+/**
+ * Drivers removed along with their user or company membership go through
+ * Driver::delete(), so DriverObserver unassigns their orders and releases
+ * their managed login account.
+ */
+beforeEach(function () {
+    Cache::swap(new Repository(new ArrayStore()));
+    session(['company' => 'co-1']);
+});
+
+afterEach(function () {
+    EloquentModel::unsetConnectionResolver();
+    EloquentModel::unsetEventDispatcher();
+});
+
+function driverDeletionCleanupDatabase(): SQLiteConnection
+{
+    $db     = TrackingPageDatabase::boot();
+    $schema = $db->getSchemaBuilder();
+
+    $schema->create('users', function ($table) {
+        $table->increments('id');
+        $table->string('uuid')->nullable();
+        $table->string('public_id')->nullable();
+        $table->string('company_uuid')->nullable();
+        $table->string('type')->nullable();
+        $table->timestamps();
+        $table->softDeletes();
+    });
+    $schema->create('company_users', function ($table) {
+        $table->increments('id');
+        $table->string('uuid')->nullable();
+        $table->string('company_uuid')->nullable();
+        $table->string('user_uuid')->nullable();
+        $table->string('status')->nullable();
+        $table->timestamps();
+        $table->softDeletes();
+    });
+    $schema->create('drivers', function ($table) {
+        $table->increments('id');
+        $table->string('uuid')->nullable();
+        $table->string('public_id')->nullable();
+        $table->string('company_uuid')->nullable();
+        $table->string('user_uuid')->nullable();
+        $table->string('vehicle_uuid')->nullable();
+        $table->timestamps();
+        $table->softDeletes();
+    });
+
+    // Model hooks bind to the dispatcher present when a class boots
+    EloquentModel::setEventDispatcher(new Dispatcher());
+    EloquentModel::clearBootedModels();
+    Driver::observe(DriverObserver::class);
+    // Core models clear the HTTP response cache on writes, and log activity
+    app()->instance('responsecache', new class {
+        public function __call($method, $arguments)
+        {
+            return null;
+        }
+    });
+    config()->set('activitylog.enabled', false);
+    app()->bind(Illuminate\Contracts\Config\Repository::class, fn () => config());
+
+    TrackingPageDatabase::insert($db, 'users', ['uuid' => 'user-1', 'type' => 'driver']);
+    TrackingPageDatabase::insert($db, 'users', ['uuid' => 'user-2', 'type' => 'driver']);
+    TrackingPageDatabase::insert($db, 'company_users', ['uuid' => 'cu-1', 'company_uuid' => 'co-1', 'user_uuid' => 'user-1', 'status' => 'active']);
+    TrackingPageDatabase::insert($db, 'drivers', ['uuid' => 'driver-1', 'company_uuid' => 'co-1', 'user_uuid' => 'user-1']);
+    TrackingPageDatabase::insert($db, 'drivers', ['uuid' => 'driver-2', 'company_uuid' => 'co-1', 'user_uuid' => 'user-2']);
+    TrackingPageDatabase::insert($db, 'orders', ['uuid' => 'order-1', 'company_uuid' => 'co-1', 'driver_assigned_uuid' => 'driver-1']);
+    TrackingPageDatabase::insert($db, 'orders', ['uuid' => 'order-2', 'company_uuid' => 'co-1', 'driver_assigned_uuid' => 'driver-2']);
+
+    return $db;
+}
+
+function driverDeletionCleanupState(SQLiteConnection $db): array
+{
+    return [
+        'drivers' => $db->table('drivers')->whereNull('deleted_at')->orderBy('uuid')->pluck('uuid')->all(),
+        'orders'  => $db->table('orders')->orderBy('uuid')->pluck('driver_assigned_uuid', 'uuid')->all(),
+        'users'   => $db->table('users')->whereNull('deleted_at')->orderBy('uuid')->pluck('uuid')->all(),
+    ];
+}
+
+test('deleting a user deletes their drivers through the model so their orders are unassigned', function () {
+    $db = driverDeletionCleanupDatabase();
+    TrackingPageDatabase::insert($db, 'drivers', ['uuid' => 'driver-1-other', 'company_uuid' => 'co-2', 'user_uuid' => 'user-1']);
+
+    // The user is already soft-deleted when its deleted event fires
+    $db->table('users')->where('uuid', 'user-1')->update(['deleted_at' => now()]);
+    $user = User::withTrashed()->where('uuid', 'user-1')->first();
+
+    (new UserObserver())->deleted($user);
+
+    expect(driverDeletionCleanupState($db))->toBe([
+        'drivers' => ['driver-2'],
+        'orders'  => ['order-1' => null, 'order-2' => 'driver-2'],
+        'users'   => ['user-2'],
+    ]);
+});
+
+test('deleting a company user deletes its driver through the model and releases the managed account', function () {
+    $db = driverDeletionCleanupDatabase();
+
+    $companyUser = CompanyUser::where('uuid', 'cu-1')->first();
+    $companyUser->delete();
+
+    (new CompanyUserObserver())->deleted($companyUser);
+
+    expect(driverDeletionCleanupState($db))->toBe([
+        'drivers' => ['driver-2'],
+        'orders'  => ['order-1' => null, 'order-2' => 'driver-2'],
+        'users'   => ['user-2'],
+    ]);
+});
+
+test('removing a user from a company deletes its driver through the model', function () {
+    $db = driverDeletionCleanupDatabase();
+
+    $company = new Company();
+    $company->setRawAttributes(['uuid' => 'co-1'], true);
+
+    (new HandleUserRemovedFromCompany())->handle(new UserRemovedFromCompany(User::where('uuid', 'user-1')->first(), $company));
+
+    expect(driverDeletionCleanupState($db))->toBe([
+        'drivers' => ['driver-2'],
+        'orders'  => ['order-1' => null, 'order-2' => 'driver-2'],
+        'users'   => ['user-2'],
+    ]);
+});

From ab5ee3a716e0d8bdab971b2a63ade891b8aafee0 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 06:27:58 +0800
Subject: [PATCH 65/87] fix(orders): index latest_status is the newest tracking
 status

The index resource took the first loaded tracking status as the latest, but
the relation has no order, so lists usually reported the oldest one
(Created). Pick the newest by created_at, then id.
---
 server/src/Http/Resources/v1/Index/Order.php  | 13 ++++++--
 .../Http/Resources/IndexOrderResourceTest.php | 30 +++++++++++++++++++
 2 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/server/src/Http/Resources/v1/Index/Order.php b/server/src/Http/Resources/v1/Index/Order.php
index 9c8ed0b8a..1b413f22d 100644
--- a/server/src/Http/Resources/v1/Index/Order.php
+++ b/server/src/Http/Resources/v1/Index/Order.php
@@ -94,12 +94,12 @@ public function toArray($request): array
 
             // Latest status only, not full array
             'latest_status'        => $this->whenLoaded('trackingStatuses', function () {
-                $latest = $this->trackingStatuses->first();
+                $latest = $this->latestTrackingStatus();
 
                 return $latest ? $latest->status : 'created';
             }),
             'latest_status_code'   => $this->whenLoaded('trackingStatuses', function () {
-                $latest = $this->trackingStatuses->first();
+                $latest = $this->latestTrackingStatus();
 
                 return $latest ? $latest->code : null;
             }),
@@ -127,4 +127,13 @@ public function toArray($request): array
             ],
         ];
     }
+
+    /**
+     * The newest loaded tracking status. The relation has no order, so the
+     * statuses are sorted here, newest insert first within the same second.
+     */
+    protected function latestTrackingStatus(): mixed
+    {
+        return $this->trackingStatuses->sortBy([['created_at', 'desc'], ['id', 'desc']])->first();
+    }
 }
diff --git a/server/tests/Unit/Http/Resources/IndexOrderResourceTest.php b/server/tests/Unit/Http/Resources/IndexOrderResourceTest.php
index b3a1ba0d4..bf002f442 100644
--- a/server/tests/Unit/Http/Resources/IndexOrderResourceTest.php
+++ b/server/tests/Unit/Http/Resources/IndexOrderResourceTest.php
@@ -6,6 +6,7 @@
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Payload;
 use Fleetbase\FleetOps\Models\TrackingNumber;
+use Fleetbase\FleetOps\Models\TrackingStatus;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Vendor;
 use Illuminate\Http\Request;
@@ -83,6 +84,35 @@ function fleetopsIndexOrderResourceOrder(): Order
         ->and($resolved['meta'])->toBe(['_index_resource' => true]);
 });
 
+test('index order resource reports the newest tracking status whatever order they load in', function () {
+    $connection = new Illuminate\Database\SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new Illuminate\Database\ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    Illuminate\Database\Eloquent\Model::setConnectionResolver($resolver);
+    app()->instance('request', Request::create('/v1/orders', 'GET'));
+    session(['company' => 'company-1']);
+
+    $status = function (int $id, string $code, string $createdAt) {
+        $status = new TrackingStatus();
+        $status->setRawAttributes(['id' => $id, 'uuid' => "ts-{$code}", 'status' => ucfirst($code), 'code' => $code, 'created_at' => $createdAt], true);
+
+        return $status;
+    };
+
+    // The relation has no order, so statuses arrive oldest first; two share a second
+    $order = fleetopsIndexOrderResourceOrder();
+    $order->setRelation('trackingStatuses', collect([
+        $status(1, 'created', '2026-10-13 09:00:00'),
+        $status(2, 'dispatched', '2026-10-13 09:05:00'),
+        $status(3, 'started', '2026-10-13 09:05:00'),
+    ]));
+
+    $resolved = (new IndexOrderResource($order))->resolve(Request::create('/v1/orders', 'GET'));
+
+    expect($resolved['latest_status'])->toBe('Started')
+        ->and($resolved['latest_status_code'])->toBe('started');
+});
+
 /**
  * The index Payload resource only emits pickup/dropoff when the payload can
  * actually produce a place. Both accessors short-circuit on a directly related

From aa1e7b30670091a92a9567edb759d64ce0713071 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 06:28:36 +0800
Subject: [PATCH 66/87] fix(contacts): the address filter searches the
 contact's place

ContactFilter::address queried an addresses relation that Contact does not
have, so filtering contacts by address threw. Search the contact's place,
the address the contacts list shows.
---
 server/src/Http/Filter/ContactFilter.php      |  2 +-
 .../tests/ControllerFilterContractsTest.php   |  2 +-
 .../Http/Filter/ContactFilterAddressTest.php  | 61 +++++++++++++++++++
 3 files changed, 63 insertions(+), 2 deletions(-)
 create mode 100644 server/tests/Unit/Http/Filter/ContactFilterAddressTest.php

diff --git a/server/src/Http/Filter/ContactFilter.php b/server/src/Http/Filter/ContactFilter.php
index f609ba6ab..ca8cdbeea 100644
--- a/server/src/Http/Filter/ContactFilter.php
+++ b/server/src/Http/Filter/ContactFilter.php
@@ -64,7 +64,7 @@ public function phone(?string $phone)
     public function address(?string $address)
     {
         $this->builder->whereHas(
-            'addresses',
+            'place',
             function ($query) use ($address) {
                 $query->search($address);
             }
diff --git a/server/tests/ControllerFilterContractsTest.php b/server/tests/ControllerFilterContractsTest.php
index de97fb955..ceefacb47 100644
--- a/server/tests/ControllerFilterContractsTest.php
+++ b/server/tests/ControllerFilterContractsTest.php
@@ -1152,7 +1152,7 @@ public function get(string $key): ?string
         ->and(collect($query->calls)->where(0, 'whereBetween')->values())->toHaveCount(1)
         ->and(collect($query->calls)->where(0, 'whereDate')->values())->toHaveCount(1);
 
-    $address = collect($query->calls)->first(fn ($call) => $call[0] === 'whereHas' && $call[1] === 'addresses');
+    $address = collect($query->calls)->first(fn ($call) => $call[0] === 'whereHas' && $call[1] === 'place');
 
     expect($address[2])->toBe([
         ['search', '1 Test Street'],
diff --git a/server/tests/Unit/Http/Filter/ContactFilterAddressTest.php b/server/tests/Unit/Http/Filter/ContactFilterAddressTest.php
new file mode 100644
index 000000000..deb89a149
--- /dev/null
+++ b/server/tests/Unit/Http/Filter/ContactFilterAddressTest.php
@@ -0,0 +1,61 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Filter\ContactFilter;
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\Http\Filter\Filter;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+
+afterEach(function () {
+    EloquentModel::unsetConnectionResolver();
+});
+
+function contactFilterAddressBoot(): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+
+    $tables = [
+        'contacts' => ['uuid', 'public_id', 'company_uuid', 'place_uuid', 'name'],
+        'places'   => ['uuid', 'public_id', 'company_uuid', 'owner_uuid', 'name', 'street1', 'street2', 'country', 'province', 'district', 'city', 'postal_code', 'phone'],
+    ];
+    foreach ($tables as $table => $columns) {
+        $connection->getSchemaBuilder()->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    $connection->table('places')->insert([
+        ['uuid' => 'place-1', 'company_uuid' => 'co-1', 'street1' => '1 Harbour Road', 'city' => 'Singapore'],
+        ['uuid' => 'place-2', 'company_uuid' => 'co-1', 'street1' => '9 Orchard Lane', 'city' => 'Singapore'],
+    ]);
+    $connection->table('contacts')->insert([
+        ['uuid' => 'contact-1', 'company_uuid' => 'co-1', 'place_uuid' => 'place-1', 'name' => 'Harbour Contact'],
+        ['uuid' => 'contact-2', 'company_uuid' => 'co-1', 'place_uuid' => 'place-2', 'name' => 'Orchard Contact'],
+        ['uuid' => 'contact-3', 'company_uuid' => 'co-1', 'place_uuid' => null, 'name' => 'Placeless Contact'],
+    ]);
+
+    return $connection;
+}
+
+test('the contact address filter matches the address the contact list shows', function () {
+    contactFilterAddressBoot();
+
+    $builder  = Contact::query();
+    $filter   = (new ReflectionClass(ContactFilter::class))->newInstanceWithoutConstructor();
+    $property = new ReflectionProperty(Filter::class, 'builder');
+    $property->setAccessible(true);
+    $property->setValue($filter, $builder);
+
+    $filter->address('harbour');
+
+    expect($builder->pluck('uuid')->all())->toBe(['contact-1']);
+});

From 100cb88903ab9dc7d402bd2083f2bb4c26ef7ecd Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 12:50:20 +0800
Subject: [PATCH 67/87] fix(api-cache): keep vehicle lists cacheable under
 telemetry and pings safe in outages

Release review of the cache dependency work:

- Vehicle lists declared devices, but telemetry saves the device row on
  every contact, so vehicle lists in any company with streaming devices
  were invalidated on every ping. The vehicle filters only read which
  devices are attached, so devices is no longer a dependency and
  Device::attachTo()/detach() invalidate the attached model's lists.
- ApiCacheThrottle runs on every location ping; a cache outage there
  (or any throwing invalidation, as in core-api before #301) now no
  longer fails the ping.
---
 server/src/Models/Device.php                  | 16 ++++
 server/src/Models/Vehicle.php                 | 12 ++-
 server/src/Support/ApiCacheThrottle.php       | 10 ++-
 .../Unit/Support/ApiCacheDependenciesTest.php | 76 +++++++++++++++++++
 4 files changed, 108 insertions(+), 6 deletions(-)

diff --git a/server/src/Models/Device.php b/server/src/Models/Device.php
index 118650efc..d38ecf3c4 100644
--- a/server/src/Models/Device.php
+++ b/server/src/Models/Device.php
@@ -465,6 +465,10 @@ public function attachTo(Model $attachable): bool
         });
 
         if ($updated) {
+            // Cached vehicle and trailer lists filter on attached devices without depending on
+            // the device table, which telemetry writes on every ping
+            static::invalidateAttachableApiCache($attachable, $this->company_uuid);
+
             activity('device_attached')
                 ->performedOn($this)
                 ->withProperties([
@@ -478,6 +482,14 @@ public function attachTo(Model $attachable): bool
         return $updated;
     }
 
+    /**
+     * Invalidate the cached lists of the attached model's table (vehicles or trailers).
+     */
+    protected static function invalidateAttachableApiCache(\Illuminate\Database\Eloquent\Model $attachable, ?string $companyUuid): void
+    {
+        \Fleetbase\Support\ApiModelCache::invalidateModelCache($attachable, $companyUuid);
+    }
+
     /**
      * Detach the device from its current attachment.
      */
@@ -495,6 +507,10 @@ public function detach(): bool
             return $this->update(['attachable_type' => null, 'attachable_uuid' => null]);
         });
 
+        if ($updated && $oldAttachableType && is_a($oldAttachableType, \Illuminate\Database\Eloquent\Model::class, true)) {
+            static::invalidateAttachableApiCache(new $oldAttachableType(), $this->company_uuid);
+        }
+
         if ($updated) {
             activity('device_detached')
                 ->performedOn($this)
diff --git a/server/src/Models/Vehicle.php b/server/src/Models/Vehicle.php
index 9f817dfb7..5819d2891 100644
--- a/server/src/Models/Vehicle.php
+++ b/server/src/Models/Vehicle.php
@@ -85,14 +85,18 @@ class Vehicle extends Model
      * Relation paths the cached vehicle lists embed or filter on (fleetbase/core-api#301).
      *
      * The public list loads vendor (with its place), category, warranty and
-     * driver; driver, devices, current trailers (through asset_connections) and
-     * fleets (through fleet_vehicles) decide which vehicles the filters return.
+     * driver; driver, current trailers (through asset_connections) and fleets
+     * (through fleet_vehicles) decide which vehicles the filters return.
      * photo is left out: files is written by every upload, and a new photo is
-     * set by writing the vehicle's own photo_uuid.
+     * set by writing the vehicle's own photo_uuid. devices is left out too: the
+     * device filters only read which devices are attached, but telemetry saves
+     * the device row on every ping, which would keep vehicle lists from ever
+     * being served from cache. Device::attachTo() and detach() invalidate the
+     * vehicle lists instead.
      *
      * @var string[]
      */
-    protected $apiCacheDependencies = ['vendor', 'vendor.place', 'category', 'warranty', 'driver', 'devices', 'currentTrailers', 'fleets'];
+    protected $apiCacheDependencies = ['vendor', 'vendor.place', 'category', 'warranty', 'driver', 'currentTrailers', 'fleets'];
 
     /**
      * Get the activity log options for the model.
diff --git a/server/src/Support/ApiCacheThrottle.php b/server/src/Support/ApiCacheThrottle.php
index 97fd4080a..114cfbd12 100644
--- a/server/src/Support/ApiCacheThrottle.php
+++ b/server/src/Support/ApiCacheThrottle.php
@@ -32,8 +32,14 @@ public static function invalidate(Model $model, ?string $companyUuid, int $secon
         }
 
         $key = 'fleetops:api_cache_throttle:' . $model->getTable() . ':' . ($companyUuid ?? 'all');
-        if (Cache::add($key, true, $seconds)) {
-            ApiModelCache::invalidateModelCache($model, $companyUuid);
+
+        try {
+            if (Cache::add($key, true, $seconds)) {
+                ApiModelCache::invalidateModelCache($model, $companyUuid);
+            }
+        } catch (\Throwable $e) {
+            // A location ping must never fail on cache bookkeeping; cached lists then
+            // show the location until their TTL. Core versions before #301 can throw here.
         }
     }
 }
diff --git a/server/tests/Unit/Support/ApiCacheDependenciesTest.php b/server/tests/Unit/Support/ApiCacheDependenciesTest.php
index eeed07026..d3e80711e 100644
--- a/server/tests/Unit/Support/ApiCacheDependenciesTest.php
+++ b/server/tests/Unit/Support/ApiCacheDependenciesTest.php
@@ -232,3 +232,79 @@ public function __call($method, $arguments)
 
     expect(apiCacheQueryVersion('vehicles', 'co-1'))->toBe(2);
 });
+
+test('attaching or detaching a device invalidates the attached model lists, and device pings do not', function () {
+    $db = apiCacheDatabase();
+    $db->getSchemaBuilder()->create('devices', function ($table) {
+        $table->increments('id');
+        foreach (['uuid', 'public_id', 'company_uuid', 'attachable_type', 'attachable_uuid', 'name', 'status'] as $column) {
+            $table->string($column)->nullable();
+        }
+        $table->text('meta')->nullable();
+        $table->timestamps();
+        $table->softDeletes();
+    });
+    TrackingPageDatabase::insert($db, 'devices', ['uuid' => 'device-1', 'company_uuid' => 'co-1']);
+    // attachTo() and detach() log activity; only the cache versions matter here
+    app()->instance(Spatie\Activitylog\ActivityLogger::class, new class extends Spatie\Activitylog\ActivityLogger {
+        public function __construct()
+        {
+        }
+
+        public function useLog(?string $logName): static
+        {
+            return $this;
+        }
+
+        public function setLogStatus(Spatie\Activitylog\ActivityLogStatus $logStatus): static
+        {
+            return $this;
+        }
+
+        public function performedOn(EloquentModel $model): static
+        {
+            return $this;
+        }
+
+        public function withProperties(mixed $properties): static
+        {
+            return $this;
+        }
+
+        public function log(string $description): ?Spatie\Activitylog\Contracts\Activity
+        {
+            return null;
+        }
+    });
+    app()->instance(Spatie\Activitylog\ActivityLogStatus::class, new Spatie\Activitylog\ActivityLogStatus(new Illuminate\Config\Repository(['activitylog' => ['enabled' => false]])));
+
+    $vehicle = new Vehicle();
+    $vehicle->setRawAttributes(['uuid' => 'vehicle-1', 'company_uuid' => 'co-1'], true);
+    $device = Device::where('uuid', 'device-1')->first();
+
+    expect($device->attachTo($vehicle))->toBeTrue()
+        ->and(apiCacheQueryVersion('vehicles', 'co-1'))->toBe(1);
+
+    // Telemetry saves the device row on every ping; vehicle lists no longer depend on it
+    $device->update(['status' => 'online']);
+    expect(apiCacheQueryVersion('vehicles', 'co-1'))->toBe(1);
+
+    expect($device->detach())->toBeTrue()
+        ->and(apiCacheQueryVersion('vehicles', 'co-1'))->toBe(2);
+
+    app()->forgetInstance(Spatie\Activitylog\ActivityLogger::class);
+    app()->forgetInstance(Spatie\Activitylog\ActivityLogStatus::class);
+});
+
+test('a cache outage never fails a throttled location invalidation', function () {
+    Cache::swap(new Repository(new class extends ArrayStore {
+        public function add($key, $value, $seconds)
+        {
+            throw new RuntimeException('cache unavailable');
+        }
+    }));
+
+    ApiCacheThrottle::invalidate(new Vehicle(), 'co-1');
+
+    expect(true)->toBeTrue();
+});

From c0eb5f5bda09c8e6b232b3d8e2408af7dc9b1dc8 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 13:12:35 +0800
Subject: [PATCH 68/87] fix(api-cache): coalesce cache invalidation from
 telemetry vehicle and trailer saves

TelematicService saves the vehicle (and trailer) with model events on
every device event. Order lists (vehicleAssigned) and storefront food
truck lists (vehicle) now depend on vehicles, so in any company with
streaming devices they would be invalidated on every ping and never be
served from cache. Telemetry saves now run through
ApiCacheThrottle::telemetryWrite(): model events still fire, and the
cache invalidation is coalesced to once per window per table and
company (fleetbase/core-api#301's withoutInvalidating(); with an older
core the save invalidates as before).
---
 server/src/Support/ApiCacheThrottle.php       | 27 +++++++++++++++++++
 .../Support/Telematics/TelematicService.php   |  7 +++--
 .../Unit/Support/ApiCacheDependenciesTest.php | 27 +++++++++++++++++++
 3 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/server/src/Support/ApiCacheThrottle.php b/server/src/Support/ApiCacheThrottle.php
index 114cfbd12..65b571bf9 100644
--- a/server/src/Support/ApiCacheThrottle.php
+++ b/server/src/Support/ApiCacheThrottle.php
@@ -22,6 +22,33 @@ class ApiCacheThrottle
      */
     public const LOCATION_WINDOW = 60;
 
+    /**
+     * Run a frequent write (a telemetry save) with its model events, but invalidate
+     * the model's cached lists at most once per window instead of on every write.
+     *
+     * Order and food truck lists embed vehicles, so invalidating them on every
+     * telemetry event would keep them from ever being served from cache for any
+     * company with streaming devices. Needs ApiModelCache::withoutInvalidating()
+     * (fleetbase/core-api#301); with an older core the write invalidates as before.
+     *
+     * @template T
+     *
+     * @param \Closure(): T $write
+     *
+     * @return T
+     */
+    public static function telemetryWrite(Model $model, \Closure $write, int $seconds = self::LOCATION_WINDOW): mixed
+    {
+        if (!method_exists(ApiModelCache::class, 'withoutInvalidating')) {
+            return $write();
+        }
+
+        $result = ApiModelCache::withoutInvalidating($write);
+        static::invalidate($model, $model->company_uuid, $seconds);
+
+        return $result;
+    }
+
     /**
      * Invalidate the model's table for the company unless that was done within the window.
      */
diff --git a/server/src/Support/Telematics/TelematicService.php b/server/src/Support/Telematics/TelematicService.php
index 2f7f10ce1..250ea5374 100644
--- a/server/src/Support/Telematics/TelematicService.php
+++ b/server/src/Support/Telematics/TelematicService.php
@@ -13,6 +13,7 @@
 use Fleetbase\FleetOps\Models\Telematic;
 use Fleetbase\FleetOps\Models\Trailer;
 use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Support\ApiCacheThrottle;
 use Fleetbase\FleetOps\Support\TrackingPublisher;
 use Fleetbase\LaravelMysqlSpatial\Types\Point as SpatialPoint;
 use Illuminate\Support\Carbon;
@@ -760,7 +761,8 @@ protected function updateTrailerTelemetry(Trailer $trailer, array $location, arr
             'last_provider'       => $event->provider,
             'last_telemetry_data' => array_filter($eventData, fn ($value) => $value !== null),
         ]);
-        $trailer->save();
+        // Every telemetry event saves the trailer: model events fire, cache invalidation is coalesced
+        ApiCacheThrottle::telemetryWrite($trailer, fn () => $trailer->save());
 
         $broadcast = new TrailerLocationChanged($trailer, ['source' => 'telematics', 'device_event_uuid' => $event->uuid, 'provider' => $event->provider, 'position_at' => $event->occurred_at?->toISOString()]);
         $this->broadcastTelemetry($broadcast, $eventData['_ordered_telemetry'] ?? false);
@@ -803,7 +805,8 @@ protected function updateVehicleTelemetry(Vehicle $vehicle, array $location, arr
                 'fuel_level' => $eventData['fuel_level'] ?? null,
             ], fn ($value) => $value !== null),
         ]);
-        $vehicle->save();
+        // Every telemetry event saves the vehicle: model events fire, cache invalidation is coalesced
+        ApiCacheThrottle::telemetryWrite($vehicle, fn () => $vehicle->save());
 
         $broadcast = new VehicleLocationChanged($vehicle, [
             'source'            => 'telematics',
diff --git a/server/tests/Unit/Support/ApiCacheDependenciesTest.php b/server/tests/Unit/Support/ApiCacheDependenciesTest.php
index d3e80711e..d721343e0 100644
--- a/server/tests/Unit/Support/ApiCacheDependenciesTest.php
+++ b/server/tests/Unit/Support/ApiCacheDependenciesTest.php
@@ -308,3 +308,30 @@ public function add($key, $value, $seconds)
 
     expect(true)->toBeTrue();
 });
+
+test('telemetry writes fire their model events but invalidate at most once per window', function () {
+    Carbon::setTestNow('2026-10-12 12:00:00');
+    $vehicle = new Vehicle();
+    $vehicle->setRawAttributes(['uuid' => 'vehicle-1', 'company_uuid' => 'co-1'], true);
+    $writes = 0;
+    // Stands in for an evented save, whose model hooks invalidate the table
+    $save = function () use ($vehicle, &$writes) {
+        $writes++;
+        Fleetbase\Support\ApiModelCache::invalidateModelCache($vehicle, 'co-1');
+
+        return true;
+    };
+
+    foreach (range(1, 3) as $ping) {
+        expect(ApiCacheThrottle::telemetryWrite($vehicle, $save))->toBeTrue();
+    }
+
+    expect($writes)->toBe(3);
+    if (method_exists(Fleetbase\Support\ApiModelCache::class, 'withoutInvalidating')) {
+        // fleetbase/core-api#301: the saves' own invalidations are coalesced into one per window
+        expect(apiCacheQueryVersion('vehicles', 'co-1'))->toBe(1);
+    } else {
+        // An older core keeps invalidating on every save, as before, with no extra throttled bump
+        expect(apiCacheQueryVersion('vehicles', 'co-1'))->toBe(3);
+    }
+});

From e4a85d749d5d3447d2162d7d248b6ed02fd645f4 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 13:35:28 +0800
Subject: [PATCH 69/87] fix(models): declare relation return types the console
 requests

Core's RequestRelations now loads a client-requested `with`/`expand`/`with_count`
name only when the method (or Expandable closure) declares an Eloquent Relation
return type, or the model lists it in `$withable`. These relations are requested
by the console and the public v1 expansions but were untyped, so they would stop
loading:

- Fleet: photo, serviceArea, zone, vendor, parentFleet (BelongsTo); subFleets
  (HasMany); drivers, vehicles (HasManyThrough)
- Issue: reporter, assignee, vehicle, driver (BelongsTo)
- FuelReport: driver, vehicle, reporter (BelongsTo)
- ServiceRate: rateFees, parcelFees (HasMany); serviceArea, zone (BelongsTo)
- Driver: vehicle (BelongsTo)
- Payload: entities (HasMany); dropoff, pickup, return (BelongsTo); waypoints
  (HasManyThrough)
- UserExpansion closures: driver, currentDriverSession, customer, contact
  (HasOne); driverProfiles (HasMany). CompanyExpansion: drivers (HasMany)

Test fakes that override these methods now declare the same return type and
extend the matching relation class, since an untyped override of a typed parent
method is a fatal error at class load.
---
 server/src/Expansions/CompanyExpansion.php    |  5 ++-
 server/src/Expansions/UserExpansion.php       | 22 +++++-----
 server/src/Models/Driver.php                  |  5 +--
 server/src/Models/Fleet.php                   | 43 +++++--------------
 server/src/Models/FuelReport.php              | 18 +++-----
 server/src/Models/Issue.php                   | 20 ++-------
 server/src/Models/Payload.php                 | 15 ++++---
 server/src/Models/ServiceRate.php             | 24 +++--------
 server/tests/ExpansionContractsTest.php       | 17 +++++++-
 server/tests/ModelAccessorContractsTest.php   |  7 +--
 .../tests/OrderActivityFlowRegressionTest.php |  5 ++-
 server/tests/Unit/Models/FleetTest.php        |  7 +--
 server/tests/Unit/Models/PayloadTest.php      | 22 ++++++++--
 ...iceRatePersistenceAndServicabilityTest.php |  4 +-
 14 files changed, 97 insertions(+), 117 deletions(-)

diff --git a/server/src/Expansions/CompanyExpansion.php b/server/src/Expansions/CompanyExpansion.php
index 5c277d3c6..683093555 100644
--- a/server/src/Expansions/CompanyExpansion.php
+++ b/server/src/Expansions/CompanyExpansion.php
@@ -4,6 +4,7 @@
 
 use Fleetbase\Build\Expansion;
 use Fleetbase\FleetOps\Models\Driver;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 
 class CompanyExpansion implements Expansion
 {
@@ -18,11 +19,11 @@ public static function target()
     }
 
     /**
-     * @return \Illuminate\Database\Eloquent\Relations\HasMany
+     * @return HasMany
      */
     public static function drivers()
     {
-        return function () {
+        return function (): HasMany {
             /** @var \Illuminate\Database\Eloquent\Model $this */
             return $this->hasMany(Driver::class);
         };
diff --git a/server/src/Expansions/UserExpansion.php b/server/src/Expansions/UserExpansion.php
index 22be64926..55b3fd26f 100644
--- a/server/src/Expansions/UserExpansion.php
+++ b/server/src/Expansions/UserExpansion.php
@@ -5,6 +5,8 @@
 use Fleetbase\Build\Expansion;
 use Fleetbase\FleetOps\Models\Contact;
 use Fleetbase\FleetOps\Models\Driver;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Relations\HasOne;
 
 class UserExpansion implements Expansion
 {
@@ -19,55 +21,55 @@ public static function target()
     }
 
     /**
-     * @return \Illuminate\Database\Eloquent\Relations\HasOne
+     * @return HasOne
      */
     public static function driver()
     {
-        return function () {
+        return function (): HasOne {
             /** @var \Illuminate\Database\Eloquent\Model $this */
             return $this->hasOne(Driver::class)->without('user');
         };
     }
 
     /**
-     * @return \Illuminate\Database\Eloquent\Relations\HasOne
+     * @return HasOne
      */
     public static function currentDriverSession()
     {
-        return function () {
+        return function (): HasOne {
             /** @var \Illuminate\Database\Eloquent\Model $this */
             return $this->driver()->where('company_uuid', session('company'));
         };
     }
 
     /**
-     * @return \Illuminate\Database\Eloquent\Relations\HasMany
+     * @return HasMany
      */
     public static function driverProfiles()
     {
-        return function () {
+        return function (): HasMany {
             /** @var \Illuminate\Database\Eloquent\Model $this */
             return $this->hasMany(Driver::class);
         };
     }
 
     /**
-     * @return \Illuminate\Database\Eloquent\Relations\HasOne
+     * @return HasOne
      */
     public static function customer()
     {
-        return function () {
+        return function (): HasOne {
             /** @var \Illuminate\Database\Eloquent\Model $this */
             return $this->hasOne(Contact::class, 'user_uuid', 'uuid')->where('type', 'customer')->without('user');
         };
     }
 
     /**
-     * @return \Illuminate\Database\Eloquent\Relations\HasOne
+     * @return HasOne
      */
     public static function contact()
     {
-        return function () {
+        return function (): HasOne {
             /** @var \Illuminate\Database\Eloquent\Model $this */
             return $this->hasOne(Contact::class, 'user_uuid', 'uuid')->without('user');
         };
diff --git a/server/src/Models/Driver.php b/server/src/Models/Driver.php
index c796257fa..8dedf68a1 100644
--- a/server/src/Models/Driver.php
+++ b/server/src/Models/Driver.php
@@ -272,10 +272,7 @@ public function company()
         return $this->belongsTo(\Fleetbase\Models\Company::class);
     }
 
-    /**
-     * @return BelongsTo
-     */
-    public function vehicle()
+    public function vehicle(): BelongsTo
     {
         return $this->belongsTo(Vehicle::class)->select([
             'uuid',
diff --git a/server/src/Models/Fleet.php b/server/src/Models/Fleet.php
index b2ba0ac2a..c76a749c8 100644
--- a/server/src/Models/Fleet.php
+++ b/server/src/Models/Fleet.php
@@ -11,6 +11,9 @@
 use Fleetbase\Traits\Searchable;
 use Fleetbase\Traits\SendsWebhooks;
 use Fleetbase\Traits\TracksApiCredential;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Relations\HasManyThrough;
 use Illuminate\Notifications\Notifiable;
 use Spatie\Activitylog\LogOptions;
 use Spatie\Activitylog\Traits\LogsActivity;
@@ -105,66 +108,42 @@ public function getSlugOptions(): SlugOptions
      */
     protected $hidden = [];
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
-     */
-    public function photo()
+    public function photo(): BelongsTo
     {
         return $this->belongsTo(\Fleetbase\Models\File::class, 'image_uuid', 'uuid');
     }
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
-     */
-    public function serviceArea()
+    public function serviceArea(): BelongsTo
     {
         return $this->belongsTo(ServiceArea::class)->select(['uuid', 'public_id', 'name', 'type', 'border']);
     }
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
-     */
-    public function zone()
+    public function zone(): BelongsTo
     {
         return $this->belongsTo(Zone::class)->select(['uuid', 'public_id', 'name', 'border']);
     }
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
-     */
-    public function vendor()
+    public function vendor(): BelongsTo
     {
         return $this->belongsTo(Vendor::class)->select(['uuid', 'public_id', 'name']);
     }
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
-     */
-    public function parentFleet()
+    public function parentFleet(): BelongsTo
     {
         return $this->belongsTo(Fleet::class)->without(['subFleets']);
     }
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\HasMany
-     */
-    public function subFleets()
+    public function subFleets(): HasMany
     {
         return $this->hasMany(Fleet::class, 'parent_fleet_uuid', 'uuid')->without(['parentFleet']);
     }
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\HasManyThrough
-     */
-    public function drivers()
+    public function drivers(): HasManyThrough
     {
         return $this->hasManyThrough(Driver::class, FleetDriver::class, 'fleet_uuid', 'uuid', 'uuid', 'driver_uuid');
     }
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\HasManyThrough
-     */
-    public function vehicles()
+    public function vehicles(): HasManyThrough
     {
         return $this->hasManyThrough(Vehicle::class, FleetVehicle::class, 'fleet_uuid', 'uuid', 'uuid', 'vehicle_uuid');
     }
diff --git a/server/src/Models/FuelReport.php b/server/src/Models/FuelReport.php
index 8c7b0b669..fe6bbeda8 100644
--- a/server/src/Models/FuelReport.php
+++ b/server/src/Models/FuelReport.php
@@ -16,6 +16,7 @@
 use Fleetbase\Traits\HasUuid;
 use Fleetbase\Traits\Searchable;
 use Fleetbase\Traits\TracksApiCredential;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
 class FuelReport extends Model
 {
@@ -118,34 +119,25 @@ public function setAmountAttribute($value)
         $this->attributes['amount'] = Utils::numbersOnly($value);
     }
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
-     */
-    public function driver()
+    public function driver(): BelongsTo
     {
         return $this->belongsTo(Driver::class)->without(['vehicle']);
     }
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
-     */
-    public function vehicle()
+    public function vehicle(): BelongsTo
     {
         return $this->belongsTo(Vehicle::class)->without(['driver']);
     }
 
     /**
-     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     * @return BelongsTo
      */
     public function reportedBy()
     {
         return $this->belongsTo(User::class);
     }
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
-     */
-    public function reporter()
+    public function reporter(): BelongsTo
     {
         return $this->belongsTo(User::class, 'reported_by_uuid');
     }
diff --git a/server/src/Models/Issue.php b/server/src/Models/Issue.php
index 6596a2a0c..00780bc8a 100644
--- a/server/src/Models/Issue.php
+++ b/server/src/Models/Issue.php
@@ -152,10 +152,7 @@ public function reportedBy()
         return $this->belongsTo(User::class);
     }
 
-    /**
-     * @return BelongsTo
-     */
-    public function reporter()
+    public function reporter(): BelongsTo
     {
         return $this->belongsTo(User::class, 'reported_by_uuid');
     }
@@ -168,26 +165,17 @@ public function assignedTo()
         return $this->belongsTo(User::class);
     }
 
-    /**
-     * @return BelongsTo
-     */
-    public function assignee()
+    public function assignee(): BelongsTo
     {
         return $this->belongsTo(User::class, 'assigned_to_uuid');
     }
 
-    /**
-     * @return BelongsTo
-     */
-    public function vehicle()
+    public function vehicle(): BelongsTo
     {
         return $this->belongsTo(Vehicle::class);
     }
 
-    /**
-     * @return BelongsTo
-     */
-    public function driver()
+    public function driver(): BelongsTo
     {
         return $this->belongsTo(Driver::class);
     }
diff --git a/server/src/Models/Payload.php b/server/src/Models/Payload.php
index de158cc0f..d15a88f2b 100644
--- a/server/src/Models/Payload.php
+++ b/server/src/Models/Payload.php
@@ -17,6 +17,9 @@
 use Fleetbase\Traits\HasPublicId;
 use Fleetbase\Traits\HasUuid;
 use Fleetbase\Traits\TracksApiCredential;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Relations\HasManyThrough;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
 
@@ -140,7 +143,7 @@ public function getReturnNameAttribute()
     /**
      * Entities in the payload.
      */
-    public function entities()
+    public function entities(): HasMany
     {
         return $this->hasMany(Entity::class);
     }
@@ -194,7 +197,7 @@ public function order()
     /**
      * The address the shipment will be delivered to.
      */
-    public function dropoff()
+    public function dropoff(): BelongsTo
     {
         return $this->belongsTo(Place::class, 'dropoff_uuid')->whereNull('deleted_at')->withoutGlobalScopes();
     }
@@ -202,7 +205,7 @@ public function dropoff()
     /**
      * The address the shipment will be delivered from.
      */
-    public function pickup()
+    public function pickup(): BelongsTo
     {
         return $this->belongsTo(Place::class, 'pickup_uuid')->whereNull('deleted_at')->withoutGlobalScopes();
     }
@@ -210,7 +213,7 @@ public function pickup()
     /**
      * The address the shipment will be sent to upon failed delivery.
      */
-    public function return()
+    public function return(): BelongsTo
     {
         return $this->belongsTo(Place::class)->withoutGlobalScopes();
     }
@@ -233,10 +236,8 @@ public function currentWaypointMarker()
 
     /**
      * Waypoints between start and end.
-     *
-     * @return \Illuminate\Database\Eloquent\Concerns\HasManyThrough
      */
-    public function waypoints()
+    public function waypoints(): HasManyThrough
     {
         return $this->hasManyThrough(Place::class, Waypoint::class, 'payload_uuid', 'uuid', 'uuid', 'place_uuid')->whereNull('waypoints.deleted_at')->withoutGlobalScopes();
     }
diff --git a/server/src/Models/ServiceRate.php b/server/src/Models/ServiceRate.php
index 043a49dcb..56169ad96 100644
--- a/server/src/Models/ServiceRate.php
+++ b/server/src/Models/ServiceRate.php
@@ -12,6 +12,8 @@
 use Fleetbase\Traits\HasUuid;
 use Fleetbase\Traits\SendsWebhooks;
 use Fleetbase\Traits\TracksApiCredential;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 
 class ServiceRate extends Model
 {
@@ -110,42 +112,30 @@ class ServiceRate extends Model
      */
     protected $filterParams = [];
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\HasMany
-     */
-    public function rateFees()
+    public function rateFees(): HasMany
     {
         return $this->hasMany(ServiceRateFee::class);
     }
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\HasMany
-     */
-    public function parcelFees()
+    public function parcelFees(): HasMany
     {
         return $this->hasMany(ServiceRateParcelFee::class);
     }
 
     /**
-     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     * @return BelongsTo
      */
     public function orderConfig()
     {
         return $this->belongsTo(OrderConfig::class)->withTrashed();
     }
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
-     */
-    public function serviceArea()
+    public function serviceArea(): BelongsTo
     {
         return $this->belongsTo(ServiceArea::class)->whereNull('deleted_at');
     }
 
-    /**
-     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
-     */
-    public function zone()
+    public function zone(): BelongsTo
     {
         return $this->belongsTo(Zone::class);
     }
diff --git a/server/tests/ExpansionContractsTest.php b/server/tests/ExpansionContractsTest.php
index 5f1b4f0f9..e5200047e 100644
--- a/server/tests/ExpansionContractsTest.php
+++ b/server/tests/ExpansionContractsTest.php
@@ -11,7 +11,9 @@ function bindFleetOpsExpansionClosure(Closure $closure, object $target): Closure
     return $closure->bindTo($target, $target::class);
 }
 
-class FleetOpsExpansionRelationFake
+// The expansion closures declare HasOne / HasMany return types, so the fakes extend
+// those relations; the parent constructor is skipped on purpose.
+trait FleetOpsExpansionRecordsRelationCalls
 {
     public array $calls = [];
 
@@ -34,6 +36,16 @@ public function where($column, $operator = null, $value = null)
     }
 }
 
+class FleetOpsExpansionRelationFake extends Illuminate\Database\Eloquent\Relations\HasOne
+{
+    use FleetOpsExpansionRecordsRelationCalls;
+}
+
+class FleetOpsExpansionManyRelationFake extends Illuminate\Database\Eloquent\Relations\HasMany
+{
+    use FleetOpsExpansionRecordsRelationCalls;
+}
+
 class FleetOpsExpansionModelFake
 {
     public array $calls     = [];
@@ -41,9 +53,10 @@ class FleetOpsExpansionModelFake
 
     public function __construct()
     {
-        foreach (['driver', 'driverProfiles', 'customer', 'contact'] as $name) {
+        foreach (['driver', 'customer', 'contact'] as $name) {
             $this->relations[$name] = new FleetOpsExpansionRelationFake($name);
         }
+        $this->relations['driverProfiles'] = new FleetOpsExpansionManyRelationFake('driverProfiles');
     }
 
     public function hasMany($class)
diff --git a/server/tests/ModelAccessorContractsTest.php b/server/tests/ModelAccessorContractsTest.php
index c40fff6cd..ca9fd6052 100644
--- a/server/tests/ModelAccessorContractsTest.php
+++ b/server/tests/ModelAccessorContractsTest.php
@@ -85,7 +85,8 @@ function fleetopsModelAccessorsUseInMemoryRelationConnection(): void
     EloquentModel::setConnectionResolver($resolver);
 }
 
-class FleetOpsCountingRelationFake
+// Extends the relation the model method now declares, so the override stays compatible; the parent constructor is skipped on purpose.
+class FleetOpsCountingRelationFake extends HasManyThrough
 {
     public function __construct(private int $total, private int $online)
     {
@@ -251,12 +252,12 @@ public function loadMissing($relations)
 
 class FleetOpsFleetAccessorFake extends Fleet
 {
-    public function drivers()
+    public function drivers(): HasManyThrough
     {
         return new FleetOpsCountingRelationFake(5, 2);
     }
 
-    public function vehicles()
+    public function vehicles(): HasManyThrough
     {
         return new FleetOpsCountingRelationFake(7, 3);
     }
diff --git a/server/tests/OrderActivityFlowRegressionTest.php b/server/tests/OrderActivityFlowRegressionTest.php
index 8a3d75cef..7eff0accf 100644
--- a/server/tests/OrderActivityFlowRegressionTest.php
+++ b/server/tests/OrderActivityFlowRegressionTest.php
@@ -20,7 +20,8 @@
 use Fleetbase\FleetOps\Support\ResolvesOrderServiceStops;
 use Fleetbase\LaravelMysqlSpatial\Types\Point;
 
-class ActivityFlowRelationCountFake
+// Extends the relation the model method now declares, so the override stays compatible; the parent constructor is skipped on purpose.
+class ActivityFlowRelationCountFake extends Illuminate\Database\Eloquent\Relations\HasManyThrough
 {
     public function __construct(private int $count)
     {
@@ -67,7 +68,7 @@ public function load($relations)
         return $this;
     }
 
-    public function waypoints()
+    public function waypoints(): Illuminate\Database\Eloquent\Relations\HasManyThrough
     {
         return new ActivityFlowRelationCountFake($this->waypoints?->count() ?? 0);
     }
diff --git a/server/tests/Unit/Models/FleetTest.php b/server/tests/Unit/Models/FleetTest.php
index 4d1a40873..3849900cf 100644
--- a/server/tests/Unit/Models/FleetTest.php
+++ b/server/tests/Unit/Models/FleetTest.php
@@ -33,7 +33,8 @@ function session($key = null, $default = null)
 use Spatie\Activitylog\LogOptions;
 use Spatie\Sluggable\SlugOptions;
 
-class FleetOpsFleetUnitCountingRelationFake
+// Extends the relation the model method now declares, so the override stays compatible; the parent constructor is skipped on purpose.
+class FleetOpsFleetUnitCountingRelationFake extends HasManyThrough
 {
     public array $wheres = [];
 
@@ -59,7 +60,7 @@ class FleetOpsFleetUnitCountingFake extends Fleet
     public array $driverRelations  = [];
     public array $vehicleRelations = [];
 
-    public function drivers()
+    public function drivers(): HasManyThrough
     {
         $relation                = new FleetOpsFleetUnitCountingRelationFake(5);
         $this->driverRelations[] = $relation;
@@ -67,7 +68,7 @@ public function drivers()
         return $relation;
     }
 
-    public function vehicles()
+    public function vehicles(): HasManyThrough
     {
         $relation                 = new FleetOpsFleetUnitCountingRelationFake(8);
         $this->vehicleRelations[] = $relation;
diff --git a/server/tests/Unit/Models/PayloadTest.php b/server/tests/Unit/Models/PayloadTest.php
index edf14cd7f..ac3627758 100644
--- a/server/tests/Unit/Models/PayloadTest.php
+++ b/server/tests/Unit/Models/PayloadTest.php
@@ -32,7 +32,8 @@
 use Illuminate\Database\Eloquent\Relations\HasOne;
 use Illuminate\Database\SQLiteConnection;
 
-class FleetOpsPayloadUnitRelationCountFake
+// Extends the relation the model method now declares, so the override stays compatible; the parent constructor is skipped on purpose.
+class FleetOpsPayloadUnitRelationCountFake extends HasManyThrough
 {
     public function __construct(private readonly Payload $payload, private readonly string $relation)
     {
@@ -44,6 +45,19 @@ public function count(): int
     }
 }
 
+// Extends the relation the model method now declares, so the override stays compatible; the parent constructor is skipped on purpose.
+class FleetOpsPayloadUnitEntityCountFake extends HasMany
+{
+    public function __construct(private readonly Payload $payload)
+    {
+    }
+
+    public function count(): int
+    {
+        return $this->payload->getRelation('entities')?->count() ?? 0;
+    }
+}
+
 class FleetOpsPayloadUnitDatabaseProbe
 {
     public function __construct(private SQLiteConnection $connection)
@@ -147,14 +161,14 @@ class FleetOpsPayloadUnitFake extends Payload
     public array $activityUpdates        = [];
     public array $currentWaypointWrites  = [];
 
-    public function waypoints()
+    public function waypoints(): HasManyThrough
     {
         return new FleetOpsPayloadUnitRelationCountFake($this, 'waypoints');
     }
 
-    public function entities()
+    public function entities(): HasMany
     {
-        return new FleetOpsPayloadUnitRelationCountFake($this, 'entities');
+        return new FleetOpsPayloadUnitEntityCountFake($this);
     }
 
     public function hasMeta($key): bool
diff --git a/server/tests/Unit/Models/ServiceRatePersistenceAndServicabilityTest.php b/server/tests/Unit/Models/ServiceRatePersistenceAndServicabilityTest.php
index 25b5755cb..dd39bcd15 100644
--- a/server/tests/Unit/Models/ServiceRatePersistenceAndServicabilityTest.php
+++ b/server/tests/Unit/Models/ServiceRatePersistenceAndServicabilityTest.php
@@ -92,12 +92,12 @@ public function getAttribute($key)
         return parent::getAttribute($key);
     }
 
-    public function rateFees()
+    public function rateFees(): Illuminate\Database\Eloquent\Relations\HasMany
     {
         return $this->hasMany(Fleetbase\FleetOps\Models\ServiceRateFee::class, 'service_rate_uuid', 'uuid');
     }
 
-    public function parcelFees()
+    public function parcelFees(): Illuminate\Database\Eloquent\Relations\HasMany
     {
         return $this->hasMany(Fleetbase\FleetOps\Models\ServiceRateParcelFee::class, 'service_rate_uuid', 'uuid');
     }

From 45fab851aacdcf7d40001080100442e3dcd9b81d Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 13:35:28 +0800
Subject: [PATCH 70/87] fix(resources): only load requested relations core
 accepts

ResolvesPublicRelationFields::requestedRelations() kept any `with` name whose
root was a method on the model, and the Fleet and Vehicle resources pass the
result to loadMissing(). Eloquent loads a name by calling it on a blank model,
so `?with=saveInstance` ran that method.

When Fleetbase\Support\RequestRelations is available, an Eloquent resource now
keeps only the paths RequestRelations::eagerLoads() accepts, named as the
model's methods, which also matches the canonical names publicRelationObject()
compares against. The method_exists check stays as the fallback for core
releases without RequestRelations and for non-Eloquent resources.
---
 .../Concerns/ResolvesPublicRelationFields.php | 15 +++++-
 server/tests/VehicleResourceContractsTest.php | 46 +++++++++++++++++++
 2 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/server/src/Http/Resources/v1/Concerns/ResolvesPublicRelationFields.php b/server/src/Http/Resources/v1/Concerns/ResolvesPublicRelationFields.php
index a6250451e..766dee847 100644
--- a/server/src/Http/Resources/v1/Concerns/ResolvesPublicRelationFields.php
+++ b/server/src/Http/Resources/v1/Concerns/ResolvesPublicRelationFields.php
@@ -3,6 +3,8 @@
 namespace Fleetbase\FleetOps\Http\Resources\v1\Concerns;
 
 use Fleetbase\Support\Http;
+use Fleetbase\Support\RequestRelations;
+use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\Resources\MissingValue;
 
 /**
@@ -30,6 +32,13 @@ trait ResolvesPublicRelationFields
      * model actually defines are kept — a parent's expansion must never reach
      * this model's loader, where it raises RelationNotFoundException.
      *
+     * The result is handed to `loadMissing()`, and Eloquent loads a name by
+     * calling it as a method on a blank model, so a name that is merely a
+     * method (`with=saveInstance`) would run it. When core's RequestRelations
+     * is available an Eloquent model keeps only declared relations, each
+     * segment named as the model's method (`service_area` → `serviceArea`).
+     * Older core releases without it keep the root-method check below.
+     *
      * @return array<int, string>
      */
     protected function requestedRelations($request): array
@@ -46,6 +55,10 @@ protected function requestedRelations($request): array
 
         $with = array_values(array_filter(array_map('strval', $with), 'strlen'));
 
+        if ($this->resource instanceof Model && class_exists(RequestRelations::class)) {
+            return RequestRelations::eagerLoads($this->resource, $with);
+        }
+
         return array_values(array_filter($with, fn (string $relation): bool => $this->definesRelation($relation)));
     }
 
@@ -77,7 +90,7 @@ private function definesRelation(string $relation): bool
      * loaded on the public endpoints, so the key was absent unless `with` named
      * it. Absent stays absent; it never becomes a string.
      *
-     * @param array<int, string> $with camelCased relations the caller asked for
+     * @param array<int, string> $with the relation paths requestedRelations() kept, named as the model's methods
      */
     protected function publicRelationObject(string $relation, array $with, \Closure $resource): mixed
     {
diff --git a/server/tests/VehicleResourceContractsTest.php b/server/tests/VehicleResourceContractsTest.php
index 5757f1805..3cb178b17 100644
--- a/server/tests/VehicleResourceContractsTest.php
+++ b/server/tests/VehicleResourceContractsTest.php
@@ -350,3 +350,49 @@ public function driver(): void
         ->and(fleetopsVehicleResourceRequestedRelations((object) ['uuid' => 'vehicle-uuid'], ['with' => ['driver']]))->toBe([])
         ->and(fleetopsVehicleResourceRequestedRelations(fleetopsVehicleResourceFixture(), ['with' => ['driver']]))->toBe([]);
 });
+
+class FleetOpsVehicleResourceRelationModel extends Illuminate\Database\Eloquent\Model
+{
+    public static int $saved = 0;
+
+    protected $table = 'vehicles';
+
+    public function driver(): Illuminate\Database\Eloquent\Relations\BelongsTo
+    {
+        return $this->belongsTo(FleetOpsVehicleResourceRelationModel::class, 'driver_id');
+    }
+
+    public function parentVehicle(): Illuminate\Database\Eloquent\Relations\BelongsTo
+    {
+        return $this->belongsTo(FleetOpsVehicleResourceRelationModel::class, 'parent_id');
+    }
+
+    public function untypedDriver()
+    {
+        return $this->belongsTo(FleetOpsVehicleResourceRelationModel::class, 'driver_id');
+    }
+
+    public function saveInstance(): self
+    {
+        static::$saved++;
+
+        return $this;
+    }
+}
+
+test('requested relations drop names that are methods but not declared relations', function () {
+    $resolver = new Illuminate\Database\ConnectionResolver(['default' => new Illuminate\Database\SQLiteConnection(new PDO('sqlite::memory:'))]);
+    $resolver->setDefaultConnection('default');
+    Illuminate\Database\Eloquent\Model::setConnectionResolver($resolver);
+    FleetOpsVehicleResourceRelationModel::$saved = 0;
+
+    $vehicle = new FleetOpsVehicleResourceRelationModel();
+
+    // `with=saveInstance` used to reach loadMissing(), which calls the method on a
+    // blank model. Only methods that declare a Relation return type survive, named
+    // as the model declares them, and nested segments are checked the same way.
+    expect(fleetopsVehicleResourceRequestedRelations($vehicle, ['with' => ['driver', 'saveInstance', 'untypedDriver', 'delete', 'driver.saveInstance', 'parent_vehicle', 'payload']]))
+        ->toBe(['driver', 'parentVehicle'])
+        ->and(fleetopsVehicleResourceRequestedRelations($vehicle, ['with' => 'saveInstance']))->toBe([])
+        ->and(FleetOpsVehicleResourceRelationModel::$saved)->toBe(0);
+})->skip(fn () => !class_exists(Fleetbase\Support\RequestRelations::class), 'needs fleetbase/core-api with Fleetbase\Support\RequestRelations');

From 2e62e30d3edda2477749528129fa4a7794813480 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 14:47:02 +0800
Subject: [PATCH 71/87] fix(driver): show the licence expiry as a date

The date picker reports a Date, which the form bound straight back into its
input, so a picked expiry showed as a full JS datetime string. Give the input
the yyyy-MM-dd text the picker reads, and show the expiry without a time on
the driver details.
---
 addon/components/driver/details.hbs | 2 +-
 addon/components/driver/form.hbs    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/addon/components/driver/details.hbs b/addon/components/driver/details.hbs
index 3c7e25d4f..adbc3695e 100644
--- a/addon/components/driver/details.hbs
+++ b/addon/components/driver/details.hbs
@@ -27,7 +27,7 @@
             </div>
             <div class="field-info-container md:col-span-3">
                 <div class="field-name">{{t "driver.fields.license-expiry"}}</div>
-                <div class="field-value">{{n-a (format-date-fns @resource.license_expiry)}}</div>
+                <div class="field-value">{{n-a (format-date-fns @resource.license_expiry "yyyy-MM-dd")}}</div>
             </div>
             <div class="field-info-container">
                 <div class="field-name">{{t "resource.vehicle"}}</div>
diff --git a/addon/components/driver/form.hbs b/addon/components/driver/form.hbs
index 1103fdcef..94ac7af21 100644
--- a/addon/components/driver/form.hbs
+++ b/addon/components/driver/form.hbs
@@ -66,7 +66,7 @@
 
             <InputGroup @name={{t "driver.fields.license-expiry"}}>
                 <DatePicker
-                    @value={{@resource.license_expiry}}
+                    @value={{format-date-fns @resource.license_expiry "yyyy-MM-dd"}}
                     @onChange={{fn (mut @resource.license_expiry)}}
                     @placeholder={{t "driver.fields.license-expiry"}}
                     @disabled={{cannot-write @resource}}

From 8922dd135e7ebe6adfb5d546b3c29620e35d57e8 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 14:48:09 +0800
Subject: [PATCH 72/87] fix(forms): give every date picker its value as
 yyyy-MM-dd

Device installation/maintenance dates and warranty start/end dates bound
the record's Date straight into the picker's input, so a picked date showed
as a full JS datetime string. The work order, maintenance, vehicle, trailer
and equipment forms showed dd-MM-yyyy while the picker reads and writes
yyyy-MM-dd, so it could not read its own value: the calendar opened with
nothing selected, typed dates were rejected and a value that changed while
the field was unfocused was blanked.
---
 addon/components/device/form.hbs      | 4 ++--
 addon/components/equipment/form.hbs   | 2 +-
 addon/components/maintenance/form.hbs | 6 +++---
 addon/components/trailer/form.hbs     | 4 ++--
 addon/components/vehicle/form.hbs     | 6 +++---
 addon/components/warranty/form.hbs    | 4 ++--
 addon/components/work-order/form.hbs  | 6 +++---
 7 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/addon/components/device/form.hbs b/addon/components/device/form.hbs
index dacb79402..5a47035b6 100644
--- a/addon/components/device/form.hbs
+++ b/addon/components/device/form.hbs
@@ -137,7 +137,7 @@
 
             <InputGroup @name={{t "device.fields.installation-date"}}>
                 <DatePicker
-                    @value={{@resource.installation_date}}
+                    @value={{format-date-fns @resource.installation_date "yyyy-MM-dd"}}
                     @onChange={{fn (mut @resource.installation_date)}}
                     @placeholder={{t "device.fields.installation-date-placeholder"}}
                     @disabled={{cannot-write @resource}}
@@ -147,7 +147,7 @@
 
             <InputGroup @name={{t "device.fields.last-maintenance-date"}}>
                 <DatePicker
-                    @value={{@resource.last_maintenance_date}}
+                    @value={{format-date-fns @resource.last_maintenance_date "yyyy-MM-dd"}}
                     @onChange={{fn (mut @resource.last_maintenance_date)}}
                     @placeholder={{t "device.fields.last-maintenance-date-placeholder"}}
                     @disabled={{cannot-write @resource}}
diff --git a/addon/components/equipment/form.hbs b/addon/components/equipment/form.hbs
index 1ce04d6be..85f770c6d 100644
--- a/addon/components/equipment/form.hbs
+++ b/addon/components/equipment/form.hbs
@@ -159,7 +159,7 @@
             </InputGroup>
             <InputGroup @name="Purchase Date">
                 <DatePicker
-                    @value={{or (format-date-fns @resource.purchased_at "dd-MM-yyyy") null}}
+                    @value={{or (format-date-fns @resource.purchased_at "yyyy-MM-dd") null}}
                     @onChange={{fn (mut @resource.purchased_at)}}
                     @placeholder="DD-MM-YYYY"
                     class="filter-date-input w-full flex-1"
diff --git a/addon/components/maintenance/form.hbs b/addon/components/maintenance/form.hbs
index 221731c88..944d88a49 100644
--- a/addon/components/maintenance/form.hbs
+++ b/addon/components/maintenance/form.hbs
@@ -185,7 +185,7 @@
             </div>
             <InputGroup @name="Scheduled At">
                 <DatePicker
-                    @value={{or (format-date-fns @resource.scheduled_at "dd-MM-yyyy") null}}
+                    @value={{or (format-date-fns @resource.scheduled_at "yyyy-MM-dd") null}}
                     @onChange={{fn (mut @resource.scheduled_at)}}
                     @placeholder="DD-MM-YYYY"
                     class="filter-date-input w-full flex-1"
@@ -193,7 +193,7 @@
             </InputGroup>
             <InputGroup @name="Started At">
                 <DatePicker
-                    @value={{or (format-date-fns @resource.started_at "dd-MM-yyyy") null}}
+                    @value={{or (format-date-fns @resource.started_at "yyyy-MM-dd") null}}
                     @onChange={{fn (mut @resource.started_at)}}
                     @placeholder="DD-MM-YYYY"
                     class="filter-date-input w-full flex-1"
@@ -201,7 +201,7 @@
             </InputGroup>
             <InputGroup @name="Completed At">
                 <DatePicker
-                    @value={{or (format-date-fns @resource.completed_at "dd-MM-yyyy") null}}
+                    @value={{or (format-date-fns @resource.completed_at "yyyy-MM-dd") null}}
                     @onChange={{fn (mut @resource.completed_at)}}
                     @placeholder="DD-MM-YYYY"
                     class="filter-date-input w-full flex-1"
diff --git a/addon/components/trailer/form.hbs b/addon/components/trailer/form.hbs
index 973986e5a..436103a52 100644
--- a/addon/components/trailer/form.hbs
+++ b/addon/components/trailer/form.hbs
@@ -389,7 +389,7 @@
 
             <InputGroup @name={{t "trailer.fields.purchased-at"}}>
                 <DatePicker
-                    @value={{or (format-date-fns @resource.purchased_at "dd-MM-yyyy") null}}
+                    @value={{or (format-date-fns @resource.purchased_at "yyyy-MM-dd") null}}
                     @onChange={{fn (mut @resource.purchased_at)}}
                     @placeholder={{t "trailer.placeholders.date"}}
                     @disabled={{cannot-write @resource}}
@@ -400,7 +400,7 @@
             {{#if this.showLeaseExpiry}}
                 <InputGroup @name={{t "trailer.fields.lease-expires-at"}} @helpText={{t "trailer.help.lease-expires-at"}}>
                     <DatePicker
-                        @value={{or (format-date-fns @resource.lease_expires_at "dd-MM-yyyy") null}}
+                        @value={{or (format-date-fns @resource.lease_expires_at "yyyy-MM-dd") null}}
                         @onChange={{fn (mut @resource.lease_expires_at)}}
                         @placeholder={{t "trailer.placeholders.date"}}
                         @disabled={{cannot-write @resource}}
diff --git a/addon/components/vehicle/form.hbs b/addon/components/vehicle/form.hbs
index 01d2b51d1..de3d89211 100644
--- a/addon/components/vehicle/form.hbs
+++ b/addon/components/vehicle/form.hbs
@@ -527,7 +527,7 @@
 
             <InputGroup @name="Purchase Date">
                 <DatePicker
-                    @value={{or (format-date-fns @resource.purchased_at "dd-MM-yyyy") null}}
+                    @value={{or (format-date-fns @resource.purchased_at "yyyy-MM-dd") null}}
                     @onChange={{fn (mut @resource.purchased_at)}}
                     @placeholder="DD-MM-YYYY"
                     class="filter-date-input w-full flex-1"
@@ -536,7 +536,7 @@
 
             <InputGroup @name="Lease Expiry Date">
                 <DatePicker
-                    @value={{or (format-date-fns @resource.lease_expires_at "dd-MM-yyyy") null}}
+                    @value={{or (format-date-fns @resource.lease_expires_at "yyyy-MM-dd") null}}
                     @onChange={{fn (mut @resource.lease_expires_at)}}
                     @placeholder="DD-MM-YYYY"
                     class="filter-date-input w-full flex-1"
@@ -555,7 +555,7 @@
 
             <InputGroup @name="First Payment Date">
                 <DatePicker
-                    @value={{or (format-date-fns @resource.loan_first_payment "dd-MM-yyyy") null}}
+                    @value={{or (format-date-fns @resource.loan_first_payment "yyyy-MM-dd") null}}
                     @onChange={{fn (mut @resource.loan_first_payment)}}
                     @placeholder="DD-MM-YYYY"
                     class="filter-date-input w-full flex-1"
diff --git a/addon/components/warranty/form.hbs b/addon/components/warranty/form.hbs
index 094a6d171..2b1ffb903 100644
--- a/addon/components/warranty/form.hbs
+++ b/addon/components/warranty/form.hbs
@@ -29,7 +29,7 @@
 
             <InputGroup @name="Start Date">
                 <DatePicker
-                    @value={{@resource.start_date}}
+                    @value={{format-date-fns @resource.start_date "yyyy-MM-dd"}}
                     @onChange={{fn (mut @resource.start_date)}}
                     @placeholder="Select Start Date"
                     @disabled={{cannot-write @resource}}
@@ -39,7 +39,7 @@
 
             <InputGroup @name="End Date">
                 <DatePicker
-                    @value={{@resource.end_date}}
+                    @value={{format-date-fns @resource.end_date "yyyy-MM-dd"}}
                     @onChange={{fn (mut @resource.end_date)}}
                     @placeholder="Select End Date"
                     @disabled={{cannot-write @resource}}
diff --git a/addon/components/work-order/form.hbs b/addon/components/work-order/form.hbs
index e5cfc85a7..fa4cc5085 100644
--- a/addon/components/work-order/form.hbs
+++ b/addon/components/work-order/form.hbs
@@ -175,7 +175,7 @@
             </div>
             <InputGroup @name="Opened At">
                 <DatePicker
-                    @value={{or (format-date-fns @resource.opened_at "dd-MM-yyyy") null}}
+                    @value={{or (format-date-fns @resource.opened_at "yyyy-MM-dd") null}}
                     @onChange={{fn (mut @resource.opened_at)}}
                     @placeholder="DD-MM-YYYY"
                     class="filter-date-input w-full flex-1"
@@ -183,7 +183,7 @@
             </InputGroup>
             <InputGroup @name="Due At">
                 <DatePicker
-                    @value={{or (format-date-fns @resource.due_at "dd-MM-yyyy") null}}
+                    @value={{or (format-date-fns @resource.due_at "yyyy-MM-dd") null}}
                     @onChange={{fn (mut @resource.due_at)}}
                     @placeholder="DD-MM-YYYY"
                     class="filter-date-input w-full flex-1"
@@ -191,7 +191,7 @@
             </InputGroup>
             <InputGroup @name="Closed At">
                 <DatePicker
-                    @value={{or (format-date-fns @resource.closed_at "dd-MM-yyyy") null}}
+                    @value={{or (format-date-fns @resource.closed_at "yyyy-MM-dd") null}}
                     @onChange={{fn (mut @resource.closed_at)}}
                     @placeholder="DD-MM-YYYY"
                     class="filter-date-input w-full flex-1"

From 1fe8aa7a6b4839b86bc1c4ea49421dca123c9fd0 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 16:57:11 +0800
Subject: [PATCH 73/87] fix(routes): throttle the public SMS-sending routes per
 address

Driver and customer login-with-sms, forgot-password and request-creation-code
get a 5-a-minute bucket per address on top of the API credential throttle. An
extra layer only: core's SmsGuard budgets bound the spend when an attacker has
many addresses.
---
 server/src/routes.php | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/server/src/routes.php b/server/src/routes.php
index 8060b5512..312b69ecf 100644
--- a/server/src/routes.php
+++ b/server/src/routes.php
@@ -54,14 +54,16 @@ function ($router) {
             // drivers routes
             $router->group(['prefix' => 'drivers', 'middleware' => []], function () use ($router) {
                 $router->post('register-device', 'DriverController@registerDevice');
-                $router->post('login-with-sms', 'DriverController@loginWithPhone');
+                // Routes that send a text message carry a small per-address bucket on top
+                // of the API credential throttle; the SMS guard in core bounds the spend.
+                $router->post('login-with-sms', 'DriverController@loginWithPhone')->middleware('throttle:5,1,fleetops-sms');
                 $router->post('verify-code', 'DriverController@verifyCode');
                 $router->post('login', 'DriverController@login');
                 // Password management. Deliberately separate from the driver
                 // update: changing a password requires proving the old one, and
                 // resetting it requires a code, neither of which a general PUT
                 // can express.
-                $router->post('forgot-password', 'DriverController@forgotPassword');
+                $router->post('forgot-password', 'DriverController@forgotPassword')->middleware('throttle:5,1,fleetops-sms');
                 $router->post('reset-password', 'DriverController@resetPassword');
                 $router->post('{id}/change-password', 'DriverController@changePassword');
                 $router->post('{id}/simulate', 'DriverController@simulate');
@@ -97,12 +99,12 @@ function ($router) {
             //  - Authenticated endpoints: API key + `Customer-Token` header (Sanctum)
             $router->group(['prefix' => 'customers', 'middleware' => []], function () use ($router) {
                 // Public auth flows
-                $router->post('request-creation-code', 'CustomerController@requestCreationCode');
+                $router->post('request-creation-code', 'CustomerController@requestCreationCode')->middleware('throttle:5,1,fleetops-sms');
                 $router->post('/', 'CustomerController@create');
                 $router->post('login', 'CustomerController@login');
-                $router->post('login-with-sms', 'CustomerController@loginWithPhone');
+                $router->post('login-with-sms', 'CustomerController@loginWithPhone')->middleware('throttle:5,1,fleetops-sms');
                 $router->post('verify-code', 'CustomerController@verifyCode');
-                $router->post('forgot-password', 'CustomerController@forgotPassword');
+                $router->post('forgot-password', 'CustomerController@forgotPassword')->middleware('throttle:5,1,fleetops-sms');
                 $router->post('reset-password', 'CustomerController@resetPassword');
 
                 // Authenticated (require Customer-Token)

From 7a8104a2f3562d3859039757276f21bee5ba360c Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 17:31:22 +0800
Subject: [PATCH 74/87] feat(orders): status-guarded order edits that announce
 order.changed

Order edits now go through one lock policy (OrderEditPolicy) built on the
order config: open statuses edit freely, ready orders only remove items and
move the schedule earlier, orders a driver has keep route, contact, notes and
cash to collect editable but lock items and schedule, and completed, canceled
or expired orders lock everything. Locked changes answer 422 with
{ error, locked: { field: reason } } from the public order update, the
console route edit, and the payload and entity endpoints. Unrelated fields
(status, meta, assignment, ...) are not guarded.

OrderEdit wraps an edit: it snapshots the order, refuses locked changes and
on commit works out what changed. A changed route no longer resets the
current waypoint to the pickup: an order under way keeps the driver's stop,
or moves them to the stop that replaced it or the next one left. Distance
and time are recomputed, public tracking is republished (reason "route"),
item changes while preparing set meta.kitchen_changed_at, and the new
OrderChanged event broadcasts `order.changed` with the changes, a summary,
the drop-off, cash to collect and total. OrderChanged::dispatchFor() lets
other extensions announce their own edits; the assigned driver gets the new
OrderChanged push when the change concerns them.

Payloads gain syncEntities() (update by id, create new, delete missing),
used when an edit sends `entities_mode=replace`; appending stays the default.
The order update reads cash to collect from payload.cod_amount or a
top-level cod_amount, and the payload update keeps a cod_amount of 0.
---
 server/src/Events/OrderChanged.php            | 257 ++++++++++++
 .../Exceptions/OrderEditLockedException.php   |  32 ++
 .../Controllers/Api/v1/EntityController.php   |  66 +++
 .../Controllers/Api/v1/OrderController.php    | 125 +++++-
 .../Controllers/Api/v1/PayloadController.php  |  84 +++-
 .../Internal/v1/OrderController.php           |  40 +-
 server/src/Models/Order.php                   |   9 +
 server/src/Models/Payload.php                 | 241 +++++++++--
 server/src/Notifications/OrderChanged.php     |  87 ++++
 .../src/Providers/FleetOpsServiceProvider.php |   1 +
 server/src/Support/OrderEdit.php              | 365 +++++++++++++++++
 server/src/Support/OrderEditPolicy.php        | 292 ++++++++++++++
 server/src/Support/TrackingPublisher.php      |  12 +
 server/src/Support/TrackingUpdate.php         |   2 +
 .../ApiEntityControllerContractsTest.php      |  84 ++++
 .../tests/ApiOrderControllerContractsTest.php | 140 +++++++
 .../ApiPayloadControllerContractsTest.php     | 121 ++++++
 .../Internal/OrderControllerContractsTest.php |  76 +++-
 .../OrderChangeNotificationsTest.php          |  47 +++
 .../Unit/Support/OrderEditPolicyTest.php      | 128 ++++++
 .../Unit/Support/OrderOperationsTest.php      | 379 ++++++++++++++++++
 21 files changed, 2526 insertions(+), 62 deletions(-)
 create mode 100644 server/src/Events/OrderChanged.php
 create mode 100644 server/src/Exceptions/OrderEditLockedException.php
 create mode 100644 server/src/Notifications/OrderChanged.php
 create mode 100644 server/src/Support/OrderEdit.php
 create mode 100644 server/src/Support/OrderEditPolicy.php
 create mode 100644 server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
 create mode 100644 server/tests/Unit/Support/OrderEditPolicyTest.php
 create mode 100644 server/tests/Unit/Support/OrderOperationsTest.php

diff --git a/server/src/Events/OrderChanged.php b/server/src/Events/OrderChanged.php
new file mode 100644
index 000000000..74a356195
--- /dev/null
+++ b/server/src/Events/OrderChanged.php
@@ -0,0 +1,257 @@
+<?php
+
+namespace Fleetbase\FleetOps\Events;
+
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Notifications\OrderChanged as OrderChangedNotification;
+use Fleetbase\LaravelMysqlSpatial\Types\Point;
+use Fleetbase\Models\User;
+use Illuminate\Broadcasting\Channel;
+use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcast;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Broadcast as `order.changed` when an order's route, items, contact, schedule,
+ * notes or amounts were edited after it was placed.
+ *
+ * Channels: order.{public_id}, order.{uuid}, driver.{public_id} and driver.{uuid}
+ * when a driver is assigned, customer.{public_id} when a customer exists and
+ * company.{company_uuid}.
+ *
+ * Data: { id, changes[], summary, dropoff, cod_amount, total, currency, changed_by, changed_at }.
+ *
+ * Every value is captured when the event is created, so the broadcast does not
+ * depend on the order still looking the same when the queue sends it.
+ */
+class OrderChanged implements ShouldBroadcast
+{
+    use Dispatchable;
+    use InteractsWithSockets;
+
+    /**
+     * Changes that concern the assigned driver: these send them a push.
+     */
+    public const DRIVER_CHANGES = ['pickup', 'dropoff', 'return', 'waypoints', 'items', 'cod_amount', 'schedule', 'notes'];
+
+    public string $eventId;
+
+    public string $sentAt;
+
+    public array $channelNames = [];
+
+    public array $data = [];
+
+    /**
+     * @param array  $changes the changed parts: dropoff, items, contact, schedule, notes, total, cod_amount, ...
+     * @param string $summary one human line describing the change
+     * @param array  $extra   overrides for the data: total, currency, cod_amount, changed_by, changed_at, dropoff
+     */
+    public function __construct(Order $order, array $changes, string $summary = '', array $extra = [])
+    {
+        $this->eventId      = uniqid('event_');
+        $this->sentAt       = Carbon::now()->toDateTimeString();
+        $this->channelNames = static::channelNamesFor($order);
+        $this->data         = static::dataFor($order, $changes, $summary, $extra);
+    }
+
+    /**
+     * Broadcast `order.changed` for the order and, unless told otherwise, push the
+     * change to the assigned driver when it concerns them.
+     *
+     * Storefront and other extensions call this after their own order edits.
+     */
+    public static function dispatchFor(Order $order, array $changes, string $summary = '', array $extra = [], bool $notifyDriver = true): ?self
+    {
+        $changes = array_values(array_unique(array_filter($changes, 'is_string')));
+        if ($changes === []) {
+            return null;
+        }
+
+        $event = new static($order, $changes, $summary, $extra);
+
+        try {
+            event($event);
+        } catch (\Throwable $exception) {
+            Log::warning('Unable to broadcast order.changed', ['order' => $order->public_id, 'error' => $exception->getMessage()]);
+        }
+
+        if ($notifyDriver && static::concernsDriver($changes)) {
+            static::notifyDriver($order, $event);
+        }
+
+        return $event;
+    }
+
+    /**
+     * Whether any of the changes concerns the driver doing the order.
+     */
+    public static function concernsDriver(array $changes): bool
+    {
+        return (bool) array_intersect($changes, self::DRIVER_CHANGES);
+    }
+
+    /**
+     * Push the change to the order's assigned driver.
+     */
+    public static function notifyDriver(Order $order, self $event): bool
+    {
+        if (!$order->driver_assigned_uuid) {
+            return false;
+        }
+
+        try {
+            $driver = static::assignedDriver($order);
+            if (!$driver) {
+                return false;
+            }
+
+            $driver->notify(new OrderChangedNotification($order, $event->data['changes'], (string) $event->data['summary']));
+
+            return true;
+        } catch (\Throwable $exception) {
+            Log::warning('Unable to notify driver of order change', ['order' => $order->public_id, 'error' => $exception->getMessage()]);
+
+            return false;
+        }
+    }
+
+    /**
+     * The order's assigned driver, read past the driver scope as the order listeners do.
+     */
+    public static function assignedDriver(Order $order): ?Driver
+    {
+        if (!$order->driver_assigned_uuid) {
+            return null;
+        }
+
+        $driver = $order->relationLoaded('driverAssigned') ? $order->getRelation('driverAssigned') : null;
+        if ($driver instanceof Driver && $driver->uuid === $order->driver_assigned_uuid) {
+            return $driver;
+        }
+
+        $driver = Driver::where('uuid', $order->driver_assigned_uuid)->withoutGlobalScopes()->first();
+        if ($driver) {
+            $order->setRelation('driverAssigned', $driver);
+        }
+
+        return $driver;
+    }
+
+    public static function channelNamesFor(Order $order): array
+    {
+        $channels = [
+            'order.' . $order->public_id,
+            'order.' . $order->uuid,
+        ];
+
+        if ($order->driver_assigned_uuid) {
+            $driverPublicId = static::attempt(fn () => static::assignedDriver($order)?->public_id);
+            if ($driverPublicId) {
+                $channels[] = 'driver.' . $driverPublicId;
+            }
+            $channels[] = 'driver.' . $order->driver_assigned_uuid;
+        }
+
+        if ($order->customer_uuid) {
+            $customerPublicId = data_get($order, 'customer.public_id');
+            if ($customerPublicId) {
+                $channels[] = 'customer.' . $customerPublicId;
+            }
+        }
+
+        if ($order->company_uuid) {
+            $channels[] = 'company.' . $order->company_uuid;
+        }
+
+        return array_values(array_unique($channels));
+    }
+
+    public static function dataFor(Order $order, array $changes, string $summary = '', array $extra = []): array
+    {
+        $payload = $order->relationLoaded('payload') ? $order->payload : static::attempt(fn () => $order->payload);
+
+        return [
+            'id'         => $order->public_id,
+            'changes'    => array_values($changes),
+            'summary'    => $summary,
+            'dropoff'    => array_key_exists('dropoff', $extra) ? $extra['dropoff'] : static::placeData($payload?->dropoff ?? null),
+            'cod_amount' => array_key_exists('cod_amount', $extra) ? $extra['cod_amount'] : static::numberOrNull($payload?->cod_amount ?? null),
+            'total'      => array_key_exists('total', $extra) ? $extra['total'] : static::numberOrNull(static::attempt(fn () => $order->transaction_amount)),
+            'currency'   => array_key_exists('currency', $extra) ? $extra['currency'] : (static::attempt(fn () => $order->transaction_currency) ?? $payload?->cod_currency ?? null),
+            'changed_by' => array_key_exists('changed_by', $extra) ? $extra['changed_by'] : static::currentUserName(),
+            'changed_at' => $extra['changed_at'] ?? Carbon::now()->toIso8601ZuluString(),
+        ];
+    }
+
+    /**
+     * The drop-off as `{ id, address, location: { type: Point, coordinates: [lng, lat] } }`.
+     */
+    public static function placeData(?Place $place): ?array
+    {
+        if (!$place instanceof Place) {
+            return null;
+        }
+
+        $location = $place->location;
+
+        return [
+            'id'       => $place->public_id,
+            'address'  => static::attempt(fn () => $place->address),
+            'location' => $location instanceof Point ? ['type' => 'Point', 'coordinates' => [$location->getLng(), $location->getLat()]] : null,
+        ];
+    }
+
+    public function broadcastOn(): array
+    {
+        return array_map(fn (string $name) => new Channel($name), $this->channelNames);
+    }
+
+    public function broadcastAs(): string
+    {
+        return 'order.changed';
+    }
+
+    public function broadcastWith(): array
+    {
+        return [
+            'id'          => $this->eventId,
+            'api_version' => config('api.version'),
+            'event'       => $this->broadcastAs(),
+            'created_at'  => $this->sentAt,
+            'data'        => $this->data,
+        ];
+    }
+
+    protected static function currentUserName(): ?string
+    {
+        $userUuid = session('user');
+        if (!$userUuid) {
+            return null;
+        }
+
+        return static::attempt(fn () => User::where('uuid', $userUuid)->value('name'));
+    }
+
+    protected static function numberOrNull(mixed $value): int|float|null
+    {
+        if ($value === null || $value === '' || !is_numeric($value)) {
+            return null;
+        }
+
+        return $value + 0;
+    }
+
+    protected static function attempt(callable $callback): mixed
+    {
+        try {
+            return $callback();
+        } catch (\Throwable) {
+            return null;
+        }
+    }
+}
diff --git a/server/src/Exceptions/OrderEditLockedException.php b/server/src/Exceptions/OrderEditLockedException.php
new file mode 100644
index 000000000..1c5c3bbc9
--- /dev/null
+++ b/server/src/Exceptions/OrderEditLockedException.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace Fleetbase\FleetOps\Exceptions;
+
+/**
+ * Thrown when an order edit touches a field its current status locks.
+ *
+ * Carries the refused fields with the reason for each, so a controller can
+ * answer 422 with `{ error, locked: { field: reason } }`.
+ */
+class OrderEditLockedException extends \Exception
+{
+    /**
+     * @param array<string, string> $locked the refused fields and why each is locked
+     */
+    public function __construct(public array $locked = [], string $message = '', int $code = 422, ?\Throwable $previous = null)
+    {
+        if ($message === '') {
+            $message = $locked ? implode(' ', array_values(array_unique($locked))) : 'This order can no longer be edited.';
+        }
+
+        parent::__construct($message, $code, $previous);
+    }
+
+    /**
+     * The 422 response body: the message plus the refused fields.
+     */
+    public function toResponseData(): array
+    {
+        return ['locked' => $this->locked];
+    }
+}
diff --git a/server/src/Http/Controllers/Api/v1/EntityController.php b/server/src/Http/Controllers/Api/v1/EntityController.php
index bc8203920..70cddb35c 100644
--- a/server/src/Http/Controllers/Api/v1/EntityController.php
+++ b/server/src/Http/Controllers/Api/v1/EntityController.php
@@ -2,13 +2,17 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 
+use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
 use Fleetbase\FleetOps\Http\Requests\CreateEntityRequest;
 use Fleetbase\FleetOps\Http\Requests\UpdateEntityRequest;
 use Fleetbase\FleetOps\Http\Resources\v1\DeletedResource;
 use Fleetbase\FleetOps\Http\Resources\v1\Entity as EntityResource;
 use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Payload;
 use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Support\OrderEdit;
+use Fleetbase\FleetOps\Support\OrderEditPolicy;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Controllers\Controller;
 use Illuminate\Http\Request;
@@ -79,8 +83,15 @@ public function create(CreateEntityRequest $request)
         // make sure company is set
         $input['company_uuid'] = session('company');
 
+        // adding an item to an order is refused once the order's status locks its items
+        $edit = $this->orderEditForPayload($input['payload_uuid'] ?? null);
+        if ($locked = $this->guardItemsEdit($edit, true)) {
+            return $locked;
+        }
+
         // create the entity
         $entity = $this->createEntity($input);
+        $this->commitItemsEdit($edit);
 
         // response the driver resource
         return $this->entityResource($entity);
@@ -159,8 +170,15 @@ public function update($id, UpdateEntityRequest $request)
             }
         }
 
+        // changing an order's item is refused once the order's status locks its items
+        $edit = $this->orderEditForPayload($entity->payload_uuid);
+        if ($locked = $this->guardItemsEdit($edit, true)) {
+            return $locked;
+        }
+
         // update the entity
         $entity->update($input);
+        $this->commitItemsEdit($edit);
 
         // response the entity resource
         return $this->entityResource($entity);
@@ -220,13 +238,61 @@ public function delete($id, Request $request)
             );
         }
 
+        // removing an order's item is refused once the order's status locks its items
+        $edit = $this->orderEditForPayload($entity->payload_uuid);
+        if ($locked = $this->guardItemsEdit($edit, false)) {
+            return $locked;
+        }
+
         // delete the entity
         $entity->delete();
+        $this->commitItemsEdit($edit);
 
         // response the entity resource
         return $this->deletedEntityResource($entity);
     }
 
+    /**
+     * Begin an edit of the order the payload belongs to, if it belongs to one.
+     */
+    protected function orderEditForPayload(?string $payloadUuid): ?OrderEdit
+    {
+        if (!$payloadUuid) {
+            return null;
+        }
+
+        try {
+            $order = Order::where('payload_uuid', $payloadUuid)->first();
+        } catch (\Throwable) {
+            return null;
+        }
+
+        return $order ? OrderEdit::begin($order) : null;
+    }
+
+    /**
+     * A 422 response when the order's status locks the item change, otherwise null.
+     */
+    protected function guardItemsEdit(?OrderEdit $edit, bool $adds)
+    {
+        if (!$edit) {
+            return null;
+        }
+
+        try {
+            $edit->guard([OrderEditPolicy::FIELD_ITEMS => ['adds' => $adds]]);
+        } catch (OrderEditLockedException $exception) {
+            return response()->apiError($exception->getMessage(), 422, $exception->toResponseData());
+        }
+
+        return null;
+    }
+
+    protected function commitItemsEdit(?OrderEdit $edit): void
+    {
+        $edit?->commit();
+    }
+
     protected function entityInputFromRequest(Request $request): array
     {
         return $request->only([
diff --git a/server/src/Http/Controllers/Api/v1/OrderController.php b/server/src/Http/Controllers/Api/v1/OrderController.php
index 8337cd0b3..4f4d059da 100644
--- a/server/src/Http/Controllers/Api/v1/OrderController.php
+++ b/server/src/Http/Controllers/Api/v1/OrderController.php
@@ -5,6 +5,7 @@
 use Fleetbase\FleetOps\Events\OrderDispatchFailed;
 use Fleetbase\FleetOps\Events\OrderStarted;
 use Fleetbase\FleetOps\Exceptions\CustomerUserConflictException;
+use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
 use Fleetbase\FleetOps\Exceptions\UserAlreadyExistsException;
 use Fleetbase\FleetOps\Flow\Activity;
 use Fleetbase\FleetOps\Http\Requests\CreateOrderRequest;
@@ -24,6 +25,7 @@
 use Fleetbase\FleetOps\Models\Proof;
 use Fleetbase\FleetOps\Models\ServiceQuote;
 use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\OrderEdit;
 use Fleetbase\FleetOps\Support\ResolvesOrderServiceStops;
 use Fleetbase\FleetOps\Support\TrackingCode;
 use Fleetbase\FleetOps\Support\Utils;
@@ -353,6 +355,19 @@ public function update($id, UpdateOrderRequest $request)
         // get request input
         $input = $this->orderUpdateInputFromRequest($request);
 
+        // `entities_mode=replace` makes the entities sent the payload's full list
+        // (update by id, create new, delete missing); by default they are appended
+        $entitiesMode = OrderEdit::entitiesMode($request->input('entities_mode', $request->input('payload.entities_mode')));
+        $codAmount    = $this->codAmountFromRequest($request);
+
+        // refuse changes the order's status locks before anything is written
+        $edit = $this->beginOrderEdit($order);
+        try {
+            $edit->guard($edit->requestedChanges($this->orderEditInputFromRequest($request, $codAmount), $entitiesMode));
+        } catch (OrderEditLockedException $exception) {
+            return $this->lockedEditResponse($exception);
+        }
+
         // update payload if new input or change payload by id
         if ($request->isArray('payload')) {
             $payload = data_get($order, 'payload', $this->newPayload());
@@ -384,6 +399,10 @@ public function update($id, UpdateOrderRequest $request)
                 $payload->setReturn($return);
             }
 
+            if ($codAmount !== null) {
+                $payload->cod_amount = $codAmount;
+            }
+
             $payload->save();
 
             // set waypoints and entities after payload is saved
@@ -393,14 +412,10 @@ public function update($id, UpdateOrderRequest $request)
                 $payload->removeWaypoints();
             }
 
-            if ($entities) {
-                $payload->setEntities($entities);
-            }
+            $this->applyPayloadEntities($payload, $entities, $entitiesMode);
 
-            $firstWaypoint = $payload->getPickupOrFirstWaypoint();
-            if ($firstWaypoint instanceof Place) {
-                $payload->setCurrentWaypoint($firstWaypoint);
-            }
+            // the current waypoint is reconciled once the edit is committed: it is only
+            // moved when the route changed, and an order under way keeps its stop
 
             $input['payload_uuid'] = $payload->uuid;
         } elseif ($request->has('payload')) {
@@ -409,6 +424,11 @@ public function update($id, UpdateOrderRequest $request)
                 'company_uuid' => $this->sessionCompany(),
             ]);
             unset($input['payload']);
+
+            if ($codAmount !== null && is_string($input['payload_uuid']) && ($switchedPayload = $this->findPayloadByUuid($input['payload_uuid']))) {
+                $switchedPayload->cod_amount = $codAmount;
+                $switchedPayload->save();
+            }
         }
 
         // create a payload if missing payload[] but has pickup/dropoff/etc
@@ -442,6 +462,10 @@ public function update($id, UpdateOrderRequest $request)
                 $payload->setReturn($return);
             }
 
+            if ($codAmount !== null) {
+                $payload->cod_amount = $codAmount;
+            }
+
             $payload->save();
 
             // set waypoints and entities after payload is saved
@@ -451,14 +475,10 @@ public function update($id, UpdateOrderRequest $request)
                 $payload->removeWaypoints();
             }
 
-            if ($entities) {
-                $payload->setEntities($entities);
-            }
+            $this->applyPayloadEntities($payload, $entities, $entitiesMode);
 
-            $firstWaypoint = $payload->getPickupOrFirstWaypoint();
-            if ($firstWaypoint instanceof Place) {
-                $payload->setCurrentWaypoint($firstWaypoint);
-            }
+            // the current waypoint is reconciled once the edit is committed: it is only
+            // moved when the route changed, and an order under way keeps its stop
 
             $input['payload_uuid'] = $payload->uuid;
         }
@@ -538,6 +558,10 @@ public function update($id, UpdateOrderRequest $request)
         $order->update($input);
         $order->flushAttributesCache();
 
+        // reroute, recompute distance and time, republish tracking and announce
+        // `order.changed` for whatever this update changed
+        $this->commitOrderEdit($edit);
+
         // load required relations
         $order->load(['trackingNumber', 'trackingStatuses', 'driverAssigned', 'vehicleAssigned', 'purchaseRate.serviceQuote.items', 'customer', 'facilitator']);
 
@@ -545,6 +569,79 @@ public function update($id, UpdateOrderRequest $request)
         return $this->orderResource($order);
     }
 
+    /**
+     * The cash to collect sent with an order update, as `payload.cod_amount` or a
+     * top-level `cod_amount`. Zero is a valid amount; anything not numeric is ignored.
+     */
+    protected function codAmountFromRequest(Request $request): int|float|string|null
+    {
+        $value = null;
+        if ($request->isArray('payload') && Arr::has((array) $request->input('payload'), 'cod_amount')) {
+            $value = data_get($request->input('payload'), 'cod_amount');
+        } elseif ($request->has('cod_amount')) {
+            $value = $request->input('cod_amount');
+        }
+
+        return is_numeric($value) ? $value : null;
+    }
+
+    /**
+     * The parts of an order update the edit policy looks at.
+     */
+    protected function orderEditInputFromRequest(Request $request, mixed $codAmount = null): array
+    {
+        $routeKeys = ['pickup', 'dropoff', 'return', 'waypoints', 'entities'];
+
+        if ($request->isArray('payload')) {
+            $edit = Arr::only((array) $request->input('payload'), $routeKeys);
+        } elseif ($request->has('payload')) {
+            // switching to another payload replaces the whole route
+            $edit = ['pickup' => true, 'dropoff' => true, 'waypoints' => true];
+        } else {
+            $edit = $request->only($routeKeys);
+        }
+
+        foreach (['scheduled_at', 'notes', 'customer'] as $key) {
+            if ($request->has($key)) {
+                $edit[$key] = $request->input($key);
+            }
+        }
+
+        if ($codAmount !== null) {
+            $edit['cod_amount'] = $codAmount;
+        }
+
+        return $edit;
+    }
+
+    protected function applyPayloadEntities(Payload $payload, mixed $entities, string $mode): void
+    {
+        if ($mode === OrderEdit::ENTITIES_REPLACE && is_array($entities)) {
+            $payload->syncEntities($entities);
+
+            return;
+        }
+
+        if ($entities) {
+            $payload->setEntities($entities);
+        }
+    }
+
+    protected function beginOrderEdit(Order $order): OrderEdit
+    {
+        return OrderEdit::begin($order);
+    }
+
+    protected function commitOrderEdit(OrderEdit $edit): array
+    {
+        return $edit->commit();
+    }
+
+    protected function lockedEditResponse(OrderEditLockedException $exception)
+    {
+        return response()->apiError($exception->getMessage(), 422, $exception->toResponseData());
+    }
+
     protected function orderCreateInputFromRequest(Request $request): array
     {
         return $request->only([
diff --git a/server/src/Http/Controllers/Api/v1/PayloadController.php b/server/src/Http/Controllers/Api/v1/PayloadController.php
index 59ae1ad03..3e0c08016 100644
--- a/server/src/Http/Controllers/Api/v1/PayloadController.php
+++ b/server/src/Http/Controllers/Api/v1/PayloadController.php
@@ -2,12 +2,15 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 
+use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
 use Fleetbase\FleetOps\Http\Requests\CreatePayloadRequest;
 use Fleetbase\FleetOps\Http\Requests\UpdatePayloadRequest;
 use Fleetbase\FleetOps\Http\Resources\v1\DeletedResource;
 use Fleetbase\FleetOps\Http\Resources\v1\Payload as PayloadResource;
+use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Payload;
 use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Support\OrderEdit;
 use Fleetbase\Http\Controllers\Controller;
 use Illuminate\Http\Request;
 use Illuminate\Support\Arr;
@@ -103,6 +106,18 @@ public function update($id, UpdatePayloadRequest $request)
         $return                 = $routeShape['return'];
         $hasWaypointsField      = $routeShape['has_waypoints_field'];
         $hasRouteEndpointFields = $routeShape['has_route_endpoint_fields'];
+        $entitiesMode           = OrderEdit::entitiesMode($input['entities_mode'] ?? null);
+
+        // when the payload belongs to an order, refuse changes the order's status locks
+        $order = $this->orderForPayload($payload);
+        $edit  = $order ? $this->beginOrderEdit($order) : null;
+        if ($edit) {
+            try {
+                $edit->guard($edit->requestedChanges(Arr::only($input, ['pickup', 'dropoff', 'return', 'waypoints', 'entities', 'cod_amount']), $entitiesMode));
+            } catch (OrderEditLockedException $exception) {
+                return $this->lockedEditResponse($exception);
+            }
+        }
 
         // pickup assignment
         if ($pickup) {
@@ -126,21 +141,29 @@ public function update($id, UpdatePayloadRequest $request)
             $payload->removeWaypoints();
         }
 
-        // set entities
-        if ($entities) {
+        // set entities: appended, or with `entities_mode=replace` the full list
+        if ($entitiesMode === OrderEdit::ENTITIES_REPLACE && is_array($entities)) {
+            $payload->syncEntities($entities);
+        } elseif ($entities) {
             $payload->setEntities($entities);
         }
 
-        // update the payload
-        $payload->fill(array_filter($this->payloadFillInputFromInput($input)));
+        // update the payload; empty values are skipped, but a cash-to-collect of 0 is kept
+        $payload->fill($this->payloadUpdateFillInput($input));
 
         // save the payload
         $payload->save();
 
-        // set the first / current waypoint from the effective route shape
-        $firstWaypoint = $payload->getPickupOrFirstWaypoint();
-        if ($firstWaypoint instanceof Place) {
-            $payload->setCurrentWaypoint($firstWaypoint);
+        if ($edit) {
+            // the order's edit moves the current waypoint only when the route changed, keeps
+            // an order under way on its stop and announces the change
+            $this->commitOrderEdit($edit);
+        } else {
+            // set the first / current waypoint from the effective route shape
+            $firstWaypoint = $payload->getPickupOrFirstWaypoint();
+            if ($firstWaypoint instanceof Place) {
+                $payload->setCurrentWaypoint($firstWaypoint);
+            }
         }
 
         // make sure entities and waypoints is loaded
@@ -237,6 +260,51 @@ protected function payloadFillInputFromInput(array $input): array
         return Arr::only($input, ['type', 'provider', 'meta', 'cod_amount', 'cod_currency', 'cod_payment_method']);
     }
 
+    /**
+     * The payload attributes an update fills: empty values are skipped as before,
+     * except a numeric cash-to-collect, so 0 clears it.
+     */
+    protected function payloadUpdateFillInput(array $input): array
+    {
+        $fill = $this->payloadFillInputFromInput($input);
+        $cod  = $fill['cod_amount'] ?? null;
+        $fill = array_filter($fill);
+
+        if (is_numeric($cod)) {
+            $fill['cod_amount'] = $cod;
+        }
+
+        return $fill;
+    }
+
+    protected function orderForPayload(Payload $payload): ?Order
+    {
+        if (!$payload->uuid) {
+            return null;
+        }
+
+        try {
+            return Order::where('payload_uuid', $payload->uuid)->first();
+        } catch (\Throwable) {
+            return null;
+        }
+    }
+
+    protected function beginOrderEdit(Order $order): OrderEdit
+    {
+        return OrderEdit::begin($order);
+    }
+
+    protected function commitOrderEdit(OrderEdit $edit): array
+    {
+        return $edit->commit();
+    }
+
+    protected function lockedEditResponse(OrderEditLockedException $exception)
+    {
+        return response()->apiError($exception->getMessage(), 422, $exception->toResponseData());
+    }
+
     protected function newPayload(array $input): Payload
     {
         return new Payload($input);
diff --git a/server/src/Http/Controllers/Internal/v1/OrderController.php b/server/src/Http/Controllers/Internal/v1/OrderController.php
index 169c815cf..69a78a52f 100644
--- a/server/src/Http/Controllers/Internal/v1/OrderController.php
+++ b/server/src/Http/Controllers/Internal/v1/OrderController.php
@@ -10,6 +10,7 @@
 use Fleetbase\FleetOps\Events\OrderStarted;
 use Fleetbase\FleetOps\Events\WaypointActivityChanged;
 use Fleetbase\FleetOps\Events\WaypointCompleted;
+use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
 use Fleetbase\FleetOps\Exports\OrderExport;
 use Fleetbase\FleetOps\Flow\Activity;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
@@ -34,6 +35,7 @@
 use Fleetbase\FleetOps\Models\TrackingStatus;
 use Fleetbase\FleetOps\Models\Waypoint;
 use Fleetbase\FleetOps\Notifications\OrderPing;
+use Fleetbase\FleetOps\Support\OrderEdit;
 use Fleetbase\FleetOps\Support\ResolvesOrderServiceStops;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Requests\ExportRequest;
@@ -320,6 +322,19 @@ public function editOrderRoute(string $id, Request $request)
             return $this->errorResponse('Unable to find order to update route for.');
         }
 
+        // Refuse a route edit the order's status locks (completed, canceled, expired)
+        $edit = $this->beginOrderEdit($order);
+        try {
+            $edit->guard($edit->requestedChanges(array_filter([
+                'pickup'    => $hasPickupInput ? true : null,
+                'dropoff'   => $hasDropoffInput ? true : null,
+                'return'    => $hasReturnInput ? true : null,
+                'waypoints' => ($hasWaypointsInput || $hasPickupInput || $hasDropoffInput || $hasReturnInput) ? true : null,
+            ])));
+        } catch (OrderEditLockedException $exception) {
+            return $this->errorResponse($exception->getMessage(), 422, $exception->toResponseData());
+        }
+
         if ($hasPickupInput) {
             if ($pickup) {
                 $order->payload->setPickup($pickup, ['save' => true]);
@@ -354,14 +369,9 @@ public function editOrderRoute(string $id, Request $request)
             $order->payload->removeWaypoints();
         }
 
-        $startingDestination = $order->payload->getPickupOrFirstWaypoint();
-        if (!$startingDestination) {
-            $startingDestination = $order->payload->getDropoffOrLastWaypoint();
-        }
-
-        if ($startingDestination instanceof Place || $startingDestination instanceof Waypoint) {
-            $order->payload->setCurrentWaypoint($startingDestination);
-        }
+        // Only a changed route moves the current waypoint, and an order under way keeps
+        // the driver's stop; distance, time, tracking and `order.changed` follow the change
+        $this->commitOrderEdit($edit);
 
         $order->load(['payload.pickup', 'payload.dropoff', 'payload.return', 'payload.waypoints']);
 
@@ -794,9 +804,19 @@ protected function jsonResponse(array $payload)
         return response()->json($payload);
     }
 
-    protected function errorResponse(string $message, int $status = 400)
+    protected function errorResponse(string $message, int $status = 400, array $data = [])
+    {
+        return response()->error($message, $status, $data);
+    }
+
+    protected function beginOrderEdit(Order $order): OrderEdit
+    {
+        return OrderEdit::begin($order);
+    }
+
+    protected function commitOrderEdit(OrderEdit $edit): array
     {
-        return response()->error($message, $status);
+        return $edit->commit();
     }
 
     /**
diff --git a/server/src/Models/Order.php b/server/src/Models/Order.php
index f2e306ae5..001ff9265 100644
--- a/server/src/Models/Order.php
+++ b/server/src/Models/Order.php
@@ -10,6 +10,7 @@
 use Fleetbase\FleetOps\Events\OrderDriverAssigned;
 use Fleetbase\FleetOps\Flow\Activity;
 use Fleetbase\FleetOps\Support\LabelPdf;
+use Fleetbase\FleetOps\Support\OrderEditPolicy;
 use Fleetbase\FleetOps\Support\OrderTracker;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\FleetOps\Traits\HasTrackingNumber;
@@ -1461,6 +1462,14 @@ public function notifyDriverAssigned()
         }
     }
 
+    /**
+     * The edit policy for the order at its current status.
+     */
+    public function editPolicy(): OrderEditPolicy
+    {
+        return OrderEditPolicy::for($this);
+    }
+
     /**
      * Updates the activity of the order.
      * Updates the order status and inserts a new activity based on the provided activity details.
diff --git a/server/src/Models/Payload.php b/server/src/Models/Payload.php
index 1ee94a0f9..c0461ce6f 100644
--- a/server/src/Models/Payload.php
+++ b/server/src/Models/Payload.php
@@ -21,6 +21,7 @@
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\HasManyThrough;
+use Illuminate\Support\Arr;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
 
@@ -251,6 +252,11 @@ public function setCodAmountAttribute($value)
         $this->attributes['cod_amount'] = Utils::numbersOnly($value);
     }
 
+    /**
+     * Add entities to the payload. Every entry creates a new entity, so sending
+     * the payload's current entities again duplicates them; use syncEntities()
+     * to replace the list.
+     */
     public function setEntities($entities = [])
     {
         if (empty($entities) || !is_array($entities)) {
@@ -258,49 +264,228 @@ public function setEntities($entities = [])
         }
 
         foreach ($entities as $attributes) {
-            if (isset($attributes['_import_id'])) {
-                $waypoint = $this->waypoints->firstWhere('_import_id', $attributes['_import_id']);
+            $entity = new Entity($this->prepareEntityAttributes($attributes));
+            $this->entities()->save($entity);
+        }
 
-                if ($waypoint) {
-                    $attributes['destination_uuid'] = $waypoint->uuid;
-                }
+        return $this;
+    }
+
+    /**
+     * Replace the payload's entities with the given list: entries naming an
+     * existing entity of this payload (by `id` public id or `uuid`) update it,
+     * entries without one create a new entity, and entities left out are deleted.
+     *
+     * @return array{created: string[], updated: string[], deleted: string[]} entity uuids by outcome
+     */
+    public function syncEntities($entities = []): array
+    {
+        $result = ['created' => [], 'updated' => [], 'deleted' => []];
+        if (!is_array($entities)) {
+            return $result;
+        }
+
+        $existing = $this->entities()->get();
+        $kept     = [];
+
+        foreach ($entities as $attributes) {
+            if (!is_array($attributes)) {
+                continue;
             }
 
-            // if a destination or waypoint is explicitly set
-            if (empty($attributes['destination_uuid'])) {
-                $destinationKey = Utils::or($attributes, ['waypoint', 'destination']);
-                $destination    = $this->findDestinationFromKey($destinationKey);
-                if ($destination instanceof Place) {
-                    $attributes['destination_uuid'] = $destination->uuid;
+            $entity = $this->findOwnEntity($existing, $attributes);
+            $values = $this->prepareEntityAttributes(Arr::except($attributes, ['id', 'uuid', 'public_id', 'payload_uuid', 'company_uuid']));
+
+            if ($entity) {
+                $entity->fill(Arr::only($values, $entity->getFillable()));
+                if ($entity->isDirty()) {
+                    $entity->save();
+                    $result['updated'][] = $entity->uuid;
                 }
+                $kept[] = $entity->uuid;
+
+                continue;
             }
 
-            // Validate destination actually exists
-            if (isset($attributes['destination_uuid']) && Place::where('uuid', $attributes['destination_uuid'])->doesntExist()) {
-                $validDestination = $this->_findCorrectDestinationForEntity($attributes);
-                if ($validDestination) {
-                    $attributes['destination_uuid'] = $validDestination->uuid;
-                }
+            $entity = new Entity($values);
+            $this->entities()->save($entity);
+            $result['created'][] = $entity->uuid;
+            $kept[]              = $entity->uuid;
+        }
+
+        foreach ($existing as $entity) {
+            if (!in_array($entity->uuid, $kept, true)) {
+                $entity->delete();
+                $result['deleted'][] = $entity->uuid;
             }
+        }
 
-            // Handle entity photo upload
-            if (isset($attributes['photo'])) {
-                $path = 'uploads/' . session('company') . '/entities';
-                $file = app(\Fleetbase\Services\FileResolverService::class)->resolve($attributes['photo'], $path);
+        $this->unsetRelation('entities');
 
-                if ($file) {
-                    $attributes['photo_uuid'] = $file->uuid;
+        return $result;
+    }
+
+    /**
+     * Whether every entry names an entity this payload already has, i.e. applying the
+     * list with syncEntities() would only update or remove entities, never add one.
+     */
+    public function entitiesListOnlyNamesExisting(array $entities): bool
+    {
+        $existing = $this->entities()->get();
+
+        foreach ($entities as $attributes) {
+            if (!is_array($attributes) || !$this->findOwnEntity($existing, $attributes)) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * Find the payload entity an entity entry refers to by `id` (public id) or `uuid`.
+     */
+    protected function findOwnEntity($existing, array $attributes): ?Entity
+    {
+        $key = $attributes['id'] ?? $attributes['public_id'] ?? $attributes['uuid'] ?? null;
+        if (!is_string($key) || $key === '') {
+            return null;
+        }
+
+        return $existing->first(fn (Entity $entity) => $entity->public_id === $key || $entity->uuid === $key);
+    }
+
+    /**
+     * Resolve an entity entry's destination and photo into storable attributes.
+     */
+    protected function prepareEntityAttributes(array $attributes): array
+    {
+        if (isset($attributes['_import_id'])) {
+            $waypoint = $this->waypoints->firstWhere('_import_id', $attributes['_import_id']);
+
+            if ($waypoint) {
+                $attributes['destination_uuid'] = $waypoint->uuid;
+            }
+        }
+
+        // if a destination or waypoint is explicitly set
+        if (empty($attributes['destination_uuid'])) {
+            $destinationKey = Utils::or($attributes, ['waypoint', 'destination']);
+            $destination    = $this->findDestinationFromKey($destinationKey);
+            if ($destination instanceof Place) {
+                $attributes['destination_uuid'] = $destination->uuid;
+            }
+        }
+
+        // Validate destination actually exists
+        if (isset($attributes['destination_uuid']) && Place::where('uuid', $attributes['destination_uuid'])->doesntExist()) {
+            $validDestination = $this->_findCorrectDestinationForEntity($attributes);
+            if ($validDestination) {
+                $attributes['destination_uuid'] = $validDestination->uuid;
+            }
+        }
+
+        // Handle entity photo upload
+        if (isset($attributes['photo'])) {
+            $path = 'uploads/' . session('company') . '/entities';
+            $file = app(\Fleetbase\Services\FileResolverService::class)->resolve($attributes['photo'], $path);
+
+            if ($file) {
+                $attributes['photo_uuid'] = $file->uuid;
+            }
+
+            // Clean up raw photo data
+            unset($attributes['photo']);
+        }
+
+        return $attributes;
+    }
+
+    /**
+     * The payload's stops as stored: pickup, dropoff and return place uuids, the
+     * waypoint place uuids in order and the current waypoint. Compare two
+     * signatures with routeChanges() to see what an edit changed.
+     */
+    public function routeSignature(): array
+    {
+        return [
+            'payload'   => $this->uuid,
+            'pickup'    => $this->pickup_uuid,
+            'dropoff'   => $this->dropoff_uuid,
+            'return'    => $this->return_uuid,
+            'waypoints' => $this->uuid ? Waypoint::where('payload_uuid', $this->uuid)->whereNull('deleted_at')->orderBy('order')->pluck('place_uuid')->values()->all() : [],
+            'current'   => $this->current_waypoint_uuid,
+        ];
+    }
+
+    /**
+     * The route parts (pickup, dropoff, return, waypoints) that differ between two route signatures.
+     */
+    public static function routeChanges(array $before, array $after): array
+    {
+        $changes = [];
+        foreach (['pickup', 'dropoff', 'return', 'waypoints'] as $part) {
+            if (($before[$part] ?? null) !== ($after[$part] ?? null)) {
+                $changes[] = $part;
+            }
+        }
+
+        return $changes;
+    }
+
+    /**
+     * Point the payload at the right stop after its route changed.
+     *
+     * Before the order is under way this is the first stop, as it always was. Once
+     * the driver is under way the stop they are heading to is kept when it is still
+     * on the route; when it was replaced the stop that took its place is used (the
+     * new pickup, dropoff or return), and a removed waypoint moves them on to the
+     * next stop they have not completed.
+     *
+     * @param array $before the routeSignature() taken before the edit
+     */
+    public function reconcileCurrentWaypoint(array $before, bool $inProgress): ?Place
+    {
+        $this->unsetRelation('waypoints');
+        $this->unsetRelation('waypointMarkers');
+        $this->loadMissing(['pickup', 'dropoff', 'return']);
+
+        $destination = null;
+
+        if ($inProgress) {
+            $after   = $this->routeSignature();
+            $current = $before['current'] ?? null;
+            $stops   = array_filter(array_merge([$after['pickup'], $after['dropoff'], $after['return']], $after['waypoints']));
+
+            if ($current && in_array($current, $stops, true)) {
+                $destination = Place::where('uuid', $current)->first();
+            } elseif ($current) {
+                foreach (['pickup', 'dropoff', 'return'] as $role) {
+                    if ($current === ($before[$role] ?? null) && $this->{$role} instanceof Place) {
+                        $destination = $this->{$role};
+                        break;
+                    }
                 }
 
-                // Clean up raw photo data
-                unset($attributes['photo']);
+                if (!$destination) {
+                    $next = $this->waypointMarkers()->orderBy('order')->get()->first(function (Waypoint $waypoint) {
+                        return !$waypoint->complete;
+                    });
+                    $destination = $next ? $next->getPlace() : ($this->dropoff instanceof Place ? $this->dropoff : null);
+                }
             }
+        }
 
-            $entity = new Entity($attributes);
-            $this->entities()->save($entity);
+        if (!$destination) {
+            $destination = $this->getPickupOrFirstWaypoint() ?? $this->getDropoffOrLastWaypoint();
         }
 
-        return $this;
+        if ($destination instanceof Place) {
+            $this->setCurrentWaypoint($destination);
+            $this->setRelation('currentWaypoint', $destination);
+        }
+
+        return $destination instanceof Place ? $destination : null;
     }
 
     public function insertEntities($entities = [])
diff --git a/server/src/Notifications/OrderChanged.php b/server/src/Notifications/OrderChanged.php
new file mode 100644
index 000000000..6db50bccc
--- /dev/null
+++ b/server/src/Notifications/OrderChanged.php
@@ -0,0 +1,87 @@
+<?php
+
+namespace Fleetbase\FleetOps\Notifications;
+
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\Support\PushNotification;
+use Illuminate\Broadcasting\Channel;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Notifications\Notification;
+use NotificationChannels\Apn\ApnChannel;
+use NotificationChannels\Fcm\FcmChannel;
+
+/**
+ * Tells the assigned driver that an order they have changed.
+ *
+ * Push data: { type: "order_changed", id: order public id, changes: [...] }.
+ */
+class OrderChanged extends Notification implements ShouldQueue
+{
+    use Queueable;
+
+    public static string $name        = 'Order Changed';
+    public static string $description = 'Notify the assigned driver when an order they have is changed.';
+    public static string $package     = 'fleet-ops';
+
+    public Order $order;
+
+    public array $changes = [];
+
+    public string $title;
+
+    public string $message;
+
+    public array $data = [];
+
+    public function __construct(Order $order, array $changes = [], string $summary = '')
+    {
+        $this->order   = $order;
+        $this->changes = array_values($changes);
+        $this->title   = 'Order ' . (data_get($order, 'trackingNumber.tracking_number') ?? $order->public_id) . ' changed';
+        $this->message = $summary !== '' ? $summary : 'This order was changed, tap for details.';
+        $this->data    = ['type' => 'order_changed', 'id' => $order->public_id, 'changes' => $this->changes];
+    }
+
+    public function via($notifiable): array
+    {
+        return ['broadcast', FcmChannel::class, ApnChannel::class];
+    }
+
+    public function broadcastOn(): array
+    {
+        return [
+            new Channel('driver.' . data_get($this->order, 'driver_assigned_uuid')),
+            new Channel('driver.' . data_get($this->order, 'driverAssigned.public_id')),
+        ];
+    }
+
+    public function toArray($notifiable = null): array
+    {
+        return [
+            'event' => 'order.changed_notification',
+            'title' => $this->title,
+            'body'  => $this->message,
+            'data'  => $this->data,
+        ];
+    }
+
+    public function toFcm($notifiable)
+    {
+        return PushNotification::createFcmMessage($this->title, $this->message, $this->fcmData());
+    }
+
+    public function toApn($notifiable)
+    {
+        return PushNotification::createApnMessage($this->title, $this->message, $this->data, 'view_order');
+    }
+
+    /**
+     * FCM data values must be strings, so on FCM the change list travels comma
+     * separated ("dropoff,items"); APNs and the broadcast carry it as a list.
+     */
+    public function fcmData(): array
+    {
+        return array_merge($this->data, ['changes' => implode(',', $this->changes)]);
+    }
+}
diff --git a/server/src/Providers/FleetOpsServiceProvider.php b/server/src/Providers/FleetOpsServiceProvider.php
index 32ddd9bdc..a60f5de5f 100644
--- a/server/src/Providers/FleetOpsServiceProvider.php
+++ b/server/src/Providers/FleetOpsServiceProvider.php
@@ -252,6 +252,7 @@ public function registerNotifications()
             \Fleetbase\FleetOps\Notifications\LateDeparture::class,
             \Fleetbase\FleetOps\Notifications\RouteDeviation::class,
             \Fleetbase\FleetOps\Notifications\ProlongedStoppage::class,
+            \Fleetbase\FleetOps\Notifications\OrderChanged::class,
         ]);
 
         // Register Notifiables
diff --git a/server/src/Support/OrderEdit.php b/server/src/Support/OrderEdit.php
new file mode 100644
index 000000000..d0ca5c13d
--- /dev/null
+++ b/server/src/Support/OrderEdit.php
@@ -0,0 +1,365 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support;
+
+use Fleetbase\FleetOps\Events\OrderChanged;
+use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Payload;
+use Fleetbase\FleetOps\Models\Place;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * One edit of an order, from the request that changes it to the events that announce it.
+ *
+ * begin() records the order as it is; guard() refuses changes its status locks
+ * (see OrderEditPolicy); commit() works out what actually changed and then:
+ *
+ * - keeps the driver on the right stop when the route changed (reconcileCurrentWaypoint),
+ * - recomputes the order's distance and time and republishes public tracking,
+ * - flags item changes made while the order is being prepared (`meta.kitchen_changed_at`),
+ * - broadcasts `order.changed` and pushes the change to the assigned driver.
+ *
+ *     $edit = OrderEdit::begin($order);
+ *     $edit->guard($edit->requestedChanges($input));
+ *     // ...apply the edit...
+ *     $edit->commit();
+ */
+class OrderEdit
+{
+    public const ENTITIES_APPEND  = 'append';
+    public const ENTITIES_REPLACE = 'replace';
+
+    protected OrderEditPolicy $policy;
+
+    protected ?array $routeBefore = null;
+
+    protected array $entitiesBefore = [];
+
+    protected mixed $codBefore = null;
+
+    protected ?string $scheduledBefore = null;
+
+    protected ?string $notesBefore = null;
+
+    protected ?string $customerBefore = null;
+
+    protected array $marked = [];
+
+    public function __construct(public Order $order)
+    {
+        $this->policy = OrderEditPolicy::for($order);
+
+        $payload = $this->currentPayload();
+        if ($payload instanceof Payload) {
+            $this->routeBefore    = $payload->routeSignature();
+            $this->entitiesBefore = $this->entitySnapshot($payload);
+            $this->codBefore      = $payload->cod_amount;
+        }
+
+        $this->scheduledBefore = static::timeString($order->scheduled_at);
+        $this->notesBefore     = $order->notes;
+        $this->customerBefore  = $order->customer_uuid;
+    }
+
+    public static function begin(Order $order): static
+    {
+        return new static($order);
+    }
+
+    public function policy(): OrderEditPolicy
+    {
+        return $this->policy;
+    }
+
+    /**
+     * Normalize an entities mode from a request value: `replace` (or `sync`) replaces
+     * the list, anything else appends as the API always has.
+     */
+    public static function entitiesMode(mixed $value): string
+    {
+        return in_array(strtolower((string) $value), ['replace', 'sync'], true) ? self::ENTITIES_REPLACE : self::ENTITIES_APPEND;
+    }
+
+    /**
+     * The policy fields an edit request touches, with the context the policy checks.
+     *
+     * Keys read from $input (presence matters): pickup, dropoff, return, waypoints,
+     * entities, scheduled_at, notes, cod_amount, customer.
+     *
+     * @return array<string, array|bool>
+     */
+    public function requestedChanges(array $input, string $entitiesMode = self::ENTITIES_APPEND): array
+    {
+        $changes = [];
+
+        foreach (OrderEditPolicy::ROUTE_FIELDS as $field) {
+            if (array_key_exists($field, $input)) {
+                $changes[$field] = true;
+            }
+        }
+
+        $entities = $input['entities'] ?? null;
+        if (is_array($entities) && ($entities !== [] || $entitiesMode === self::ENTITIES_REPLACE)) {
+            $payload = $this->currentPayload();
+            $adds    = true;
+            if ($entitiesMode === self::ENTITIES_REPLACE && $payload instanceof Payload) {
+                $adds = !$payload->entitiesListOnlyNamesExisting($entities);
+            }
+            $changes[OrderEditPolicy::FIELD_ITEMS] = ['adds' => $adds];
+        }
+
+        if (array_key_exists('scheduled_at', $input) && static::timeString($input['scheduled_at']) !== $this->scheduledBefore) {
+            $changes[OrderEditPolicy::FIELD_SCHEDULE] = ['from' => $this->scheduledBefore, 'to' => $input['scheduled_at']];
+        }
+
+        if (array_key_exists('notes', $input) && (string) $input['notes'] !== (string) $this->notesBefore) {
+            $changes[OrderEditPolicy::FIELD_NOTES] = true;
+        }
+
+        if (array_key_exists('cod_amount', $input) && !static::sameAmount($input['cod_amount'], $this->codBefore)) {
+            $changes[OrderEditPolicy::FIELD_COD_AMOUNT] = true;
+        }
+
+        if (array_key_exists('customer', $input) && !empty($input['customer']) && !$this->isCurrentCustomer($input['customer'])) {
+            $changes[OrderEditPolicy::FIELD_CONTACT] = true;
+        }
+
+        return $changes;
+    }
+
+    /**
+     * Refuse the edit when its status locks any requested field.
+     *
+     * @throws \Fleetbase\FleetOps\Exceptions\OrderEditLockedException
+     */
+    public function guard(array $changes): static
+    {
+        $this->policy->assert($changes);
+
+        return $this;
+    }
+
+    /**
+     * Record a change the snapshot cannot see (for example a total recomputed elsewhere).
+     */
+    public function markChanged(string ...$changes): static
+    {
+        $this->marked = array_values(array_unique(array_merge($this->marked, $changes)));
+
+        return $this;
+    }
+
+    /**
+     * Work out what changed since begin(), apply the follow-up effects and announce it.
+     *
+     * @param array $extra        order.changed data overrides (summary, total, currency, changed_by, ...)
+     * @param bool  $notifyDriver push the change to the assigned driver when it concerns them
+     *
+     * @return string[] the changes announced
+     */
+    public function commit(array $extra = [], bool $notifyDriver = true): array
+    {
+        $order   = $this->order;
+        $payload = $this->freshPayload();
+        $changes = [];
+
+        $routeChanges = [];
+        if ($payload instanceof Payload) {
+            $routeAfter   = $payload->routeSignature();
+            $routeChanges = $this->routeBefore ? Payload::routeChanges($this->routeBefore, $routeAfter) : ['pickup', 'dropoff', 'waypoints'];
+            $routeChanges = array_values(array_filter($routeChanges, function ($part) use ($routeAfter) {
+                // A route part that was and still is empty did not change.
+                return !empty($this->routeBefore[$part] ?? null) || !empty($routeAfter[$part]);
+            }));
+
+            if ($routeChanges) {
+                $payload->reconcileCurrentWaypoint($this->routeBefore ?? [], $this->isUnderWay());
+            }
+
+            if ($this->entitySnapshot($payload) !== $this->entitiesBefore) {
+                $changes[] = OrderEditPolicy::FIELD_ITEMS;
+            }
+
+            if (!static::sameAmount($payload->cod_amount, $this->codBefore)) {
+                $changes[] = OrderEditPolicy::FIELD_COD_AMOUNT;
+            }
+
+            $order->setRelation('payload', $payload);
+        }
+
+        $changes = array_merge($routeChanges, $changes);
+
+        if (static::timeString($order->scheduled_at) !== $this->scheduledBefore) {
+            $changes[] = OrderEditPolicy::FIELD_SCHEDULE;
+        }
+
+        if ((string) $order->notes !== (string) $this->notesBefore) {
+            $changes[] = OrderEditPolicy::FIELD_NOTES;
+        }
+
+        if ($order->customer_uuid !== $this->customerBefore) {
+            $changes[] = OrderEditPolicy::FIELD_CONTACT;
+        }
+
+        $changes = array_values(array_unique(array_merge($changes, $this->marked)));
+
+        if ($routeChanges) {
+            $this->afterRouteChanged();
+        }
+
+        if (in_array(OrderEditPolicy::FIELD_ITEMS, $changes, true) && $this->policy->flagsKitchenChanges()) {
+            $this->attempt(fn () => $order->updateMeta('kitchen_changed_at', Carbon::now()->toIso8601ZuluString()));
+        }
+
+        if ($changes) {
+            $summary = $extra['summary'] ?? static::summarize($changes, $payload, $order);
+            unset($extra['summary']);
+            $this->announce($changes, (string) $summary, $extra, $notifyDriver);
+        }
+
+        return $changes;
+    }
+
+    /**
+     * One line describing the changes, e.g. "Drop-off changed to 8 Marina View · Items changed".
+     */
+    public static function summarize(array $changes, ?Payload $payload = null, ?Order $order = null): string
+    {
+        $parts = [];
+
+        foreach ($changes as $change) {
+            $parts[] = match ($change) {
+                'dropoff'    => static::placeLine('Drop-off', $payload?->dropoff),
+                'pickup'     => static::placeLine('Pickup', $payload?->pickup),
+                'return'     => static::placeLine('Return', $payload?->return),
+                'waypoints'  => 'Stops changed',
+                'items'      => 'Items changed',
+                'schedule'   => $order?->scheduled_at ? 'Rescheduled to ' . Carbon::parse($order->scheduled_at)->format('j M H:i') : 'Schedule cleared',
+                'notes'      => 'Notes updated',
+                'cod_amount' => $payload && $payload->cod_amount !== null ? 'Cash to collect changed to ' . trim(($payload->cod_currency ?? '') . ' ' . $payload->cod_amount) : 'Cash to collect changed',
+                'contact'    => 'Customer changed',
+                'total'      => 'Total changed',
+                default      => ucfirst(str_replace('_', ' ', (string) $change)) . ' changed',
+            };
+        }
+
+        return implode(' · ', array_filter($parts));
+    }
+
+    protected function afterRouteChanged(): void
+    {
+        $order = $this->order;
+
+        $this->attempt(fn () => $order->setDistanceAndTime());
+        $this->attempt(fn () => app(TrackingPublisher::class)->routeChanged($order));
+    }
+
+    protected function announce(array $changes, string $summary, array $extra, bool $notifyDriver): void
+    {
+        OrderChanged::dispatchFor($this->order, $changes, $summary, $extra, $notifyDriver);
+    }
+
+    /**
+     * Whether the driver is already working the order, so a route change must keep their place.
+     */
+    protected function isUnderWay(): bool
+    {
+        return (bool) $this->order->started || $this->policy->stage() === OrderEditPolicy::STAGE_IN_TRANSIT;
+    }
+
+    protected function currentPayload(): ?Payload
+    {
+        $payload = $this->order->relationLoaded('payload') ? $this->order->getRelation('payload') : $this->attempt(fn () => $this->order->payload);
+
+        return $payload instanceof Payload ? $payload : null;
+    }
+
+    protected function freshPayload(): ?Payload
+    {
+        if (!$this->order->payload_uuid) {
+            return $this->currentPayload();
+        }
+
+        $payload = $this->attempt(fn () => Payload::where('uuid', $this->order->payload_uuid)->withoutGlobalScopes()->first());
+
+        return $payload instanceof Payload ? $payload : $this->currentPayload();
+    }
+
+    /**
+     * Entity uuid => fingerprint of its stored attributes.
+     */
+    protected function entitySnapshot(Payload $payload): array
+    {
+        if (!$payload->uuid) {
+            return [];
+        }
+
+        $entities = $this->attempt(fn () => Entity::where('payload_uuid', $payload->uuid)->get()) ?? collect();
+
+        return $entities->mapWithKeys(function (Entity $entity) {
+            $attributes = Arr::except($entity->getAttributes(), ['id', 'created_at', 'updated_at', 'qr_code', 'barcode']);
+            ksort($attributes);
+
+            return [$entity->uuid => md5((string) json_encode($attributes))];
+        })->sortKeys()->all();
+    }
+
+    protected function isCurrentCustomer(mixed $customer): bool
+    {
+        if (!is_string($customer)) {
+            return false;
+        }
+
+        if ($customer === $this->customerBefore) {
+            return true;
+        }
+
+        return $this->attempt(fn () => data_get($this->order, 'customer.public_id')) === $customer;
+    }
+
+    protected static function placeLine(string $label, mixed $place): string
+    {
+        if (!$place instanceof Place) {
+            return $label . ' changed';
+        }
+
+        $address = trim((string) ($place->address ?: $place->name ?: $place->street1));
+
+        return $address !== '' ? $label . ' changed to ' . $address : $label . ' changed';
+    }
+
+    protected static function timeString(mixed $value): ?string
+    {
+        if (empty($value)) {
+            return null;
+        }
+
+        try {
+            return Carbon::parse($value)->toIso8601ZuluString();
+        } catch (\Throwable) {
+            return (string) $value;
+        }
+    }
+
+    protected static function sameAmount(mixed $a, mixed $b): bool
+    {
+        $a = ($a === '' || $a === null) ? null : (is_numeric($a) ? (float) $a : $a);
+        $b = ($b === '' || $b === null) ? null : (is_numeric($b) ? (float) $b : $b);
+
+        return $a === $b;
+    }
+
+    protected function attempt(callable $callback): mixed
+    {
+        try {
+            return $callback();
+        } catch (\Throwable $exception) {
+            Log::debug('Order edit follow-up failed', ['order' => $this->order->public_id, 'error' => $exception->getMessage()]);
+
+            return null;
+        }
+    }
+}
diff --git a/server/src/Support/OrderEditPolicy.php b/server/src/Support/OrderEditPolicy.php
new file mode 100644
index 000000000..c76d1e30d
--- /dev/null
+++ b/server/src/Support/OrderEditPolicy.php
@@ -0,0 +1,292 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support;
+
+use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\OrderConfig;
+use Illuminate\Support\Carbon;
+
+/**
+ * Decides which parts of an order may still be edited at its current status.
+ *
+ * The policy groups statuses into four stages:
+ *
+ * - open (created, pending, accepted/confirmed, preparing): everything is editable.
+ * - ready (ready, pickup_ready): route, contact, notes and cash to collect are editable;
+ *   items may only be removed and the schedule may only move earlier.
+ * - in transit (dispatched, started, enroute, driver_*): route (the driver is rerouted),
+ *   contact, notes and cash to collect are editable; items and schedule are locked.
+ * - terminal (the config's complete or terminal activity, canceled, expired): nothing is editable.
+ *
+ * Fields are named the way edit requests and `order.changed` events name them:
+ * pickup, dropoff, return, waypoints, items, schedule, contact, notes, cod_amount.
+ */
+class OrderEditPolicy
+{
+    public const STAGE_OPEN       = 'open';
+    public const STAGE_READY      = 'ready';
+    public const STAGE_IN_TRANSIT = 'in_transit';
+    public const STAGE_TERMINAL   = 'terminal';
+
+    public const FIELD_PICKUP     = 'pickup';
+    public const FIELD_DROPOFF    = 'dropoff';
+    public const FIELD_RETURN     = 'return';
+    public const FIELD_WAYPOINTS  = 'waypoints';
+    public const FIELD_ITEMS      = 'items';
+    public const FIELD_SCHEDULE   = 'schedule';
+    public const FIELD_CONTACT    = 'contact';
+    public const FIELD_NOTES      = 'notes';
+    public const FIELD_COD_AMOUNT = 'cod_amount';
+
+    public const FIELDS = [
+        self::FIELD_PICKUP,
+        self::FIELD_DROPOFF,
+        self::FIELD_RETURN,
+        self::FIELD_WAYPOINTS,
+        self::FIELD_ITEMS,
+        self::FIELD_SCHEDULE,
+        self::FIELD_CONTACT,
+        self::FIELD_NOTES,
+        self::FIELD_COD_AMOUNT,
+    ];
+
+    public const ROUTE_FIELDS = [self::FIELD_PICKUP, self::FIELD_DROPOFF, self::FIELD_RETURN, self::FIELD_WAYPOINTS];
+
+    public const OPEN_STATUSES       = ['created', 'pending', 'accepted', 'confirmed', 'preparing'];
+    public const READY_STATUSES      = ['ready', 'pickup_ready', 'ready_for_pickup'];
+    public const IN_TRANSIT_STATUSES = ['dispatched', 'started', 'enroute', 'en_route', 'in_progress', 'picked_up', 'arrived', 'out_for_delivery'];
+    public const TERMINAL_STATUSES   = ['completed', 'canceled', 'cancelled', 'expired'];
+
+    public const RESTRICTION_REMOVAL_ONLY = 'removal_only';
+    public const RESTRICTION_EARLIER_ONLY = 'earlier_only';
+
+    protected ?string $stage = null;
+
+    public function __construct(public Order $order)
+    {
+    }
+
+    public static function for(Order $order): self
+    {
+        return new static($order);
+    }
+
+    /**
+     * The order status the policy reads, normalized to snake case.
+     */
+    public function status(): string
+    {
+        return strtolower((string) ($this->order->status ?: 'created'));
+    }
+
+    /**
+     * The edit stage of the order.
+     */
+    public function stage(): string
+    {
+        if ($this->stage !== null) {
+            return $this->stage;
+        }
+
+        $status = $this->status();
+
+        if ($this->isTerminal()) {
+            return $this->stage = self::STAGE_TERMINAL;
+        }
+
+        if (in_array($status, self::READY_STATUSES, true)) {
+            return $this->stage = self::STAGE_READY;
+        }
+
+        if ((bool) $this->order->started || in_array($status, self::IN_TRANSIT_STATUSES, true) || str_starts_with($status, 'driver_')) {
+            return $this->stage = self::STAGE_IN_TRANSIT;
+        }
+
+        if (in_array($status, self::OPEN_STATUSES, true)) {
+            return $this->stage = self::STAGE_OPEN;
+        }
+
+        // A custom status after dispatch means the order is out with a driver.
+        return $this->stage = (bool) $this->order->dispatched ? self::STAGE_IN_TRANSIT : self::STAGE_OPEN;
+    }
+
+    /**
+     * Whether the order is completed, canceled or expired: completed meaning the
+     * order config's complete activity or one of its terminal activity codes.
+     */
+    public function isTerminal(): bool
+    {
+        $status = $this->status();
+
+        if (in_array($status, self::TERMINAL_STATUSES, true)) {
+            return true;
+        }
+
+        if (in_array($status, array_merge(self::OPEN_STATUSES, self::READY_STATUSES, self::IN_TRANSIT_STATUSES), true)) {
+            return false;
+        }
+
+        $config = $this->orderConfig();
+        if (!$config) {
+            return false;
+        }
+
+        try {
+            if ($config->isTerminalActivityCode($status)) {
+                return true;
+            }
+
+            $activity = $config->getActivityByCode($status);
+
+            return $activity ? $activity->complete() : false;
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
+    /**
+     * Fields locked outright at this stage, each with the reason.
+     *
+     * @return array<string, string>
+     */
+    public function locked(): array
+    {
+        $stage = $this->stage();
+
+        if ($stage === self::STAGE_TERMINAL) {
+            $reason = sprintf('The order is %s and can no longer be changed.', str_replace('_', ' ', $this->status()));
+
+            return array_fill_keys(self::FIELDS, $reason);
+        }
+
+        if ($stage === self::STAGE_IN_TRANSIT) {
+            return [
+                self::FIELD_ITEMS    => 'Items cannot be changed once a driver has the order.',
+                self::FIELD_SCHEDULE => 'The schedule cannot be changed once a driver has the order.',
+            ];
+        }
+
+        return [];
+    }
+
+    /**
+     * Fields that are only partly editable at this stage.
+     *
+     * @return array<string, string> field => removal_only|earlier_only
+     */
+    public function restrictions(): array
+    {
+        if ($this->stage() === self::STAGE_READY) {
+            return [
+                self::FIELD_ITEMS    => self::RESTRICTION_REMOVAL_ONLY,
+                self::FIELD_SCHEDULE => self::RESTRICTION_EARLIER_ONLY,
+            ];
+        }
+
+        return [];
+    }
+
+    /**
+     * Whether the field may be edited at all at this stage.
+     */
+    public function allows(string $field): bool
+    {
+        return !array_key_exists($field, $this->locked());
+    }
+
+    /**
+     * Why a change to the field is refused, or null when it is allowed.
+     *
+     * Context keys:
+     * - items: `adds` (bool) whether the change adds or changes items rather than only removing them.
+     * - schedule: `from` and `to` (the current and requested scheduled time).
+     */
+    public function check(string $field, array $context = []): ?string
+    {
+        $locked = $this->locked();
+        if (isset($locked[$field])) {
+            return $locked[$field];
+        }
+
+        $restriction = $this->restrictions()[$field] ?? null;
+
+        if ($restriction === self::RESTRICTION_REMOVAL_ONLY && ($context['adds'] ?? true)) {
+            return 'Once the order is ready, items can only be removed.';
+        }
+
+        if ($restriction === self::RESTRICTION_EARLIER_ONLY && !static::isEarlier($context['from'] ?? null, $context['to'] ?? null)) {
+            return 'Once the order is ready, the schedule can only be moved earlier.';
+        }
+
+        return null;
+    }
+
+    /**
+     * Refuse the edit when any requested field is locked.
+     *
+     * @param array<string, array|bool> $changes field => context (see check()), or field => true
+     *
+     * @throws OrderEditLockedException
+     */
+    public function assert(array $changes): void
+    {
+        $refused = [];
+
+        foreach ($changes as $field => $context) {
+            $reason = $this->check($field, is_array($context) ? $context : []);
+            if ($reason !== null) {
+                $refused[$field] = $reason;
+            }
+        }
+
+        if ($refused) {
+            throw new OrderEditLockedException($refused);
+        }
+    }
+
+    /**
+     * Whether item changes at this status must be flagged for the kitchen.
+     */
+    public function flagsKitchenChanges(): bool
+    {
+        return $this->status() === 'preparing';
+    }
+
+    /**
+     * The policy as data, for clients that mirror it.
+     */
+    public function toArray(): array
+    {
+        return [
+            'stage'        => $this->stage(),
+            'status'       => $this->status(),
+            'locked'       => (object) $this->locked(),
+            'restrictions' => (object) $this->restrictions(),
+        ];
+    }
+
+    protected function orderConfig(): ?OrderConfig
+    {
+        try {
+            $config = $this->order->relationLoaded('orderConfig') ? $this->order->orderConfig : $this->order->orderConfig()->first();
+        } catch (\Throwable) {
+            return null;
+        }
+
+        return $config instanceof OrderConfig ? $config : null;
+    }
+
+    protected static function isEarlier(mixed $from, mixed $to): bool
+    {
+        if (empty($from) || empty($to)) {
+            return false;
+        }
+
+        try {
+            return Carbon::parse($to)->lessThanOrEqualTo(Carbon::parse($from));
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+}
diff --git a/server/src/Support/TrackingPublisher.php b/server/src/Support/TrackingPublisher.php
index 5a9ab4679..2f8b140ae 100644
--- a/server/src/Support/TrackingPublisher.php
+++ b/server/src/Support/TrackingPublisher.php
@@ -79,6 +79,18 @@ public function orderChanged(Order $order): bool
         return $this->queue($order->uuid, $reason, $order->getConnectionName());
     }
 
+    /**
+     * An order's stops were edited: queue an update so customers see the new route and ETAs.
+     */
+    public function routeChanged(Order $order): bool
+    {
+        if (!static::enabled() || !$order->uuid) {
+            return false;
+        }
+
+        return $this->queue($order->uuid, TrackingUpdate::REASON_ROUTE, $order->getConnectionName());
+    }
+
     /**
      * A waypoint or entity activity changed: queue an update for its order.
      */
diff --git a/server/src/Support/TrackingUpdate.php b/server/src/Support/TrackingUpdate.php
index fdcdffc6a..fe7986738 100644
--- a/server/src/Support/TrackingUpdate.php
+++ b/server/src/Support/TrackingUpdate.php
@@ -36,6 +36,8 @@ final class TrackingUpdate
 
     public const REASON_LOCATION = 'location';
 
+    public const REASON_ROUTE = 'route';
+
     /**
      * Decimal places kept on published coordinates: 4 places is roughly 11 m.
      */
diff --git a/server/tests/ApiEntityControllerContractsTest.php b/server/tests/ApiEntityControllerContractsTest.php
index 4f6efc5b8..7581a8e44 100644
--- a/server/tests/ApiEntityControllerContractsTest.php
+++ b/server/tests/ApiEntityControllerContractsTest.php
@@ -4,8 +4,11 @@
 use Fleetbase\FleetOps\Http\Requests\CreateEntityRequest;
 use Fleetbase\FleetOps\Http\Requests\UpdateEntityRequest;
 use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Payload;
 use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Support\OrderEdit;
+use Fleetbase\FleetOps\Support\OrderEditPolicy;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\Request;
 
@@ -327,3 +330,84 @@ function fleetopsApiEntityController(): FleetOpsApiEntityControllerProbe
         'status' => 404,
     ]);
 })->with(['update', 'find', 'delete']);
+
+/**
+ * Entities that belong to an order: the order's edit uses the real lock policy and records its commit.
+ */
+class FleetOpsApiEntityOrderControllerProbe extends FleetOpsApiEntityControllerProbe
+{
+    public ?Order $order = null;
+
+    public array $edits = [];
+
+    protected function orderEditForPayload(?string $payloadUuid): ?OrderEdit
+    {
+        if (!$this->order) {
+            return null;
+        }
+
+        return $this->edits[] = new FleetOpsApiEntityOrderEditFake($this->order);
+    }
+}
+
+class FleetOpsApiEntityOrderEditFake extends OrderEdit
+{
+    public int $commits = 0;
+
+    public function __construct(public Order $order)
+    {
+        $this->policy = OrderEditPolicy::for($order);
+    }
+
+    public function commit(array $extra = [], bool $notifyDriver = true): array
+    {
+        $this->commits++;
+
+        return ['items'];
+    }
+}
+
+function fleetopsApiEntityOrderController(string $status): FleetOpsApiEntityOrderControllerProbe
+{
+    $controller        = new FleetOpsApiEntityOrderControllerProbe();
+    $controller->order = new Order();
+    $controller->order->setRawAttributes(['uuid' => 'order-uuid', 'public_id' => 'order_entity', 'status' => $status], true);
+    $controller->entity = new FleetOpsApiEntityFake();
+    $controller->entity->setRawAttributes(['uuid' => 'entity-uuid', 'payload_uuid' => 'payload-uuid'], true);
+
+    return $controller;
+}
+
+test('api entity controller announces item edits on orders that allow them', function () {
+    $controller = fleetopsApiEntityOrderController('created');
+
+    $controller->create(new FleetOpsCreateEntityRequestFake(['name' => 'Latte', 'payload' => 'payload_public']));
+    $controller->update('entity_public', new FleetOpsUpdateEntityRequestFake(['name' => 'Iced Latte']));
+    $controller->delete('entity_public', new Request());
+
+    expect(array_map(fn ($edit) => $edit->commits, $controller->edits))->toBe([1, 1, 1])
+        ->and($controller->createdEntities)->toHaveCount(1)
+        ->and($controller->entity->deletedForTest)->toBeTrue();
+});
+
+test('api entity controller refuses item edits the order status locks', function () {
+    $dispatched = fleetopsApiEntityOrderController('dispatched');
+    $created    = $dispatched->create(new FleetOpsCreateEntityRequestFake(['name' => 'Latte', 'payload' => 'payload_public']));
+    $deleted    = $dispatched->delete('entity_public', new Request());
+
+    expect($created->getStatusCode())->toBe(422)
+        ->and($created->getData(true)['locked'])->toBe(['items' => 'Items cannot be changed once a driver has the order.'])
+        ->and($deleted->getStatusCode())->toBe(422)
+        ->and($dispatched->createdEntities)->toBe([])
+        ->and($dispatched->entity->deletedForTest)->toBeFalse();
+
+    // once ready, an item may be removed but not changed
+    $ready   = fleetopsApiEntityOrderController('ready');
+    $updated = $ready->update('entity_public', new FleetOpsUpdateEntityRequestFake(['name' => 'Iced Latte']));
+    $ready->delete('entity_public', new Request());
+
+    expect($updated->getStatusCode())->toBe(422)
+        ->and($updated->getData(true)['error'])->toBe('Once the order is ready, items can only be removed.')
+        ->and($ready->entity->updatedPayloads)->toBe([])
+        ->and($ready->entity->deletedForTest)->toBeTrue();
+});
diff --git a/server/tests/ApiOrderControllerContractsTest.php b/server/tests/ApiOrderControllerContractsTest.php
index d22c0394d..58c473fde 100644
--- a/server/tests/ApiOrderControllerContractsTest.php
+++ b/server/tests/ApiOrderControllerContractsTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\OrderController;
 use Fleetbase\FleetOps\Http\Requests\CreateOrderRequest;
 use Fleetbase\FleetOps\Http\Requests\ScheduleOrderRequest;
@@ -12,6 +13,8 @@
 use Fleetbase\FleetOps\Models\Proof;
 use Fleetbase\FleetOps\Models\ServiceQuote;
 use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\OrderEdit;
+use Fleetbase\FleetOps\Support\OrderEditPolicy;
 use Fleetbase\FleetOps\Support\OrderTracker;
 use Fleetbase\Models\File;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
@@ -41,6 +44,8 @@ class FleetOpsApiOrderCrudControllerProbe extends OrderController
     public bool $missingOrderConfig              = false;
     public mixed $resolvedSubject                = null;
     public ?string $companyUuid                  = 'company-uuid';
+    public ?FleetOpsApiOrderEditFake $edit       = null;
+    public array $editLockedWith                 = [];
 
     protected function findOrder(string $id, array $with = [], array $withCount = []): Order
     {
@@ -54,6 +59,19 @@ protected function findOrder(string $id, array $with = [], array $withCount = []
         return $this->order;
     }
 
+    protected function beginOrderEdit(Order $order): OrderEdit
+    {
+        $this->edit ??= new FleetOpsApiOrderEditFake($order);
+        $this->edit->lockWith = $this->editLockedWith;
+
+        return $this->edit;
+    }
+
+    protected function lockedEditResponse(OrderEditLockedException $exception)
+    {
+        return ['apiError' => $exception->getMessage(), 'status' => 422, 'locked' => $exception->locked];
+    }
+
     protected function drivingDistanceAndTime(mixed $origin, mixed $destination): mixed
     {
         return $this->matrix ?? (object) ['distance' => 1200, 'time' => 360];
@@ -244,6 +262,43 @@ protected function apiError(string $message, int $status = 400)
     }
 }
 
+/**
+ * Records the edit guard and commit instead of reading and announcing through the database.
+ */
+class FleetOpsApiOrderEditFake extends OrderEdit
+{
+    public array $guarded  = [];
+    public array $lockWith = [];
+    public int $commits    = 0;
+
+    public function __construct(public Order $order)
+    {
+        $this->policy = OrderEditPolicy::for($order);
+    }
+
+    public function requestedChanges(array $input, string $entitiesMode = self::ENTITIES_APPEND): array
+    {
+        return ['input' => $input, 'entities_mode' => $entitiesMode];
+    }
+
+    public function guard(array $changes): static
+    {
+        $this->guarded[] = $changes;
+        if ($this->lockWith) {
+            throw new OrderEditLockedException($this->lockWith);
+        }
+
+        return $this;
+    }
+
+    public function commit(array $extra = [], bool $notifyDriver = true): array
+    {
+        $this->commits++;
+
+        return [];
+    }
+}
+
 class FleetOpsApiOrderCrudFake extends Order
 {
     public array $lookups                  = [];
@@ -383,6 +438,7 @@ public function cancel()
         return $this;
     }
 
+
     public function tracker(): OrderTracker
     {
         return $this->trackerFake;
@@ -447,6 +503,13 @@ public function setEntities($entities = [])
         return $this;
     }
 
+    public function syncEntities($entities = []): array
+    {
+        $this->calls[] = ['sync-entities', $entities];
+
+        return ['created' => [], 'updated' => [], 'deleted' => []];
+    }
+
     public function setCurrentWaypoint(Place|Waypoint $destination, bool $save = true): Payload
     {
         $this->calls[] = ['current', $destination instanceof Place, $save];
@@ -1079,3 +1142,80 @@ public function isString(string $key): bool
         ])->and($controller->createdProofs)->toBe([]);
     }
 });
+
+test('api order controller refuses order edits the status locks with a 422 and writes nothing', function () {
+    $order          = new FleetOpsApiOrderCrudFake(['status' => 'completed']);
+    $payload        = new FleetOpsApiOrderPayloadFake();
+    $order->payload = $payload;
+
+    $controller                 = new FleetOpsApiOrderCrudControllerProbe();
+    $controller->order          = $order;
+    $controller->editLockedWith = ['dropoff' => 'The order is completed and can no longer be changed.'];
+
+    $response = $controller->update('order-public', new FleetOpsApiOrderUpdateRequestFake([
+        'payload' => ['dropoff' => ['name' => 'Somewhere else']],
+    ]));
+
+    expect($response)->toBe([
+        'apiError' => 'The order is completed and can no longer be changed.',
+        'status'   => 422,
+        'locked'   => ['dropoff' => 'The order is completed and can no longer be changed.'],
+    ])
+        ->and($payload->calls)->toBe([])
+        ->and($payload->savedForTest)->toBeFalse()
+        ->and($order->updates)->toBe([])
+        ->and($controller->edit->commits)->toBe(0);
+});
+
+test('api order controller passes the edit to the guard, keeps cod 0, replaces entities and commits once', function () {
+    $order          = new FleetOpsApiOrderCrudFake(['status' => 'dispatched']);
+    $payload        = new FleetOpsApiOrderPayloadFake();
+    $order->payload = $payload;
+
+    $controller        = new FleetOpsApiOrderCrudControllerProbe();
+    $controller->order = $order;
+
+    $controller->update('order-public', new FleetOpsApiOrderUpdateRequestFake([
+        'payload' => [
+            'dropoff'       => ['name' => 'New drop'],
+            'entities'      => [['id' => 'entity_keep', 'name' => 'Latte']],
+            'entities_mode' => 'replace',
+            'cod_amount'    => 0,
+        ],
+        'notes'   => 'Leave at the door',
+    ]));
+
+    expect($controller->edit->guarded)->toBe([[
+        'input' => [
+            'dropoff'    => ['name' => 'New drop'],
+            'entities'   => [['id' => 'entity_keep', 'name' => 'Latte']],
+            'notes'      => 'Leave at the door',
+            'cod_amount' => 0,
+        ],
+        'entities_mode' => 'replace',
+    ]])
+        ->and($payload->calls)->toContain(['sync-entities', [['id' => 'entity_keep', 'name' => 'Latte']]])
+        ->and(collect($payload->calls)->where(0, 'entities')->all())->toBe([])
+        ->and($payload->getAttributes()['cod_amount'])->toBe(0)
+        ->and(collect($payload->calls)->where(0, 'current')->all())->toBe([])
+        ->and($controller->edit->commits)->toBe(1);
+});
+
+test('api order controller reads a top-level cod amount and appends entities by default', function () {
+    $order          = new FleetOpsApiOrderCrudFake();
+    $payload        = new FleetOpsApiOrderPayloadFake();
+    $order->payload = $payload;
+
+    $controller        = new FleetOpsApiOrderCrudControllerProbe();
+    $controller->order = $order;
+
+    $controller->update('order-public', new FleetOpsApiOrderUpdateRequestFake([
+        'entities'   => [['name' => 'Crate']],
+        'cod_amount' => '2500',
+    ]));
+
+    expect($payload->calls)->toContain(['entities', [['name' => 'Crate']]])
+        ->and($payload->getAttributes()['cod_amount'])->toBe(2500)
+        ->and($controller->edit->guarded[0]['input'])->toMatchArray(['cod_amount' => '2500'])
+        ->and($controller->edit->guarded[0]['entities_mode'])->toBe('append');
+});
diff --git a/server/tests/ApiPayloadControllerContractsTest.php b/server/tests/ApiPayloadControllerContractsTest.php
index 6aa5b2584..2346dc629 100644
--- a/server/tests/ApiPayloadControllerContractsTest.php
+++ b/server/tests/ApiPayloadControllerContractsTest.php
@@ -3,9 +3,12 @@
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\PayloadController;
 use Fleetbase\FleetOps\Http\Requests\CreatePayloadRequest;
 use Fleetbase\FleetOps\Http\Requests\UpdatePayloadRequest;
+use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Payload;
 use Fleetbase\FleetOps\Models\Place;
 use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\OrderEdit;
+use Fleetbase\FleetOps\Support\OrderEditPolicy;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\Request;
 
@@ -124,6 +127,15 @@ public function setEntities($entities = [])
         return $this;
     }
 
+    public array $entitySyncs = [];
+
+    public function syncEntities($entities = []): array
+    {
+        $this->entitySyncs[] = $entities;
+
+        return ['created' => [], 'updated' => [], 'deleted' => []];
+    }
+
     public function getPickupOrFirstWaypoint(): ?Place
     {
         return $this->firstWaypoint;
@@ -312,3 +324,112 @@ function fleetopsApiPayloadController(): FleetOpsApiPayloadControllerProbe
         'status' => 404,
     ]);
 })->with(['update', 'find', 'delete']);
+
+/**
+ * A payload that belongs to an order: the order's edit is recorded instead of read from the database.
+ */
+class FleetOpsApiPayloadOrderControllerProbe extends FleetOpsApiPayloadControllerProbe
+{
+    public ?Order $order = null;
+
+    public ?FleetOpsApiPayloadOrderEditFake $edit = null;
+
+    protected function orderForPayload(Payload $payload): ?Order
+    {
+        return $this->order;
+    }
+
+    protected function beginOrderEdit(Order $order): OrderEdit
+    {
+        return $this->edit ??= new FleetOpsApiPayloadOrderEditFake($order);
+    }
+}
+
+class FleetOpsApiPayloadOrderEditFake extends OrderEdit
+{
+    public array $requested = [];
+    public int $commits     = 0;
+
+    public function __construct(public Order $order)
+    {
+        $this->policy = OrderEditPolicy::for($order);
+    }
+
+    public function requestedChanges(array $input, string $entitiesMode = self::ENTITIES_APPEND): array
+    {
+        $this->requested[] = [$input, $entitiesMode];
+
+        return parent::requestedChanges(array_diff_key($input, ['entities' => true, 'cod_amount' => true]), $entitiesMode)
+            + (isset($input['entities']) ? ['items' => ['adds' => $entitiesMode !== self::ENTITIES_REPLACE]] : []);
+    }
+
+    public function commit(array $extra = [], bool $notifyDriver = true): array
+    {
+        $this->commits++;
+
+        return [];
+    }
+}
+
+function fleetopsApiPayloadOrderController(string $status): FleetOpsApiPayloadOrderControllerProbe
+{
+    $controller                         = new FleetOpsApiPayloadOrderControllerProbe();
+    $controller->payload                = new FleetOpsApiPayloadEndpointFake();
+    $controller->payload->firstWaypoint = fleetopsApiPayloadPlace();
+    $controller->order                  = new Order();
+    $controller->order->setRawAttributes(['uuid' => 'order-uuid', 'public_id' => 'order_payload', 'status' => $status], true);
+
+    return $controller;
+}
+
+test('api payload controller keeps a cash to collect of zero and still skips empty values', function () {
+    $controller = fleetopsApiPayloadController();
+
+    $response = $controller->update('payload-public', fleetopsUpdatePayloadRequest([
+        'cod_amount' => 0,
+        'type'       => '',
+        'provider'   => null,
+    ]));
+
+    // the first fill is the model constructor's
+    expect(end($response['payload']->filledPayloads))->toBe(['cod_amount' => 0])
+        ->and($response['payload']->getAttributes()['cod_amount'])->toBe(0);
+});
+
+test('api payload controller edits an order payload through the order edit', function () {
+    $controller = fleetopsApiPayloadOrderController('dispatched');
+
+    $response = $controller->update('payload-public', fleetopsUpdatePayloadRequest([
+        'dropoff'    => ['public_id' => 'dropoff-public'],
+        'cod_amount' => 1500,
+    ]));
+
+    expect($response['payload']->dropoffAssignments)->toBe([['public_id' => 'dropoff-public']])
+        ->and($response['payload']->currentWaypointAssignments)->toBe([])
+        ->and($controller->edit->requested[0])->toBe([['dropoff' => ['public_id' => 'dropoff-public'], 'cod_amount' => 1500], 'append'])
+        ->and($controller->edit->commits)->toBe(1);
+});
+
+test('api payload controller replaces entities on request and refuses locked item edits', function () {
+    $controller = fleetopsApiPayloadOrderController('created');
+
+    $response = $controller->update('payload-public', fleetopsUpdatePayloadRequest([
+        'entities'      => [['id' => 'entity_keep']],
+        'entities_mode' => 'replace',
+    ]));
+
+    expect($response['payload']->entitySyncs)->toBe([[['id' => 'entity_keep']]])
+        ->and($response['payload']->entityAssignments)->toBe([]);
+
+    $locked   = fleetopsApiPayloadOrderController('dispatched');
+    $response = $locked->update('payload-public', fleetopsUpdatePayloadRequest([
+        'entities' => [['name' => 'Extra']],
+    ]));
+
+    expect($response->getStatusCode())->toBe(422)
+        ->and($response->getData(true)['error'])->toBe('Items cannot be changed once a driver has the order.')
+        ->and($response->getData(true)['locked'])->toBe(['items' => 'Items cannot be changed once a driver has the order.'])
+        ->and($locked->payload->entityAssignments)->toBe([])
+        ->and($locked->payload->savedForTest)->toBeFalse()
+        ->and($locked->edit->commits)->toBe(0);
+});
diff --git a/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php b/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php
index a92601055..cd970116c 100644
--- a/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php
+++ b/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
 use Fleetbase\FleetOps\Flow\Activity;
 use Fleetbase\FleetOps\Http\Controllers\Internal\v1\OrderController;
 use Fleetbase\FleetOps\Http\Requests\BulkDispatchRequest;
@@ -14,6 +15,8 @@
 use Fleetbase\FleetOps\Models\Proof;
 use Fleetbase\FleetOps\Models\TrackingStatus;
 use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\OrderEdit;
+use Fleetbase\FleetOps\Support\OrderEditPolicy;
 use Fleetbase\FleetOps\Support\OrderTracker;
 use Fleetbase\Http\Requests\ExportRequest;
 use Fleetbase\Models\Type;
@@ -38,6 +41,43 @@ class FleetOpsInternalOrderLifecycleEventRecorder
     eval('namespace Fleetbase\Http\Requests; class ExportRequest extends \Illuminate\Http\Request {}');
 }
 
+/**
+ * Records the route edit guard and commit instead of reading and announcing through the database.
+ */
+class FleetOpsInternalOrderEditFake extends OrderEdit
+{
+    public array $guarded  = [];
+    public array $lockWith = [];
+    public int $commits    = 0;
+
+    public function __construct(public Order $order)
+    {
+        $this->policy = OrderEditPolicy::for($order);
+    }
+
+    public function requestedChanges(array $input, string $entitiesMode = self::ENTITIES_APPEND): array
+    {
+        return $input;
+    }
+
+    public function guard(array $changes): static
+    {
+        $this->guarded[] = $changes;
+        if ($this->lockWith) {
+            throw new OrderEditLockedException($this->lockWith);
+        }
+
+        return $this;
+    }
+
+    public function commit(array $extra = [], bool $notifyDriver = true): array
+    {
+        $this->commits++;
+
+        return [];
+    }
+}
+
 class FleetOpsInternalOrderLifecycleControllerProbe extends OrderController
 {
     public Collection $orders;
@@ -257,6 +297,18 @@ protected function findOrderRouteForEdit(string $uuid): ?Order
         return $this->order;
     }
 
+    public ?FleetOpsInternalOrderEditFake $edit = null;
+
+    public array $editLockedWith = [];
+
+    protected function beginOrderEdit(Order $order): OrderEdit
+    {
+        $this->edit ??= new FleetOpsInternalOrderEditFake($order);
+        $this->edit->lockWith = $this->editLockedWith;
+
+        return $this->edit;
+    }
+
     protected function orderResponse(Order $order): array
     {
         return ['order' => $order];
@@ -416,6 +468,7 @@ public function cancel()
         return $this;
     }
 
+
     public function dispatch(bool $save = true): Order
     {
         $this->dispatchedForTest = true;
@@ -911,10 +964,29 @@ function fleetopsSuppressStrNullDeprecations(): Closure
         ->and($payload->calls)->toContain(['setDropoff', ['name' => 'Dropoff'], ['save' => true]])
         ->and($payload->calls)->toContain(['setReturn', ['name' => 'Return'], ['save' => true]])
         ->and($payload->calls)->toContain(['updateWaypoints', [['name' => 'Waypoint']]])
-        ->and($payload->calls)->toContain(['setCurrentWaypoint', $startingDestination, true])
+        // the current waypoint is reconciled by the committed edit, not reset to the first stop here
+        ->and(collect($payload->calls)->where(0, 'setCurrentWaypoint')->all())->toBe([])
+        ->and($controller->edit->guarded)->toBe([['pickup' => true, 'dropoff' => true, 'return' => true, 'waypoints' => true]])
+        ->and($controller->edit->commits)->toBe(1)
         ->and($order->loadedRelations)->toBe([['payload.pickup', 'payload.dropoff', 'payload.return', 'payload.waypoints']]);
 });
 
+test('internal order controller refuses route edits on finished orders with a 422', function () {
+    $payload = fleetopsInternalOrderLifecyclePayload(fleetopsInternalOrderLifecyclePlace('starting-place'));
+    $order   = fleetopsInternalOrderLifecycleOrder('order-route', 'completed');
+    $order->setRelation('payload', $payload);
+    $controller                 = fleetopsInternalOrderLifecycleController([$order]);
+    $controller->editLockedWith = ['dropoff' => 'The order is completed and can no longer be changed.'];
+
+    $response = $controller->editOrderRoute('order-route', new Request(['dropoff' => ['name' => 'Dropoff']]));
+
+    // the harness response factory keeps only the message; the app's error macro adds `locked`
+    expect($response->getStatusCode())->toBe(422)
+        ->and($response->getData(true)['error'])->toBe('The order is completed and can no longer be changed.')
+        ->and($payload->calls)->toBe([])
+        ->and($controller->edit->commits)->toBe(0);
+});
+
 test('internal order controller clears route endpoints and falls back to dropoff destination', function () {
     $fallbackDestination = fleetopsInternalOrderLifecyclePlace('fallback-place');
     $payload             = fleetopsInternalOrderLifecyclePayload(null, $fallbackDestination);
@@ -933,7 +1005,7 @@ function fleetopsSuppressStrNullDeprecations(): Closure
         ->and($payload->calls)->toContain(['removePlace', 'dropoff', ['save' => true]])
         ->and($payload->calls)->toContain(['removePlace', 'return', ['save' => true]])
         ->and($payload->calls)->toContain(['removeWaypoints'])
-        ->and($payload->calls)->toContain(['setCurrentWaypoint', $fallbackDestination, true]);
+        ->and($controller->edit->commits)->toBe(1);
 });
 
 test('internal order controller reports missing order route edits', function () {
diff --git a/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php b/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
new file mode 100644
index 000000000..64c68ebee
--- /dev/null
+++ b/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
@@ -0,0 +1,47 @@
+<?php
+
+use Fleetbase\FleetOps\Events\OrderOfferChanged;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\TrackingNumber;
+use Fleetbase\FleetOps\Notifications\DriverNotAccepted;
+use Fleetbase\FleetOps\Notifications\OrderChanged;
+use Fleetbase\FleetOps\Notifications\OrderOfferDeclined;
+use Fleetbase\FleetOps\Notifications\OrderUnassigned;
+use NotificationChannels\Apn\ApnChannel;
+use NotificationChannels\Fcm\FcmChannel;
+
+/**
+ * Covers the driver pushes and dispatch alerts for order changes, unassignment
+ * and offers: their titles, bodies and the data the apps read.
+ */
+function fleetopsOrderChangeNotificationOrder(): Order
+{
+    $trackingNumber = new TrackingNumber();
+    $trackingNumber->setRawAttributes(['uuid' => 'tn-1', 'tracking_number' => 'FLB-CHANGE-1'], true);
+
+    $order = new Order();
+    $order->setRawAttributes([
+        'uuid'                 => 'order-uuid',
+        'public_id'            => 'order_change',
+        'company_uuid'         => 'company-1',
+        'driver_assigned_uuid' => 'driver-uuid',
+        'meta'                 => json_encode(['offer' => ['driver' => 'driver_one', 'status' => 'expired', 'expires_at' => '2026-10-13T12:05:00Z']]),
+    ], true);
+    $order->setRelation('trackingNumber', $trackingNumber);
+    $order->setRelation('driverAssigned', null);
+
+    return $order;
+}
+
+test('order changed pushes the changes to the driver with fcm safe data', function () {
+    $notification = new OrderChanged(fleetopsOrderChangeNotificationOrder(), ['dropoff', 'items'], 'Drop-off changed to 8 Marina View · Items changed');
+
+    expect($notification->title)->toBe('Order FLB-CHANGE-1 changed')
+        ->and($notification->message)->toBe('Drop-off changed to 8 Marina View · Items changed')
+        ->and($notification->data)->toBe(['type' => 'order_changed', 'id' => 'order_change', 'changes' => ['dropoff', 'items']])
+        ->and($notification->fcmData())->toBe(['type' => 'order_changed', 'id' => 'order_change', 'changes' => 'dropoff,items'])
+        ->and($notification->via(null))->toBe(['broadcast', FcmChannel::class, ApnChannel::class])
+        ->and($notification->toArray())->toMatchArray(['event' => 'order.changed_notification', 'data' => $notification->data])
+        ->and(array_map(fn ($channel) => $channel->name, $notification->broadcastOn()))->toContain('driver.driver-uuid')
+        ->and((new OrderChanged(fleetopsOrderChangeNotificationOrder()))->message)->toBe('This order was changed, tap for details.');
+});
diff --git a/server/tests/Unit/Support/OrderEditPolicyTest.php b/server/tests/Unit/Support/OrderEditPolicyTest.php
new file mode 100644
index 000000000..8153865e0
--- /dev/null
+++ b/server/tests/Unit/Support/OrderEditPolicyTest.php
@@ -0,0 +1,128 @@
+<?php
+
+use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\OrderConfig;
+use Fleetbase\FleetOps\Support\OrderEditPolicy;
+
+/**
+ * Covers the order edit lock policy: the stage each status falls into, the fields
+ * each stage locks or restricts, and the refusal raised for a locked edit.
+ */
+function fleetopsEditPolicyOrder(string $status, array $attributes = [], ?OrderConfig $config = null): Order
+{
+    $order = new Order();
+    $order->setRawAttributes(array_merge(['uuid' => 'order-uuid', 'public_id' => 'order_policy', 'status' => $status], $attributes), true);
+    $order->setRelation('orderConfig', $config);
+
+    return $order;
+}
+
+test('open statuses leave every field editable', function () {
+    foreach (['created', 'pending', 'accepted', 'confirmed', 'preparing'] as $status) {
+        $policy = OrderEditPolicy::for(fleetopsEditPolicyOrder($status));
+
+        expect($policy->stage())->toBe(OrderEditPolicy::STAGE_OPEN)
+            ->and($policy->locked())->toBe([])
+            ->and($policy->restrictions())->toBe([])
+            ->and($policy->check('items', ['adds' => true]))->toBeNull()
+            ->and($policy->check('schedule', ['from' => '2026-10-13 12:00:00', 'to' => '2026-10-14 12:00:00']))->toBeNull();
+    }
+
+    expect(OrderEditPolicy::for(fleetopsEditPolicyOrder('preparing'))->flagsKitchenChanges())->toBeTrue()
+        ->and(OrderEditPolicy::for(fleetopsEditPolicyOrder('created'))->flagsKitchenChanges())->toBeFalse();
+});
+
+test('ready orders only allow removing items and moving the schedule earlier', function () {
+    $policy = OrderEditPolicy::for(fleetopsEditPolicyOrder('pickup_ready'));
+
+    expect($policy->stage())->toBe(OrderEditPolicy::STAGE_READY)
+        ->and($policy->locked())->toBe([])
+        ->and($policy->restrictions())->toBe(['items' => 'removal_only', 'schedule' => 'earlier_only'])
+        ->and($policy->check('dropoff'))->toBeNull()
+        ->and($policy->check('contact'))->toBeNull()
+        ->and($policy->check('items', ['adds' => false]))->toBeNull()
+        ->and($policy->check('items', ['adds' => true]))->toBe('Once the order is ready, items can only be removed.')
+        ->and($policy->check('schedule', ['from' => '2026-10-13 12:00:00', 'to' => '2026-10-13 11:30:00']))->toBeNull()
+        ->and($policy->check('schedule', ['from' => '2026-10-13 12:00:00', 'to' => '2026-10-13 12:30:00']))->toBe('Once the order is ready, the schedule can only be moved earlier.')
+        ->and($policy->check('schedule', ['from' => null, 'to' => '2026-10-13 12:30:00']))->not->toBeNull();
+});
+
+test('orders a driver has keep route contact and notes editable but lock items and schedule', function () {
+    $cases = [
+        fleetopsEditPolicyOrder('dispatched'),
+        fleetopsEditPolicyOrder('driver_enroute'),
+        fleetopsEditPolicyOrder('enroute'),
+        fleetopsEditPolicyOrder('created', ['started' => true]),
+        fleetopsEditPolicyOrder('at_customs', ['dispatched' => true]),
+    ];
+
+    foreach ($cases as $order) {
+        $policy = OrderEditPolicy::for($order);
+
+        expect($policy->stage())->toBe(OrderEditPolicy::STAGE_IN_TRANSIT)
+            ->and(array_keys($policy->locked()))->toBe(['items', 'schedule'])
+            ->and($policy->allows('dropoff'))->toBeTrue()
+            ->and($policy->allows('waypoints'))->toBeTrue()
+            ->and($policy->allows('contact'))->toBeTrue()
+            ->and($policy->allows('notes'))->toBeTrue()
+            ->and($policy->allows('cod_amount'))->toBeTrue()
+            ->and($policy->allows('items'))->toBeFalse();
+    }
+
+    // a custom status before dispatch is still open
+    expect(OrderEditPolicy::for(fleetopsEditPolicyOrder('awaiting_stock'))->stage())->toBe(OrderEditPolicy::STAGE_OPEN);
+});
+
+test('completed canceled and expired orders and the config terminal codes lock everything', function () {
+    foreach (['completed', 'canceled', 'expired'] as $status) {
+        $policy = OrderEditPolicy::for(fleetopsEditPolicyOrder($status));
+
+        expect($policy->stage())->toBe(OrderEditPolicy::STAGE_TERMINAL)
+            ->and($policy->isTerminal())->toBeTrue()
+            ->and(array_keys($policy->locked()))->toBe(OrderEditPolicy::FIELDS)
+            ->and($policy->check('notes'))->toBe(sprintf('The order is %s and can no longer be changed.', $status));
+    }
+
+    $config = new OrderConfig();
+    $config->setRawAttributes([
+        'uuid' => 'config-uuid',
+        'meta' => json_encode(['lifecycle' => ['initial' => 'booked', 'completed' => 'delivered', 'terminal' => ['no_show']]]),
+        'flow' => json_encode([
+            'booked'    => ['key' => 'booked', 'code' => 'booked', 'status' => 'Booked', 'activities' => ['delivered']],
+            'delivered' => ['key' => 'delivered', 'code' => 'delivered', 'status' => 'Delivered', 'complete' => true],
+            'no_show'   => ['key' => 'no_show', 'code' => 'no_show', 'status' => 'No show'],
+        ]),
+    ], true);
+
+    expect(OrderEditPolicy::for(fleetopsEditPolicyOrder('delivered', [], $config))->stage())->toBe(OrderEditPolicy::STAGE_TERMINAL)
+        ->and(OrderEditPolicy::for(fleetopsEditPolicyOrder('no_show', [], $config))->stage())->toBe(OrderEditPolicy::STAGE_TERMINAL)
+        ->and(OrderEditPolicy::for(fleetopsEditPolicyOrder('booked', [], $config))->stage())->toBe(OrderEditPolicy::STAGE_OPEN);
+});
+
+test('asserting a locked edit throws with every refused field and the policy serializes', function () {
+    $policy = OrderEditPolicy::for(fleetopsEditPolicyOrder('dispatched'));
+
+    $policy->assert(['dropoff' => true, 'notes' => true]);
+
+    try {
+        $policy->assert(['dropoff' => true, 'items' => ['adds' => false], 'schedule' => ['from' => 'a', 'to' => 'b']]);
+        $this->fail('Expected the edit to be refused');
+    } catch (OrderEditLockedException $exception) {
+        expect($exception->locked)->toBe([
+            'items'    => 'Items cannot be changed once a driver has the order.',
+            'schedule' => 'The schedule cannot be changed once a driver has the order.',
+        ])
+            ->and($exception->getCode())->toBe(422)
+            ->and($exception->getMessage())->toContain('Items cannot be changed')
+            ->and($exception->toResponseData())->toBe(['locked' => $exception->locked]);
+    }
+
+    $serialized = OrderEditPolicy::for(fleetopsEditPolicyOrder('ready'))->toArray();
+
+    expect($serialized['stage'])->toBe('ready')
+        ->and($serialized['status'])->toBe('ready')
+        ->and((array) $serialized['locked'])->toBe([])
+        ->and((array) $serialized['restrictions'])->toBe(['items' => 'removal_only', 'schedule' => 'earlier_only'])
+        ->and(fleetopsEditPolicyOrder('ready')->editPolicy())->toBeInstanceOf(OrderEditPolicy::class);
+});
diff --git a/server/tests/Unit/Support/OrderOperationsTest.php b/server/tests/Unit/Support/OrderOperationsTest.php
new file mode 100644
index 000000000..89ee3a7c2
--- /dev/null
+++ b/server/tests/Unit/Support/OrderOperationsTest.php
@@ -0,0 +1,379 @@
+<?php
+
+if (!function_exists('Fleetbase\Support\session')) {
+    eval('namespace Fleetbase\Support; function session($key = null, $default = null) { if ($key === null) { return new class { public function has($k) { return \session($k) !== null; } public function get($k, $d = null) { return \session($k, $d); } }; } return \session($key, $default); }');
+}
+
+if (!function_exists('Fleetbase\Support\auth')) {
+    eval('namespace Fleetbase\Support; function auth() { return new class { public function user() { return null; } public function id() { return null; } }; }');
+}
+
+if (!function_exists('event')) {
+    function event(...$arguments)
+    {
+        return app('events')->dispatch(...$arguments);
+    }
+}
+
+use Fleetbase\FleetOps\Console\Commands\ExpireOrderOffers;
+use Fleetbase\FleetOps\Events\OrderChanged;
+use Fleetbase\FleetOps\Events\OrderOfferChanged;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Entity;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Payload;
+use Fleetbase\FleetOps\Support\OrderEdit;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Support\Carbon;
+
+/**
+ * Covers order edits against SQLite: replacing a payload's entities, keeping the
+ * driver's stop when an in-progress route changes, the order.changed event an edit
+ * commits, and the driver offer lifecycle with its expiry command.
+ */
+class FleetOpsOrderOpsEventRecorder
+{
+    public array $dispatched = [];
+
+    public function dispatch($event, $payload = [], $halt = false)
+    {
+        if (is_object($event)) {
+            $this->dispatched[] = $event;
+        }
+
+        return $halt ? null : [];
+    }
+
+    public function of(string $class): array
+    {
+        return array_values(array_filter($this->dispatched, fn ($event) => $event instanceof $class));
+    }
+
+    public function __call($method, $arguments)
+    {
+        return null;
+    }
+}
+
+/**
+ * Runs only the uuid and public id generation the models register, none of the
+ * observers and tracking number hooks, which reach for services the harness lacks.
+ */
+class FleetOpsOrderOpsModelDispatcher extends Illuminate\Events\Dispatcher
+{
+    public function listen($events, $listener = null)
+    {
+        if (!$listener instanceof Closure) {
+            return;
+        }
+
+        $file = (string) (new ReflectionFunction($listener))->getFileName();
+        if (str_contains($file, 'HasUuid') || str_contains($file, 'HasPublicId')) {
+            parent::listen($events, $listener);
+        }
+    }
+}
+
+class FleetOpsOrderOpsDriver extends Driver
+{
+    public array $notified = [];
+
+    public function notify($instance)
+    {
+        $this->notified[] = $instance;
+    }
+}
+
+function fleetopsOrderOpsBoot(): SQLiteConnection
+{
+    $pdo = new PDO('sqlite::memory:');
+    $pdo->sqliteCreateFunction('ST_PointFromText', fn ($wkt, $srid = 0, $axisOrder = null) => $wkt);
+    $pdo->sqliteCreateFunction('ST_GeomFromText', fn ($wkt, $srid = 0, $axisOrder = null) => $wkt);
+    $connection = new SQLiteConnection($pdo);
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+    // models register their uuid hooks once, when first booted, so every test shares one dispatcher
+    static $modelDispatcher;
+    EloquentModel::setEventDispatcher($modelDispatcher ??= new FleetOpsOrderOpsModelDispatcher());
+    app()->instance('db', new class($connection) {
+        public function __construct(public SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null): SQLiteConnection
+        {
+            return $this->c;
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+    class_exists(Fleetbase\FleetOps\Models\Contact::class);
+
+    foreach (['DNS2D', 'DNS1D'] as $barcode) {
+        app()->instance($barcode, new class {
+            public function __call($method, $arguments)
+            {
+                return 'barcode';
+            }
+        });
+    }
+
+    app()->instance('events', new FleetOpsOrderOpsEventRecorder());
+    app()->instance('responsecache', new class {
+        public function __call($method, $arguments)
+        {
+            return null;
+        }
+    });
+
+    $schema = $connection->getSchemaBuilder();
+    $tables = [
+        'orders'            => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'tracking_number_uuid', 'driver_assigned_uuid', 'customer_uuid', 'customer_type', 'order_config_uuid', 'status', 'type', 'notes', 'scheduled_at', 'started', 'dispatched', 'adhoc', 'distance', 'time', 'meta', 'orchestrator_priority', '_key'],
+        'payloads'          => ['uuid', 'public_id', 'company_uuid', 'pickup_uuid', 'dropoff_uuid', 'return_uuid', 'current_waypoint_uuid', 'cod_amount', 'cod_currency', 'type', 'meta', '_key'],
+        'places'            => ['uuid', 'public_id', 'company_uuid', 'owner_uuid', 'name', 'street1', 'city', 'country', 'location', 'meta', 'type', '_key', '_import_id'],
+        'waypoints'         => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'place_uuid', 'tracking_number_uuid', 'customer_uuid', 'customer_type', 'order', 'type', '_import_id', '_key'],
+        'entities'          => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'destination_uuid', 'tracking_number_uuid', 'customer_uuid', 'customer_type', 'photo_uuid', 'name', 'type', 'price', 'meta', 'qr_code', 'barcode', '_import_id', '_key'],
+        'drivers'           => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'current_job_uuid', 'status', '_key'],
+        'contacts'          => ['uuid', 'public_id', 'company_uuid', 'name', 'type', 'meta', '_key'],
+        'tracking_numbers'  => ['uuid', 'public_id', 'company_uuid', 'tracking_number', 'owner_uuid', 'owner_type', 'region', 'qr_code', 'barcode', 'status_uuid', '_key'],
+        'companies'         => ['uuid', 'public_id', 'name', 'country'],
+        'tracking_statuses' => ['uuid', 'public_id', 'company_uuid', 'tracking_number_uuid', 'code', 'status', 'details', 'location', 'city', 'province', 'postal_code', 'country', 'complete', '_key'],
+    ];
+    foreach ($tables as $table => $columns) {
+        $schema->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    session(['company' => 'company-1', 'api_key' => 'console', 'user' => null]);
+    $connection->table('companies')->insert(['uuid' => 'company-1', 'name' => 'Acme', 'country' => 'SG']);
+    $connection->table('places')->insert([
+        ['uuid' => 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa', 'public_id' => 'place_pickup', 'company_uuid' => 'company-1', 'name' => 'Store', 'street1' => '1 Store Rd'],
+        ['uuid' => 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb', 'public_id' => 'place_drop_old', 'company_uuid' => 'company-1', 'name' => 'Old Drop', 'street1' => '2 Old Rd'],
+        ['uuid' => 'cccccccc-cccc-4ccc-8ccc-cccccccccccc', 'public_id' => 'place_drop_new', 'company_uuid' => 'company-1', 'name' => 'Tower B', 'street1' => '8 Marina View'],
+        ['uuid' => 'dddddddd-dddd-4ddd-8ddd-dddddddddddd', 'public_id' => 'place_stop_d', 'company_uuid' => 'company-1', 'name' => 'Stop D', 'street1' => '4 D St'],
+    ]);
+    $connection->table('drivers')->insert(['uuid' => 'driver-1', 'public_id' => 'driver_one', 'company_uuid' => 'company-1', 'current_job_uuid' => 'order-1']);
+
+    return $connection;
+}
+
+function fleetopsOrderOpsEvents(): FleetOpsOrderOpsEventRecorder
+{
+    return app('events');
+}
+
+function fleetopsOrderOpsOrder(SQLiteConnection $connection, array $order = [], array $payload = []): Order
+{
+    $connection->table('payloads')->insert(array_merge([
+        'uuid'                  => 'payload-1',
+        'public_id'             => 'payload_one',
+        'company_uuid'          => 'company-1',
+        'pickup_uuid'           => 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+        'dropoff_uuid'          => 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+        'current_waypoint_uuid' => 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+    ], $payload));
+    $connection->table('orders')->insert(array_merge([
+        'uuid'         => 'order-1',
+        'public_id'    => 'order_one',
+        'company_uuid' => 'company-1',
+        'payload_uuid' => 'payload-1',
+        'status'       => 'created',
+    ], $order));
+
+    return Order::where('uuid', 'order-1')->first();
+}
+
+test('sync entities updates named entities creates new ones and deletes the rest while set entities appends', function () {
+    $connection = fleetopsOrderOpsBoot();
+    $order      = fleetopsOrderOpsOrder($connection);
+    $payload    = $order->payload;
+
+    $payload->setEntities([['name' => 'Latte', 'price' => '450'], ['name' => 'Muffin', 'price' => '300']]);
+    $latte  = Entity::where('name', 'Latte')->first();
+    $muffin = Entity::where('name', 'Muffin')->first();
+
+    // resending the same list through setEntities duplicates it
+    $payload->setEntities([['name' => 'Latte', 'price' => '450']]);
+    expect(Entity::where('payload_uuid', 'payload-1')->count())->toBe(3);
+    Entity::where('name', 'Latte')->where('uuid', '!=', $latte->uuid)->get()->each->forceDelete();
+
+    expect($payload->entitiesListOnlyNamesExisting([['id' => $latte->public_id]]))->toBeTrue()
+        ->and($payload->entitiesListOnlyNamesExisting([['id' => $latte->public_id], ['name' => 'New']]))->toBeFalse();
+
+    $result = $payload->syncEntities([
+        ['id' => $latte->public_id, 'name' => 'Latte', 'price' => '500'],
+        ['name' => 'Croissant', 'price' => '350'],
+    ]);
+
+    $names = Entity::where('payload_uuid', 'payload-1')->orderBy('name')->pluck('name')->all();
+
+    expect($names)->toBe(['Croissant', 'Latte'])
+        ->and(Entity::where('uuid', $latte->uuid)->value('price'))->toBe('500')
+        ->and($result['updated'])->toBe([$latte->uuid])
+        ->and($result['deleted'])->toBe([$muffin->uuid])
+        ->and($result['created'])->toHaveCount(1)
+        ->and($payload->syncEntities([['uuid' => $latte->uuid, 'name' => 'Latte', 'price' => '500']])['updated'])->toBe([]);
+});
+
+test('route signatures report changed parts and a not started order restarts at the first stop', function () {
+    $connection = fleetopsOrderOpsBoot();
+    $order      = fleetopsOrderOpsOrder($connection, [], ['current_waypoint_uuid' => 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb']);
+    $payload    = $order->payload;
+    $before     = $payload->routeSignature();
+
+    $connection->table('payloads')->update(['dropoff_uuid' => 'cccccccc-cccc-4ccc-8ccc-cccccccccccc']);
+    $payload = Payload::where('uuid', 'payload-1')->first();
+
+    expect(Payload::routeChanges($before, $payload->routeSignature()))->toBe(['dropoff'])
+        ->and(Payload::routeChanges($before, $before))->toBe([]);
+
+    $payload->reconcileCurrentWaypoint($before, false);
+
+    expect($connection->table('payloads')->value('current_waypoint_uuid'))->toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+});
+
+test('an in progress order keeps the driver on their stop or moves them to its replacement', function () {
+    $connection = fleetopsOrderOpsBoot();
+
+    // heading to the pickup, the dropoff changes: the pickup stays current
+    $order   = fleetopsOrderOpsOrder($connection, ['status' => 'driver_enroute', 'started' => '1']);
+    $before  = $order->payload->routeSignature();
+    $connection->table('payloads')->update(['dropoff_uuid' => 'cccccccc-cccc-4ccc-8ccc-cccccccccccc']);
+    Payload::where('uuid', 'payload-1')->first()->reconcileCurrentWaypoint($before, true);
+    expect($connection->table('payloads')->value('current_waypoint_uuid'))->toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+
+    // heading to the dropoff, the dropoff changes: the new dropoff becomes current
+    $connection->table('payloads')->update(['dropoff_uuid' => 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb', 'current_waypoint_uuid' => 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb']);
+    $before = Payload::where('uuid', 'payload-1')->first()->routeSignature();
+    $connection->table('payloads')->update(['dropoff_uuid' => 'cccccccc-cccc-4ccc-8ccc-cccccccccccc']);
+    Payload::where('uuid', 'payload-1')->first()->reconcileCurrentWaypoint($before, true);
+    expect($connection->table('payloads')->value('current_waypoint_uuid'))->toBe('cccccccc-cccc-4ccc-8ccc-cccccccccccc');
+
+    // a multi-stop route loses the stop the driver was heading to: the next stop takes over
+    $connection->table('payloads')->update(['pickup_uuid' => null, 'dropoff_uuid' => null, 'current_waypoint_uuid' => 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb']);
+    $connection->table('waypoints')->insert([
+        ['uuid' => 'wp-1', 'company_uuid' => 'company-1', 'payload_uuid' => 'payload-1', 'place_uuid' => 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb', 'order' => 0],
+        ['uuid' => 'wp-2', 'company_uuid' => 'company-1', 'payload_uuid' => 'payload-1', 'place_uuid' => 'dddddddd-dddd-4ddd-8ddd-dddddddddddd', 'order' => 1],
+    ]);
+    $before = Payload::where('uuid', 'payload-1')->first()->routeSignature();
+    $connection->table('waypoints')->where('uuid', 'wp-1')->update(['deleted_at' => now()]);
+    Payload::where('uuid', 'payload-1')->first()->reconcileCurrentWaypoint($before, true);
+    expect($connection->table('payloads')->value('current_waypoint_uuid'))->toBe('dddddddd-dddd-4ddd-8ddd-dddddddddddd');
+});
+
+test('committing a dropoff change on a dispatched order keeps its stop and announces order changed', function () {
+    $connection = fleetopsOrderOpsBoot();
+    $order      = fleetopsOrderOpsOrder($connection, ['status' => 'dispatched', 'driver_assigned_uuid' => 'driver-1'], ['cod_amount' => '5000']);
+    $driver     = new FleetOpsOrderOpsDriver();
+    $driver->setRawAttributes(['uuid' => 'driver-1', 'public_id' => 'driver_one', 'company_uuid' => 'company-1'], true);
+    $order->setRelation('driverAssigned', $driver);
+
+    $edit = OrderEdit::begin($order);
+
+    // the edit is allowed: route changes are open while a driver has the order
+    $edit->guard($edit->requestedChanges(['dropoff' => ['id' => 'place_drop_new']]));
+
+    $connection->table('payloads')->update(['dropoff_uuid' => 'cccccccc-cccc-4ccc-8ccc-cccccccccccc']);
+    $changes = $edit->commit(['total' => 8400, 'currency' => 'SGD', 'changed_by' => 'Jon (store)']);
+
+    $events = fleetopsOrderOpsEvents()->of(OrderChanged::class);
+
+    expect($changes)->toBe(['dropoff'])
+        ->and($connection->table('payloads')->value('current_waypoint_uuid'))->toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa')
+        ->and($events)->toHaveCount(1)
+        ->and($events[0]->broadcastAs())->toBe('order.changed')
+        ->and($events[0]->channelNames)->toBe(['order.order_one', 'order.order-1', 'driver.driver_one', 'driver.driver-1', 'company.company-1'])
+        ->and($events[0]->data)->toMatchArray([
+            'id'         => 'order_one',
+            'changes'    => ['dropoff'],
+            'summary'    => 'Drop-off changed to TOWER B - 8 MARINA VIEW',
+            'cod_amount' => 5000,
+            'total'      => 8400,
+            'currency'   => 'SGD',
+            'changed_by' => 'Jon (store)',
+        ])
+        ->and($events[0]->data['dropoff']['id'])->toBe('place_drop_new')
+        ->and($events[0]->broadcastWith()['data'])->toBe($events[0]->data);
+});
+
+test('order changed pushes the assigned driver only for changes that concern them', function () {
+    $connection = fleetopsOrderOpsBoot();
+    $order      = fleetopsOrderOpsOrder($connection, ['status' => 'dispatched', 'driver_assigned_uuid' => 'driver-1']);
+    $driver     = new FleetOpsOrderOpsDriver();
+    $driver->setRawAttributes(['uuid' => 'driver-1', 'public_id' => 'driver_one', 'company_uuid' => 'company-1'], true);
+    $order->setRelation('driverAssigned', $driver);
+
+    $event = OrderChanged::dispatchFor($order, ['dropoff', 'items', 'dropoff'], 'Drop-off changed', ['changed_by' => 'Jon (store)', 'dropoff' => null]);
+
+    expect($event->data['changes'])->toBe(['dropoff', 'items'])
+        ->and($driver->notified)->toHaveCount(1)
+        ->and($driver->notified[0])->toBeInstanceOf(Fleetbase\FleetOps\Notifications\OrderChanged::class)
+        ->and($driver->notified[0]->data)->toBe(['type' => 'order_changed', 'id' => 'order_one', 'changes' => ['dropoff', 'items']])
+        ->and($driver->notified[0]->message)->toBe('Drop-off changed');
+
+    OrderChanged::dispatchFor($order, ['contact'], 'Customer changed');
+    OrderChanged::dispatchFor($order, ['items'], 'Items changed', [], false);
+
+    expect($driver->notified)->toHaveCount(1)
+        ->and(OrderChanged::dispatchFor($order, []))->toBeNull()
+        ->and(fleetopsOrderOpsEvents()->of(OrderChanged::class))->toHaveCount(3);
+});
+
+test('an edit that changes nothing announces nothing and item and notes changes are detected', function () {
+    $connection = fleetopsOrderOpsBoot();
+    $order      = fleetopsOrderOpsOrder($connection);
+
+    expect(OrderEdit::begin($order)->commit())->toBe([])
+        ->and(fleetopsOrderOpsEvents()->of(OrderChanged::class))->toBe([]);
+
+    $edit = OrderEdit::begin($order);
+    $order->payload->setEntities([['name' => 'Latte']]);
+    $order->notes = 'Ring twice';
+    $order->save();
+
+    expect($edit->commit())->toBe(['items', 'notes'])
+        ->and($connection->table('payloads')->value('current_waypoint_uuid'))->toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa')
+        ->and(fleetopsOrderOpsEvents()->of(OrderChanged::class)[0]->data['summary'])->toBe('Items changed · Notes updated');
+});
+
+test('requested changes name the policy fields an edit touches', function () {
+    $connection = fleetopsOrderOpsBoot();
+    $order      = fleetopsOrderOpsOrder($connection, ['status' => 'ready', 'scheduled_at' => '2026-10-13 12:00:00', 'notes' => 'Same'], ['cod_amount' => '0']);
+    $order->payload->setEntities([['name' => 'Latte']]);
+    $latte = Entity::where('name', 'Latte')->first();
+    $edit  = OrderEdit::begin($order);
+
+    expect($edit->requestedChanges([
+        'dropoff'      => ['id' => 'place_drop_new'],
+        'entities'     => [['id' => $latte->public_id]],
+        'scheduled_at' => '2026-10-13 11:00:00',
+        'notes'        => 'Same',
+        'cod_amount'   => 0,
+    ], OrderEdit::ENTITIES_REPLACE))->toBe([
+        'dropoff'  => true,
+        'items'    => ['adds' => false],
+        'schedule' => ['from' => '2026-10-13T12:00:00Z', 'to' => '2026-10-13 11:00:00'],
+    ]);
+
+    // ready: removing items and an earlier time pass, adding an item does not
+    $edit->guard($edit->requestedChanges(['entities' => [['id' => $latte->public_id]], 'scheduled_at' => '2026-10-13 11:00:00'], OrderEdit::ENTITIES_REPLACE));
+
+    expect(fn () => $edit->guard($edit->requestedChanges(['entities' => [['name' => 'Cake']]])))
+        ->toThrow(Fleetbase\FleetOps\Exceptions\OrderEditLockedException::class, 'Once the order is ready, items can only be removed.')
+        ->and(OrderEdit::entitiesMode('replace'))->toBe('replace')
+        ->and(OrderEdit::entitiesMode('sync'))->toBe('replace')
+        ->and(OrderEdit::entitiesMode(null))->toBe('append');
+});

From e8f250afb0096b5fc7ae06af247ba20a93a73d10 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 17:32:09 +0800
Subject: [PATCH 75/87] fix(orders): tell a driver when an order is taken off
 them; send OrderDriverAssigned once

When an order's driver is removed or replaced, the old driver now hears
about it: `order.driver_unassigned` is broadcast on driver.{public_id},
driver.{uuid} and the company channel with { id, driver }, the new
OrderUnassigned push sends { type: "order_unassigned", id }, and the order
is cleared as their current job. This runs from the order observer (public
update, console update, assign, unassign-order) and from the bulk paths that
bypass the model (unassign-orders, bulk-assign-driver).

Order::assignDriver no longer fires OrderDriverAssigned itself before saving;
the observer fires it once after the save, so drivers stop getting the
assignment twice. A silent assignment is now silent for that save, and the
silent flag survives the public-id lookup.
---
 server/src/Events/OrderDriverUnassigned.php   |  68 +++++++++++
 .../Internal/v1/DriverController.php          |   9 ++
 .../Internal/v1/OrderController.php           |  10 ++
 server/src/Models/Order.php                   |  65 ++++++++++-
 server/src/Notifications/OrderUnassigned.php  |  66 +++++++++++
 server/src/Observers/OrderObserver.php        |  10 +-
 .../src/Providers/FleetOpsServiceProvider.php |   1 +
 .../OrderChangeNotificationsTest.php          |   9 ++
 .../Observers/OrderAssignmentObserverTest.php | 107 ++++++++++++++++++
 .../Unit/Support/OrderOperationsTest.php      |  15 +++
 10 files changed, 354 insertions(+), 6 deletions(-)
 create mode 100644 server/src/Events/OrderDriverUnassigned.php
 create mode 100644 server/src/Notifications/OrderUnassigned.php
 create mode 100644 server/tests/Unit/Observers/OrderAssignmentObserverTest.php

diff --git a/server/src/Events/OrderDriverUnassigned.php b/server/src/Events/OrderDriverUnassigned.php
new file mode 100644
index 000000000..c5454bb39
--- /dev/null
+++ b/server/src/Events/OrderDriverUnassigned.php
@@ -0,0 +1,68 @@
+<?php
+
+namespace Fleetbase\FleetOps\Events;
+
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Order;
+use Illuminate\Broadcasting\Channel;
+use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcast;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Support\Carbon;
+
+/**
+ * Broadcast as `order.driver_unassigned` when a driver is taken off an order,
+ * whether unassigned or replaced by another driver.
+ *
+ * Channels: driver.{old driver public_id}, driver.{old driver uuid} and the
+ * order's company channel. Data: { id: order public id, driver: old driver public id }.
+ */
+class OrderDriverUnassigned implements ShouldBroadcast
+{
+    use Dispatchable;
+    use InteractsWithSockets;
+
+    public string $eventId;
+
+    public string $sentAt;
+
+    public array $channelNames = [];
+
+    public array $data = [];
+
+    public function __construct(Order $order, Driver $driver)
+    {
+        $this->eventId      = uniqid('event_');
+        $this->sentAt       = Carbon::now()->toDateTimeString();
+        $this->channelNames = array_values(array_filter([
+            $driver->public_id ? 'driver.' . $driver->public_id : null,
+            $driver->uuid ? 'driver.' . $driver->uuid : null,
+            $order->company_uuid ? 'company.' . $order->company_uuid : null,
+        ]));
+        $this->data = [
+            'id'     => $order->public_id,
+            'driver' => $driver->public_id,
+        ];
+    }
+
+    public function broadcastOn(): array
+    {
+        return array_map(fn (string $name) => new Channel($name), $this->channelNames);
+    }
+
+    public function broadcastAs(): string
+    {
+        return 'order.driver_unassigned';
+    }
+
+    public function broadcastWith(): array
+    {
+        return [
+            'id'          => $this->eventId,
+            'api_version' => config('api.version'),
+            'event'       => $this->broadcastAs(),
+            'created_at'  => $this->sentAt,
+            'data'        => $this->data,
+        ];
+    }
+}
diff --git a/server/src/Http/Controllers/Internal/v1/DriverController.php b/server/src/Http/Controllers/Internal/v1/DriverController.php
index aee020d4b..6e4dcc212 100644
--- a/server/src/Http/Controllers/Internal/v1/DriverController.php
+++ b/server/src/Http/Controllers/Internal/v1/DriverController.php
@@ -596,6 +596,15 @@ protected function clearDriverAssignmentsForOrders($orders): void
             'updated_at'           => now(),
         ]);
         Order::invalidateApiCacheManually(session('company'));
+
+        // The bulk update bypasses the order observer, so the driver taken off each
+        // order is told here
+        foreach ($orders as $order) {
+            $previousDriverUuid = $order->driver_assigned_uuid;
+            if ($previousDriverUuid) {
+                $order->notifyDriverUnassigned($previousDriverUuid);
+            }
+        }
     }
 
     protected function freshOrders($orders, array $with)
diff --git a/server/src/Http/Controllers/Internal/v1/OrderController.php b/server/src/Http/Controllers/Internal/v1/OrderController.php
index 69a78a52f..2da065c52 100644
--- a/server/src/Http/Controllers/Internal/v1/OrderController.php
+++ b/server/src/Http/Controllers/Internal/v1/OrderController.php
@@ -782,11 +782,21 @@ protected function orderResponse(Order $order): array
 
     protected function assignDriverToOrders($orderUuids, Driver $driver): void
     {
+        // Drivers being replaced are told once the assignment is written
+        $replaced = $this->scopedToCompany(Order::whereIn('uuid', $orderUuids))
+            ->whereNotNull('driver_assigned_uuid')
+            ->where('driver_assigned_uuid', '!=', $driver->uuid)
+            ->get();
+
         $this->scopedToCompany(Order::whereIn('uuid', $orderUuids))->update([
             'driver_assigned_uuid' => $driver->uuid,
             'updated_at'           => now(),
         ]);
         Order::invalidateApiCacheManually(session('company'));
+
+        foreach ($replaced as $order) {
+            $order->notifyDriverUnassigned($order->driver_assigned_uuid);
+        }
     }
 
     protected function dispatchBulkAssignedDriverNotification(array $orderUuids, Driver $driver): void
diff --git a/server/src/Models/Order.php b/server/src/Models/Order.php
index 001ff9265..0370a7240 100644
--- a/server/src/Models/Order.php
+++ b/server/src/Models/Order.php
@@ -8,7 +8,9 @@
 use Fleetbase\FleetOps\Events\OrderCompleted;
 use Fleetbase\FleetOps\Events\OrderDispatched;
 use Fleetbase\FleetOps\Events\OrderDriverAssigned;
+use Fleetbase\FleetOps\Events\OrderDriverUnassigned;
 use Fleetbase\FleetOps\Flow\Activity;
+use Fleetbase\FleetOps\Notifications\OrderUnassigned;
 use Fleetbase\FleetOps\Support\LabelPdf;
 use Fleetbase\FleetOps\Support\OrderEditPolicy;
 use Fleetbase\FleetOps\Support\OrderTracker;
@@ -36,6 +38,7 @@
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Str;
 use Spatie\Activitylog\LogOptions;
 use Spatie\Activitylog\Traits\LogsActivity;
@@ -277,6 +280,16 @@ class Order extends Model
         '_key',
     ];
 
+    /**
+     * Set for one save: the driver assignment being saved sends no assignment notification.
+     */
+    public bool $silentDriverAssignment = false;
+
+    /**
+     * Set for one save: the driver taken off the order is not sent an unassigned push (they declined it themselves).
+     */
+    public bool $quietDriverUnassignment = false;
+
     /**
      * Enforce a morph map.
      */
@@ -1462,6 +1475,44 @@ public function notifyDriverAssigned()
         }
     }
 
+    /**
+     * Tell a driver the order was taken off them: broadcasts `order.driver_unassigned`
+     * on their channels and pushes `{ type: "order_unassigned", id }` to their devices.
+     * The order is cleared as the driver's current job.
+     *
+     * @param Driver|string|null $driver the driver (or driver uuid) removed from the order
+     */
+    public function notifyDriverUnassigned($driver): bool
+    {
+        if (is_string($driver)) {
+            $driver = Driver::where('uuid', $driver)->withoutGlobalScopes()->first();
+        }
+
+        if (!$driver instanceof Driver) {
+            return false;
+        }
+
+        if ($driver->current_job_uuid && $driver->current_job_uuid === $this->uuid) {
+            $driver->forceFill(['current_job_uuid' => null])->saveQuietly();
+        }
+
+        try {
+            event(new OrderDriverUnassigned($this, $driver));
+        } catch (\Throwable $exception) {
+            Log::warning('Unable to broadcast order.driver_unassigned', ['order' => $this->public_id, 'error' => $exception->getMessage()]);
+        }
+
+        if (!$this->quietDriverUnassignment) {
+            try {
+                $driver->notify(new OrderUnassigned($this));
+            } catch (\Throwable $exception) {
+                Log::warning('Unable to notify driver of unassignment', ['order' => $this->public_id, 'error' => $exception->getMessage()]);
+            }
+        }
+
+        return true;
+    }
+
     /**
      * The edit policy for the order at its current status.
      */
@@ -1727,7 +1778,7 @@ public function assignDriver($driver, $silent = false)
                         return $this;
                     }
 
-                    return $this->assignDriver($driver);
+                    return $this->assignDriver($driver, $silent);
                 }
 
                 throw new \Exception('Invalid driver provided for assignment!');
@@ -1740,12 +1791,16 @@ public function assignDriver($driver, $silent = false)
             $this->setRelation('driverAssigned', $driver);
         }
 
-        if (!$silent) {
-            $this->notifyDriverAssigned();
+        // The order observer sends OrderDriverAssigned once the assignment is saved
+        // (and tells a replaced driver they were unassigned), so it is not fired here
+        // as well. A silent assignment is flagged for that one save.
+        $this->silentDriverAssignment = (bool) $silent;
+        try {
+            $this->save();
+        } finally {
+            $this->silentDriverAssignment = false;
         }
 
-        $this->save();
-
         return $this;
     }
 
diff --git a/server/src/Notifications/OrderUnassigned.php b/server/src/Notifications/OrderUnassigned.php
new file mode 100644
index 000000000..b1afe886b
--- /dev/null
+++ b/server/src/Notifications/OrderUnassigned.php
@@ -0,0 +1,66 @@
+<?php
+
+namespace Fleetbase\FleetOps\Notifications;
+
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\Support\PushNotification;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Notifications\Notification;
+use NotificationChannels\Apn\ApnChannel;
+use NotificationChannels\Fcm\FcmChannel;
+
+/**
+ * Tells a driver that an order was taken off them (unassigned or reassigned).
+ *
+ * Push data: { type: "order_unassigned", id: order public id }.
+ */
+class OrderUnassigned extends Notification implements ShouldQueue
+{
+    use Queueable;
+
+    public static string $name        = 'Order Unassigned';
+    public static string $description = 'Notify a driver when an order is unassigned from them or reassigned to another driver.';
+    public static string $package     = 'fleet-ops';
+
+    public Order $order;
+
+    public string $title;
+
+    public string $message;
+
+    public array $data = [];
+
+    public function __construct(Order $order)
+    {
+        $this->order   = $order;
+        $this->title   = 'Order ' . (data_get($order, 'trackingNumber.tracking_number') ?? $order->public_id) . ' unassigned';
+        $this->message = 'This order is no longer assigned to you.';
+        $this->data    = ['type' => 'order_unassigned', 'id' => $order->public_id];
+    }
+
+    public function via($notifiable): array
+    {
+        return [FcmChannel::class, ApnChannel::class];
+    }
+
+    public function toArray($notifiable = null): array
+    {
+        return [
+            'event' => 'order.unassigned_notification',
+            'title' => $this->title,
+            'body'  => $this->message,
+            'data'  => $this->data,
+        ];
+    }
+
+    public function toFcm($notifiable)
+    {
+        return PushNotification::createFcmMessage($this->title, $this->message, $this->data);
+    }
+
+    public function toApn($notifiable)
+    {
+        return PushNotification::createApnMessage($this->title, $this->message, $this->data, 'view_order');
+    }
+}
diff --git a/server/src/Observers/OrderObserver.php b/server/src/Observers/OrderObserver.php
index 796c908c7..45c9261bd 100644
--- a/server/src/Observers/OrderObserver.php
+++ b/server/src/Observers/OrderObserver.php
@@ -58,7 +58,15 @@ public function updated(Order $order)
         $order->setDriverLocationAsPickup();
 
         if ($order->wasChanged('driver_assigned_uuid')) {
-            $order->notifyDriverAssigned();
+            // The driver taken off the order hears about it, whether it was unassigned or reassigned.
+            $previousDriverUuid = $order->getOriginal('driver_assigned_uuid');
+            if ($previousDriverUuid) {
+                $order->notifyDriverUnassigned($previousDriverUuid);
+            }
+
+            if (!$order->silentDriverAssignment) {
+                $order->notifyDriverAssigned();
+            }
         }
 
         $this->invalidateCache($order);
diff --git a/server/src/Providers/FleetOpsServiceProvider.php b/server/src/Providers/FleetOpsServiceProvider.php
index a60f5de5f..bb24c8932 100644
--- a/server/src/Providers/FleetOpsServiceProvider.php
+++ b/server/src/Providers/FleetOpsServiceProvider.php
@@ -253,6 +253,7 @@ public function registerNotifications()
             \Fleetbase\FleetOps\Notifications\RouteDeviation::class,
             \Fleetbase\FleetOps\Notifications\ProlongedStoppage::class,
             \Fleetbase\FleetOps\Notifications\OrderChanged::class,
+            \Fleetbase\FleetOps\Notifications\OrderUnassigned::class,
         ]);
 
         // Register Notifiables
diff --git a/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php b/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
index 64c68ebee..0682d86ec 100644
--- a/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
+++ b/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
@@ -45,3 +45,12 @@ function fleetopsOrderChangeNotificationOrder(): Order
         ->and(array_map(fn ($channel) => $channel->name, $notification->broadcastOn()))->toContain('driver.driver-uuid')
         ->and((new OrderChanged(fleetopsOrderChangeNotificationOrder()))->message)->toBe('This order was changed, tap for details.');
 });
+
+test('order unassigned tells the driver the order is no longer theirs', function () {
+    $notification = new OrderUnassigned(fleetopsOrderChangeNotificationOrder());
+
+    expect($notification->title)->toBe('Order FLB-CHANGE-1 unassigned')
+        ->and($notification->data)->toBe(['type' => 'order_unassigned', 'id' => 'order_change'])
+        ->and($notification->via(null))->toBe([FcmChannel::class, ApnChannel::class])
+        ->and($notification->toArray()['event'])->toBe('order.unassigned_notification');
+});
diff --git a/server/tests/Unit/Observers/OrderAssignmentObserverTest.php b/server/tests/Unit/Observers/OrderAssignmentObserverTest.php
new file mode 100644
index 000000000..1c61273d6
--- /dev/null
+++ b/server/tests/Unit/Observers/OrderAssignmentObserverTest.php
@@ -0,0 +1,107 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Observers\OrderObserver;
+use Fleetbase\FleetOps\Support\TrackingPublisher;
+use Illuminate\Cache\ArrayStore;
+use Illuminate\Cache\Repository;
+use Illuminate\Support\Facades\Cache;
+
+/**
+ * Covers how the order observer follows driver assignment: a replaced driver is
+ * told they were unassigned, the new driver is notified exactly once (and not at
+ * all for a silent assignment), and saving an assignment starts the driver offer.
+ */
+class FleetOpsOrderAssignmentObserverOrder extends Order
+{
+    public array $events       = [];
+    public array $originalData = [];
+    public bool $driverChanged = true;
+    public bool $driverDirty   = false;
+
+    public function getOriginal($key = null, $default = null): mixed
+    {
+        return $key === null ? $this->originalData : ($this->originalData[$key] ?? $default);
+    }
+
+    public function wasChanged($attributes = null): bool
+    {
+        return $attributes === 'driver_assigned_uuid' && $this->driverChanged;
+    }
+
+    public function isDirty($attributes = null): bool
+    {
+        return $attributes === 'driver_assigned_uuid' && $this->driverDirty;
+    }
+
+    public function setDriverLocationAsPickup($force = false)
+    {
+    }
+
+    public function notifyDriverAssigned()
+    {
+        $this->events[] = 'assigned:' . $this->driver_assigned_uuid;
+    }
+
+    public function notifyDriverUnassigned($driver): bool
+    {
+        $this->events[] = 'unassigned:' . $driver;
+
+        return true;
+    }
+
+    public function syncOfferWithAssignment(): Order
+    {
+        $this->events[] = 'offer';
+
+        return $this;
+    }
+}
+
+beforeEach(function () {
+    Cache::swap(new Repository(new ArrayStore()));
+    session(['company' => 'company-uuid']);
+
+    // public tracking is published elsewhere; it is not what these tests cover
+    app()->instance(TrackingPublisher::class, new class extends TrackingPublisher {
+        public function orderChanged(Order $order): bool
+        {
+            return false;
+        }
+    });
+});
+
+test('reassigning an order tells the replaced driver and notifies the new one once', function () {
+    $order = new FleetOpsOrderAssignmentObserverOrder();
+    $order->setRawAttributes(['uuid' => 'order-uuid', 'driver_assigned_uuid' => 'driver-new'], true);
+    $order->originalData = ['driver_assigned_uuid' => 'driver-old'];
+
+    (new OrderObserver())->updated($order);
+
+    expect($order->events)->toBe(['unassigned:driver-old', 'assigned:driver-new']);
+});
+
+test('unassigning tells the driver and a silent assignment sends no assignment notification', function () {
+    $unassigned = new FleetOpsOrderAssignmentObserverOrder();
+    $unassigned->setRawAttributes(['uuid' => 'order-uuid', 'driver_assigned_uuid' => null], true);
+    $unassigned->originalData = ['driver_assigned_uuid' => 'driver-old'];
+
+    (new OrderObserver())->updated($unassigned);
+
+    $silent = new FleetOpsOrderAssignmentObserverOrder();
+    $silent->setRawAttributes(['uuid' => 'order-uuid', 'driver_assigned_uuid' => 'driver-new'], true);
+    $silent->silentDriverAssignment = true;
+
+    (new OrderObserver())->updated($silent);
+
+    expect($unassigned->events)->toBe(['unassigned:driver-old', 'assigned:'])
+        ->and($silent->events)->toBe([]);
+});
+
+test('assign driver relies on the observer instead of notifying before the save', function () {
+    $source = file_get_contents(dirname(__DIR__, 3) . '/src/Models/Order.php');
+    preg_match('/public function assignDriver\(.*?\n    }\n/s', $source, $matches);
+
+    expect($matches[0] ?? '')->not->toContain('notifyDriverAssigned()')
+        ->toContain('$this->silentDriverAssignment = (bool) $silent;');
+});
diff --git a/server/tests/Unit/Support/OrderOperationsTest.php b/server/tests/Unit/Support/OrderOperationsTest.php
index 89ee3a7c2..6051132ee 100644
--- a/server/tests/Unit/Support/OrderOperationsTest.php
+++ b/server/tests/Unit/Support/OrderOperationsTest.php
@@ -377,3 +377,18 @@ function fleetopsOrderOpsOrder(SQLiteConnection $connection, array $order = [],
         ->and(OrderEdit::entitiesMode('sync'))->toBe('replace')
         ->and(OrderEdit::entitiesMode(null))->toBe('append');
 });
+
+test('a driver taken off an order is told and loses it as their current job', function () {
+    $connection = fleetopsOrderOpsBoot();
+    $order      = fleetopsOrderOpsOrder($connection);
+
+    expect($order->notifyDriverUnassigned('driver-1'))->toBeTrue()
+        ->and($connection->table('drivers')->where('uuid', 'driver-1')->value('current_job_uuid'))->toBeNull()
+        ->and($order->notifyDriverUnassigned('missing-driver'))->toBeFalse();
+
+    $events = fleetopsOrderOpsEvents()->of(Fleetbase\FleetOps\Events\OrderDriverUnassigned::class);
+    expect($events)->toHaveCount(1)
+        ->and($events[0]->broadcastAs())->toBe('order.driver_unassigned')
+        ->and($events[0]->channelNames)->toBe(['driver.driver_one', 'driver.driver-1', 'company.company-1'])
+        ->and($events[0]->broadcastWith()['data'])->toBe(['id' => 'order_one', 'driver' => 'driver_one']);
+});

From ea06435ac85dc12a3895e29aa6710eeb84aa3aaf Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 17:32:47 +0800
Subject: [PATCH 76/87] feat(orders): driver offers with accept, decline and
 expiry

Assigning a driver now starts an offer on the order, kept in meta.offer as
{ driver, offered_at, expires_at, accepted_at, declined_at, status } with
status offered, accepted, declined or expired. The offer is written in the
same save as the assignment (order observer "saving"), and by the bulk
assign path. The window is the company setting
fleetops.offer_timeout_minutes (default 5; 0 disables expiry). Adhoc
drivers who take an order through `start` with `assign` start accepted,
and starting an order accepts an open offer.

New public endpoints for the authenticated driver (or a `driver` id):
- POST v1/orders/{id}/accept: accepts the offer (assigns an unassigned
  adhoc order to the driver) and broadcasts `order.offer_accepted`.
- POST v1/orders/{id}/decline { reason? }: records the decline, unassigns
  the driver, broadcasts `order.offer_declined` and notifies dispatch
  (OrderOfferDeclined).

The scheduled fleetops:expire-offers command (every minute) expires offers
past expires_at, raises the `driver_not_accepted` operational alert once per
offer (DriverNotAccepted, meta.operational_alerts.driver_not_accepted) and
broadcasts `order.offer_expired` on order.{public_id}, order.{uuid} and
company.{uuid}. The driver stays assigned. The order resources expose `offer`.
---
 .../Console/Commands/ExpireOrderOffers.php    | 158 ++++++++++++++++
 server/src/Events/OrderOfferChanged.php       |  73 ++++++++
 .../Controllers/Api/v1/OrderController.php    | 156 +++++++++++++++-
 .../Internal/v1/DriverController.php          |  14 +-
 .../Internal/v1/OrderController.php           |  12 +-
 server/src/Http/Resources/v1/Index/Order.php  |   1 +
 server/src/Http/Resources/v1/Order.php        |   2 +
 server/src/Models/Order.php                   | 168 ++++++++++++++++++
 .../src/Notifications/DriverNotAccepted.php   |  56 ++++++
 .../src/Notifications/OrderOfferDeclined.php  |  59 ++++++
 server/src/Observers/OrderObserver.php        |  11 ++
 .../src/Providers/FleetOpsServiceProvider.php |   4 +
 server/src/routes.php                         |   2 +
 .../tests/ApiOrderControllerContractsTest.php |  72 ++++++++
 .../Internal/OrderControllerHelpersTest.php   |   6 +-
 .../OrderChangeNotificationsTest.php          |  31 ++++
 .../Observers/OrderAssignmentObserverTest.php |  15 ++
 .../Unit/Support/OrderOperationsTest.php      |  73 ++++++++
 18 files changed, 904 insertions(+), 9 deletions(-)
 create mode 100644 server/src/Console/Commands/ExpireOrderOffers.php
 create mode 100644 server/src/Events/OrderOfferChanged.php
 create mode 100644 server/src/Notifications/DriverNotAccepted.php
 create mode 100644 server/src/Notifications/OrderOfferDeclined.php

diff --git a/server/src/Console/Commands/ExpireOrderOffers.php b/server/src/Console/Commands/ExpireOrderOffers.php
new file mode 100644
index 000000000..9c9374432
--- /dev/null
+++ b/server/src/Console/Commands/ExpireOrderOffers.php
@@ -0,0 +1,158 @@
+<?php
+
+namespace Fleetbase\FleetOps\Console\Commands;
+
+use Fleetbase\FleetOps\Events\OrderOfferChanged;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Notifications\DriverNotAccepted;
+use Fleetbase\Support\NotificationRegistry;
+use Illuminate\Console\Command;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Expire driver offers that were not answered in time.
+ *
+ * An order assigned to a driver carries an offer (`meta.offer`) that expires after
+ * the company's `fleetops.offer_timeout_minutes`. Each offer past its `expires_at`
+ * is marked expired, raises the `driver_not_accepted` operational alert (once per
+ * order, like the alerts of fleetops:process-operational-alerts) and broadcasts
+ * `order.offer_expired` on the order and company channels. The driver stays
+ * assigned: dispatch decides whether to reassign.
+ */
+class ExpireOrderOffers extends Command
+{
+    public const ALERT_KEY = 'driver_not_accepted';
+
+    protected $signature = 'fleetops:expire-offers
+        {--days=2 : Only include orders updated in the last N days}
+        {--chunk=250 : How many orders to process per chunk}
+        {--no-lock : Skip process locking}
+        {--dry : Dry run without updating orders}';
+
+    protected $description = 'Expire driver order offers that were not accepted in time and alert dispatch.';
+
+    public function handle(): int
+    {
+        $days     = max(1, (int) $this->option('days'));
+        $perChunk = max(50, (int) $this->option('chunk'));
+        $dryRun   = (bool) $this->option('dry');
+        $lock     = null;
+
+        if (!$this->option('no-lock')) {
+            $lock = Cache::lock('fleetops:expire-offers', 300);
+            if (!$lock->get()) {
+                $this->warn('Another offer expiry run appears to be in progress.');
+
+                return self::SUCCESS;
+            }
+        }
+
+        try {
+            $now     = Carbon::now();
+            $expired = 0;
+
+            $this->ordersQuery($now->copy()->subDays($days))->orderBy('id')->chunkById($perChunk, function ($orders) use ($now, $dryRun, &$expired) {
+                foreach ($orders as $order) {
+                    if ($this->expire($order, $now, $dryRun)) {
+                        $expired++;
+                    }
+                }
+            });
+
+            $this->info(($dryRun ? '[Dry Run] ' : '') . "Offers expired: {$expired}");
+
+            return self::SUCCESS;
+        } finally {
+            $lock?->release();
+        }
+    }
+
+    /**
+     * Orders with an open offer that are not finished or under way.
+     */
+    protected function ordersQuery(Carbon $cutoff)
+    {
+        return Order::query()
+            ->withoutGlobalScopes()
+            ->where('meta->offer->status', Order::OFFER_OFFERED)
+            ->whereNotIn('status', ['completed', 'canceled', 'expired'])
+            ->where(fn ($query) => $query->whereNull('started')->orWhere('started', false))
+            ->whereNull('deleted_at')
+            ->whereNotNull('company_uuid')
+            ->where('updated_at', '>=', $cutoff);
+    }
+
+    /**
+     * Expire the order's offer when it has run out. Returns whether it was expired.
+     */
+    public function expire(Order $order, Carbon $now, bool $dryRun = false): bool
+    {
+        $offer     = $order->getOffer();
+        $expiresAt = data_get($offer, 'expires_at');
+
+        if (data_get($offer, 'status') !== Order::OFFER_OFFERED || !$expiresAt || Carbon::parse($expiresAt)->isAfter($now)) {
+            return false;
+        }
+
+        // An offer left behind on an order that no longer has a driver is not chased
+        if (!$order->driver_assigned_uuid) {
+            if (!$dryRun) {
+                $order->setMeta('offer', null);
+                $order->saveQuietly();
+            }
+
+            return false;
+        }
+
+        if ($dryRun) {
+            return true;
+        }
+
+        session(['company' => $order->company_uuid]);
+
+        $order->expireOffer();
+        $this->raiseAlert($order, (array) $offer);
+        $this->broadcast($order);
+
+        return true;
+    }
+
+    protected function raiseAlert(Order $order, array $offer): void
+    {
+        $metaKey = 'operational_alerts.' . self::ALERT_KEY;
+        $context = [
+            'driver'     => $offer['driver'] ?? null,
+            'offered_at' => $offer['offered_at'] ?? null,
+            'expires_at' => $offer['expires_at'] ?? null,
+        ];
+
+        // once per offer: a later offer to another driver may alert again
+        if (data_get($order->getMeta($metaKey), 'context.offered_at') === $context['offered_at']) {
+            return;
+        }
+
+        try {
+            NotificationRegistry::notify(DriverNotAccepted::class, $order, $context);
+        } catch (\Throwable $exception) {
+            Log::warning('Unable to raise driver_not_accepted alert', ['order' => $order->public_id, 'error' => $exception->getMessage()]);
+        }
+
+        $order->setMeta($metaKey, [
+            'notified_at' => Carbon::now()->toDateTimeString(),
+            'context'     => $context,
+        ]);
+        $order->saveQuietly();
+        $order->invalidateApiCache();
+    }
+
+    protected function broadcast(Order $order): void
+    {
+        try {
+            event(new OrderOfferChanged($order, Order::OFFER_EXPIRED));
+        } catch (\Throwable $exception) {
+            Log::warning('Unable to broadcast order.offer_expired', ['order' => $order->public_id, 'error' => $exception->getMessage()]);
+        }
+    }
+}
diff --git a/server/src/Events/OrderOfferChanged.php b/server/src/Events/OrderOfferChanged.php
new file mode 100644
index 000000000..08c82cd5f
--- /dev/null
+++ b/server/src/Events/OrderOfferChanged.php
@@ -0,0 +1,73 @@
+<?php
+
+namespace Fleetbase\FleetOps\Events;
+
+use Fleetbase\FleetOps\Models\Order;
+use Illuminate\Broadcasting\Channel;
+use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcast;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Support\Carbon;
+
+/**
+ * Broadcast as `order.offer_{status}` (offer_accepted, offer_declined, offer_expired)
+ * when the driver offer on an order is answered or runs out.
+ *
+ * Channels: order.{public_id}, order.{uuid} and company.{company_uuid}.
+ * Data: { id: order public id, driver: driver public id, offer: meta.offer }.
+ */
+class OrderOfferChanged implements ShouldBroadcast
+{
+    use Dispatchable;
+    use InteractsWithSockets;
+
+    public string $eventId;
+
+    public string $sentAt;
+
+    public string $status;
+
+    public array $channelNames = [];
+
+    public array $data = [];
+
+    public function __construct(Order $order, string $status)
+    {
+        $offer = (array) $order->getMeta('offer', []);
+
+        $this->eventId      = uniqid('event_');
+        $this->sentAt       = Carbon::now()->toDateTimeString();
+        $this->status       = $status;
+        $this->channelNames = array_values(array_filter([
+            'order.' . $order->public_id,
+            'order.' . $order->uuid,
+            $order->company_uuid ? 'company.' . $order->company_uuid : null,
+        ]));
+        $this->data = [
+            'id'     => $order->public_id,
+            'driver' => $offer['driver'] ?? null,
+            'offer'  => $offer ?: null,
+        ];
+    }
+
+    public function broadcastOn(): array
+    {
+        return array_map(fn (string $name) => new Channel($name), $this->channelNames);
+    }
+
+    public function broadcastAs(): string
+    {
+        return 'order.offer_' . $this->status;
+    }
+
+    public function broadcastWith(): array
+    {
+        return [
+            'id'          => $this->eventId,
+            'api_version' => config('api.version'),
+            'event'       => $this->broadcastAs(),
+            'created_at'  => $this->sentAt,
+            'data'        => $this->data,
+        ];
+    }
+}
diff --git a/server/src/Http/Controllers/Api/v1/OrderController.php b/server/src/Http/Controllers/Api/v1/OrderController.php
index 4f4d059da..8773bd2b0 100644
--- a/server/src/Http/Controllers/Api/v1/OrderController.php
+++ b/server/src/Http/Controllers/Api/v1/OrderController.php
@@ -3,6 +3,7 @@
 namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 
 use Fleetbase\FleetOps\Events\OrderDispatchFailed;
+use Fleetbase\FleetOps\Events\OrderOfferChanged;
 use Fleetbase\FleetOps\Events\OrderStarted;
 use Fleetbase\FleetOps\Exceptions\CustomerUserConflictException;
 use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
@@ -25,6 +26,7 @@
 use Fleetbase\FleetOps\Models\Proof;
 use Fleetbase\FleetOps\Models\ServiceQuote;
 use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Notifications\OrderOfferDeclined;
 use Fleetbase\FleetOps\Support\OrderEdit;
 use Fleetbase\FleetOps\Support\ResolvesOrderServiceStops;
 use Fleetbase\FleetOps\Support\TrackingCode;
@@ -34,7 +36,9 @@
 use Fleetbase\Models\Company;
 use Fleetbase\Models\File;
 use Fleetbase\Models\Setting;
+use Fleetbase\Models\User;
 use Fleetbase\Support\Auth;
+use Fleetbase\Support\NotificationRegistry;
 use Fleetbase\Support\TemplateString;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\Request;
@@ -1062,9 +1066,15 @@ public function startOrder(string $id, Request $request)
             return response()->apiError('Order has already started.');
         }
 
-        // if the order is adhoc and the parameter of `assign` is set with a valid driver id, assign the driver and continue
+        // if the order is adhoc and the parameter of `assign` is set with a valid driver id, assign the driver and continue;
+        // the driver took the order themselves, so their offer starts accepted
         if ($order->adhoc && $assignAdhocDriver && Str::startsWith($assignAdhocDriver, 'driver_')) {
-            $order->assignDriver($assignAdhocDriver, true);
+            $order->acceptOfferOnAssign = true;
+            try {
+                $order->assignDriver($assignAdhocDriver, true);
+            } finally {
+                $order->acceptOfferOnAssign = false;
+            }
         }
 
         /** @var \Fleetbase\Models\Driver */
@@ -1096,9 +1106,10 @@ public function startOrder(string $id, Request $request)
             return response()->apiError('Order has not been dispatched yet and cannot be started.');
         }
 
-        // set order to started
+        // set order to started; starting the order answers an open offer
         $order->started    = true;
         $order->started_at = now();
+        $order->acceptOffer(false);
         $order->save();
 
         // trigger start event
@@ -1394,6 +1405,145 @@ public function cancelOrder(string $id)
         return $this->orderResource($order);
     }
 
+    /**
+     * The assigned driver accepts the order offered to them. An adhoc order that
+     * has no driver yet is assigned to the accepting driver.
+     *
+     * @return \Fleetbase\Http\Resources\v1\Order
+     */
+    public function acceptOrder(string $id, Request $request)
+    {
+        try {
+            $order = $this->findOrder($id, ['driverAssigned']);
+        } catch (ModelNotFoundException $exception) {
+            return $this->apiError('Order resource not found.', 404);
+        }
+
+        $driver = $this->offerDriverFromRequest($request);
+        if (!$driver) {
+            return $this->apiError('No driver found to accept the order.', 404);
+        }
+
+        if ($order->editPolicy()->isTerminal()) {
+            return $this->apiError('This order can no longer be accepted.', 422);
+        }
+
+        if (!$order->driver_assigned_uuid && $order->adhoc) {
+            $order->acceptOfferOnAssign = true;
+            try {
+                $order->assignDriver($driver, true);
+            } finally {
+                $order->acceptOfferOnAssign = false;
+            }
+        } elseif (!$order->isDriver($driver)) {
+            return $this->apiError('This order is not offered to you.', 403);
+        } elseif (!$order->acceptOffer() && $order->offerStatus() !== Order::OFFER_ACCEPTED) {
+            // no offer recorded (assigned before offers existed): record it as accepted
+            $order->acceptOfferOnAssign = true;
+            $order->syncOfferWithAssignment();
+            $order->acceptOfferOnAssign = false;
+            $order->saveQuietly();
+            $order->invalidateApiCache();
+        }
+
+        $this->broadcastOfferChange($order, Order::OFFER_ACCEPTED);
+
+        return $this->orderResource($order->refresh());
+    }
+
+    /**
+     * The assigned driver declines the order offered to them: the order is
+     * unassigned and dispatch is told.
+     *
+     * @return \Fleetbase\Http\Resources\v1\Order
+     */
+    public function declineOrder(string $id, Request $request)
+    {
+        try {
+            $order = $this->findOrder($id, ['driverAssigned']);
+        } catch (ModelNotFoundException $exception) {
+            return $this->apiError('Order resource not found.', 404);
+        }
+
+        $driver = $this->offerDriverFromRequest($request);
+        if (!$driver) {
+            return $this->apiError('No driver found to decline the order.', 404);
+        }
+
+        if (!$order->isDriver($driver)) {
+            return $this->apiError('This order is not offered to you.', 403);
+        }
+
+        if ($order->started) {
+            return $this->apiError('This order has already been started and cannot be declined.', 422);
+        }
+
+        $reason = $this->reasonFromRequest($request);
+        $order->declineOffer($reason);
+
+        $this->broadcastOfferChange($order, Order::OFFER_DECLINED);
+        $this->notifyOfferDeclined($order, $driver, $reason);
+
+        return $this->orderResource($order->refresh());
+    }
+
+    /**
+     * The free-text `reason` sent with a cancel or decline, trimmed to 1000 characters.
+     */
+    protected function reasonFromRequest(Request $request): ?string
+    {
+        $reason = $request->input('reason');
+        if (!is_string($reason) || trim($reason) === '') {
+            return null;
+        }
+
+        return Str::limit(trim($reason), 1000, '');
+    }
+
+    /**
+     * The driver answering an offer: the `driver` named in the request, or the
+     * driver profile of the authenticated user.
+     */
+    protected function offerDriverFromRequest(Request $request): ?Driver
+    {
+        if ($request->filled('driver')) {
+            return $this->findDriverByPublicId($request->input('driver'));
+        }
+
+        $user = $request->user();
+        if (!$user instanceof User) {
+            $user = User::where('uuid', session('user'))->first();
+        }
+
+        if (!$user) {
+            return null;
+        }
+
+        return Driver::where(['user_uuid' => $user->uuid, 'company_uuid' => $this->sessionCompany()])->first();
+    }
+
+    protected function broadcastOfferChange(Order $order, string $status): void
+    {
+        try {
+            event(new OrderOfferChanged($order, $status));
+        } catch (\Throwable $exception) {
+            Log::warning('Unable to broadcast order offer change', ['order' => $order->public_id, 'error' => $exception->getMessage()]);
+        }
+    }
+
+    protected function notifyOfferDeclined(Order $order, Driver $driver, ?string $reason): void
+    {
+        try {
+            NotificationRegistry::notify(OrderOfferDeclined::class, $order, [
+                'driver'      => $driver->public_id,
+                'driver_name' => $driver->name,
+                'reason'      => $reason,
+            ]);
+        } catch (\Throwable $exception) {
+            Log::warning('Unable to notify dispatch of declined order', ['order' => $order->public_id, 'error' => $exception->getMessage()]);
+        }
+    }
+
     /**
      * Mark a specific place (waypoint, pickup, or drop-off) as the current
      * destination for an order payload.
diff --git a/server/src/Http/Controllers/Internal/v1/DriverController.php b/server/src/Http/Controllers/Internal/v1/DriverController.php
index 6e4dcc212..3847787ef 100644
--- a/server/src/Http/Controllers/Internal/v1/DriverController.php
+++ b/server/src/Http/Controllers/Internal/v1/DriverController.php
@@ -598,12 +598,20 @@ protected function clearDriverAssignmentsForOrders($orders): void
         Order::invalidateApiCacheManually(session('company'));
 
         // The bulk update bypasses the order observer, so the driver taken off each
-        // order is told here
+        // order is told here and the offer made to them is dropped
         foreach ($orders as $order) {
             $previousDriverUuid = $order->driver_assigned_uuid;
-            if ($previousDriverUuid) {
-                $order->notifyDriverUnassigned($previousDriverUuid);
+            if (!$previousDriverUuid) {
+                continue;
             }
+
+            $order->driver_assigned_uuid = null;
+            $order->syncOfferWithAssignment();
+            if ($order->isDirty('meta')) {
+                $order->saveQuietly();
+            }
+            $order->syncOriginal();
+            $order->notifyDriverUnassigned($previousDriverUuid);
         }
     }
 
diff --git a/server/src/Http/Controllers/Internal/v1/OrderController.php b/server/src/Http/Controllers/Internal/v1/OrderController.php
index 2da065c52..970460d3d 100644
--- a/server/src/Http/Controllers/Internal/v1/OrderController.php
+++ b/server/src/Http/Controllers/Internal/v1/OrderController.php
@@ -797,6 +797,15 @@ protected function assignDriverToOrders($orderUuids, Driver $driver): void
         foreach ($replaced as $order) {
             $order->notifyDriverUnassigned($order->driver_assigned_uuid);
         }
+
+        // The bulk update bypasses the model, so each order's driver offer is started here
+        $this->scopedToCompany(Order::whereIn('uuid', $orderUuids))->get()->each(function (Order $order) use ($driver) {
+            $order->setRelation('driverAssigned', $driver);
+            $order->syncOfferWithAssignment();
+            if ($order->isDirty('meta')) {
+                $order->saveQuietly();
+            }
+        });
     }
 
     protected function dispatchBulkAssignedDriverNotification(array $orderUuids, Driver $driver): void
@@ -863,9 +872,10 @@ public function start(Request $request)
             return response()->error('No driver assigned to order.');
         }
 
-        // set order to started
+        // set order to started; starting the order answers an open offer
         $order->started    = true;
         $order->started_at = now();
+        $order->acceptOffer(false);
         $order->save();
 
         // trigger start event
diff --git a/server/src/Http/Resources/v1/Index/Order.php b/server/src/Http/Resources/v1/Index/Order.php
index 1b413f22d..39afca97a 100644
--- a/server/src/Http/Resources/v1/Index/Order.php
+++ b/server/src/Http/Resources/v1/Index/Order.php
@@ -113,6 +113,7 @@ public function toArray($request): array
             'is_scheduled'                         => $this->when($isInternal, $this->is_scheduled),
             'transaction_amount'                   => $this->transaction_amount,
             'currency'                             => $this->transaction_currency,
+            'offer'                                => data_get($this, 'meta.offer'),
 
             // Timestamps
             'scheduled_at'         => $this->scheduled_at,
diff --git a/server/src/Http/Resources/v1/Order.php b/server/src/Http/Resources/v1/Order.php
index 6ed174612..43ac5dbed 100644
--- a/server/src/Http/Resources/v1/Order.php
+++ b/server/src/Http/Resources/v1/Order.php
@@ -99,6 +99,7 @@ public function toArray($request): array
                 return $this->resource->eta ?? ($tracker ? $tracker->eta() : null);
             }),
             'meta'                 => data_get($this, 'meta', Utils::createObject()),
+            'offer'                => data_get($this, 'meta.offer'),
             'dispatched_at'        => $this->dispatched_at,
             'started_at'           => $this->started_at,
             'scheduled_at'         => $this->scheduled_at,
@@ -207,6 +208,7 @@ public function toWebhookPayload()
             'status'          => $this->status,
             'adhoc'           => $this->adhoc,
             'meta'            => data_get($this, 'meta', Utils::createObject()),
+            'offer'           => data_get($this, 'meta.offer'),
             'dispatched_at'   => $this->dispatched_at,
             'started_at'      => $this->started_at,
             'scheduled_at'    => $this->scheduled_at,
diff --git a/server/src/Models/Order.php b/server/src/Models/Order.php
index 0370a7240..b581f7204 100644
--- a/server/src/Models/Order.php
+++ b/server/src/Models/Order.php
@@ -18,6 +18,7 @@
 use Fleetbase\FleetOps\Traits\HasTrackingNumber;
 use Fleetbase\LaravelMysqlSpatial\Types\Point;
 use Fleetbase\Models\Model;
+use Fleetbase\Models\Setting;
 use Fleetbase\Models\Transaction;
 use Fleetbase\Traits\HasApiModelBehavior;
 use Fleetbase\Traits\HasApiModelCache;
@@ -280,11 +281,30 @@ class Order extends Model
         '_key',
     ];
 
+    /**
+     * Offer statuses kept in `meta.offer.status`.
+     */
+    public const OFFER_OFFERED  = 'offered';
+    public const OFFER_ACCEPTED = 'accepted';
+    public const OFFER_DECLINED = 'declined';
+    public const OFFER_EXPIRED  = 'expired';
+
+    /**
+     * Minutes a driver has to accept an order offered to them, unless the company
+     * sets `fleetops.offer_timeout_minutes`. Zero means offers never expire.
+     */
+    public const DEFAULT_OFFER_TIMEOUT_MINUTES = 5;
+
     /**
      * Set for one save: the driver assignment being saved sends no assignment notification.
      */
     public bool $silentDriverAssignment = false;
 
+    /**
+     * Set for one save: the driver being assigned has already accepted the order (adhoc start).
+     */
+    public bool $acceptOfferOnAssign = false;
+
     /**
      * Set for one save: the driver taken off the order is not sent an unassigned push (they declined it themselves).
      */
@@ -1521,6 +1541,154 @@ public function editPolicy(): OrderEditPolicy
         return OrderEditPolicy::for($this);
     }
 
+    /**
+     * The driver offer on the order (`meta.offer`), or null when there is none.
+     */
+    public function getOffer(): ?array
+    {
+        $offer = $this->getMeta('offer');
+
+        return is_array($offer) && !empty($offer) ? $offer : null;
+    }
+
+    /**
+     * The status of the driver offer on the order, or null when there is none.
+     */
+    public function offerStatus(): ?string
+    {
+        return data_get($this->getOffer(), 'status');
+    }
+
+    /**
+     * Minutes a driver has to accept an offer, from the company setting
+     * `fleetops.offer_timeout_minutes` (default 5). Zero disables expiry.
+     */
+    public function offerTimeoutMinutes(): int
+    {
+        try {
+            $minutes = Setting::lookupForCompany($this->company_uuid ?? session('company'), 'fleetops.offer_timeout_minutes', static::DEFAULT_OFFER_TIMEOUT_MINUTES);
+        } catch (\Throwable) {
+            $minutes = static::DEFAULT_OFFER_TIMEOUT_MINUTES;
+        }
+
+        return is_numeric($minutes) ? max(0, (int) $minutes) : static::DEFAULT_OFFER_TIMEOUT_MINUTES;
+    }
+
+    /**
+     * Keep `meta.offer` in step with the driver assignment being saved: a newly
+     * assigned driver gets a fresh offer (accepted straight away when they took
+     * the order themselves), and removing the driver drops an open offer.
+     * Only sets attributes; the save in progress persists them.
+     */
+    public function syncOfferWithAssignment(): self
+    {
+        $driverUuid = $this->driver_assigned_uuid;
+
+        if (!$driverUuid) {
+            if (in_array($this->offerStatus(), [static::OFFER_OFFERED, static::OFFER_ACCEPTED], true)) {
+                $this->setMeta('offer', null);
+            }
+
+            return $this;
+        }
+
+        if ($this->exists && $this->editPolicy()->isTerminal()) {
+            return $this;
+        }
+
+        $driverPublicId = data_get($this->relationLoaded('driverAssigned') ? $this->getRelation('driverAssigned') : null, 'public_id');
+        if (!$driverPublicId || data_get($this->getRelation('driverAssigned'), 'uuid') !== $driverUuid) {
+            try {
+                $driverPublicId = Driver::where('uuid', $driverUuid)->withoutGlobalScopes()->value('public_id');
+            } catch (\Throwable) {
+                $driverPublicId = null;
+            }
+        }
+
+        $now   = Carbon::now();
+        $offer = [
+            'driver'      => $driverPublicId,
+            'offered_at'  => $now->toIso8601ZuluString(),
+            'expires_at'  => null,
+            'accepted_at' => null,
+            'declined_at' => null,
+            'status'      => static::OFFER_OFFERED,
+        ];
+
+        if ($this->acceptOfferOnAssign) {
+            $offer['accepted_at'] = $offer['offered_at'];
+            $offer['status']      = static::OFFER_ACCEPTED;
+        } elseif ($minutes = $this->offerTimeoutMinutes()) {
+            $offer['expires_at'] = $now->copy()->addMinutes($minutes)->toIso8601ZuluString();
+        }
+
+        $this->setMeta('offer', $offer);
+
+        return $this;
+    }
+
+    /**
+     * Mark the open offer accepted. Returns false when there is no open offer.
+     */
+    public function acceptOffer(bool $save = true): bool
+    {
+        $offer = $this->getOffer();
+        if (!$offer || !in_array($offer['status'] ?? null, [static::OFFER_OFFERED, static::OFFER_EXPIRED], true)) {
+            return false;
+        }
+
+        $offer['status']      = static::OFFER_ACCEPTED;
+        $offer['accepted_at'] = Carbon::now()->toIso8601ZuluString();
+        $this->setMeta('offer', $offer);
+
+        if ($save) {
+            $this->saveQuietly();
+            $this->invalidateApiCache();
+        }
+
+        return true;
+    }
+
+    /**
+     * Record that the driver declined the offer and take the order off them.
+     */
+    public function declineOffer(?string $reason = null): self
+    {
+        $offer = $this->getOffer() ?? ['driver' => data_get($this, 'driverAssigned.public_id'), 'offered_at' => null, 'expires_at' => null, 'accepted_at' => null];
+
+        $offer['status']      = static::OFFER_DECLINED;
+        $offer['declined_at'] = Carbon::now()->toIso8601ZuluString();
+        if ($reason) {
+            $offer['reason'] = $reason;
+        }
+
+        $this->setMeta('offer', $offer);
+        $this->quietDriverUnassignment = true;
+        $this->driver_assigned_uuid    = null;
+        $this->save();
+        $this->quietDriverUnassignment = false;
+
+        return $this;
+    }
+
+    /**
+     * Mark an open offer expired. Returns false when there is no open offer.
+     */
+    public function expireOffer(): bool
+    {
+        $offer = $this->getOffer();
+        if (!$offer || ($offer['status'] ?? null) !== static::OFFER_OFFERED) {
+            return false;
+        }
+
+        $offer['status'] = static::OFFER_EXPIRED;
+        $this->setMeta('offer', $offer);
+        $this->saveQuietly();
+        $this->invalidateApiCache();
+
+        return true;
+    }
+
     /**
      * Updates the activity of the order.
      * Updates the order status and inserts a new activity based on the provided activity details.
diff --git a/server/src/Notifications/DriverNotAccepted.php b/server/src/Notifications/DriverNotAccepted.php
new file mode 100644
index 000000000..d106ec4bf
--- /dev/null
+++ b/server/src/Notifications/DriverNotAccepted.php
@@ -0,0 +1,56 @@
+<?php
+
+namespace Fleetbase\FleetOps\Notifications;
+
+use Fleetbase\FleetOps\Models\Order;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+
+/**
+ * Operational alert raised when the driver an order was offered to did not accept it in time.
+ */
+class DriverNotAccepted extends Notification implements ShouldQueue
+{
+    use Queueable;
+
+    public static string $name        = 'Driver Not Accepted';
+    public static string $description = 'Notify when the driver an order was offered to has not accepted it within the offer window.';
+    public static string $package     = 'fleet-ops';
+
+    public function __construct(public Order $order, public array $context = [])
+    {
+    }
+
+    public function via($notifiable): array
+    {
+        return ['mail', 'database'];
+    }
+
+    public function toMail($notifiable): MailMessage
+    {
+        $orderId = $this->order->tracking ?? $this->order->public_id;
+
+        return (new MailMessage())
+            ->subject("Driver has not accepted {$orderId}")
+            ->line($this->message())
+            ->line('Please contact the driver or reassign the order.');
+    }
+
+    public function toArray($notifiable): array
+    {
+        return [
+            'event'      => 'order.driver_not_accepted',
+            'order_id'   => $this->order->public_id,
+            'order_uuid' => $this->order->uuid,
+            'context'    => $this->context,
+            'message'    => $this->message(),
+        ];
+    }
+
+    protected function message(): string
+    {
+        return sprintf('The driver has not accepted order %s within the offer window.', $this->order->tracking ?? $this->order->public_id);
+    }
+}
diff --git a/server/src/Notifications/OrderOfferDeclined.php b/server/src/Notifications/OrderOfferDeclined.php
new file mode 100644
index 000000000..1fb14a80c
--- /dev/null
+++ b/server/src/Notifications/OrderOfferDeclined.php
@@ -0,0 +1,59 @@
+<?php
+
+namespace Fleetbase\FleetOps\Notifications;
+
+use Fleetbase\FleetOps\Models\Order;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+
+/**
+ * Tells dispatch that a driver declined the order offered to them, which left it unassigned.
+ */
+class OrderOfferDeclined extends Notification implements ShouldQueue
+{
+    use Queueable;
+
+    public static string $name        = 'Order Declined By Driver';
+    public static string $description = 'Notify when a driver declines an order offered to them.';
+    public static string $package     = 'fleet-ops';
+
+    public function __construct(public Order $order, public array $context = [])
+    {
+    }
+
+    public function via($notifiable): array
+    {
+        return ['mail', 'database'];
+    }
+
+    public function toMail($notifiable): MailMessage
+    {
+        $orderId = $this->order->tracking ?? $this->order->public_id;
+
+        return (new MailMessage())
+            ->subject("Driver declined {$orderId}")
+            ->line($this->message())
+            ->line('The order is unassigned and needs a driver.');
+    }
+
+    public function toArray($notifiable): array
+    {
+        return [
+            'event'      => 'order.offer_declined',
+            'order_id'   => $this->order->public_id,
+            'order_uuid' => $this->order->uuid,
+            'context'    => $this->context,
+            'message'    => $this->message(),
+        ];
+    }
+
+    protected function message(): string
+    {
+        $driver = $this->context['driver_name'] ?? 'The driver';
+        $reason = $this->context['reason'] ?? null;
+
+        return sprintf('%s declined order %s%s', $driver, $this->order->tracking ?? $this->order->public_id, $reason ? ': ' . $reason : '.');
+    }
+}
diff --git a/server/src/Observers/OrderObserver.php b/server/src/Observers/OrderObserver.php
index 45c9261bd..c2c4c21ed 100644
--- a/server/src/Observers/OrderObserver.php
+++ b/server/src/Observers/OrderObserver.php
@@ -34,6 +34,17 @@ public function created(Order $order)
         $this->invalidateCache($order);
     }
 
+    /**
+     * Handle the Order "saving" event: a driver assignment being saved starts
+     * (or clears) the driver offer in the same write.
+     */
+    public function saving(Order $order): void
+    {
+        if ($order->isDirty('driver_assigned_uuid')) {
+            $order->syncOfferWithAssignment();
+        }
+    }
+
     /**
      * Handle the Order "updating" event.
      *
diff --git a/server/src/Providers/FleetOpsServiceProvider.php b/server/src/Providers/FleetOpsServiceProvider.php
index bb24c8932..cd90f69e5 100644
--- a/server/src/Providers/FleetOpsServiceProvider.php
+++ b/server/src/Providers/FleetOpsServiceProvider.php
@@ -75,6 +75,7 @@ class FleetOpsServiceProvider extends CoreServiceProvider
         \Fleetbase\FleetOps\Console\Commands\ProcessMaintenanceTriggers::class,
         \Fleetbase\FleetOps\Console\Commands\SendMaintenanceReminders::class,
         \Fleetbase\FleetOps\Console\Commands\ProcessOperationalAlerts::class,
+        \Fleetbase\FleetOps\Console\Commands\ExpireOrderOffers::class,
         \Fleetbase\FleetOps\Console\Commands\SyncTelematics::class,
         \Fleetbase\FleetOps\Console\Commands\DrainTelematicInbox::class,
         \Fleetbase\FleetOps\Console\Commands\PruneTelematicsData::class,
@@ -150,6 +151,7 @@ public function boot()
             $schedule->command('fleetops:process-maintenance-triggers')->daily()->withoutOverlapping()->storeOutputInDb();
             $schedule->command('fleetops:send-maintenance-reminders')->daily()->withoutOverlapping()->storeOutputInDb();
             $schedule->command('fleetops:process-operational-alerts')->everyMinute()->withoutOverlapping()->storeOutputInDb();
+            $schedule->command('fleetops:expire-offers')->everyMinute()->withoutOverlapping();
             // These commands dispatch bounded jobs. A scheduler restart must not
             // leave the default 24-hour overlap lease blocking telemetry recovery.
             $schedule->command('fleetops:sync-telematics')->everyMinute()->withoutOverlapping(2)->storeOutputInDb();
@@ -252,6 +254,8 @@ public function registerNotifications()
             \Fleetbase\FleetOps\Notifications\LateDeparture::class,
             \Fleetbase\FleetOps\Notifications\RouteDeviation::class,
             \Fleetbase\FleetOps\Notifications\ProlongedStoppage::class,
+            \Fleetbase\FleetOps\Notifications\DriverNotAccepted::class,
+            \Fleetbase\FleetOps\Notifications\OrderOfferDeclined::class,
             \Fleetbase\FleetOps\Notifications\OrderChanged::class,
             \Fleetbase\FleetOps\Notifications\OrderUnassigned::class,
         ]);
diff --git a/server/src/routes.php b/server/src/routes.php
index 8060b5512..174069dc7 100644
--- a/server/src/routes.php
+++ b/server/src/routes.php
@@ -210,6 +210,8 @@ function ($router) {
                 $router->match(['post', 'patch'], '{id}/dispatch', 'OrderController@dispatchOrder');
                 $router->post('{id}/start', 'OrderController@startOrder');
                 $router->delete('{id}/cancel', 'OrderController@cancelOrder');
+                $router->post('{id}/accept', 'OrderController@acceptOrder');
+                $router->post('{id}/decline', 'OrderController@declineOrder');
                 $router->match(['post', 'patch'], '{id}/update-activity', 'OrderController@updateActivity');
                 $router->post('{id}/complete', 'OrderController@completeOrder');
                 $router->get('{id}/next-activity', 'OrderController@getNextActivity');
diff --git a/server/tests/ApiOrderControllerContractsTest.php b/server/tests/ApiOrderControllerContractsTest.php
index 58c473fde..33435dbfc 100644
--- a/server/tests/ApiOrderControllerContractsTest.php
+++ b/server/tests/ApiOrderControllerContractsTest.php
@@ -72,6 +72,20 @@ protected function lockedEditResponse(OrderEditLockedException $exception)
         return ['apiError' => $exception->getMessage(), 'status' => 422, 'locked' => $exception->locked];
     }
 
+    public ?Fleetbase\FleetOps\Models\Driver $offerDriver = null;
+
+    public array $offerNotifications = [];
+
+    protected function offerDriverFromRequest(Request $request): ?Fleetbase\FleetOps\Models\Driver
+    {
+        return $this->offerDriver;
+    }
+
+    protected function notifyOfferDeclined(Order $order, Fleetbase\FleetOps\Models\Driver $driver, ?string $reason): void
+    {
+        $this->offerNotifications[] = [$order->uuid, $driver->public_id, $reason];
+    }
+
     protected function drivingDistanceAndTime(mixed $origin, mixed $destination): mixed
     {
         return $this->matrix ?? (object) ['distance' => 1200, 'time' => 360];
@@ -438,6 +452,22 @@ public function cancel()
         return $this;
     }
 
+    public bool $declinedForTest = false;
+
+    public ?string $declineReasonForTest = null;
+
+    public function declineOffer(?string $reason = null): Order
+    {
+        $this->declinedForTest      = true;
+        $this->declineReasonForTest = $reason;
+        $this->setMeta('offer', ['status' => Order::OFFER_DECLINED]);
+
+        return $this;
+    }
+
+    public function invalidateApiCache(): void
+    {
+    }
 
     public function tracker(): OrderTracker
     {
@@ -1219,3 +1249,45 @@ public function isString(string $key): bool
         ->and($controller->edit->guarded[0]['input'])->toMatchArray(['cod_amount' => '2500'])
         ->and($controller->edit->guarded[0]['entities_mode'])->toBe('append');
 });
+
+test('api order controller accepts and declines offers for the assigned driver only', function () {
+    $driver = new FleetOpsApiOrderDriverFake();
+    $driver->setRawAttributes(['uuid' => 'driver-uuid', 'public_id' => 'driver_offer', 'name' => 'Dee'], true);
+
+    $order = new FleetOpsApiOrderCrudFake(['status' => 'created']);
+    $order->setRawAttributes(array_merge($order->getAttributes(), ['driver_assigned_uuid' => 'driver-uuid']));
+    $order->setMeta('offer', ['driver' => 'driver_offer', 'status' => Order::OFFER_OFFERED, 'offered_at' => '2026-10-13T12:00:00Z', 'expires_at' => '2026-10-13T12:05:00Z']);
+
+    $controller              = new FleetOpsApiOrderCrudControllerProbe();
+    $controller->order       = $order;
+    $controller->offerDriver = $driver;
+
+    $accepted = $controller->acceptOrder('order-public', new Request());
+
+    expect($accepted)->toBe(['resource' => 'order', 'order' => $order])
+        ->and($order->offerStatus())->toBe(Order::OFFER_ACCEPTED)
+        ->and($order->getOffer()['accepted_at'])->not->toBeNull();
+
+    $declined = $controller->declineOrder('order-public', new Request(['reason' => 'Too far']));
+
+    expect($declined)->toBe(['resource' => 'order', 'order' => $order])
+        ->and($order->declinedForTest)->toBeTrue()
+        ->and($order->declineReasonForTest)->toBe('Too far')
+        ->and($controller->offerNotifications)->toBe([['order-uuid', 'driver_offer', 'Too far']]);
+
+    $other = new FleetOpsApiOrderDriverFake();
+    $other->setRawAttributes(['uuid' => 'other-uuid', 'public_id' => 'driver_other'], true);
+    $controller->offerDriver = $other;
+
+    expect($controller->acceptOrder('order-public', new Request()))->toBe(['apiError' => 'This order is not offered to you.', 'status' => 403])
+        ->and($controller->declineOrder('order-public', new Request()))->toBe(['apiError' => 'This order is not offered to you.', 'status' => 403]);
+
+    $controller->offerDriver = null;
+    expect($controller->acceptOrder('order-public', new Request()))->toBe(['apiError' => 'No driver found to accept the order.', 'status' => 404]);
+
+    $done                    = new FleetOpsApiOrderCrudFake(['status' => 'canceled']);
+    $controller              = new FleetOpsApiOrderCrudControllerProbe();
+    $controller->order       = $done;
+    $controller->offerDriver = $driver;
+    expect($controller->acceptOrder('order-public', new Request()))->toBe(['apiError' => 'This order can no longer be accepted.', 'status' => 422]);
+});
diff --git a/server/tests/Feature/Http/Internal/OrderControllerHelpersTest.php b/server/tests/Feature/Http/Internal/OrderControllerHelpersTest.php
index 1760fbc3f..a94e37dba 100644
--- a/server/tests/Feature/Http/Internal/OrderControllerHelpersTest.php
+++ b/server/tests/Feature/Http/Internal/OrderControllerHelpersTest.php
@@ -96,7 +96,7 @@ public function __call($method, $arguments)
 
     $schema = $connection->getSchemaBuilder();
     $tables = [
-        'orders'           => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'tracking_number_uuid', 'driver_assigned_uuid', 'status'],
+        'orders'           => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'tracking_number_uuid', 'driver_assigned_uuid', 'status', 'meta'],
         'contacts'         => ['uuid', 'public_id', 'company_uuid', 'name', 'type'],
         'vendors'          => ['uuid', 'public_id', 'company_uuid', 'name'],
         'drivers'          => ['uuid', 'public_id', 'company_uuid', 'user_uuid'],
@@ -168,7 +168,9 @@ public function __call($method, $arguments)
 
     (new FleetOpsInternalOrderHelpersProbe())->callProtected('assignDriverToOrders', ['order-1', 'order-2'], $driver);
 
-    expect($connection->table('orders')->where('driver_assigned_uuid', 'driver-1')->count())->toBe(2);
+    // the bulk update bypasses the model, so each order's driver offer is started explicitly
+    expect($connection->table('orders')->where('driver_assigned_uuid', 'driver-1')->count())->toBe(2)
+        ->and(json_decode($connection->table('orders')->where('uuid', 'order-1')->value('meta'), true)['offer']['status'] ?? null)->toBe('offered');
 });
 
 test('dispatch domain event helper emits and returns the event', function () {
diff --git a/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php b/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
index 0682d86ec..f2d10b54b 100644
--- a/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
+++ b/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
@@ -54,3 +54,34 @@ function fleetopsOrderChangeNotificationOrder(): Order
         ->and($notification->via(null))->toBe([FcmChannel::class, ApnChannel::class])
         ->and($notification->toArray()['event'])->toBe('order.unassigned_notification');
 });
+
+test('offer alerts describe the declined or unanswered offer for dispatch', function () {
+    $order    = fleetopsOrderChangeNotificationOrder();
+    $declined = new OrderOfferDeclined($order, ['driver' => 'driver_one', 'driver_name' => 'Dee', 'reason' => 'Too far']);
+    $silent   = new DriverNotAccepted($order, ['driver' => 'driver_one']);
+
+    expect($declined->toArray(null))->toMatchArray([
+        'event'    => 'order.offer_declined',
+        'order_id' => 'order_change',
+        'message'  => 'Dee declined order FLB-CHANGE-1: Too far',
+    ])
+        ->and($declined->via(null))->toBe(['mail', 'database'])
+        ->and($silent->toArray(null))->toMatchArray([
+            'event'    => 'order.driver_not_accepted',
+            'order_id' => 'order_change',
+            'context'  => ['driver' => 'driver_one'],
+        ]);
+});
+
+test('offer changes broadcast as order offer status on the order and company channels', function () {
+    $event = new OrderOfferChanged(fleetopsOrderChangeNotificationOrder(), Order::OFFER_EXPIRED);
+
+    expect($event->broadcastAs())->toBe('order.offer_expired')
+        ->and(array_map(fn ($channel) => $channel->name, $event->broadcastOn()))->toBe(['order.order_change', 'order.order-uuid', 'company.company-1'])
+        ->and($event->broadcastWith())->toMatchArray(['event' => 'order.offer_expired'])
+        ->and($event->broadcastWith()['data'])->toBe([
+            'id'     => 'order_change',
+            'driver' => 'driver_one',
+            'offer'  => ['driver' => 'driver_one', 'status' => 'expired', 'expires_at' => '2026-10-13T12:05:00Z'],
+        ]);
+});
diff --git a/server/tests/Unit/Observers/OrderAssignmentObserverTest.php b/server/tests/Unit/Observers/OrderAssignmentObserverTest.php
index 1c61273d6..d98aabb37 100644
--- a/server/tests/Unit/Observers/OrderAssignmentObserverTest.php
+++ b/server/tests/Unit/Observers/OrderAssignmentObserverTest.php
@@ -98,6 +98,21 @@ public function orderChanged(Order $order): bool
         ->and($silent->events)->toBe([]);
 });
 
+test('saving a driver assignment starts the offer in the same write', function () {
+    $order              = new FleetOpsOrderAssignmentObserverOrder();
+    $order->driverDirty = true;
+
+    (new OrderObserver())->saving($order);
+
+    $unchanged              = new FleetOpsOrderAssignmentObserverOrder();
+    $unchanged->driverDirty = false;
+
+    (new OrderObserver())->saving($unchanged);
+
+    expect($order->events)->toBe(['offer'])
+        ->and($unchanged->events)->toBe([]);
+});
+
 test('assign driver relies on the observer instead of notifying before the save', function () {
     $source = file_get_contents(dirname(__DIR__, 3) . '/src/Models/Order.php');
     preg_match('/public function assignDriver\(.*?\n    }\n/s', $source, $matches);
diff --git a/server/tests/Unit/Support/OrderOperationsTest.php b/server/tests/Unit/Support/OrderOperationsTest.php
index 6051132ee..d76e24fe3 100644
--- a/server/tests/Unit/Support/OrderOperationsTest.php
+++ b/server/tests/Unit/Support/OrderOperationsTest.php
@@ -378,6 +378,79 @@ function fleetopsOrderOpsOrder(SQLiteConnection $connection, array $order = [],
         ->and(OrderEdit::entitiesMode(null))->toBe('append');
 });
 
+test('assigning a driver starts an offer that is accepted declined or expired', function () {
+    $connection = fleetopsOrderOpsBoot();
+    Carbon::setTestNow('2026-10-13 12:00:00');
+    $order = fleetopsOrderOpsOrder($connection);
+
+    $order->driver_assigned_uuid = 'driver-1';
+    $order->syncOfferWithAssignment();
+
+    expect($order->getOffer())->toBe([
+        'driver'      => 'driver_one',
+        'offered_at'  => '2026-10-13T12:00:00Z',
+        'expires_at'  => '2026-10-13T12:05:00Z',
+        'accepted_at' => null,
+        'declined_at' => null,
+        'status'      => 'offered',
+    ]);
+    $order->saveQuietly();
+
+    // adhoc drivers who took the order themselves start accepted
+    $adhoc                      = new Order(['driver_assigned_uuid' => 'driver-1']);
+    $adhoc->acceptOfferOnAssign = true;
+    $adhoc->syncOfferWithAssignment();
+    expect($adhoc->offerStatus())->toBe('accepted')
+        ->and($adhoc->getOffer()['accepted_at'])->toBe('2026-10-13T12:00:00Z');
+
+    // the expiry command leaves an offer alone until it runs out
+    $command = new ExpireOrderOffers();
+    expect($command->expire($order, Carbon::parse('2026-10-13 12:04:00')))->toBeFalse();
+
+    expect($command->expire($order, Carbon::parse('2026-10-13 12:06:00')))->toBeTrue();
+    $stored = Order::where('uuid', 'order-1')->first();
+    expect($stored->offerStatus())->toBe('expired')
+        ->and($stored->getMeta('operational_alerts.driver_not_accepted.context'))->toBe([
+            'driver'     => 'driver_one',
+            'offered_at' => '2026-10-13T12:00:00Z',
+            'expires_at' => '2026-10-13T12:05:00Z',
+        ])
+        ->and(fleetopsOrderOpsEvents()->of(OrderOfferChanged::class)[0]->broadcastAs())->toBe('order.offer_expired')
+        ->and(fleetopsOrderOpsEvents()->of(OrderOfferChanged::class)[0]->channelNames)->toBe(['order.order_one', 'order.order-1', 'company.company-1'])
+        ->and($command->expire($stored, Carbon::parse('2026-10-13 12:07:00')))->toBeFalse();
+
+    // a late acceptance still counts
+    expect($stored->acceptOffer())->toBeTrue()
+        ->and(Order::where('uuid', 'order-1')->first()->offerStatus())->toBe('accepted');
+
+    // declining records it and takes the order off the driver
+    $stored->setMeta('offer', array_merge($stored->getOffer(), ['status' => 'offered']));
+    $stored->declineOffer('Too far');
+    $declined = Order::where('uuid', 'order-1')->first();
+    expect($declined->driver_assigned_uuid)->toBeNull()
+        ->and($declined->offerStatus())->toBe('declined')
+        ->and($declined->getOffer()['reason'])->toBe('Too far');
+
+    // removing the driver drops an open offer but keeps a declined one
+    $declined->syncOfferWithAssignment();
+    expect($declined->offerStatus())->toBe('declined');
+    $open = new Order();
+    $open->setMeta('offer', ['status' => 'offered']);
+    $open->syncOfferWithAssignment();
+    expect($open->getOffer())->toBeNull();
+
+    Carbon::setTestNow();
+});
+
+test('the expiry command drops offers left on orders without a driver', function () {
+    $connection = fleetopsOrderOpsBoot();
+    $order      = fleetopsOrderOpsOrder($connection, ['meta' => json_encode(['offer' => ['driver' => 'driver_one', 'status' => 'offered', 'expires_at' => '2026-10-13T12:05:00Z']])]);
+
+    expect((new ExpireOrderOffers())->expire($order, Carbon::parse('2026-10-13 12:06:00')))->toBeFalse()
+        ->and(Order::where('uuid', 'order-1')->first()->getOffer())->toBeNull()
+        ->and(fleetopsOrderOpsEvents()->of(OrderOfferChanged::class))->toBe([]);
+});
+
 test('a driver taken off an order is told and loses it as their current job', function () {
     $connection = fleetopsOrderOpsBoot();
     $order      = fleetopsOrderOpsOrder($connection);

From 9026c245ea2fef97b366892ba0497b6294337a65 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 17:36:46 +0800
Subject: [PATCH 77/87] feat(orders): cancel an order with a reason

DELETE v1/orders/{id}/cancel and PATCH int/v1/orders/cancel accept an
optional `reason` (string, up to 1000 characters). Order::cancelWithReason()
records it as the details of the canceled tracking status (the config's
activity is cloned, not changed) and carries that activity on the
OrderCanceled event, so NotifyOrderEvent and the driver's canceled
notification include it. The canceled notification data gains `reason` when
one was given. Order::cancel() keeps its signature and behaviour.
---
 .../Controllers/Api/v1/OrderController.php    |  14 +-
 .../Internal/v1/OrderController.php           |   7 +-
 .../src/Http/Requests/CancelOrderRequest.php  |   3 +-
 server/src/Listeners/HandleOrderCanceled.php  |  10 +-
 server/src/Models/Order.php                   |  30 +++-
 server/src/Notifications/OrderCanceled.php    |   5 +
 .../tests/ApiOrderControllerContractsTest.php |  29 ++++
 .../Internal/OrderControllerContractsTest.php |  18 ++-
 .../NotificationAndMailContractsTest.php      |   2 +-
 .../Unit/Models/OrderCancelReasonTest.php     | 143 ++++++++++++++++++
 10 files changed, 253 insertions(+), 8 deletions(-)
 create mode 100644 server/tests/Unit/Models/OrderCancelReasonTest.php

diff --git a/server/src/Http/Controllers/Api/v1/OrderController.php b/server/src/Http/Controllers/Api/v1/OrderController.php
index 8773bd2b0..fa64ba550 100644
--- a/server/src/Http/Controllers/Api/v1/OrderController.php
+++ b/server/src/Http/Controllers/Api/v1/OrderController.php
@@ -1387,8 +1387,12 @@ public function completeOrder(string $id)
      *
      * @return \Fleetbase\Http\Resources\v1\Order
      */
-    public function cancelOrder(string $id)
+    public function cancelOrder(string $id, ?Request $request = null)
     {
+        // Laravel does not inject a class-typed parameter that has a default, so the
+        // current request is read here; the default keeps cancelOrder($id) callable.
+        $request = $request ?? request();
+
         try {
             $order = $this->findOrder($id);
         } catch (ModelNotFoundException $exception) {
@@ -1400,7 +1404,13 @@ public function cancelOrder(string $id)
             );
         }
 
-        $order->cancel();
+        // the reason becomes the canceled status details and is sent with the canceled notifications
+        $reason = $this->reasonFromRequest($request);
+        if ($reason !== null) {
+            $order->cancelWithReason($reason);
+        } else {
+            $order->cancel();
+        }
 
         return $this->orderResource($order);
     }
diff --git a/server/src/Http/Controllers/Internal/v1/OrderController.php b/server/src/Http/Controllers/Internal/v1/OrderController.php
index 970460d3d..d9cc3bd46 100644
--- a/server/src/Http/Controllers/Internal/v1/OrderController.php
+++ b/server/src/Http/Controllers/Internal/v1/OrderController.php
@@ -612,7 +612,12 @@ public function cancel(CancelOrderRequest $request)
             return $this->errorResponse('No order found to cancel.');
         }
 
-        $order->cancel();
+        $reason = $request->input('reason');
+        if (is_string($reason) && trim($reason) !== '') {
+            $order->cancelWithReason($reason);
+        } else {
+            $order->cancel();
+        }
 
         return $this->jsonResponse(
             [
diff --git a/server/src/Http/Requests/CancelOrderRequest.php b/server/src/Http/Requests/CancelOrderRequest.php
index ba6607783..3168734f5 100644
--- a/server/src/Http/Requests/CancelOrderRequest.php
+++ b/server/src/Http/Requests/CancelOrderRequest.php
@@ -20,7 +20,8 @@ public function authorize(): bool
     public function rules(): array
     {
         return [
-            'order' => 'required|exists:orders,uuid',
+            'order'  => 'required|exists:orders,uuid',
+            'reason' => 'nullable|string|max:1000',
         ];
     }
 }
diff --git a/server/src/Listeners/HandleOrderCanceled.php b/server/src/Listeners/HandleOrderCanceled.php
index 63b880896..4adb3a525 100644
--- a/server/src/Listeners/HandleOrderCanceled.php
+++ b/server/src/Listeners/HandleOrderCanceled.php
@@ -12,6 +12,11 @@ class HandleOrderCanceled implements ShouldQueue
 {
     use InteractsWithQueue;
 
+    /**
+     * The reason the order being handled was canceled.
+     */
+    protected string $reason = '';
+
     /**
      * Handle the event.
      *
@@ -21,6 +26,9 @@ class HandleOrderCanceled implements ShouldQueue
      */
     public function handle(OrderCanceled $event)
     {
+        // the cancellation reason travels as the canceled activity's details
+        $this->reason = (string) ($event->activity ? $event->activity->get('details', '') : '');
+
         /** @var \Fleetbase\FleetOps\Models\Order $order */
         $order    = $event->getModelRecord();
         if ($order->isIntegratedVendorOrder()) {
@@ -50,6 +58,6 @@ protected function findAssignedDriver($order): ?Driver
 
     protected function notifyAssignedDriver(Driver $driver, $order): void
     {
-        $driver->notify(new OrderCanceledNotification($order));
+        $driver->notify(new OrderCanceledNotification($order, $this->reason));
     }
 }
diff --git a/server/src/Models/Order.php b/server/src/Models/Order.php
index b581f7204..36e7ebf5e 100644
--- a/server/src/Models/Order.php
+++ b/server/src/Models/Order.php
@@ -1463,11 +1463,33 @@ public function firstDispatchWithActivity(): Order
      * @return mixed the result of the OrderCanceled event
      */
     public function cancel()
+    {
+        return $this->cancelWithReason(null);
+    }
+
+    /**
+     * Cancels the order, recording why.
+     *
+     * The reason becomes the details of the canceled tracking status and is carried on
+     * the OrderCanceled event's activity, which the canceled notifications read.
+     *
+     * @return mixed the result of the OrderCanceled event
+     */
+    public function cancelWithReason(?string $reason = null)
     {
         // The canceled activity comes from the order config, which may define its own code.
         $this->loadMissing('orderConfig');
         $orderConfig      = $this->orderConfig ?? $this->config();
         $canceledActivity = $orderConfig->getCanceledActivity();
+
+        // A reason given for the cancellation becomes the canceled status details, which
+        // the canceled notifications read. The config's activity itself is left untouched.
+        $reason         = is_string($reason) ? trim($reason) : null;
+        $reasonActivity = null;
+        if ($reason !== null && $reason !== '' && $canceledActivity instanceof Activity) {
+            $canceledActivity = $reasonActivity = (clone $canceledActivity)->set('details', $reason);
+        }
+
         $this->status     = $canceledActivity->code ?? 'canceled';
         $this->updateActivity($canceledActivity);
 
@@ -1479,7 +1501,13 @@ public function cancel()
             }
         }
 
-        return dispatch(fn () => event(new OrderCanceled($this)))->afterCommit();
+        // The event carries the activity when a reason was given, so the canceled
+        // notifications (which read the activity details) include it.
+        return dispatch(function () use ($reasonActivity) {
+            $event           = new OrderCanceled($this);
+            $event->activity = $reasonActivity;
+            event($event);
+        })->afterCommit();
     }
 
     /**
diff --git a/server/src/Notifications/OrderCanceled.php b/server/src/Notifications/OrderCanceled.php
index a1827295b..22dc8f743 100644
--- a/server/src/Notifications/OrderCanceled.php
+++ b/server/src/Notifications/OrderCanceled.php
@@ -82,6 +82,11 @@ public function __construct(Order $order, string $reason = '', ?Waypoint $waypoi
         $this->title       = 'Order ' . $this->getTrackingNumber() . ' was canceled';
         $this->message     = 'Order ' . $this->getTrackingNumber() . ' has been canceled.';
         $this->data        = ['id' => $this->order->public_id, 'type' => 'order_canceled'];
+
+        // apps show why the order was canceled when a reason was given
+        if ($reason !== '') {
+            $this->data['reason'] = $reason;
+        }
     }
 
     /**
diff --git a/server/tests/ApiOrderControllerContractsTest.php b/server/tests/ApiOrderControllerContractsTest.php
index 33435dbfc..95599e330 100644
--- a/server/tests/ApiOrderControllerContractsTest.php
+++ b/server/tests/ApiOrderControllerContractsTest.php
@@ -452,6 +452,16 @@ public function cancel()
         return $this;
     }
 
+    public ?string $cancelReasonForTest = null;
+
+    public function cancelWithReason(?string $reason = null)
+    {
+        $this->cancelledForTest    = true;
+        $this->cancelReasonForTest = $reason;
+
+        return $this;
+    }
+
     public bool $declinedForTest = false;
 
     public ?string $declineReasonForTest = null;
@@ -1250,6 +1260,25 @@ public function isString(string $key): bool
         ->and($controller->edit->guarded[0]['entities_mode'])->toBe('append');
 });
 
+test('api order controller cancels with a reason when one is given', function () {
+    $order             = new FleetOpsApiOrderCrudFake();
+    $controller        = new FleetOpsApiOrderCrudControllerProbe();
+    $controller->order = $order;
+
+    $controller->cancelOrder('order-public', new Request(['reason' => '  Customer moved away  ']));
+
+    expect($order->cancelledForTest)->toBeTrue()
+        ->and($order->cancelReasonForTest)->toBe('Customer moved away');
+
+    $plain             = new FleetOpsApiOrderCrudFake();
+    $controller        = new FleetOpsApiOrderCrudControllerProbe();
+    $controller->order = $plain;
+    $controller->cancelOrder('order-public', new Request());
+
+    expect($plain->cancelledForTest)->toBeTrue()
+        ->and($plain->cancelReasonForTest)->toBeNull();
+});
+
 test('api order controller accepts and declines offers for the assigned driver only', function () {
     $driver = new FleetOpsApiOrderDriverFake();
     $driver->setRawAttributes(['uuid' => 'driver-uuid', 'public_id' => 'driver_offer', 'name' => 'Dee'], true);
diff --git a/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php b/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php
index cd970116c..9b5e62f19 100644
--- a/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php
+++ b/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php
@@ -468,6 +468,14 @@ public function cancel()
         return $this;
     }
 
+    public ?string $cancelReasonForTest = null;
+
+    public function cancelWithReason(?string $reason = null)
+    {
+        $this->cancelReasonForTest = $reason;
+
+        return $this->cancel();
+    }
 
     public function dispatch(bool $save = true): Order
     {
@@ -1129,7 +1137,15 @@ function fleetopsSuppressStrNullDeprecations(): Closure
         'order'   => 'order-uuid',
     ])
         ->and($order->lookup_uuid)->toBe('order-uuid')
-        ->and($order->canceledForTest)->toBeTrue();
+        ->and($order->canceledForTest)->toBeTrue()
+        ->and($order->cancelReasonForTest)->toBeNull();
+
+    $order      = fleetopsInternalOrderLifecycleOrder('order-uuid', 'created');
+    $controller = fleetopsInternalOrderLifecycleController([$order]);
+    $controller->cancel(fleetopsCancelOrderRequest(['order' => 'order-uuid', 'reason' => 'Customer asked to cancel']));
+
+    expect($order->canceledForTest)->toBeTrue()
+        ->and($order->cancelReasonForTest)->toBe('Customer asked to cancel');
 
     $order      = fleetopsInternalOrderLifecycleOrder('order-dispatch', 'created');
     $controller = fleetopsInternalOrderLifecycleController([$order]);
diff --git a/server/tests/NotificationAndMailContractsTest.php b/server/tests/NotificationAndMailContractsTest.php
index a2f0f419c..467bd4998 100644
--- a/server/tests/NotificationAndMailContractsTest.php
+++ b/server/tests/NotificationAndMailContractsTest.php
@@ -543,7 +543,7 @@ public function track(Order $order, mixed $options): array
             'event' => 'order.canceled_notification',
             'title' => 'Order WP-TRACK-123 was canceled',
             'body'  => 'Order WP-TRACK-123 has been canceled. customer requested cancel',
-            'data'  => ['id' => 'order_public', 'type' => 'order_canceled'],
+            'data'  => ['id' => 'order_public', 'type' => 'order_canceled', 'reason' => 'customer requested cancel'],
         ])
         ->and($failed->toArray())->toMatchArray([
             'event' => 'order.failed_notification',
diff --git a/server/tests/Unit/Models/OrderCancelReasonTest.php b/server/tests/Unit/Models/OrderCancelReasonTest.php
new file mode 100644
index 000000000..eddd2a606
--- /dev/null
+++ b/server/tests/Unit/Models/OrderCancelReasonTest.php
@@ -0,0 +1,143 @@
+<?php
+
+if (!class_exists('FleetOpsOrderCancelReasonRecorder', false)) {
+    class FleetOpsOrderCancelReasonRecorder
+    {
+        public static array $events = [];
+
+        public static function dispatch($job): object
+        {
+            if ($job instanceof Closure) {
+                $job();
+            }
+
+            return new class {
+                public function afterCommit(): self
+                {
+                    return $this;
+                }
+            };
+        }
+    }
+}
+
+if (!function_exists('Fleetbase\FleetOps\Models\dispatch')) {
+    eval('namespace Fleetbase\FleetOps\Models; function dispatch($job) { return \FleetOpsOrderCancelReasonRecorder::dispatch($job); }');
+}
+
+if (!function_exists('Fleetbase\FleetOps\Models\event')) {
+    eval('namespace Fleetbase\FleetOps\Models; function event($event = null) { \FleetOpsOrderCancelReasonRecorder::$events[] = $event; return $event; }');
+}
+
+if (!class_exists('Fleetbase\FleetOps\Events\OrderCanceled', false)) {
+    eval('namespace Fleetbase\FleetOps\Events; class OrderCanceled { public $activity = null; public $waypoint = null; public function __construct(public $order) {} public function getModelRecord() { return $this->order; } }');
+}
+
+use Fleetbase\FleetOps\Events\OrderCanceled;
+use Fleetbase\FleetOps\Flow\Activity;
+use Fleetbase\FleetOps\Listeners\HandleOrderCanceled;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\OrderConfig;
+
+/**
+ * Covers canceling an order with a reason: the reason becomes the canceled
+ * status details and rides on the OrderCanceled event, while the config's
+ * activity is left untouched and a plain cancel carries no activity.
+ */
+class FleetOpsOrderCancelReasonOrder extends Order
+{
+    public array $activities = [];
+
+    public function updateActivity(?Activity $activity = null, $proof = null): Order
+    {
+        $this->activities[] = $activity;
+        $this->status       = $activity?->code;
+
+        return $this;
+    }
+}
+
+class FleetOpsOrderCancelReasonConfig extends OrderConfig
+{
+    public ?Activity $canceled = null;
+
+    public function getCanceledActivity()
+    {
+        return $this->canceled;
+    }
+}
+
+function fleetopsOrderCancelReasonOrder(): array
+{
+    FleetOpsOrderCancelReasonRecorder::$events = [];
+
+    $config           = new FleetOpsOrderCancelReasonConfig();
+    $config->canceled = new Activity(['code' => 'canceled', 'status' => 'Order canceled', 'details' => 'Order was canceled']);
+
+    $order = new FleetOpsOrderCancelReasonOrder();
+    $order->setRawAttributes(['uuid' => 'order-uuid', 'status' => 'dispatched'], true);
+    $order->setRelation('orderConfig', $config);
+
+    return [$order, $config];
+}
+
+test('canceling with a reason records it as the canceled details and on the event', function () {
+    [$order, $config] = fleetopsOrderCancelReasonOrder();
+
+    $order->cancelWithReason('  Customer moved house  ');
+
+    $event = collect(FleetOpsOrderCancelReasonRecorder::$events)->first(fn ($event) => $event instanceof OrderCanceled);
+
+    expect($order->status)->toBe('canceled')
+        ->and($order->activities[0]->get('details'))->toBe('Customer moved house')
+        ->and($config->canceled->get('details'))->toBe('Order was canceled')
+        ->and($event)->not->toBeNull()
+        ->and($event->activity->get('details'))->toBe('Customer moved house');
+});
+
+test('a plain cancel keeps the config activity and sends no reason', function () {
+    [$order, $config] = fleetopsOrderCancelReasonOrder();
+
+    $order->cancel();
+
+    $event = collect(FleetOpsOrderCancelReasonRecorder::$events)->first(fn ($event) => $event instanceof OrderCanceled);
+
+    expect($order->activities[0])->toBe($config->canceled)
+        ->and($event->activity)->toBeNull();
+});
+
+test('the canceled listener passes the reason on to the assigned driver', function () {
+    [$order] = fleetopsOrderCancelReasonOrder();
+    $order->setRawAttributes(array_merge($order->getAttributes(), ['driver_assigned_uuid' => 'driver-uuid']));
+    $order->setRelation('facilitator', null);
+    $order->setRelation('trackingNumber', null);
+
+    $driver = new class extends Driver {
+        public array $notified = [];
+
+        public function notify($instance)
+        {
+            $this->notified[] = $instance;
+        }
+    };
+
+    $listener = new class($driver) extends HandleOrderCanceled {
+        public function __construct(private Driver $driverForTest)
+        {
+        }
+
+        protected function findAssignedDriver($order): ?Driver
+        {
+            return $this->driverForTest;
+        }
+    };
+
+    $event           = new OrderCanceled($order);
+    $event->activity = new Activity(['code' => 'canceled', 'details' => 'Customer moved house']);
+    $listener->handle($event);
+
+    expect($driver->notified)->toHaveCount(1)
+        ->and($driver->notified[0]->reason)->toBe('Customer moved house')
+        ->and($driver->notified[0]->data)->toBe(['id' => null, 'type' => 'order_canceled', 'reason' => 'Customer moved house']);
+});

From 62415d4efdb7268061b727e109a265a9350e5ca2 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 17:43:06 +0800
Subject: [PATCH 78/87] test(orders): align request and assignment contracts
 with the cancel reason rule and observer-sent assignment

---
 server/tests/RequestContractsTest.php              | 2 +-
 server/tests/Unit/Models/OrderPayloadRouteTest.php | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/server/tests/RequestContractsTest.php b/server/tests/RequestContractsTest.php
index 86f7280eb..045909958 100644
--- a/server/tests/RequestContractsTest.php
+++ b/server/tests/RequestContractsTest.php
@@ -507,7 +507,7 @@ protected function canUpdateDriver(): bool
                 'service_area' => 'service area',
                 'parent_fleet' => 'parent fleet',
             ])
-            ->and(requestRules(CancelOrderRequest::class))->toBe(['order' => 'required|exists:orders,uuid'])
+            ->and(requestRules(CancelOrderRequest::class))->toBe(['order' => 'required|exists:orders,uuid', 'reason' => 'nullable|string|max:1000'])
             ->and(requestRules(DecodeTrackingNumberQR::class))->toBe(['code' => 'required|string'])
             ->and(requestRules(CreateServiceQuoteRequest::class))->toBe([]);
     });
diff --git a/server/tests/Unit/Models/OrderPayloadRouteTest.php b/server/tests/Unit/Models/OrderPayloadRouteTest.php
index d4b65a949..759ee0bcc 100644
--- a/server/tests/Unit/Models/OrderPayloadRouteTest.php
+++ b/server/tests/Unit/Models/OrderPayloadRouteTest.php
@@ -205,10 +205,12 @@ function fleetopsOrderPayloadRouteOrder(array $attributes = []): FleetOpsOrderPa
     expect($assigned->assignDriver($driver))->toBe($assigned)
         ->and($assigned->notified)->toBe([]);
 
-    // Driver instance assignment notifies and saves
+    // Driver instance assignment saves; the order observer sends the assignment
+    // notification after the save, so assignDriver does not send it as well
     $order->assignDriver($driver);
     expect($order->driver_assigned_uuid)->toBe('driver-1')
-        ->and($order->notified)->toBe(['driver-assigned'])
+        ->and($order->notified)->toBe([])
+        ->and($order->silentDriverAssignment)->toBeFalse()
         ->and($connection->table('orders')->value('driver_assigned_uuid'))->toBe('driver-1');
 
     // Public id resolution recurses into instance assignment

From b40795059f61f07a78406b4e98af75869a1c1d84 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 18:25:52 +0800
Subject: [PATCH 79/87] feat(auth): hashed single-use verification codes, no
 stub users before verification

Phase 1 of the SMS guard on the FleetOps side (needs core-api with the
hashed-code APIs, fleetbase/core-api#307):

- The customer API no longer persists a User for an identity that merely asked
  for a creation code; the code's subject is the existing user or an unsaved one.
  A users row per unverified identity was a way to fill the table from a leaked
  credential.
- Every SMS code the driver and customer APIs send is issued hashed (HMAC on the
  row, 10 minute expiry, plain code only in the message).
- One verify-and-consume path: create, verify-code, and the password resets check
  the submitted code against the live codes for the identity or user, newest
  first, lock a code after five wrong guesses, and mark the matching one used.
  Plaintext rows written before this verify the same way.
- The public tracking page consumes a verified code instead of deleting it, so
  the row stays for the ledger.
---
 .../Controllers/Api/v1/CustomerController.php | 79 +++++++++++++++----
 .../Controllers/Api/v1/DriverController.php   | 51 +++++++++---
 .../Support/TrackingPage/TrackingAccess.php   | 20 ++++-
 .../ApiCustomerControllerContractsTest.php    | 10 +--
 .../tests/ApiDriverPasswordContractsTest.php  | 19 +----
 .../Api/CustomerControllerHelperSeamsTest.php | 24 ++++++
 .../TrackingPage/TrackingAccessTest.php       |  4 +-
 7 files changed, 155 insertions(+), 52 deletions(-)

diff --git a/server/src/Http/Controllers/Api/v1/CustomerController.php b/server/src/Http/Controllers/Api/v1/CustomerController.php
index 204dcd85b..108f11482 100644
--- a/server/src/Http/Controllers/Api/v1/CustomerController.php
+++ b/server/src/Http/Controllers/Api/v1/CustomerController.php
@@ -46,6 +46,11 @@ class CustomerController extends Controller
 
     public const DEACTIVATED_LOGIN_MESSAGE = 'This customer login has been deactivated.';
 
+    /**
+     * Wrong guesses a single code tolerates before it locks itself (core's check()).
+     */
+    public const CODE_CHECK_ATTEMPTS = 5;
+
     /* ============================================================
      | Public auth flows (API credential only, no Customer-Token)
      * ============================================================ */
@@ -80,23 +85,21 @@ public function requestCreationCode(VerifyCreateCustomerRequest $request)
         $providedName  = trim((string) $request->input('name', ''));
         $providedPhone = $request->filled('phone') ? static::phone($request->input('phone')) : null;
 
-        // The verification code needs a persisted subject so the mail renderer
-        // can resolve the polymorphic `subject` relation (the verification blade
-        // template references `$user->name`). Look up — or create — the User
-        // before sending. `create()` later backfills password + remaining fields
-        // on this same row when the customer confirms the code.
+        // The code's subject is the person signing up: an existing user (a prior
+        // incomplete signup, or an account in another organization) as it stands, else
+        // an unsaved User carrying the name and contact details the message needs.
+        // Nothing is persisted until create() verifies the code — a users row per
+        // unverified identity was a way to fill the table from a leaked credential.
         $subject = $this->findActiveUserByIdentity($identity, $isEmail ? 'email' : 'phone');
 
         if (!$subject) {
-            // `password` and `type` are guarded on User; assign type after create
-            // via setUserType (saves the row).
-            $subject = $this->createUser([
+            $subject = new User();
+            $subject->forceFill([
                 'company_uuid' => $sessionCompany,
                 'name'         => $providedName !== '' ? $providedName : $identity,
                 'email'        => $isEmail ? $identity : null,
                 'phone'        => $isEmail ? $providedPhone : $identity,
             ]);
-            $subject->setUserType('customer');
         } elseif ($providedName !== '' && (!$subject->name || $subject->name === $subject->email)) {
             // Existing stub user from a prior incomplete signup — refresh the
             // greeting name if the client supplied one.
@@ -118,6 +121,7 @@ public function requestCreationCode(VerifyCreateCustomerRequest $request)
                 ]);
             } else {
                 $this->generateSmsVerification($subject, 'fleetops_create_customer', [
+                    'hashed'          => true,
                     'messageCallback' => fn ($verification) => 'Your ' . config('app.name') . ' verification code is ' . $verification->code,
                     'meta'            => $meta,
                 ]);
@@ -393,6 +397,7 @@ public function loginWithPhone(Request $request)
 
         try {
             $this->generateSmsVerification($user, 'fleetops_customer_login', [
+                'hashed'          => true,
                 'messageCallback' => fn ($verification) => 'Your ' . config('app.name') . ' verification code is ' . $verification->code,
             ]);
 
@@ -494,6 +499,7 @@ public function forgotPassword(Request $request)
                 ]);
             } else {
                 $this->generateSmsVerification($user, 'fleetops_customer_password_reset', [
+                    'hashed'          => true,
                     'messageCallback' => fn ($v) => 'Your ' . config('app.name') . ' password reset code is ' . $v->code,
                     'meta'            => $meta,
                 ]);
@@ -542,12 +548,9 @@ public function resetPassword(Request $request)
         // setPasswordAttribute mutator hashes plaintext; don't pre-hash here.
         $user->password = $password;
         $user->save();
-        // Invalidate all existing sessions for this user after a password reset.
+        // Invalidate all existing sessions for this user after a password reset. The
+        // code itself was used up when it verified (findVerificationCode).
         $this->deleteUserTokens($user);
-        // Null on the testing-bypass path — there is no row to consume.
-        if ($verificationCode) {
-            $verificationCode->delete();
-        }
 
         return response()->json(['status' => 'ok']);
     }
@@ -978,14 +981,58 @@ protected function verificationBypassMatches(?string $identity, ?string $code):
         );
     }
 
+    /**
+     * Whether the submitted code verifies against a live code for the purpose and
+     * subject or identity in `$attributes`, using the code up when it does.
+     */
     protected function verificationCodeExists(array $attributes): bool
     {
-        return VerificationCode::where($attributes)->exists();
+        return $this->findVerificationCode($attributes) !== null;
     }
 
+    /**
+     * The live code the submitted code verified against, used up so it cannot verify
+     * again, or null. `$attributes` carries `code`, `for` and either `subject_uuid` or
+     * `meta->identity`. Live codes are checked newest first; a wrong guess counts against
+     * each until it locks (core's check()). Plaintext rows written before codes were hashed
+     * verify the same way.
+     */
     protected function findVerificationCode(array $attributes): mixed
     {
-        return VerificationCode::where($attributes)->first();
+        $code = (string) ($attributes['code'] ?? '');
+
+        foreach ($this->liveVerificationCodes($attributes) as $verificationCode) {
+            if ($verificationCode->check($code, static::CODE_CHECK_ATTEMPTS) === VerificationCode::CHECK_VALID) {
+                $verificationCode->consume();
+
+                return $verificationCode;
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Unexpired, unused, unlocked codes for the purpose and subject or identity in
+     * `$attributes`, newest first.
+     *
+     * @return \Illuminate\Support\Collection<int, VerificationCode>
+     */
+    protected function liveVerificationCodes(array $attributes)
+    {
+        $query = VerificationCode::query()
+            ->where('for', (string) ($attributes['for'] ?? ''))
+            ->where(function ($query) {
+                $query->whereNull('status')->orWhereNotIn('status', [VerificationCode::STATUS_USED, VerificationCode::STATUS_LOCKED]);
+            });
+
+        foreach (['subject_uuid', 'meta->identity'] as $column) {
+            if (array_key_exists($column, $attributes)) {
+                $query->where($column, $attributes[$column]);
+            }
+        }
+
+        return $query->orderByDesc('created_at')->get();
     }
 
     protected function findFileByPublicId(string $publicId): mixed
diff --git a/server/src/Http/Controllers/Api/v1/DriverController.php b/server/src/Http/Controllers/Api/v1/DriverController.php
index 124373721..7171cf6b4 100644
--- a/server/src/Http/Controllers/Api/v1/DriverController.php
+++ b/server/src/Http/Controllers/Api/v1/DriverController.php
@@ -56,6 +56,11 @@ class DriverController extends Controller
      */
     public const DEACTIVATED_LOGIN_MESSAGE = 'This driver login has been deactivated.';
 
+    /**
+     * Wrong guesses a single code tolerates before it locks itself (core's check()).
+     */
+    public const CODE_CHECK_ATTEMPTS = 5;
+
     /**
      * Public expansion name => Eloquent relation name.
      *
@@ -588,6 +593,7 @@ public function loginWithPhone()
         // generate verification token
         try {
             VerificationCode::generateSmsVerificationFor($user, 'driver_login', [
+                'hashed'          => true,
                 'company_uuid'    => $company->uuid,
                 'messageCallback' => function ($verification) use ($company) {
                     return 'Your ' . data_get($company, 'name', config('app.name')) . ' verification code is ' . $verification->code;
@@ -652,8 +658,8 @@ public function verifyCode(Request $request)
             return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
         }
 
-        // find and verify code
-        $verificationCode = VerificationCode::where(['subject_uuid' => $user->uuid, 'code' => $code, 'for' => $for])->exists();
+        // find and verify code: the user's newest live code for this purpose, used up
+        $verificationCode = static::spendCode($user, $for, (string) $code);
         if (!$verificationCode && !static::verificationBypassMatches($identity, $code)) {
             return response()->apiError('Invalid verification code!');
         }
@@ -1387,7 +1393,7 @@ public function resetPassword(Request $request)
         $user->password = $password;
         $user->save();
 
-        $verification->delete();
+        // The code was used up when it verified (findResetCode); every session ends.
         $user->tokens()->delete();
 
         return response()->json(['status' => 'ok']);
@@ -1422,14 +1428,40 @@ protected static function passwordMatches(User $user, string $plain): bool
         return Hash::check($plain, $user->password);
     }
 
-    /** The unexpired reset code for this user, if the one supplied matches. */
+    /**
+     * The live reset code the supplied one verified against, used up so it cannot
+     * verify again, or null.
+     */
     protected static function findResetCode(User $user, string $code)
     {
-        return VerificationCode::where([
-            'subject_uuid' => $user->uuid,
-            'code'         => $code,
-            'for'          => 'driver_password_reset',
-        ])->where('expires_at', '>', now())->first();
+        return static::spendCode($user, 'driver_password_reset', $code);
+    }
+
+    /**
+     * Verify a code against the user's live codes for a purpose and use it up. Codes are
+     * checked newest first; a wrong guess counts against each until it locks (core's
+     * check()). Plaintext rows written before codes were hashed verify the same way.
+     */
+    protected static function spendCode(User $user, string $for, string $code): ?VerificationCode
+    {
+        $live = VerificationCode::query()
+            ->where('for', $for)
+            ->where('subject_uuid', $user->uuid)
+            ->where(function ($query) {
+                $query->whereNull('status')->orWhereNotIn('status', [VerificationCode::STATUS_USED, VerificationCode::STATUS_LOCKED]);
+            })
+            ->orderByDesc('created_at')
+            ->get();
+
+        foreach ($live as $verificationCode) {
+            if ($verificationCode->check($code, static::CODE_CHECK_ATTEMPTS) === VerificationCode::CHECK_VALID) {
+                $verificationCode->consume();
+
+                return $verificationCode;
+            }
+        }
+
+        return null;
     }
 
     /** Sends the reset code by whichever channel the identity names. */
@@ -1444,6 +1476,7 @@ protected static function sendResetCode(User $user, string $identity): void
             ]);
         } else {
             VerificationCode::generateSmsVerificationFor($user, 'driver_password_reset', [
+                'hashed'          => true,
                 'messageCallback' => fn ($v) => 'Your ' . config('app.name') . ' password reset code is ' . $v->code,
             ]);
         }
diff --git a/server/src/Support/TrackingPage/TrackingAccess.php b/server/src/Support/TrackingPage/TrackingAccess.php
index f6872871a..bc2cc7dde 100644
--- a/server/src/Support/TrackingPage/TrackingAccess.php
+++ b/server/src/Support/TrackingPage/TrackingAccess.php
@@ -141,7 +141,7 @@ public function checkCode(TrackingScope $scope, string $code): array
         $result = $verificationCode->check($code, self::MAX_ATTEMPTS);
         if ($result === VerificationCode::CHECK_VALID) {
             $channel = $verificationCode->getMeta('channel');
-            $this->deleteCode($verificationCode);
+            $this->consumeCode($verificationCode);
 
             return ['status' => $result, 'channel' => $channel];
         }
@@ -290,14 +290,26 @@ protected function createCode(mixed $recipient, array $options): VerificationCod
         return VerificationCode::issue($recipient, self::CODE_PURPOSE, $options);
     }
 
+    /**
+     * The scope's newest code that has not been used. Read without the expiry scope so an
+     * expired code is reported as such rather than as missing; a used code stays on the
+     * table for the ledger but never verifies again.
+     */
     protected function latestCode(TrackingScope $scope): ?VerificationCode
     {
-        return VerificationCode::withoutGlobalScope(ExpiryScope::class)->where('for', self::CODE_PURPOSE)->where('meta->scope', $scope->key())->latest()->first();
+        return VerificationCode::withoutGlobalScope(ExpiryScope::class)
+            ->where('for', self::CODE_PURPOSE)
+            ->where('meta->scope', $scope->key())
+            ->where(function ($query) {
+                $query->whereNull('status')->orWhere('status', '!=', VerificationCode::STATUS_USED);
+            })
+            ->latest()
+            ->first();
     }
 
-    protected function deleteCode(VerificationCode $verificationCode): void
+    protected function consumeCode(VerificationCode $verificationCode): void
     {
-        $verificationCode->delete();
+        $verificationCode->consume();
     }
 
     protected function findSession(string $tokenHash): ?TrackingSession
diff --git a/server/tests/ApiCustomerControllerContractsTest.php b/server/tests/ApiCustomerControllerContractsTest.php
index 49131be51..1140e1460 100644
--- a/server/tests/ApiCustomerControllerContractsTest.php
+++ b/server/tests/ApiCustomerControllerContractsTest.php
@@ -692,12 +692,9 @@ function fleetopsApiCustomerJson($response): array
     ]));
 
     expect($created)->toBe(['status' => 'ok'])
-        ->and($controller->createdUsers[0])->toMatchArray([
-            'company_uuid' => 'company-uuid',
-            'name'         => 'Jane',
-            'email'        => 'jane@example.test',
-            'phone'        => '+15551234567',
-        ])
+        // Nothing is persisted for an unverified identity: the code's subject is an unsaved user.
+        ->and($controller->createdUsers)->toBe([])
+        ->and($controller->emailVerifications[0][0])->toBeNull()
         ->and($controller->emailVerifications[0][1])->toBe('fleetops_create_customer')
         ->and($updated)->toBe(['status' => 'ok'])
         ->and($stub->name)->toBe('Stub Name')
@@ -844,7 +841,6 @@ function fleetopsApiCustomerJson($response): array
         ->and(fleetopsApiCustomerJson($reset))->toBe(['status' => 'ok'])
         ->and($controller->genericUser->savedForTest)->toBeTrue()
         ->and($controller->genericUser->tokensDeleted)->toBeTrue()
-        ->and($controller->verificationCode->deleted)->toBeTrue()
         ->and(fleetopsApiCustomerJson($unknown->forgotPassword(Request::create('/v1/customers/forgot-password', 'POST', [
             'identity' => 'missing@example.test',
         ]))))->toBe(['status' => 'ok'])
diff --git a/server/tests/ApiDriverPasswordContractsTest.php b/server/tests/ApiDriverPasswordContractsTest.php
index 8d7a44414..3716031c8 100644
--- a/server/tests/ApiDriverPasswordContractsTest.php
+++ b/server/tests/ApiDriverPasswordContractsTest.php
@@ -362,23 +362,13 @@ function fleetopsPasswordUser(string $plainPassword = 'correct-horse'): FleetOps
         ->and($unknownIdentity->getData())->toBe($badCode->getData());
 });
 
-test('reset password sets the password, spends the code, and ends every session', function () {
+test('reset password sets the password and ends every session once the code verified', function () {
     $user                                          = fleetopsPasswordUser();
     FleetOpsPasswordControllerProbe::$identityUser = $user;
 
-    $deleted                                    = false;
-    FleetOpsPasswordControllerProbe::$resetCode = new class($deleted) {
-        public function __construct(public bool &$deleted)
-        {
-        }
-
-        public function delete(): bool
-        {
-            $this->deleted = true;
-
-            return true;
-        }
-    };
+    // findResetCode() hands back the code it verified and used up; nothing more is done
+    // to it here.
+    FleetOpsPasswordControllerProbe::$resetCode = (object) ['uuid' => 'reset-code'];
 
     $response = (new FleetOpsPasswordControllerProbe())->resetPassword(
         new Request(['identity' => 'driver@example.test', 'code' => '123456', 'password' => 'newpassword'])
@@ -386,7 +376,6 @@ public function delete(): bool
 
     expect($response->getStatusCode())->toBe(200)
         ->and($user->saved)->toHaveCount(1)
-        ->and($deleted)->toBeTrue()
         // A reset is a recovery from losing control; nothing keeps working.
         ->and($user->tokensDeleted)->toBeTrue();
 });
diff --git a/server/tests/Feature/Http/Api/CustomerControllerHelperSeamsTest.php b/server/tests/Feature/Http/Api/CustomerControllerHelperSeamsTest.php
index 6477520a2..bd034d946 100644
--- a/server/tests/Feature/Http/Api/CustomerControllerHelperSeamsTest.php
+++ b/server/tests/Feature/Http/Api/CustomerControllerHelperSeamsTest.php
@@ -829,3 +829,27 @@ protected function createFileFromBase64(string $contents, string $path): mixed
     expect($connection->table('contacts')->where('uuid', '88888888-8888-4888-8888-888888888820')->value('photo_uuid'))->toBe('file-b64-1');
     app()->forgetInstance(CustomerAuth::APP_BINDING);
 });
+
+test('a wrong code counts against the live code, a right one uses it up, and a used code never verifies again', function () {
+    $connection = fleetopsCustomerHelperBoot();
+    $controller = new CustomerController();
+
+    $connection->table('verification_codes')->insert([
+        ['uuid' => 'vc-older', 'code' => '101010', 'for' => 'fleetops_create_customer', 'meta' => json_encode(['identity' => 'spend@example.com']), 'status' => 'active', 'created_at' => '2026-10-13 09:00:00'],
+        ['uuid' => 'vc-newer', 'code' => '202020', 'for' => 'fleetops_create_customer', 'meta' => json_encode(['identity' => 'spend@example.com']), 'status' => 'active', 'created_at' => '2026-10-13 09:05:00'],
+    ]);
+
+    $wrong = $controller->create(CreateCustomerRequest::create('/v1/customers', 'POST', ['code' => '999999', 'identity' => 'spend@example.com', 'name' => 'Spender', 'password' => 'secret']));
+    expect($wrong->getData(true)['error'])->toContain('Invalid verification code')
+        ->and(json_decode($connection->table('verification_codes')->where('uuid', 'vc-newer')->value('meta'), true)['attempts'])->toBe(1)
+        ->and(json_decode($connection->table('verification_codes')->where('uuid', 'vc-older')->value('meta'), true)['attempts'])->toBe(1);
+
+    // The older code still verifies while it is live, and is used up by doing so.
+    $controller->create(CreateCustomerRequest::create('/v1/customers', 'POST', ['code' => '101010', 'identity' => 'spend@example.com', 'name' => 'Spender', 'password' => 'secret']));
+    expect($connection->table('contacts')->where('email', 'spend@example.com')->count())->toBe(1)
+        ->and($connection->table('verification_codes')->where('uuid', 'vc-older')->value('status'))->toBe('used')
+        ->and($connection->table('verification_codes')->where('uuid', 'vc-newer')->value('status'))->toBe('active');
+
+    $again = $controller->create(CreateCustomerRequest::create('/v1/customers', 'POST', ['code' => '101010', 'identity' => 'spend@example.com', 'name' => 'Spender', 'password' => 'secret']));
+    expect($again->getData(true)['error'])->toContain('Invalid verification code');
+});
diff --git a/server/tests/Unit/Support/TrackingPage/TrackingAccessTest.php b/server/tests/Unit/Support/TrackingPage/TrackingAccessTest.php
index 70ae31558..c3376434d 100644
--- a/server/tests/Unit/Support/TrackingPage/TrackingAccessTest.php
+++ b/server/tests/Unit/Support/TrackingPage/TrackingAccessTest.php
@@ -126,8 +126,10 @@ function trackingRequest(array $cookies = [], string $ip = '203.0.113.7'): Reque
     expect($access->checkCode($scope, $wrong))->toBe(['status' => VerificationCode::CHECK_INVALID, 'attempts_left' => 2])
         ->and($access->pausedFor($scope))->toBe(0);
 
+    // A used code stays on the table for the ledger, marked used, and never verifies again.
     expect($access->checkCode($scope, $second->plainCode))->toBe(['status' => VerificationCode::CHECK_VALID, 'channel' => 'email'])
-        ->and(VerificationCode::withoutGlobalScope(ExpiryScope::class)->count())->toBe(0)
+        ->and(VerificationCode::withoutGlobalScope(ExpiryScope::class)->count())->toBe(1)
+        ->and(VerificationCode::withoutGlobalScope(ExpiryScope::class)->value('status'))->toBe(VerificationCode::STATUS_USED)
         ->and($access->checkCode($scope, $second->plainCode))->toBe(['status' => VerificationCode::CHECK_EXPIRED]);
 
     $third = $access->issueCode($scope, null, 'sms');

From bc0c72262e3dfa76c6c4b4b990335e6ace8c15c6 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 18:53:22 +0800
Subject: [PATCH 80/87] fix(api): answer an SMS guard refusal with its status

The customer and driver login, creation-code and forgot-password endpoints
wrap their SMS send in a catch-all, so a refusal from the guard (a
RuntimeException) was flattened into the generic 400 send error, or into
the email fallback, and an app could neither explain it nor back off.

The refusal now reaches the caller with the status it carries: 422 for a
number that can never be texted, 429 with Retry-After for a cooldown or
budget, 423 while texting is paused. Login still falls back to email when
the account has an address; the refusal is the answer only when nothing
else can carry the code.
---
 .../Controllers/Api/v1/CustomerController.php | 47 ++++++++++++++++-
 .../Controllers/Api/v1/DriverController.php   | 43 +++++++++++++++-
 .../ApiCustomerControllerContractsTest.php    | 50 +++++++++++++++++++
 .../tests/ApiDriverPasswordContractsTest.php  | 27 +++++++---
 .../Api/DriverControllerAuthFlowsTest.php     | 23 +++++++++
 5 files changed, 181 insertions(+), 9 deletions(-)

diff --git a/server/src/Http/Controllers/Api/v1/CustomerController.php b/server/src/Http/Controllers/Api/v1/CustomerController.php
index 108f11482..0fc7479c8 100644
--- a/server/src/Http/Controllers/Api/v1/CustomerController.php
+++ b/server/src/Http/Controllers/Api/v1/CustomerController.php
@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 
+use Fleetbase\Exceptions\SmsBlockedException;
 use Fleetbase\FleetOps\Exceptions\UserAlreadyExistsException;
 use Fleetbase\FleetOps\Http\Requests\CreateCustomerOrderRequest;
 use Fleetbase\FleetOps\Http\Requests\CreateCustomerRequest;
@@ -28,6 +29,7 @@
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Str;
+use Symfony\Component\HttpFoundation\Response;
 
 /**
  * Customer-facing Fleet-Ops API.
@@ -126,6 +128,8 @@ public function requestCreationCode(VerifyCreateCustomerRequest $request)
                     'meta'            => $meta,
                 ]);
             }
+        } catch (SmsBlockedException $e) {
+            return static::smsBlockedResponse($e);
         } catch (\Twilio\Exceptions\RestException $e) {
             return response()->apiError($e->getMessage());
         } catch (\Exception $e) {
@@ -395,6 +399,11 @@ public function loginWithPhone(Request $request)
             return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
         }
 
+        // A guard refusal (paused, over budget, unusable number) falls back to email like
+        // a provider failure does; with no email to fall back to, the refusal itself is the
+        // answer, with its status, not the generic error.
+        $smsFailure = null;
+
         try {
             $this->generateSmsVerification($user, 'fleetops_customer_login', [
                 'hashed'          => true,
@@ -403,6 +412,8 @@ public function loginWithPhone(Request $request)
 
             return response()->json(['status' => 'ok', 'method' => 'sms']);
         } catch (\Throwable $e) {
+            $smsFailure = $e;
+
             if ($user->email) {
                 try {
                     $this->generateEmailVerification($user, 'fleetops_customer_login', [
@@ -412,12 +423,12 @@ public function loginWithPhone(Request $request)
 
                     return response()->json(['status' => 'ok', 'method' => 'email']);
                 } catch (\Throwable $inner) {
-                    return response()->apiError('Unable to send verification code.');
+                    return static::sendFailureResponse($smsFailure, 'Unable to send verification code.');
                 }
             }
         }
 
-        return response()->apiError('Unable to send verification code.');
+        return static::sendFailureResponse($smsFailure, 'Unable to send verification code.');
     }
 
     /**
@@ -504,6 +515,8 @@ public function forgotPassword(Request $request)
                     'meta'            => $meta,
                 ]);
             }
+        } catch (SmsBlockedException $e) {
+            return static::smsBlockedResponse($e);
         } catch (\Throwable $e) {
             return response()->apiError(app()->hasDebugModeEnabled() ? $e->getMessage() : 'Unable to send reset code.');
         }
@@ -951,6 +964,36 @@ protected function generateSmsVerification(User $user, string $for, array $optio
         return VerificationCode::generateSmsVerificationFor($user, $for, $options);
     }
 
+    /**
+     * Answer a refusal from the SMS guard with the status it carries: 422 for a number that
+     * can never be texted, 429 with Retry-After for a cooldown or budget, 423 while texting
+     * is paused. The sends here sit inside catch-alls so a provider outage becomes an email
+     * fallback or a generic error; a refusal must not be flattened into that generic error,
+     * or an app can neither explain it to the person nor back off.
+     */
+    protected static function smsBlockedResponse(SmsBlockedException $e)
+    {
+        $response = response()->apiError($e->getMessage(), $e->status());
+        if ($response instanceof Response) {
+            $response->headers->add($e->headers());
+        }
+
+        return $response;
+    }
+
+    /**
+     * The response when a code could not be sent: the guard's refusal when that is why,
+     * otherwise the flow's own generic message.
+     */
+    protected static function sendFailureResponse(?\Throwable $failure, string $message)
+    {
+        if ($failure instanceof SmsBlockedException) {
+            return static::smsBlockedResponse($failure);
+        }
+
+        return response()->apiError($message);
+    }
+
     /**
      * Whether the supplied code matches the configured testing bypass code.
      *
diff --git a/server/src/Http/Controllers/Api/v1/DriverController.php b/server/src/Http/Controllers/Api/v1/DriverController.php
index 7171cf6b4..2deb0b7a8 100644
--- a/server/src/Http/Controllers/Api/v1/DriverController.php
+++ b/server/src/Http/Controllers/Api/v1/DriverController.php
@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 
+use Fleetbase\Exceptions\SmsBlockedException;
 use Fleetbase\FleetOps\Events\DriverLocationChanged;
 use Fleetbase\FleetOps\Events\GeofenceEntered;
 use Fleetbase\FleetOps\Events\GeofenceExited;
@@ -44,6 +45,7 @@
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Str;
+use Symfony\Component\HttpFoundation\Response;
 
 class DriverController extends Controller
 {
@@ -590,6 +592,11 @@ public function loginWithPhone()
         // Get the user's company for this driver profile
         $company = static::getDriverCompanyFromUser($user);
 
+        // A guard refusal (paused, over budget, unusable number) falls back to email like
+        // a provider failure does; with no email to fall back to, the refusal itself is the
+        // answer, with its status, not the generic error.
+        $smsFailure = null;
+
         // generate verification token
         try {
             VerificationCode::generateSmsVerificationFor($user, 'driver_login', [
@@ -602,6 +609,8 @@ public function loginWithPhone()
 
             return response()->json(['status' => 'OK', 'method' => 'sms']);
         } catch (\Throwable $e) {
+            $smsFailure = $e;
+
             if (app()->bound('sentry')) {
                 app('sentry')->captureException($e);
             }
@@ -625,7 +634,7 @@ public function loginWithPhone()
             }
         }
 
-        return response()->apiError('Unable to send SMS Verification code.');
+        return static::sendFailureResponse($smsFailure, 'Unable to send SMS Verification code.');
     }
 
     /**
@@ -1353,6 +1362,8 @@ public function forgotPassword(Request $request)
 
         try {
             static::sendResetCode($user, $identity);
+        } catch (SmsBlockedException $e) {
+            return static::smsBlockedResponse($e);
         } catch (\Throwable $e) {
             return response()->apiError(static::debugEnabled() ? $e->getMessage() : 'Unable to send reset code.');
         }
@@ -1482,6 +1493,36 @@ protected static function sendResetCode(User $user, string $identity): void
         }
     }
 
+    /**
+     * Answer a refusal from the SMS guard with the status it carries: 422 for a number that
+     * can never be texted, 429 with Retry-After for a cooldown or budget, 423 while texting
+     * is paused. The sends here sit inside catch-alls so a provider outage becomes an email
+     * fallback or a generic error; a refusal must not be flattened into that generic error,
+     * or an app can neither explain it to the person nor back off.
+     */
+    protected static function smsBlockedResponse(SmsBlockedException $e)
+    {
+        $response = response()->apiError($e->getMessage(), $e->status());
+        if ($response instanceof Response) {
+            $response->headers->add($e->headers());
+        }
+
+        return $response;
+    }
+
+    /**
+     * The response when a code could not be sent: the guard's refusal when that is why,
+     * otherwise the flow's own generic message.
+     */
+    protected static function sendFailureResponse(?\Throwable $failure, string $message)
+    {
+        if ($failure instanceof SmsBlockedException) {
+            return static::smsBlockedResponse($failure);
+        }
+
+        return response()->apiError($message);
+    }
+
     /** Resolve a driver's user account from an email address or a phone number. */
     protected static function findDriverUserByIdentity(string $identity): ?User
     {
diff --git a/server/tests/ApiCustomerControllerContractsTest.php b/server/tests/ApiCustomerControllerContractsTest.php
index 1140e1460..81edbd4f6 100644
--- a/server/tests/ApiCustomerControllerContractsTest.php
+++ b/server/tests/ApiCustomerControllerContractsTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use Fleetbase\Exceptions\SmsBlockedException;
 use Fleetbase\FleetOps\Exceptions\UserAlreadyExistsException;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\CustomerController;
 use Fleetbase\FleetOps\Http\Requests\CreateCustomerOrderRequest;
@@ -14,6 +15,7 @@
 use Fleetbase\FleetOps\Models\ServiceQuote;
 use Fleetbase\FleetOps\Models\Waypoint;
 use Fleetbase\Models\User;
+use Fleetbase\Support\Sms\PhoneValidator;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\Request;
 
@@ -56,6 +58,7 @@ class FleetOpsApiCustomerControllerProbe extends CustomerController
     public mixed $placesResult                                        = null;
     public bool $emailVerificationFails                               = false;
     public bool $smsVerificationFails                                 = false;
+    public ?Throwable $smsVerificationThrows                          = null;
     public bool $verificationExists                                   = true;
     public bool $passwordMatches                                      = true;
     public bool $findOrderFails                                       = false;
@@ -164,6 +167,9 @@ protected function generateEmailVerification(User $user, string $for, array $opt
 
     protected function generateSmsVerification(User $user, string $for, array $options): mixed
     {
+        if ($this->smsVerificationThrows) {
+            throw $this->smsVerificationThrows;
+        }
         if ($this->smsVerificationFails) {
             throw new RuntimeException('sms failed');
         }
@@ -978,6 +984,50 @@ function fleetopsApiCustomerJson($response): array
         ]))))->toBe(['error' => 'update failed']);
 });
 
+test('api customer controller answers an sms guard refusal with its status, not the generic error', function () {
+    // A paused organization: the sign-up code request answers 423 with the wait.
+    $paused                        = fleetopsApiCustomerController();
+    $paused->activeUser            = null;
+    $paused->smsVerificationThrows = SmsBlockedException::paused('company:company-uuid', 120);
+    $creation                      = $paused->requestCreationCode(new VerifyCreateCustomerRequest([
+        'mode'     => 'sms',
+        'identity' => '15550000000',
+    ]));
+
+    // Over budget with no email on file: the 429 and its Retry-After reach the app.
+    $limited                        = fleetopsApiCustomerController();
+    $limited->smsVerificationThrows = SmsBlockedException::limited('company_per_hour', 45);
+    $login                          = $limited->loginWithPhone(Request::create('/v1/customers/login/phone', 'POST', [
+        'phone' => '15551234567',
+    ]));
+
+    // Over budget with an email on file: the code still goes by email.
+    $fallback                        = fleetopsApiCustomerController();
+    $fallback->smsVerificationThrows = SmsBlockedException::limited('company_per_hour', 45);
+    $fallback->activeUser->email     = 'jane@example.test';
+    $byEmail                         = $fallback->loginWithPhone(Request::create('/v1/customers/login/phone', 'POST', [
+        'phone' => '15551234567',
+    ]));
+
+    // A number that can never be texted: the reset request answers 422.
+    $invalid                        = fleetopsApiCustomerController();
+    $invalid->smsVerificationThrows = SmsBlockedException::invalidDestination(PhoneValidator::REASON_TYPE_NOT_ALLOWED);
+    $forgot                         = $invalid->forgotPassword(Request::create('/v1/customers/forgot-password', 'POST', [
+        'identity' => '15551234567',
+    ]));
+
+    expect($creation->getStatusCode())->toBe(423)
+        ->and($creation->headers->get('Retry-After'))->toBe('120')
+        ->and(fleetopsApiCustomerJson($creation))->toBe(['error' => 'Text messages are temporarily unavailable. Try again later.'])
+        ->and($login->getStatusCode())->toBe(429)
+        ->and($login->headers->get('Retry-After'))->toBe('45')
+        ->and(fleetopsApiCustomerJson($login))->toBe(['error' => 'Unable to send a verification code right now. Try again in a minute.'])
+        ->and(fleetopsApiCustomerJson($byEmail))->toBe(['status' => 'ok', 'method' => 'email'])
+        ->and($fallback->emailVerifications[0][1])->toBe('fleetops_customer_login')
+        ->and($forgot->getStatusCode())->toBe(422)
+        ->and(fleetopsApiCustomerJson($forgot))->toBe(['error' => 'The phone number provided cannot receive text messages.']);
+});
+
 /**
  * Run a callback with an app container that supports environment().
  *
diff --git a/server/tests/ApiDriverPasswordContractsTest.php b/server/tests/ApiDriverPasswordContractsTest.php
index 3716031c8..f9e580361 100644
--- a/server/tests/ApiDriverPasswordContractsTest.php
+++ b/server/tests/ApiDriverPasswordContractsTest.php
@@ -130,12 +130,13 @@ public function getUser(): ?User
 
 class FleetOpsPasswordControllerProbe extends DriverController
 {
-    public static ?Driver $driver     = null;
-    public static bool $driverMissing = false;
-    public static ?User $identityUser = null;
-    public static mixed $resetCode    = null;
-    public static array $sentCodes    = [];
-    public static bool $sendThrows    = false;
+    public static ?Driver $driver         = null;
+    public static bool $driverMissing     = false;
+    public static ?User $identityUser     = null;
+    public static mixed $resetCode        = null;
+    public static array $sentCodes        = [];
+    public static bool $sendThrows        = false;
+    public static ?Throwable $sendRefusal = null;
 
     public function findDriver(string $id, array $with = []): Driver
     {
@@ -180,6 +181,9 @@ protected static function debugEnabled(): bool
 
     protected static function sendResetCode(User $user, string $identity): void
     {
+        if (static::$sendRefusal) {
+            throw static::$sendRefusal;
+        }
         if (static::$sendThrows) {
             throw new RuntimeException('sms gateway down');
         }
@@ -205,6 +209,7 @@ function fleetopsPasswordUser(string $plainPassword = 'correct-horse'): FleetOps
     FleetOpsPasswordControllerProbe::$resetCode     = null;
     FleetOpsPasswordControllerProbe::$sentCodes     = [];
     FleetOpsPasswordControllerProbe::$sendThrows    = false;
+    FleetOpsPasswordControllerProbe::$sendRefusal   = null;
 });
 
 test('change password requires both the current and the new one', function () {
@@ -331,6 +336,16 @@ function fleetopsPasswordUser(string $plainPassword = 'correct-horse'): FleetOps
     expect($response->getStatusCode())->toBe(400);
 });
 
+test('forgot password passes an sms guard refusal through with its status', function () {
+    FleetOpsPasswordControllerProbe::$identityUser = fleetopsPasswordUser();
+    FleetOpsPasswordControllerProbe::$sendRefusal  = Fleetbase\Exceptions\SmsBlockedException::limited('destination_cooldown', 30);
+
+    $response = (new FleetOpsPasswordControllerProbe())->forgotPassword(new Request(['identity' => '+6581000001']));
+
+    expect($response->getStatusCode())->toBe(429)
+        ->and($response->getData())->toBe(['error' => 'Unable to send a verification code right now. Try again in a minute.']);
+});
+
 test('reset password requires identity, code and a new password', function () {
     $response = (new FleetOpsPasswordControllerProbe())->resetPassword(new Request(['identity' => 'a@b.test']));
 
diff --git a/server/tests/Feature/Http/Api/DriverControllerAuthFlowsTest.php b/server/tests/Feature/Http/Api/DriverControllerAuthFlowsTest.php
index d2bf127af..f3b6bc9b3 100644
--- a/server/tests/Feature/Http/Api/DriverControllerAuthFlowsTest.php
+++ b/server/tests/Feature/Http/Api/DriverControllerAuthFlowsTest.php
@@ -304,6 +304,29 @@ public function __call($method, $arguments)
         ->and($connection->table('verification_codes')->where('for', 'driver_login')->count())->toBe(1);
 });
 
+test('phone login passes an sms guard refusal through once no email can carry the code', function () {
+    $connection = fleetopsDriverAuthBoot();
+    app()->instance('twilio', new class {
+        public function message($to, $text, $mediaUrls = [], $params = [])
+        {
+            throw Fleetbase\Exceptions\SmsBlockedException::paused('platform', 300);
+        }
+    });
+    Fleetbase\Twilio\Support\Laravel\Facade::clearResolvedInstances();
+
+    // With an email on file the refusal is handled like any send failure: by email.
+    app()->instance('request', Request::create('/x', 'POST', ['phone' => '6591234567']));
+    $byEmail = (new DriverController())->loginWithPhone();
+    expect($byEmail->getData(true))->toBe(['status' => 'OK', 'method' => 'email']);
+
+    // Without one, the app gets the refusal itself: 423 and how long to wait.
+    $connection->table('users')->where('uuid', 'user-1')->update(['email' => null]);
+    $refused = (new DriverController())->loginWithPhone();
+    expect($refused->getStatusCode())->toBe(423)
+        ->and($refused->headers->get('Retry-After'))->toBe('300')
+        ->and($refused->getData(true)['error'])->toBe('Text messages are temporarily unavailable. Try again later.');
+});
+
 test('code verification handles unknown users invalid codes bypass and success', function () {
     $connection = fleetopsDriverAuthBoot();
     $controller = new DriverController();

From 865d9d8d3c2c290646ce0b9af28a416c838dbea7 Mon Sep 17 00:00:00 2001
From: Sergey Panchenko <serj129@gmail.com>
Date: Tue, 13 Oct 2026 16:31:12 +0500
Subject: [PATCH 81/87] i18n(ru): improve street-1 and street-2 translations to
 align with customer-portal

---
 translations/ru-ru.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/translations/ru-ru.yaml b/translations/ru-ru.yaml
index 492dacfbb..7a2a68996 100644
--- a/translations/ru-ru.yaml
+++ b/translations/ru-ru.yaml
@@ -892,8 +892,8 @@ place:
     province: Провинция
     country: Страна
     state: Штат
-    street-1: Улица 1
-    street-2: Улица 2
+    street-1: Улица, дом (строка 1)
+    street-2: Квартира/офис (строка 2)
     coordinates: Координаты
     phone: Телефон
   prompts:

From ce91de23fb0f85e7593fb167ee02c8ab75b2848a Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 21:45:43 +0800
Subject: [PATCH 82/87] fix(orders): remove driver offers; only adhoc orders
 are offered to drivers

Assigning a driver started an expiring "offer" in meta.offer that the driver
had to accept, and raised "driver not accepted" when they did not. That is
not how dispatch works: an order assigned to a driver (by dispatch or
auto-assign) is simply theirs. Only adhoc orders are offered, and the
existing adhoc flow already does it: dispatching pings drivers within
adhoc_distance (OrderPing), fleetops:dispatch-adhoc pings again every minute
while nobody has taken it, and a driver takes it with `start` + `assign`.

This reverts "feat(orders): driver offers with accept, decline and expiry":

- meta.offer and its sync on assignment (observer, bulk assign)
- POST v1/orders/{id}/accept and /decline
- fleetops:expire-offers, the driver_not_accepted alert (DriverNotAccepted),
  OrderOfferDeclined, the order.offer_* broadcasts
- `offer` on the order resources and fleetops.offer_timeout_minutes

The cancel reason keeps its request helper, which it shared with decline.
---
 .../Console/Commands/ExpireOrderOffers.php    | 158 ----------------
 server/src/Events/OrderOfferChanged.php       |  73 --------
 .../Controllers/Api/v1/OrderController.php    | 145 +--------------
 .../Internal/v1/DriverController.php          |  14 +-
 .../Internal/v1/OrderController.php           |  12 +-
 server/src/Http/Resources/v1/Index/Order.php  |   1 -
 server/src/Http/Resources/v1/Order.php        |   2 -
 server/src/Models/Order.php                   | 168 ------------------
 .../src/Notifications/DriverNotAccepted.php   |  56 ------
 .../src/Notifications/OrderOfferDeclined.php  |  59 ------
 server/src/Observers/OrderObserver.php        |  11 --
 .../src/Providers/FleetOpsServiceProvider.php |   4 -
 server/src/routes.php                         |   2 -
 .../tests/ApiOrderControllerContractsTest.php |  73 --------
 .../Internal/OrderControllerHelpersTest.php   |   6 +-
 .../OrderChangeNotificationsTest.php          |  39 +---
 .../Observers/OrderAssignmentObserverTest.php |  26 +--
 .../Unit/Support/OrderOperationsTest.php      |  80 +--------
 18 files changed, 16 insertions(+), 913 deletions(-)
 delete mode 100644 server/src/Console/Commands/ExpireOrderOffers.php
 delete mode 100644 server/src/Events/OrderOfferChanged.php
 delete mode 100644 server/src/Notifications/DriverNotAccepted.php
 delete mode 100644 server/src/Notifications/OrderOfferDeclined.php

diff --git a/server/src/Console/Commands/ExpireOrderOffers.php b/server/src/Console/Commands/ExpireOrderOffers.php
deleted file mode 100644
index 9c9374432..000000000
--- a/server/src/Console/Commands/ExpireOrderOffers.php
+++ /dev/null
@@ -1,158 +0,0 @@
-<?php
-
-namespace Fleetbase\FleetOps\Console\Commands;
-
-use Fleetbase\FleetOps\Events\OrderOfferChanged;
-use Fleetbase\FleetOps\Models\Order;
-use Fleetbase\FleetOps\Notifications\DriverNotAccepted;
-use Fleetbase\Support\NotificationRegistry;
-use Illuminate\Console\Command;
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Facades\Cache;
-use Illuminate\Support\Facades\Log;
-
-/**
- * Expire driver offers that were not answered in time.
- *
- * An order assigned to a driver carries an offer (`meta.offer`) that expires after
- * the company's `fleetops.offer_timeout_minutes`. Each offer past its `expires_at`
- * is marked expired, raises the `driver_not_accepted` operational alert (once per
- * order, like the alerts of fleetops:process-operational-alerts) and broadcasts
- * `order.offer_expired` on the order and company channels. The driver stays
- * assigned: dispatch decides whether to reassign.
- */
-class ExpireOrderOffers extends Command
-{
-    public const ALERT_KEY = 'driver_not_accepted';
-
-    protected $signature = 'fleetops:expire-offers
-        {--days=2 : Only include orders updated in the last N days}
-        {--chunk=250 : How many orders to process per chunk}
-        {--no-lock : Skip process locking}
-        {--dry : Dry run without updating orders}';
-
-    protected $description = 'Expire driver order offers that were not accepted in time and alert dispatch.';
-
-    public function handle(): int
-    {
-        $days     = max(1, (int) $this->option('days'));
-        $perChunk = max(50, (int) $this->option('chunk'));
-        $dryRun   = (bool) $this->option('dry');
-        $lock     = null;
-
-        if (!$this->option('no-lock')) {
-            $lock = Cache::lock('fleetops:expire-offers', 300);
-            if (!$lock->get()) {
-                $this->warn('Another offer expiry run appears to be in progress.');
-
-                return self::SUCCESS;
-            }
-        }
-
-        try {
-            $now     = Carbon::now();
-            $expired = 0;
-
-            $this->ordersQuery($now->copy()->subDays($days))->orderBy('id')->chunkById($perChunk, function ($orders) use ($now, $dryRun, &$expired) {
-                foreach ($orders as $order) {
-                    if ($this->expire($order, $now, $dryRun)) {
-                        $expired++;
-                    }
-                }
-            });
-
-            $this->info(($dryRun ? '[Dry Run] ' : '') . "Offers expired: {$expired}");
-
-            return self::SUCCESS;
-        } finally {
-            $lock?->release();
-        }
-    }
-
-    /**
-     * Orders with an open offer that are not finished or under way.
-     */
-    protected function ordersQuery(Carbon $cutoff)
-    {
-        return Order::query()
-            ->withoutGlobalScopes()
-            ->where('meta->offer->status', Order::OFFER_OFFERED)
-            ->whereNotIn('status', ['completed', 'canceled', 'expired'])
-            ->where(fn ($query) => $query->whereNull('started')->orWhere('started', false))
-            ->whereNull('deleted_at')
-            ->whereNotNull('company_uuid')
-            ->where('updated_at', '>=', $cutoff);
-    }
-
-    /**
-     * Expire the order's offer when it has run out. Returns whether it was expired.
-     */
-    public function expire(Order $order, Carbon $now, bool $dryRun = false): bool
-    {
-        $offer     = $order->getOffer();
-        $expiresAt = data_get($offer, 'expires_at');
-
-        if (data_get($offer, 'status') !== Order::OFFER_OFFERED || !$expiresAt || Carbon::parse($expiresAt)->isAfter($now)) {
-            return false;
-        }
-
-        // An offer left behind on an order that no longer has a driver is not chased
-        if (!$order->driver_assigned_uuid) {
-            if (!$dryRun) {
-                $order->setMeta('offer', null);
-                $order->saveQuietly();
-            }
-
-            return false;
-        }
-
-        if ($dryRun) {
-            return true;
-        }
-
-        session(['company' => $order->company_uuid]);
-
-        $order->expireOffer();
-        $this->raiseAlert($order, (array) $offer);
-        $this->broadcast($order);
-
-        return true;
-    }
-
-    protected function raiseAlert(Order $order, array $offer): void
-    {
-        $metaKey = 'operational_alerts.' . self::ALERT_KEY;
-        $context = [
-            'driver'     => $offer['driver'] ?? null,
-            'offered_at' => $offer['offered_at'] ?? null,
-            'expires_at' => $offer['expires_at'] ?? null,
-        ];
-
-        // once per offer: a later offer to another driver may alert again
-        if (data_get($order->getMeta($metaKey), 'context.offered_at') === $context['offered_at']) {
-            return;
-        }
-
-        try {
-            NotificationRegistry::notify(DriverNotAccepted::class, $order, $context);
-        } catch (\Throwable $exception) {
-            Log::warning('Unable to raise driver_not_accepted alert', ['order' => $order->public_id, 'error' => $exception->getMessage()]);
-        }
-
-        $order->setMeta($metaKey, [
-            'notified_at' => Carbon::now()->toDateTimeString(),
-            'context'     => $context,
-        ]);
-        $order->saveQuietly();
-        $order->invalidateApiCache();
-    }
-
-    protected function broadcast(Order $order): void
-    {
-        try {
-            event(new OrderOfferChanged($order, Order::OFFER_EXPIRED));
-        } catch (\Throwable $exception) {
-            Log::warning('Unable to broadcast order.offer_expired', ['order' => $order->public_id, 'error' => $exception->getMessage()]);
-        }
-    }
-}
diff --git a/server/src/Events/OrderOfferChanged.php b/server/src/Events/OrderOfferChanged.php
deleted file mode 100644
index 08c82cd5f..000000000
--- a/server/src/Events/OrderOfferChanged.php
+++ /dev/null
@@ -1,73 +0,0 @@
-<?php
-
-namespace Fleetbase\FleetOps\Events;
-
-use Fleetbase\FleetOps\Models\Order;
-use Illuminate\Broadcasting\Channel;
-use Illuminate\Broadcasting\InteractsWithSockets;
-use Illuminate\Contracts\Broadcasting\ShouldBroadcast;
-use Illuminate\Foundation\Bus\Dispatchable;
-use Illuminate\Support\Carbon;
-
-/**
- * Broadcast as `order.offer_{status}` (offer_accepted, offer_declined, offer_expired)
- * when the driver offer on an order is answered or runs out.
- *
- * Channels: order.{public_id}, order.{uuid} and company.{company_uuid}.
- * Data: { id: order public id, driver: driver public id, offer: meta.offer }.
- */
-class OrderOfferChanged implements ShouldBroadcast
-{
-    use Dispatchable;
-    use InteractsWithSockets;
-
-    public string $eventId;
-
-    public string $sentAt;
-
-    public string $status;
-
-    public array $channelNames = [];
-
-    public array $data = [];
-
-    public function __construct(Order $order, string $status)
-    {
-        $offer = (array) $order->getMeta('offer', []);
-
-        $this->eventId      = uniqid('event_');
-        $this->sentAt       = Carbon::now()->toDateTimeString();
-        $this->status       = $status;
-        $this->channelNames = array_values(array_filter([
-            'order.' . $order->public_id,
-            'order.' . $order->uuid,
-            $order->company_uuid ? 'company.' . $order->company_uuid : null,
-        ]));
-        $this->data = [
-            'id'     => $order->public_id,
-            'driver' => $offer['driver'] ?? null,
-            'offer'  => $offer ?: null,
-        ];
-    }
-
-    public function broadcastOn(): array
-    {
-        return array_map(fn (string $name) => new Channel($name), $this->channelNames);
-    }
-
-    public function broadcastAs(): string
-    {
-        return 'order.offer_' . $this->status;
-    }
-
-    public function broadcastWith(): array
-    {
-        return [
-            'id'          => $this->eventId,
-            'api_version' => config('api.version'),
-            'event'       => $this->broadcastAs(),
-            'created_at'  => $this->sentAt,
-            'data'        => $this->data,
-        ];
-    }
-}
diff --git a/server/src/Http/Controllers/Api/v1/OrderController.php b/server/src/Http/Controllers/Api/v1/OrderController.php
index fa64ba550..75e7cf96b 100644
--- a/server/src/Http/Controllers/Api/v1/OrderController.php
+++ b/server/src/Http/Controllers/Api/v1/OrderController.php
@@ -3,7 +3,6 @@
 namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 
 use Fleetbase\FleetOps\Events\OrderDispatchFailed;
-use Fleetbase\FleetOps\Events\OrderOfferChanged;
 use Fleetbase\FleetOps\Events\OrderStarted;
 use Fleetbase\FleetOps\Exceptions\CustomerUserConflictException;
 use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
@@ -26,7 +25,6 @@
 use Fleetbase\FleetOps\Models\Proof;
 use Fleetbase\FleetOps\Models\ServiceQuote;
 use Fleetbase\FleetOps\Models\Waypoint;
-use Fleetbase\FleetOps\Notifications\OrderOfferDeclined;
 use Fleetbase\FleetOps\Support\OrderEdit;
 use Fleetbase\FleetOps\Support\ResolvesOrderServiceStops;
 use Fleetbase\FleetOps\Support\TrackingCode;
@@ -36,9 +34,7 @@
 use Fleetbase\Models\Company;
 use Fleetbase\Models\File;
 use Fleetbase\Models\Setting;
-use Fleetbase\Models\User;
 use Fleetbase\Support\Auth;
-use Fleetbase\Support\NotificationRegistry;
 use Fleetbase\Support\TemplateString;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\Request;
@@ -1066,15 +1062,9 @@ public function startOrder(string $id, Request $request)
             return response()->apiError('Order has already started.');
         }
 
-        // if the order is adhoc and the parameter of `assign` is set with a valid driver id, assign the driver and continue;
-        // the driver took the order themselves, so their offer starts accepted
+        // if the order is adhoc and the parameter of `assign` is set with a valid driver id, assign the driver and continue
         if ($order->adhoc && $assignAdhocDriver && Str::startsWith($assignAdhocDriver, 'driver_')) {
-            $order->acceptOfferOnAssign = true;
-            try {
-                $order->assignDriver($assignAdhocDriver, true);
-            } finally {
-                $order->acceptOfferOnAssign = false;
-            }
+            $order->assignDriver($assignAdhocDriver, true);
         }
 
         /** @var \Fleetbase\Models\Driver */
@@ -1106,10 +1096,9 @@ public function startOrder(string $id, Request $request)
             return response()->apiError('Order has not been dispatched yet and cannot be started.');
         }
 
-        // set order to started; starting the order answers an open offer
+        // set order to started
         $order->started    = true;
         $order->started_at = now();
-        $order->acceptOffer(false);
         $order->save();
 
         // trigger start event
@@ -1416,89 +1405,7 @@ public function cancelOrder(string $id, ?Request $request = null)
     }
 
     /**
-     * The assigned driver accepts the order offered to them. An adhoc order that
-     * has no driver yet is assigned to the accepting driver.
-     *
-     * @return \Fleetbase\Http\Resources\v1\Order
-     */
-    public function acceptOrder(string $id, Request $request)
-    {
-        try {
-            $order = $this->findOrder($id, ['driverAssigned']);
-        } catch (ModelNotFoundException $exception) {
-            return $this->apiError('Order resource not found.', 404);
-        }
-
-        $driver = $this->offerDriverFromRequest($request);
-        if (!$driver) {
-            return $this->apiError('No driver found to accept the order.', 404);
-        }
-
-        if ($order->editPolicy()->isTerminal()) {
-            return $this->apiError('This order can no longer be accepted.', 422);
-        }
-
-        if (!$order->driver_assigned_uuid && $order->adhoc) {
-            $order->acceptOfferOnAssign = true;
-            try {
-                $order->assignDriver($driver, true);
-            } finally {
-                $order->acceptOfferOnAssign = false;
-            }
-        } elseif (!$order->isDriver($driver)) {
-            return $this->apiError('This order is not offered to you.', 403);
-        } elseif (!$order->acceptOffer() && $order->offerStatus() !== Order::OFFER_ACCEPTED) {
-            // no offer recorded (assigned before offers existed): record it as accepted
-            $order->acceptOfferOnAssign = true;
-            $order->syncOfferWithAssignment();
-            $order->acceptOfferOnAssign = false;
-            $order->saveQuietly();
-            $order->invalidateApiCache();
-        }
-
-        $this->broadcastOfferChange($order, Order::OFFER_ACCEPTED);
-
-        return $this->orderResource($order->refresh());
-    }
-
-    /**
-     * The assigned driver declines the order offered to them: the order is
-     * unassigned and dispatch is told.
-     *
-     * @return \Fleetbase\Http\Resources\v1\Order
-     */
-    public function declineOrder(string $id, Request $request)
-    {
-        try {
-            $order = $this->findOrder($id, ['driverAssigned']);
-        } catch (ModelNotFoundException $exception) {
-            return $this->apiError('Order resource not found.', 404);
-        }
-
-        $driver = $this->offerDriverFromRequest($request);
-        if (!$driver) {
-            return $this->apiError('No driver found to decline the order.', 404);
-        }
-
-        if (!$order->isDriver($driver)) {
-            return $this->apiError('This order is not offered to you.', 403);
-        }
-
-        if ($order->started) {
-            return $this->apiError('This order has already been started and cannot be declined.', 422);
-        }
-
-        $reason = $this->reasonFromRequest($request);
-        $order->declineOffer($reason);
-
-        $this->broadcastOfferChange($order, Order::OFFER_DECLINED);
-        $this->notifyOfferDeclined($order, $driver, $reason);
-
-        return $this->orderResource($order->refresh());
-    }
-
-    /**
-     * The free-text `reason` sent with a cancel or decline, trimmed to 1000 characters.
+     * The free-text `reason` sent with a cancel, trimmed to 1000 characters.
      */
     protected function reasonFromRequest(Request $request): ?string
     {
@@ -1510,50 +1417,6 @@ protected function reasonFromRequest(Request $request): ?string
         return Str::limit(trim($reason), 1000, '');
     }
 
-    /**
-     * The driver answering an offer: the `driver` named in the request, or the
-     * driver profile of the authenticated user.
-     */
-    protected function offerDriverFromRequest(Request $request): ?Driver
-    {
-        if ($request->filled('driver')) {
-            return $this->findDriverByPublicId($request->input('driver'));
-        }
-
-        $user = $request->user();
-        if (!$user instanceof User) {
-            $user = User::where('uuid', session('user'))->first();
-        }
-
-        if (!$user) {
-            return null;
-        }
-
-        return Driver::where(['user_uuid' => $user->uuid, 'company_uuid' => $this->sessionCompany()])->first();
-    }
-
-    protected function broadcastOfferChange(Order $order, string $status): void
-    {
-        try {
-            event(new OrderOfferChanged($order, $status));
-        } catch (\Throwable $exception) {
-            Log::warning('Unable to broadcast order offer change', ['order' => $order->public_id, 'error' => $exception->getMessage()]);
-        }
-    }
-
-    protected function notifyOfferDeclined(Order $order, Driver $driver, ?string $reason): void
-    {
-        try {
-            NotificationRegistry::notify(OrderOfferDeclined::class, $order, [
-                'driver'      => $driver->public_id,
-                'driver_name' => $driver->name,
-                'reason'      => $reason,
-            ]);
-        } catch (\Throwable $exception) {
-            Log::warning('Unable to notify dispatch of declined order', ['order' => $order->public_id, 'error' => $exception->getMessage()]);
-        }
-    }
-
     /**
      * Mark a specific place (waypoint, pickup, or drop-off) as the current
      * destination for an order payload.
diff --git a/server/src/Http/Controllers/Internal/v1/DriverController.php b/server/src/Http/Controllers/Internal/v1/DriverController.php
index 3847787ef..6e4dcc212 100644
--- a/server/src/Http/Controllers/Internal/v1/DriverController.php
+++ b/server/src/Http/Controllers/Internal/v1/DriverController.php
@@ -598,20 +598,12 @@ protected function clearDriverAssignmentsForOrders($orders): void
         Order::invalidateApiCacheManually(session('company'));
 
         // The bulk update bypasses the order observer, so the driver taken off each
-        // order is told here and the offer made to them is dropped
+        // order is told here
         foreach ($orders as $order) {
             $previousDriverUuid = $order->driver_assigned_uuid;
-            if (!$previousDriverUuid) {
-                continue;
+            if ($previousDriverUuid) {
+                $order->notifyDriverUnassigned($previousDriverUuid);
             }
-
-            $order->driver_assigned_uuid = null;
-            $order->syncOfferWithAssignment();
-            if ($order->isDirty('meta')) {
-                $order->saveQuietly();
-            }
-            $order->syncOriginal();
-            $order->notifyDriverUnassigned($previousDriverUuid);
         }
     }
 
diff --git a/server/src/Http/Controllers/Internal/v1/OrderController.php b/server/src/Http/Controllers/Internal/v1/OrderController.php
index d9cc3bd46..14cd0a4f5 100644
--- a/server/src/Http/Controllers/Internal/v1/OrderController.php
+++ b/server/src/Http/Controllers/Internal/v1/OrderController.php
@@ -802,15 +802,6 @@ protected function assignDriverToOrders($orderUuids, Driver $driver): void
         foreach ($replaced as $order) {
             $order->notifyDriverUnassigned($order->driver_assigned_uuid);
         }
-
-        // The bulk update bypasses the model, so each order's driver offer is started here
-        $this->scopedToCompany(Order::whereIn('uuid', $orderUuids))->get()->each(function (Order $order) use ($driver) {
-            $order->setRelation('driverAssigned', $driver);
-            $order->syncOfferWithAssignment();
-            if ($order->isDirty('meta')) {
-                $order->saveQuietly();
-            }
-        });
     }
 
     protected function dispatchBulkAssignedDriverNotification(array $orderUuids, Driver $driver): void
@@ -877,10 +868,9 @@ public function start(Request $request)
             return response()->error('No driver assigned to order.');
         }
 
-        // set order to started; starting the order answers an open offer
+        // set order to started
         $order->started    = true;
         $order->started_at = now();
-        $order->acceptOffer(false);
         $order->save();
 
         // trigger start event
diff --git a/server/src/Http/Resources/v1/Index/Order.php b/server/src/Http/Resources/v1/Index/Order.php
index 39afca97a..1b413f22d 100644
--- a/server/src/Http/Resources/v1/Index/Order.php
+++ b/server/src/Http/Resources/v1/Index/Order.php
@@ -113,7 +113,6 @@ public function toArray($request): array
             'is_scheduled'                         => $this->when($isInternal, $this->is_scheduled),
             'transaction_amount'                   => $this->transaction_amount,
             'currency'                             => $this->transaction_currency,
-            'offer'                                => data_get($this, 'meta.offer'),
 
             // Timestamps
             'scheduled_at'         => $this->scheduled_at,
diff --git a/server/src/Http/Resources/v1/Order.php b/server/src/Http/Resources/v1/Order.php
index 43ac5dbed..6ed174612 100644
--- a/server/src/Http/Resources/v1/Order.php
+++ b/server/src/Http/Resources/v1/Order.php
@@ -99,7 +99,6 @@ public function toArray($request): array
                 return $this->resource->eta ?? ($tracker ? $tracker->eta() : null);
             }),
             'meta'                 => data_get($this, 'meta', Utils::createObject()),
-            'offer'                => data_get($this, 'meta.offer'),
             'dispatched_at'        => $this->dispatched_at,
             'started_at'           => $this->started_at,
             'scheduled_at'         => $this->scheduled_at,
@@ -208,7 +207,6 @@ public function toWebhookPayload()
             'status'          => $this->status,
             'adhoc'           => $this->adhoc,
             'meta'            => data_get($this, 'meta', Utils::createObject()),
-            'offer'           => data_get($this, 'meta.offer'),
             'dispatched_at'   => $this->dispatched_at,
             'started_at'      => $this->started_at,
             'scheduled_at'    => $this->scheduled_at,
diff --git a/server/src/Models/Order.php b/server/src/Models/Order.php
index 36e7ebf5e..0af1fae5a 100644
--- a/server/src/Models/Order.php
+++ b/server/src/Models/Order.php
@@ -18,7 +18,6 @@
 use Fleetbase\FleetOps\Traits\HasTrackingNumber;
 use Fleetbase\LaravelMysqlSpatial\Types\Point;
 use Fleetbase\Models\Model;
-use Fleetbase\Models\Setting;
 use Fleetbase\Models\Transaction;
 use Fleetbase\Traits\HasApiModelBehavior;
 use Fleetbase\Traits\HasApiModelCache;
@@ -281,30 +280,11 @@ class Order extends Model
         '_key',
     ];
 
-    /**
-     * Offer statuses kept in `meta.offer.status`.
-     */
-    public const OFFER_OFFERED  = 'offered';
-    public const OFFER_ACCEPTED = 'accepted';
-    public const OFFER_DECLINED = 'declined';
-    public const OFFER_EXPIRED  = 'expired';
-
-    /**
-     * Minutes a driver has to accept an order offered to them, unless the company
-     * sets `fleetops.offer_timeout_minutes`. Zero means offers never expire.
-     */
-    public const DEFAULT_OFFER_TIMEOUT_MINUTES = 5;
-
     /**
      * Set for one save: the driver assignment being saved sends no assignment notification.
      */
     public bool $silentDriverAssignment = false;
 
-    /**
-     * Set for one save: the driver being assigned has already accepted the order (adhoc start).
-     */
-    public bool $acceptOfferOnAssign = false;
-
     /**
      * Set for one save: the driver taken off the order is not sent an unassigned push (they declined it themselves).
      */
@@ -1569,154 +1549,6 @@ public function editPolicy(): OrderEditPolicy
         return OrderEditPolicy::for($this);
     }
 
-    /**
-     * The driver offer on the order (`meta.offer`), or null when there is none.
-     */
-    public function getOffer(): ?array
-    {
-        $offer = $this->getMeta('offer');
-
-        return is_array($offer) && !empty($offer) ? $offer : null;
-    }
-
-    /**
-     * The status of the driver offer on the order, or null when there is none.
-     */
-    public function offerStatus(): ?string
-    {
-        return data_get($this->getOffer(), 'status');
-    }
-
-    /**
-     * Minutes a driver has to accept an offer, from the company setting
-     * `fleetops.offer_timeout_minutes` (default 5). Zero disables expiry.
-     */
-    public function offerTimeoutMinutes(): int
-    {
-        try {
-            $minutes = Setting::lookupForCompany($this->company_uuid ?? session('company'), 'fleetops.offer_timeout_minutes', static::DEFAULT_OFFER_TIMEOUT_MINUTES);
-        } catch (\Throwable) {
-            $minutes = static::DEFAULT_OFFER_TIMEOUT_MINUTES;
-        }
-
-        return is_numeric($minutes) ? max(0, (int) $minutes) : static::DEFAULT_OFFER_TIMEOUT_MINUTES;
-    }
-
-    /**
-     * Keep `meta.offer` in step with the driver assignment being saved: a newly
-     * assigned driver gets a fresh offer (accepted straight away when they took
-     * the order themselves), and removing the driver drops an open offer.
-     * Only sets attributes; the save in progress persists them.
-     */
-    public function syncOfferWithAssignment(): self
-    {
-        $driverUuid = $this->driver_assigned_uuid;
-
-        if (!$driverUuid) {
-            if (in_array($this->offerStatus(), [static::OFFER_OFFERED, static::OFFER_ACCEPTED], true)) {
-                $this->setMeta('offer', null);
-            }
-
-            return $this;
-        }
-
-        if ($this->exists && $this->editPolicy()->isTerminal()) {
-            return $this;
-        }
-
-        $driverPublicId = data_get($this->relationLoaded('driverAssigned') ? $this->getRelation('driverAssigned') : null, 'public_id');
-        if (!$driverPublicId || data_get($this->getRelation('driverAssigned'), 'uuid') !== $driverUuid) {
-            try {
-                $driverPublicId = Driver::where('uuid', $driverUuid)->withoutGlobalScopes()->value('public_id');
-            } catch (\Throwable) {
-                $driverPublicId = null;
-            }
-        }
-
-        $now   = Carbon::now();
-        $offer = [
-            'driver'      => $driverPublicId,
-            'offered_at'  => $now->toIso8601ZuluString(),
-            'expires_at'  => null,
-            'accepted_at' => null,
-            'declined_at' => null,
-            'status'      => static::OFFER_OFFERED,
-        ];
-
-        if ($this->acceptOfferOnAssign) {
-            $offer['accepted_at'] = $offer['offered_at'];
-            $offer['status']      = static::OFFER_ACCEPTED;
-        } elseif ($minutes = $this->offerTimeoutMinutes()) {
-            $offer['expires_at'] = $now->copy()->addMinutes($minutes)->toIso8601ZuluString();
-        }
-
-        $this->setMeta('offer', $offer);
-
-        return $this;
-    }
-
-    /**
-     * Mark the open offer accepted. Returns false when there is no open offer.
-     */
-    public function acceptOffer(bool $save = true): bool
-    {
-        $offer = $this->getOffer();
-        if (!$offer || !in_array($offer['status'] ?? null, [static::OFFER_OFFERED, static::OFFER_EXPIRED], true)) {
-            return false;
-        }
-
-        $offer['status']      = static::OFFER_ACCEPTED;
-        $offer['accepted_at'] = Carbon::now()->toIso8601ZuluString();
-        $this->setMeta('offer', $offer);
-
-        if ($save) {
-            $this->saveQuietly();
-            $this->invalidateApiCache();
-        }
-
-        return true;
-    }
-
-    /**
-     * Record that the driver declined the offer and take the order off them.
-     */
-    public function declineOffer(?string $reason = null): self
-    {
-        $offer = $this->getOffer() ?? ['driver' => data_get($this, 'driverAssigned.public_id'), 'offered_at' => null, 'expires_at' => null, 'accepted_at' => null];
-
-        $offer['status']      = static::OFFER_DECLINED;
-        $offer['declined_at'] = Carbon::now()->toIso8601ZuluString();
-        if ($reason) {
-            $offer['reason'] = $reason;
-        }
-
-        $this->setMeta('offer', $offer);
-        $this->quietDriverUnassignment = true;
-        $this->driver_assigned_uuid    = null;
-        $this->save();
-        $this->quietDriverUnassignment = false;
-
-        return $this;
-    }
-
-    /**
-     * Mark an open offer expired. Returns false when there is no open offer.
-     */
-    public function expireOffer(): bool
-    {
-        $offer = $this->getOffer();
-        if (!$offer || ($offer['status'] ?? null) !== static::OFFER_OFFERED) {
-            return false;
-        }
-
-        $offer['status'] = static::OFFER_EXPIRED;
-        $this->setMeta('offer', $offer);
-        $this->saveQuietly();
-        $this->invalidateApiCache();
-
-        return true;
-    }
-
     /**
      * Updates the activity of the order.
      * Updates the order status and inserts a new activity based on the provided activity details.
diff --git a/server/src/Notifications/DriverNotAccepted.php b/server/src/Notifications/DriverNotAccepted.php
deleted file mode 100644
index d106ec4bf..000000000
--- a/server/src/Notifications/DriverNotAccepted.php
+++ /dev/null
@@ -1,56 +0,0 @@
-<?php
-
-namespace Fleetbase\FleetOps\Notifications;
-
-use Fleetbase\FleetOps\Models\Order;
-use Illuminate\Bus\Queueable;
-use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Notifications\Messages\MailMessage;
-use Illuminate\Notifications\Notification;
-
-/**
- * Operational alert raised when the driver an order was offered to did not accept it in time.
- */
-class DriverNotAccepted extends Notification implements ShouldQueue
-{
-    use Queueable;
-
-    public static string $name        = 'Driver Not Accepted';
-    public static string $description = 'Notify when the driver an order was offered to has not accepted it within the offer window.';
-    public static string $package     = 'fleet-ops';
-
-    public function __construct(public Order $order, public array $context = [])
-    {
-    }
-
-    public function via($notifiable): array
-    {
-        return ['mail', 'database'];
-    }
-
-    public function toMail($notifiable): MailMessage
-    {
-        $orderId = $this->order->tracking ?? $this->order->public_id;
-
-        return (new MailMessage())
-            ->subject("Driver has not accepted {$orderId}")
-            ->line($this->message())
-            ->line('Please contact the driver or reassign the order.');
-    }
-
-    public function toArray($notifiable): array
-    {
-        return [
-            'event'      => 'order.driver_not_accepted',
-            'order_id'   => $this->order->public_id,
-            'order_uuid' => $this->order->uuid,
-            'context'    => $this->context,
-            'message'    => $this->message(),
-        ];
-    }
-
-    protected function message(): string
-    {
-        return sprintf('The driver has not accepted order %s within the offer window.', $this->order->tracking ?? $this->order->public_id);
-    }
-}
diff --git a/server/src/Notifications/OrderOfferDeclined.php b/server/src/Notifications/OrderOfferDeclined.php
deleted file mode 100644
index 1fb14a80c..000000000
--- a/server/src/Notifications/OrderOfferDeclined.php
+++ /dev/null
@@ -1,59 +0,0 @@
-<?php
-
-namespace Fleetbase\FleetOps\Notifications;
-
-use Fleetbase\FleetOps\Models\Order;
-use Illuminate\Bus\Queueable;
-use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Notifications\Messages\MailMessage;
-use Illuminate\Notifications\Notification;
-
-/**
- * Tells dispatch that a driver declined the order offered to them, which left it unassigned.
- */
-class OrderOfferDeclined extends Notification implements ShouldQueue
-{
-    use Queueable;
-
-    public static string $name        = 'Order Declined By Driver';
-    public static string $description = 'Notify when a driver declines an order offered to them.';
-    public static string $package     = 'fleet-ops';
-
-    public function __construct(public Order $order, public array $context = [])
-    {
-    }
-
-    public function via($notifiable): array
-    {
-        return ['mail', 'database'];
-    }
-
-    public function toMail($notifiable): MailMessage
-    {
-        $orderId = $this->order->tracking ?? $this->order->public_id;
-
-        return (new MailMessage())
-            ->subject("Driver declined {$orderId}")
-            ->line($this->message())
-            ->line('The order is unassigned and needs a driver.');
-    }
-
-    public function toArray($notifiable): array
-    {
-        return [
-            'event'      => 'order.offer_declined',
-            'order_id'   => $this->order->public_id,
-            'order_uuid' => $this->order->uuid,
-            'context'    => $this->context,
-            'message'    => $this->message(),
-        ];
-    }
-
-    protected function message(): string
-    {
-        $driver = $this->context['driver_name'] ?? 'The driver';
-        $reason = $this->context['reason'] ?? null;
-
-        return sprintf('%s declined order %s%s', $driver, $this->order->tracking ?? $this->order->public_id, $reason ? ': ' . $reason : '.');
-    }
-}
diff --git a/server/src/Observers/OrderObserver.php b/server/src/Observers/OrderObserver.php
index c2c4c21ed..45c9261bd 100644
--- a/server/src/Observers/OrderObserver.php
+++ b/server/src/Observers/OrderObserver.php
@@ -34,17 +34,6 @@ public function created(Order $order)
         $this->invalidateCache($order);
     }
 
-    /**
-     * Handle the Order "saving" event: a driver assignment being saved starts
-     * (or clears) the driver offer in the same write.
-     */
-    public function saving(Order $order): void
-    {
-        if ($order->isDirty('driver_assigned_uuid')) {
-            $order->syncOfferWithAssignment();
-        }
-    }
-
     /**
      * Handle the Order "updating" event.
      *
diff --git a/server/src/Providers/FleetOpsServiceProvider.php b/server/src/Providers/FleetOpsServiceProvider.php
index cd90f69e5..bb24c8932 100644
--- a/server/src/Providers/FleetOpsServiceProvider.php
+++ b/server/src/Providers/FleetOpsServiceProvider.php
@@ -75,7 +75,6 @@ class FleetOpsServiceProvider extends CoreServiceProvider
         \Fleetbase\FleetOps\Console\Commands\ProcessMaintenanceTriggers::class,
         \Fleetbase\FleetOps\Console\Commands\SendMaintenanceReminders::class,
         \Fleetbase\FleetOps\Console\Commands\ProcessOperationalAlerts::class,
-        \Fleetbase\FleetOps\Console\Commands\ExpireOrderOffers::class,
         \Fleetbase\FleetOps\Console\Commands\SyncTelematics::class,
         \Fleetbase\FleetOps\Console\Commands\DrainTelematicInbox::class,
         \Fleetbase\FleetOps\Console\Commands\PruneTelematicsData::class,
@@ -151,7 +150,6 @@ public function boot()
             $schedule->command('fleetops:process-maintenance-triggers')->daily()->withoutOverlapping()->storeOutputInDb();
             $schedule->command('fleetops:send-maintenance-reminders')->daily()->withoutOverlapping()->storeOutputInDb();
             $schedule->command('fleetops:process-operational-alerts')->everyMinute()->withoutOverlapping()->storeOutputInDb();
-            $schedule->command('fleetops:expire-offers')->everyMinute()->withoutOverlapping();
             // These commands dispatch bounded jobs. A scheduler restart must not
             // leave the default 24-hour overlap lease blocking telemetry recovery.
             $schedule->command('fleetops:sync-telematics')->everyMinute()->withoutOverlapping(2)->storeOutputInDb();
@@ -254,8 +252,6 @@ public function registerNotifications()
             \Fleetbase\FleetOps\Notifications\LateDeparture::class,
             \Fleetbase\FleetOps\Notifications\RouteDeviation::class,
             \Fleetbase\FleetOps\Notifications\ProlongedStoppage::class,
-            \Fleetbase\FleetOps\Notifications\DriverNotAccepted::class,
-            \Fleetbase\FleetOps\Notifications\OrderOfferDeclined::class,
             \Fleetbase\FleetOps\Notifications\OrderChanged::class,
             \Fleetbase\FleetOps\Notifications\OrderUnassigned::class,
         ]);
diff --git a/server/src/routes.php b/server/src/routes.php
index 297f6caed..312b69ecf 100644
--- a/server/src/routes.php
+++ b/server/src/routes.php
@@ -212,8 +212,6 @@ function ($router) {
                 $router->match(['post', 'patch'], '{id}/dispatch', 'OrderController@dispatchOrder');
                 $router->post('{id}/start', 'OrderController@startOrder');
                 $router->delete('{id}/cancel', 'OrderController@cancelOrder');
-                $router->post('{id}/accept', 'OrderController@acceptOrder');
-                $router->post('{id}/decline', 'OrderController@declineOrder');
                 $router->match(['post', 'patch'], '{id}/update-activity', 'OrderController@updateActivity');
                 $router->post('{id}/complete', 'OrderController@completeOrder');
                 $router->get('{id}/next-activity', 'OrderController@getNextActivity');
diff --git a/server/tests/ApiOrderControllerContractsTest.php b/server/tests/ApiOrderControllerContractsTest.php
index 95599e330..5b87e94d8 100644
--- a/server/tests/ApiOrderControllerContractsTest.php
+++ b/server/tests/ApiOrderControllerContractsTest.php
@@ -72,20 +72,6 @@ protected function lockedEditResponse(OrderEditLockedException $exception)
         return ['apiError' => $exception->getMessage(), 'status' => 422, 'locked' => $exception->locked];
     }
 
-    public ?Fleetbase\FleetOps\Models\Driver $offerDriver = null;
-
-    public array $offerNotifications = [];
-
-    protected function offerDriverFromRequest(Request $request): ?Fleetbase\FleetOps\Models\Driver
-    {
-        return $this->offerDriver;
-    }
-
-    protected function notifyOfferDeclined(Order $order, Fleetbase\FleetOps\Models\Driver $driver, ?string $reason): void
-    {
-        $this->offerNotifications[] = [$order->uuid, $driver->public_id, $reason];
-    }
-
     protected function drivingDistanceAndTime(mixed $origin, mixed $destination): mixed
     {
         return $this->matrix ?? (object) ['distance' => 1200, 'time' => 360];
@@ -462,23 +448,6 @@ public function cancelWithReason(?string $reason = null)
         return $this;
     }
 
-    public bool $declinedForTest = false;
-
-    public ?string $declineReasonForTest = null;
-
-    public function declineOffer(?string $reason = null): Order
-    {
-        $this->declinedForTest      = true;
-        $this->declineReasonForTest = $reason;
-        $this->setMeta('offer', ['status' => Order::OFFER_DECLINED]);
-
-        return $this;
-    }
-
-    public function invalidateApiCache(): void
-    {
-    }
-
     public function tracker(): OrderTracker
     {
         return $this->trackerFake;
@@ -1278,45 +1247,3 @@ public function isString(string $key): bool
     expect($plain->cancelledForTest)->toBeTrue()
         ->and($plain->cancelReasonForTest)->toBeNull();
 });
-
-test('api order controller accepts and declines offers for the assigned driver only', function () {
-    $driver = new FleetOpsApiOrderDriverFake();
-    $driver->setRawAttributes(['uuid' => 'driver-uuid', 'public_id' => 'driver_offer', 'name' => 'Dee'], true);
-
-    $order = new FleetOpsApiOrderCrudFake(['status' => 'created']);
-    $order->setRawAttributes(array_merge($order->getAttributes(), ['driver_assigned_uuid' => 'driver-uuid']));
-    $order->setMeta('offer', ['driver' => 'driver_offer', 'status' => Order::OFFER_OFFERED, 'offered_at' => '2026-10-13T12:00:00Z', 'expires_at' => '2026-10-13T12:05:00Z']);
-
-    $controller              = new FleetOpsApiOrderCrudControllerProbe();
-    $controller->order       = $order;
-    $controller->offerDriver = $driver;
-
-    $accepted = $controller->acceptOrder('order-public', new Request());
-
-    expect($accepted)->toBe(['resource' => 'order', 'order' => $order])
-        ->and($order->offerStatus())->toBe(Order::OFFER_ACCEPTED)
-        ->and($order->getOffer()['accepted_at'])->not->toBeNull();
-
-    $declined = $controller->declineOrder('order-public', new Request(['reason' => 'Too far']));
-
-    expect($declined)->toBe(['resource' => 'order', 'order' => $order])
-        ->and($order->declinedForTest)->toBeTrue()
-        ->and($order->declineReasonForTest)->toBe('Too far')
-        ->and($controller->offerNotifications)->toBe([['order-uuid', 'driver_offer', 'Too far']]);
-
-    $other = new FleetOpsApiOrderDriverFake();
-    $other->setRawAttributes(['uuid' => 'other-uuid', 'public_id' => 'driver_other'], true);
-    $controller->offerDriver = $other;
-
-    expect($controller->acceptOrder('order-public', new Request()))->toBe(['apiError' => 'This order is not offered to you.', 'status' => 403])
-        ->and($controller->declineOrder('order-public', new Request()))->toBe(['apiError' => 'This order is not offered to you.', 'status' => 403]);
-
-    $controller->offerDriver = null;
-    expect($controller->acceptOrder('order-public', new Request()))->toBe(['apiError' => 'No driver found to accept the order.', 'status' => 404]);
-
-    $done                    = new FleetOpsApiOrderCrudFake(['status' => 'canceled']);
-    $controller              = new FleetOpsApiOrderCrudControllerProbe();
-    $controller->order       = $done;
-    $controller->offerDriver = $driver;
-    expect($controller->acceptOrder('order-public', new Request()))->toBe(['apiError' => 'This order can no longer be accepted.', 'status' => 422]);
-});
diff --git a/server/tests/Feature/Http/Internal/OrderControllerHelpersTest.php b/server/tests/Feature/Http/Internal/OrderControllerHelpersTest.php
index a94e37dba..1760fbc3f 100644
--- a/server/tests/Feature/Http/Internal/OrderControllerHelpersTest.php
+++ b/server/tests/Feature/Http/Internal/OrderControllerHelpersTest.php
@@ -96,7 +96,7 @@ public function __call($method, $arguments)
 
     $schema = $connection->getSchemaBuilder();
     $tables = [
-        'orders'           => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'tracking_number_uuid', 'driver_assigned_uuid', 'status', 'meta'],
+        'orders'           => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'tracking_number_uuid', 'driver_assigned_uuid', 'status'],
         'contacts'         => ['uuid', 'public_id', 'company_uuid', 'name', 'type'],
         'vendors'          => ['uuid', 'public_id', 'company_uuid', 'name'],
         'drivers'          => ['uuid', 'public_id', 'company_uuid', 'user_uuid'],
@@ -168,9 +168,7 @@ public function __call($method, $arguments)
 
     (new FleetOpsInternalOrderHelpersProbe())->callProtected('assignDriverToOrders', ['order-1', 'order-2'], $driver);
 
-    // the bulk update bypasses the model, so each order's driver offer is started explicitly
-    expect($connection->table('orders')->where('driver_assigned_uuid', 'driver-1')->count())->toBe(2)
-        ->and(json_decode($connection->table('orders')->where('uuid', 'order-1')->value('meta'), true)['offer']['status'] ?? null)->toBe('offered');
+    expect($connection->table('orders')->where('driver_assigned_uuid', 'driver-1')->count())->toBe(2);
 });
 
 test('dispatch domain event helper emits and returns the event', function () {
diff --git a/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php b/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
index f2d10b54b..ae9005236 100644
--- a/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
+++ b/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
@@ -1,18 +1,15 @@
 <?php
 
-use Fleetbase\FleetOps\Events\OrderOfferChanged;
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\TrackingNumber;
-use Fleetbase\FleetOps\Notifications\DriverNotAccepted;
 use Fleetbase\FleetOps\Notifications\OrderChanged;
-use Fleetbase\FleetOps\Notifications\OrderOfferDeclined;
 use Fleetbase\FleetOps\Notifications\OrderUnassigned;
 use NotificationChannels\Apn\ApnChannel;
 use NotificationChannels\Fcm\FcmChannel;
 
 /**
- * Covers the driver pushes and dispatch alerts for order changes, unassignment
- * and offers: their titles, bodies and the data the apps read.
+ * Covers the driver pushes for order changes and unassignment: their titles,
+ * bodies and the data the apps read.
  */
 function fleetopsOrderChangeNotificationOrder(): Order
 {
@@ -25,7 +22,6 @@ function fleetopsOrderChangeNotificationOrder(): Order
         'public_id'            => 'order_change',
         'company_uuid'         => 'company-1',
         'driver_assigned_uuid' => 'driver-uuid',
-        'meta'                 => json_encode(['offer' => ['driver' => 'driver_one', 'status' => 'expired', 'expires_at' => '2026-10-13T12:05:00Z']]),
     ], true);
     $order->setRelation('trackingNumber', $trackingNumber);
     $order->setRelation('driverAssigned', null);
@@ -54,34 +50,3 @@ function fleetopsOrderChangeNotificationOrder(): Order
         ->and($notification->via(null))->toBe([FcmChannel::class, ApnChannel::class])
         ->and($notification->toArray()['event'])->toBe('order.unassigned_notification');
 });
-
-test('offer alerts describe the declined or unanswered offer for dispatch', function () {
-    $order    = fleetopsOrderChangeNotificationOrder();
-    $declined = new OrderOfferDeclined($order, ['driver' => 'driver_one', 'driver_name' => 'Dee', 'reason' => 'Too far']);
-    $silent   = new DriverNotAccepted($order, ['driver' => 'driver_one']);
-
-    expect($declined->toArray(null))->toMatchArray([
-        'event'    => 'order.offer_declined',
-        'order_id' => 'order_change',
-        'message'  => 'Dee declined order FLB-CHANGE-1: Too far',
-    ])
-        ->and($declined->via(null))->toBe(['mail', 'database'])
-        ->and($silent->toArray(null))->toMatchArray([
-            'event'    => 'order.driver_not_accepted',
-            'order_id' => 'order_change',
-            'context'  => ['driver' => 'driver_one'],
-        ]);
-});
-
-test('offer changes broadcast as order offer status on the order and company channels', function () {
-    $event = new OrderOfferChanged(fleetopsOrderChangeNotificationOrder(), Order::OFFER_EXPIRED);
-
-    expect($event->broadcastAs())->toBe('order.offer_expired')
-        ->and(array_map(fn ($channel) => $channel->name, $event->broadcastOn()))->toBe(['order.order_change', 'order.order-uuid', 'company.company-1'])
-        ->and($event->broadcastWith())->toMatchArray(['event' => 'order.offer_expired'])
-        ->and($event->broadcastWith()['data'])->toBe([
-            'id'     => 'order_change',
-            'driver' => 'driver_one',
-            'offer'  => ['driver' => 'driver_one', 'status' => 'expired', 'expires_at' => '2026-10-13T12:05:00Z'],
-        ]);
-});
diff --git a/server/tests/Unit/Observers/OrderAssignmentObserverTest.php b/server/tests/Unit/Observers/OrderAssignmentObserverTest.php
index d98aabb37..5c7f289fd 100644
--- a/server/tests/Unit/Observers/OrderAssignmentObserverTest.php
+++ b/server/tests/Unit/Observers/OrderAssignmentObserverTest.php
@@ -9,8 +9,8 @@
 
 /**
  * Covers how the order observer follows driver assignment: a replaced driver is
- * told they were unassigned, the new driver is notified exactly once (and not at
- * all for a silent assignment), and saving an assignment starts the driver offer.
+ * told they were unassigned, and the new driver is notified exactly once (and not
+ * at all for a silent assignment).
  */
 class FleetOpsOrderAssignmentObserverOrder extends Order
 {
@@ -49,13 +49,6 @@ public function notifyDriverUnassigned($driver): bool
 
         return true;
     }
-
-    public function syncOfferWithAssignment(): Order
-    {
-        $this->events[] = 'offer';
-
-        return $this;
-    }
 }
 
 beforeEach(function () {
@@ -98,21 +91,6 @@ public function orderChanged(Order $order): bool
         ->and($silent->events)->toBe([]);
 });
 
-test('saving a driver assignment starts the offer in the same write', function () {
-    $order              = new FleetOpsOrderAssignmentObserverOrder();
-    $order->driverDirty = true;
-
-    (new OrderObserver())->saving($order);
-
-    $unchanged              = new FleetOpsOrderAssignmentObserverOrder();
-    $unchanged->driverDirty = false;
-
-    (new OrderObserver())->saving($unchanged);
-
-    expect($order->events)->toBe(['offer'])
-        ->and($unchanged->events)->toBe([]);
-});
-
 test('assign driver relies on the observer instead of notifying before the save', function () {
     $source = file_get_contents(dirname(__DIR__, 3) . '/src/Models/Order.php');
     preg_match('/public function assignDriver\(.*?\n    }\n/s', $source, $matches);
diff --git a/server/tests/Unit/Support/OrderOperationsTest.php b/server/tests/Unit/Support/OrderOperationsTest.php
index d76e24fe3..5ac197271 100644
--- a/server/tests/Unit/Support/OrderOperationsTest.php
+++ b/server/tests/Unit/Support/OrderOperationsTest.php
@@ -15,9 +15,7 @@ function event(...$arguments)
     }
 }
 
-use Fleetbase\FleetOps\Console\Commands\ExpireOrderOffers;
 use Fleetbase\FleetOps\Events\OrderChanged;
-use Fleetbase\FleetOps\Events\OrderOfferChanged;
 use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\FleetOps\Models\Entity;
 use Fleetbase\FleetOps\Models\Order;
@@ -26,12 +24,11 @@ function event(...$arguments)
 use Illuminate\Database\ConnectionResolver;
 use Illuminate\Database\Eloquent\Model as EloquentModel;
 use Illuminate\Database\SQLiteConnection;
-use Illuminate\Support\Carbon;
 
 /**
  * Covers order edits against SQLite: replacing a payload's entities, keeping the
- * driver's stop when an in-progress route changes, the order.changed event an edit
- * commits, and the driver offer lifecycle with its expiry command.
+ * driver's stop when an in-progress route changes, and the order.changed event an
+ * edit commits.
  */
 class FleetOpsOrderOpsEventRecorder
 {
@@ -378,79 +375,6 @@ function fleetopsOrderOpsOrder(SQLiteConnection $connection, array $order = [],
         ->and(OrderEdit::entitiesMode(null))->toBe('append');
 });
 
-test('assigning a driver starts an offer that is accepted declined or expired', function () {
-    $connection = fleetopsOrderOpsBoot();
-    Carbon::setTestNow('2026-10-13 12:00:00');
-    $order = fleetopsOrderOpsOrder($connection);
-
-    $order->driver_assigned_uuid = 'driver-1';
-    $order->syncOfferWithAssignment();
-
-    expect($order->getOffer())->toBe([
-        'driver'      => 'driver_one',
-        'offered_at'  => '2026-10-13T12:00:00Z',
-        'expires_at'  => '2026-10-13T12:05:00Z',
-        'accepted_at' => null,
-        'declined_at' => null,
-        'status'      => 'offered',
-    ]);
-    $order->saveQuietly();
-
-    // adhoc drivers who took the order themselves start accepted
-    $adhoc                      = new Order(['driver_assigned_uuid' => 'driver-1']);
-    $adhoc->acceptOfferOnAssign = true;
-    $adhoc->syncOfferWithAssignment();
-    expect($adhoc->offerStatus())->toBe('accepted')
-        ->and($adhoc->getOffer()['accepted_at'])->toBe('2026-10-13T12:00:00Z');
-
-    // the expiry command leaves an offer alone until it runs out
-    $command = new ExpireOrderOffers();
-    expect($command->expire($order, Carbon::parse('2026-10-13 12:04:00')))->toBeFalse();
-
-    expect($command->expire($order, Carbon::parse('2026-10-13 12:06:00')))->toBeTrue();
-    $stored = Order::where('uuid', 'order-1')->first();
-    expect($stored->offerStatus())->toBe('expired')
-        ->and($stored->getMeta('operational_alerts.driver_not_accepted.context'))->toBe([
-            'driver'     => 'driver_one',
-            'offered_at' => '2026-10-13T12:00:00Z',
-            'expires_at' => '2026-10-13T12:05:00Z',
-        ])
-        ->and(fleetopsOrderOpsEvents()->of(OrderOfferChanged::class)[0]->broadcastAs())->toBe('order.offer_expired')
-        ->and(fleetopsOrderOpsEvents()->of(OrderOfferChanged::class)[0]->channelNames)->toBe(['order.order_one', 'order.order-1', 'company.company-1'])
-        ->and($command->expire($stored, Carbon::parse('2026-10-13 12:07:00')))->toBeFalse();
-
-    // a late acceptance still counts
-    expect($stored->acceptOffer())->toBeTrue()
-        ->and(Order::where('uuid', 'order-1')->first()->offerStatus())->toBe('accepted');
-
-    // declining records it and takes the order off the driver
-    $stored->setMeta('offer', array_merge($stored->getOffer(), ['status' => 'offered']));
-    $stored->declineOffer('Too far');
-    $declined = Order::where('uuid', 'order-1')->first();
-    expect($declined->driver_assigned_uuid)->toBeNull()
-        ->and($declined->offerStatus())->toBe('declined')
-        ->and($declined->getOffer()['reason'])->toBe('Too far');
-
-    // removing the driver drops an open offer but keeps a declined one
-    $declined->syncOfferWithAssignment();
-    expect($declined->offerStatus())->toBe('declined');
-    $open = new Order();
-    $open->setMeta('offer', ['status' => 'offered']);
-    $open->syncOfferWithAssignment();
-    expect($open->getOffer())->toBeNull();
-
-    Carbon::setTestNow();
-});
-
-test('the expiry command drops offers left on orders without a driver', function () {
-    $connection = fleetopsOrderOpsBoot();
-    $order      = fleetopsOrderOpsOrder($connection, ['meta' => json_encode(['offer' => ['driver' => 'driver_one', 'status' => 'offered', 'expires_at' => '2026-10-13T12:05:00Z']])]);
-
-    expect((new ExpireOrderOffers())->expire($order, Carbon::parse('2026-10-13 12:06:00')))->toBeFalse()
-        ->and(Order::where('uuid', 'order-1')->first()->getOffer())->toBeNull()
-        ->and(fleetopsOrderOpsEvents()->of(OrderOfferChanged::class))->toBe([]);
-});
-
 test('a driver taken off an order is told and loses it as their current job', function () {
     $connection = fleetopsOrderOpsBoot();
     $order      = fleetopsOrderOpsOrder($connection);

From ef3c9dcbb8148fb21a92b8a12e373ab472b4911c Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Wed, 14 Oct 2026 13:09:12 +0800
Subject: [PATCH 83/87] test(customers): the over-budget login case has no
 email on file

The fixture customer has an email, so the refusal fell back to email and
answered 200 where the test expects the guard's 429. Never ran green: PHP CI
could not resolve core-api ^1.6.69 until it was tagged.
---
 server/tests/ApiCustomerControllerContractsTest.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server/tests/ApiCustomerControllerContractsTest.php b/server/tests/ApiCustomerControllerContractsTest.php
index 81edbd4f6..00dffea9c 100644
--- a/server/tests/ApiCustomerControllerContractsTest.php
+++ b/server/tests/ApiCustomerControllerContractsTest.php
@@ -996,6 +996,7 @@ function fleetopsApiCustomerJson($response): array
 
     // Over budget with no email on file: the 429 and its Retry-After reach the app.
     $limited                        = fleetopsApiCustomerController();
+    $limited->activeUser->email     = null;
     $limited->smsVerificationThrows = SmsBlockedException::limited('company_per_hour', 45);
     $login                          = $limited->loginWithPhone(Request::create('/v1/customers/login/phone', 'POST', [
         'phone' => '15551234567',

From ee54423dba5277c5df1fc6c3108934347b750f66 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Wed, 14 Oct 2026 13:16:01 +0800
Subject: [PATCH 84/87] chore(deps): ember-ui 0.4.6, ember-core 0.3.26 and
 fleetops-data 0.2.3

---
 package.json   |    6 +-
 pnpm-lock.yaml | 3174 ++++++++++++++++++++++++------------------------
 2 files changed, 1569 insertions(+), 1611 deletions(-)

diff --git a/package.json b/package.json
index 5a0ea58ff..6590a8142 100644
--- a/package.json
+++ b/package.json
@@ -44,9 +44,9 @@
     },
     "dependencies": {
         "@babel/core": "^7.23.2",
-        "@fleetbase/ember-core": "^0.3.25",
-        "@fleetbase/ember-ui": "^0.4.5",
-        "@fleetbase/fleetops-data": "^0.2.2",
+        "@fleetbase/ember-core": "^0.3.26",
+        "@fleetbase/ember-ui": "^0.4.6",
+        "@fleetbase/fleetops-data": "^0.2.3",
         "@fleetbase/leaflet-routing-machine": "^3.2.17",
         "@fortawesome/ember-fontawesome": "^2.0.0",
         "@fortawesome/fontawesome-svg-core": "6.4.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d3b5bdd36..9778f5269 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -10,22 +10,22 @@ importers:
     dependencies:
       '@babel/core':
         specifier: ^7.23.2
-        version: 7.29.0(supports-color@8.1.1)
+        version: 7.29.0
       '@fleetbase/ember-core':
-        specifier: ^0.3.25
-        version: 0.3.25(78f09a12995f47803acc2adcbf41a991)
+        specifier: ^0.3.26
+        version: 0.3.26(@ember/string@3.1.1)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(eslint@8.57.1)(webpack@5.106.2(postcss@8.5.14))
       '@fleetbase/ember-ui':
-        specifier: ^0.4.5
-        version: 0.4.5(717e8ca975a22bd279331556b4b156ee)
+        specifier: ^0.4.6
+        version: 0.4.6(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(@glimmer/component@1.1.2(@babel/core@7.29.0))(@glimmer/tracking@1.1.2)(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(eslint@8.57.1)(postcss@8.5.14)(rollup@2.80.0)(tracked-built-ins@3.4.0(@babel/core@7.29.0))(webpack@5.106.2(postcss@8.5.14))(yaml@2.9.0)
       '@fleetbase/fleetops-data':
-        specifier: ^0.2.2
-        version: 0.2.2(78f09a12995f47803acc2adcbf41a991)
+        specifier: ^0.2.3
+        version: 0.2.3(@ember/string@3.1.1)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(eslint@8.57.1)(webpack@5.106.2(postcss@8.5.14))
       '@fleetbase/leaflet-routing-machine':
         specifier: ^3.2.17
         version: 3.2.17
       '@fortawesome/ember-fontawesome':
         specifier: ^2.0.0
-        version: 2.0.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(rollup@2.80.0)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+        version: 2.0.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(rollup@2.80.0)(webpack@5.106.2(postcss@8.5.14))
       '@fortawesome/fontawesome-svg-core':
         specifier: 6.4.0
         version: 6.4.0
@@ -55,40 +55,40 @@ importers:
         version: 7.3.5
       '@zestia/ember-dragula':
         specifier: ^12.0.0
-        version: 12.1.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+        version: 12.1.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))
       broccoli-funnel:
         specifier: ^3.0.8
-        version: 3.0.8(supports-color@8.1.1)
+        version: 3.0.8
       broccoli-merge-trees:
         specifier: ^4.2.0
-        version: 4.2.0(supports-color@8.1.1)
+        version: 4.2.0
       ember-auto-import:
         specifier: ^2.7.4
-        version: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+        version: 2.13.1(webpack@5.106.2(postcss@8.5.14))
       ember-cli-babel:
         specifier: ^8.2.0
-        version: 8.3.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+        version: 8.3.1(@babel/core@7.29.0)
       ember-cli-htmlbars:
         specifier: ^6.3.0
-        version: 6.3.0(supports-color@8.1.1)
+        version: 6.3.0
       ember-drag-sort:
         specifier: ^3.0.1
-        version: 3.0.1(supports-color@8.1.1)
+        version: 3.0.1
       ember-intl:
         specifier: 6.3.2
-        version: 6.3.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+        version: 6.3.2(@babel/core@7.29.0)(webpack@5.106.2(postcss@8.5.14))
       ember-maybe-in-element:
         specifier: ^2.1.0
-        version: 2.1.0(supports-color@8.1.1)
+        version: 2.1.0
       ember-radio-button:
         specifier: ^3.0.0-beta.1
-        version: 3.0.0-beta.1(clean-css@5.3.3)(postcss@8.5.14)(supports-color@8.1.1)(uglify-js@3.19.3)
+        version: 3.0.0-beta.1(postcss@8.5.14)
       ember-tag-input:
         specifier: ^3.1.0
-        version: 3.1.0(supports-color@8.1.1)
+        version: 3.1.0
       ember-wormhole:
         specifier: ^0.6.0
-        version: 0.6.1(supports-color@8.1.1)
+        version: 0.6.1
       leaflet:
         specifier: ^1.9.4
         version: 1.9.4
@@ -104,19 +104,19 @@ importers:
     devDependencies:
       '@babel/eslint-parser':
         specifier: ^7.22.15
-        version: 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(eslint@8.57.1(supports-color@8.1.1))
+        version: 7.28.6(@babel/core@7.29.0)(eslint@8.57.1)
       '@babel/plugin-proposal-decorators':
         specifier: ^7.23.2
-        version: 7.29.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+        version: 7.29.0(@babel/core@7.29.0)
       '@ember/legacy-built-in-components':
         specifier: ^0.4.2
-        version: 0.4.2(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+        version: 0.4.2(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
       '@ember/optional-features':
         specifier: ^2.0.0
-        version: 2.3.0(supports-color@8.1.1)
+        version: 2.3.0
       '@ember/test-helpers':
         specifier: ^3.2.0
-        version: 3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+        version: 3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))
       '@embroider/test-setup':
         specifier: ^3.0.2
         version: 3.0.3
@@ -125,13 +125,13 @@ importers:
         version: 0.0.1
       '@glimmer/component':
         specifier: ^1.1.2
-        version: 1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+        version: 1.1.2(@babel/core@7.29.0)
       '@glimmer/tracking':
         specifier: ^1.1.2
         version: 1.1.2
       broccoli-asset-rev:
         specifier: ^3.0.0
-        version: 3.0.0(supports-color@8.1.1)
+        version: 3.0.0
       concurrently:
         specifier: ^8.2.2
         version: 8.2.2
@@ -140,82 +140,82 @@ importers:
         version: 3.7.3
       ember-cli:
         specifier: ~5.4.1
-        version: 5.4.2(@babel/core@7.29.0(supports-color@8.1.1))(@types/node@25.9.0)(debug@4.4.3(supports-color@8.1.1))(handlebars@4.7.9)(supports-color@8.1.1)(underscore@1.13.8)
+        version: 5.4.2(@babel/core@7.29.0)(@types/node@25.9.0)(handlebars@4.7.9)(underscore@1.13.8)
       ember-cli-clean-css:
         specifier: ^3.0.0
-        version: 3.0.0(supports-color@8.1.1)
+        version: 3.0.0
       ember-cli-dependency-checker:
         specifier: ^3.3.2
-        version: 3.3.3(ember-cli@5.4.2(@babel/core@7.29.0(supports-color@8.1.1))(@types/node@25.9.0)(debug@4.4.3(supports-color@8.1.1))(handlebars@4.7.9)(supports-color@8.1.1)(underscore@1.13.8))
+        version: 3.3.3(ember-cli@5.4.2(@babel/core@7.29.0)(@types/node@25.9.0)(handlebars@4.7.9)(underscore@1.13.8))
       ember-cli-inject-live-reload:
         specifier: ^2.1.0
         version: 2.1.0
       ember-cli-sri:
         specifier: ^2.1.1
-        version: 2.1.1(supports-color@8.1.1)
+        version: 2.1.1
       ember-cli-terser:
         specifier: ^4.0.2
-        version: 4.0.2(supports-color@8.1.1)
+        version: 4.0.2
       ember-composable-helpers:
         specifier: ^5.0.0
-        version: 5.0.0(supports-color@8.1.1)
+        version: 5.0.0
       ember-concurrency:
         specifier: ^4.0.6
-        version: 4.0.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+        version: 4.0.6(@babel/core@7.29.0)
       ember-data:
         specifier: ^4.12.5
-        version: 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+        version: 4.12.8(@babel/core@7.29.0)(@ember/string@3.1.1)(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))
       ember-engines:
         specifier: ^0.9.0
-        version: 0.9.0(@babel/core@7.29.0(supports-color@8.1.1))(@ember/legacy-built-in-components@0.4.2(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+        version: 0.9.0(@babel/core@7.29.0)(@ember/legacy-built-in-components@0.4.2(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
       ember-load-initializers:
         specifier: ^2.1.2
-        version: 2.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+        version: 2.1.2(@babel/core@7.29.0)
       ember-math-helpers:
         specifier: ^4.0.0
-        version: 4.2.1(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+        version: 4.2.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
       ember-page-title:
         specifier: ^8.0.0
-        version: 8.2.4(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+        version: 8.2.4(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
       ember-qunit:
         specifier: ^8.0.1
-        version: 8.1.1(@babel/core@7.29.0(supports-color@8.1.1))(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(qunit@2.25.0)(supports-color@8.1.1)
+        version: 8.1.1(@babel/core@7.29.0)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(qunit@2.25.0)
       ember-resolver:
         specifier: ^11.0.1
-        version: 11.0.1(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+        version: 11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
       ember-responsive:
         specifier: ^5.0.0
-        version: 5.0.0(supports-color@8.1.1)
+        version: 5.0.0
       ember-source:
         specifier: ~5.4.0
-        version: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+        version: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
       ember-source-channel-url:
         specifier: ^3.0.0
         version: 3.0.0
       ember-template-lint:
         specifier: ^5.11.2
-        version: 5.13.0(supports-color@8.1.1)
+        version: 5.13.0
       ember-try:
         specifier: ^3.0.0
-        version: 3.0.0(supports-color@8.1.1)
+        version: 3.0.0
       eslint:
         specifier: ^8.52.0
-        version: 8.57.1(supports-color@8.1.1)
+        version: 8.57.1
       eslint-config-prettier:
         specifier: ^9.0.0
-        version: 9.1.2(eslint@8.57.1(supports-color@8.1.1))
+        version: 9.1.2(eslint@8.57.1)
       eslint-plugin-ember:
         specifier: ^11.11.1
-        version: 11.12.0(eslint@8.57.1(supports-color@8.1.1))(supports-color@8.1.1)
+        version: 11.12.0(eslint@8.57.1)
       eslint-plugin-n:
         specifier: ^16.2.0
-        version: 16.6.2(eslint@8.57.1(supports-color@8.1.1))
+        version: 16.6.2(eslint@8.57.1)
       eslint-plugin-prettier:
         specifier: ^5.0.1
-        version: 5.5.5(@types/eslint@9.6.1)(eslint-config-prettier@9.1.2(eslint@8.57.1(supports-color@8.1.1)))(eslint@8.57.1(supports-color@8.1.1))(prettier@3.8.3)
+        version: 5.5.5(@types/eslint@9.6.1)(eslint-config-prettier@9.1.2(eslint@8.57.1))(eslint@8.57.1)(prettier@3.8.3)
       eslint-plugin-qunit:
         specifier: ^8.0.1
-        version: 8.2.6(eslint@8.57.1(supports-color@8.1.1))
+        version: 8.2.6(eslint@8.57.1)
       loader.js:
         specifier: ^4.7.0
         version: 4.7.0
@@ -227,22 +227,22 @@ importers:
         version: 2.25.0
       qunit-dom:
         specifier: ^2.0.0
-        version: 2.0.0(supports-color@8.1.1)
+        version: 2.0.0
       resolve:
         specifier: ^1.22.2
         version: 1.22.12
       stylelint:
         specifier: ^15.11.0
-        version: 15.11.0(supports-color@8.1.1)
+        version: 15.11.0
       stylelint-config-standard:
         specifier: ^34.0.0
-        version: 34.0.0(stylelint@15.11.0(supports-color@8.1.1))
+        version: 34.0.0(stylelint@15.11.0)
       stylelint-prettier:
         specifier: ^4.0.2
-        version: 4.1.0(prettier@3.8.3)(stylelint@15.11.0(supports-color@8.1.1))
+        version: 4.1.0(prettier@3.8.3)(stylelint@15.11.0)
       webpack:
         specifier: ^5.89.0
-        version: 5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)
+        version: 5.106.2(postcss@8.5.14)
 
 packages:
 
@@ -1393,24 +1393,20 @@ packages:
     peerDependencies:
       ember-source: '>= 4.0.0'
 
-  '@fleetbase/ember-core@0.3.24':
-    resolution: {integrity: sha512-WG32JlX4S75ofa34RQEMxFEqc20fTv2Qn3A5+NlqXtL0lfnCthdO+a1DrGqIIierthHl3mVTxhe+z63f8sM6EA==}
+  '@fleetbase/ember-core@0.3.26':
+    resolution: {integrity: sha512-MFnYa/KwiMx9e5Ac7LuaelBWivA9O/rr38Vo3ouhuGri3q0A09WUsjdCX8/j/NkwFWT5gL9Ko469C1XKKyRiXg==}
     engines: {node: '>= 18'}
 
-  '@fleetbase/ember-core@0.3.25':
-    resolution: {integrity: sha512-nzeF6V+hAqepHAyor0s8rPN7H6keDpkBTJg2Rm+c+Qb325a7J1gZi4JjqxWN7hbRLrNl7xWgh53DHGDmiz53KA==}
-    engines: {node: '>= 18'}
-
-  '@fleetbase/ember-ui@0.4.5':
-    resolution: {integrity: sha512-C/+OvMpH5fCKYY5v+CteR6Tx6IAI33nfvOrmo7mFGDnyKDsjplsVVgWpsecLG94fJvpuVVI+CFvaiH50GUM3Mg==}
+  '@fleetbase/ember-ui@0.4.6':
+    resolution: {integrity: sha512-KEMn5eBjNq2GS/bkrLs2zZYE2uTmrIe+K6tqVvLXh4wYwRuIfdIfTNI0rrhXBBN3OR+xriurXNpaTu/X8+5BsQ==}
     engines: {node: '>= 18'}
 
   '@fleetbase/fleetops-data@0.1.40':
     resolution: {integrity: sha512-bp4tWaS2cpnitjtmH9hm3T7milwSqgt4j3T/KA8cvsFpbg7p303ADb5CNml5RsribgdBcRYtMsLEFYeYnU9dpg==}
     engines: {node: '>= 18'}
 
-  '@fleetbase/fleetops-data@0.2.2':
-    resolution: {integrity: sha512-HDgcGpJAk8q+sSmV070nCh02o4S0kuFCvwrf+Ltb+IrUkQ2RhDL/w8gdrqM65HrgbgWxQnslIeqzKfF6pV4/DA==}
+  '@fleetbase/fleetops-data@0.2.3':
+    resolution: {integrity: sha512-brLYiGHZCKMDaZcyy2bJHY7SHsOTgNk8+XSpdqgmuoTT466xOg4qTPP56LxZbcp2uHyPiUvgNRb5K843gNtJww==}
     engines: {node: '>= 18'}
 
   '@fleetbase/intl-lint@0.0.1':
@@ -3329,6 +3325,7 @@ packages:
 
   concat-stream@1.6.2:
     resolution: {integrity: sha512-27HBghJxjiZtIk3Ycvn/4kbJk/1uZuJFfuPEns6LaEvpvG1f0hTea8lilrouyo9mVc2GWdcEZ8OLoGmSADlrCw==}
+    engines: {'0': node >= 0.8}
 
   concurrently@8.2.2:
     resolution: {integrity: sha512-1dP4gpXFhei8IOtlXRE/T/4H88ElHgTiUzh71YUmtjTEHMSRS2Z/fgOxHSxxusGHogsRfxNq1vyAwxSC+EVyDg==}
@@ -8920,31 +8917,31 @@ snapshots:
 
   '@babel/compat-data@7.29.3': {}
 
-  '@babel/core@7.29.0(supports-color@8.1.1)':
+  '@babel/core@7.29.0':
     dependencies:
       '@babel/code-frame': 7.29.0
       '@babel/generator': 7.29.1
       '@babel/helper-compilation-targets': 7.28.6
-      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
       '@babel/helpers': 7.29.2
       '@babel/parser': 7.29.3
       '@babel/template': 7.28.6
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/traverse': 7.29.0
       '@babel/types': 7.29.0
       '@jridgewell/remapping': 2.3.5
       convert-source-map: 2.0.0
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       gensync: 1.0.0-beta.2
       json5: 2.2.3
       semver: 6.3.1
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/eslint-parser@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(eslint@8.57.1(supports-color@8.1.1))':
+  '@babel/eslint-parser@7.28.6(@babel/core@7.29.0)(eslint@8.57.1)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@nicolo-ribaudo/eslint-scope-5-internals': 5.1.1-v1
-      eslint: 8.57.1(supports-color@8.1.1)
+      eslint: 8.57.1
       eslint-visitor-keys: 2.1.0
       semver: 6.3.1
 
@@ -8976,32 +8973,32 @@ snapshots:
       lru-cache: 5.1.1
       semver: 6.3.1
 
-  '@babel/helper-create-class-features-plugin@7.29.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/helper-create-class-features-plugin@7.29.3(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-annotate-as-pure': 7.27.3
-      '@babel/helper-member-expression-to-functions': 7.28.5(supports-color@8.1.1)
+      '@babel/helper-member-expression-to-functions': 7.28.5
       '@babel/helper-optimise-call-expression': 7.27.1
-      '@babel/helper-replace-supers': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1(supports-color@8.1.1)
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/helper-replace-supers': 7.28.6(@babel/core@7.29.0)
+      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1
+      '@babel/traverse': 7.29.0
       semver: 6.3.1
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/helper-create-regexp-features-plugin@7.28.5(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/helper-create-regexp-features-plugin@7.28.5(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-annotate-as-pure': 7.27.3
       regexpu-core: 6.4.0
       semver: 6.3.1
 
-  '@babel/helper-define-polyfill-provider@0.6.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/helper-define-polyfill-provider@0.6.8(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-compilation-targets': 7.28.6
       '@babel/helper-plugin-utils': 7.29.7
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       lodash.debounce: 4.0.8
       resolve: 1.22.12
     transitivePeerDependencies:
@@ -9011,33 +9008,33 @@ snapshots:
 
   '@babel/helper-globals@7.29.7': {}
 
-  '@babel/helper-member-expression-to-functions@7.28.5(supports-color@8.1.1)':
+  '@babel/helper-member-expression-to-functions@7.28.5':
     dependencies:
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/traverse': 7.29.0
       '@babel/types': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/helper-module-imports@7.28.6(supports-color@8.1.1)':
+  '@babel/helper-module-imports@7.28.6':
     dependencies:
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/traverse': 7.29.0
       '@babel/types': 7.29.0
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/helper-module-imports@7.29.7(supports-color@8.1.1)':
+  '@babel/helper-module-imports@7.29.7':
     dependencies:
-      '@babel/traverse': 7.29.7(supports-color@8.1.1)
+      '@babel/traverse': 7.29.7
       '@babel/types': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/helper-module-transforms@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/helper-module-transforms@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-module-imports': 7.28.6(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-module-imports': 7.28.6
       '@babel/helper-validator-identifier': 7.28.5
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/traverse': 7.29.0
     transitivePeerDependencies:
       - supports-color
 
@@ -9049,27 +9046,27 @@ snapshots:
 
   '@babel/helper-plugin-utils@7.29.7': {}
 
-  '@babel/helper-remap-async-to-generator@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/helper-remap-async-to-generator@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-annotate-as-pure': 7.27.3
-      '@babel/helper-wrap-function': 7.28.6(supports-color@8.1.1)
-      '@babel/traverse': 7.29.7(supports-color@8.1.1)
+      '@babel/helper-wrap-function': 7.28.6
+      '@babel/traverse': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/helper-replace-supers@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/helper-replace-supers@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-member-expression-to-functions': 7.28.5(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-member-expression-to-functions': 7.28.5
       '@babel/helper-optimise-call-expression': 7.27.1
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/traverse': 7.29.0
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/helper-skip-transparent-expression-wrappers@7.27.1(supports-color@8.1.1)':
+  '@babel/helper-skip-transparent-expression-wrappers@7.27.1':
     dependencies:
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/traverse': 7.29.0
       '@babel/types': 7.29.7
     transitivePeerDependencies:
       - supports-color
@@ -9084,10 +9081,10 @@ snapshots:
 
   '@babel/helper-validator-option@7.27.1': {}
 
-  '@babel/helper-wrap-function@7.28.6(supports-color@8.1.1)':
+  '@babel/helper-wrap-function@7.28.6':
     dependencies:
       '@babel/template': 7.29.7
-      '@babel/traverse': 7.29.7(supports-color@8.1.1)
+      '@babel/traverse': 7.29.7
       '@babel/types': 7.29.7
     transitivePeerDependencies:
       - supports-color
@@ -9105,493 +9102,493 @@ snapshots:
     dependencies:
       '@babel/types': 7.29.7
 
-  '@babel/plugin-bugfix-firefox-class-in-computed-class-key@7.28.5(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-bugfix-firefox-class-in-computed-class-key@7.28.5(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/traverse': 7.29.0
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-bugfix-safari-class-field-initializer-scope@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-bugfix-safari-class-field-initializer-scope@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-bugfix-safari-rest-destructuring-rhs-array@7.29.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-bugfix-safari-rest-destructuring-rhs-array@7.29.3(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1(supports-color@8.1.1)
+      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1(supports-color@8.1.1)
-      '@babel/plugin-transform-optional-chaining': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1
+      '@babel/plugin-transform-optional-chaining': 7.28.6(@babel/core@7.29.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/traverse': 7.29.0
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-proposal-class-properties@7.18.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-proposal-class-properties@7.18.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-proposal-decorators@7.29.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-proposal-decorators@7.29.0(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.28.6
-      '@babel/plugin-syntax-decorators': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/plugin-syntax-decorators': 7.28.6(@babel/core@7.29.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-proposal-private-methods@7.18.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-proposal-private-methods@7.18.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-proposal-private-property-in-object@7.21.0-placeholder-for-preset-env.2(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-proposal-private-property-in-object@7.21.0-placeholder-for-preset-env.2(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
 
-  '@babel/plugin-proposal-private-property-in-object@7.21.11(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-proposal-private-property-in-object@7.21.11(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-annotate-as-pure': 7.27.3
-      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/plugin-syntax-private-property-in-object': 7.14.5(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/plugin-syntax-private-property-in-object': 7.14.5(@babel/core@7.29.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-syntax-decorators@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-syntax-decorators@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.28.6
 
-  '@babel/plugin-syntax-decorators@7.29.7(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-syntax-decorators@7.29.7(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-syntax-import-assertions@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-syntax-import-assertions@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-syntax-import-attributes@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-syntax-import-attributes@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-syntax-private-property-in-object@7.14.5(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-syntax-private-property-in-object@7.14.5(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-syntax-typescript@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-syntax-typescript@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-syntax-unicode-sets-regex@7.18.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-syntax-unicode-sets-regex@7.18.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-arrow-functions@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-arrow-functions@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-async-generator-functions@7.29.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-async-generator-functions@7.29.0(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/helper-remap-async-to-generator': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/helper-remap-async-to-generator': 7.27.1(@babel/core@7.29.0)
+      '@babel/traverse': 7.29.0
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-async-to-generator@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-async-to-generator@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-module-imports': 7.29.7(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-module-imports': 7.29.7
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/helper-remap-async-to-generator': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/helper-remap-async-to-generator': 7.27.1(@babel/core@7.29.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-block-scoped-functions@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-block-scoped-functions@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-block-scoping@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-block-scoping@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.28.6
 
-  '@babel/plugin-transform-class-properties@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-class-properties@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-class-static-block@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-class-static-block@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-classes@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-classes@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-annotate-as-pure': 7.27.3
       '@babel/helper-compilation-targets': 7.28.6
       '@babel/helper-globals': 7.28.0
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/helper-replace-supers': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/helper-replace-supers': 7.28.6(@babel/core@7.29.0)
+      '@babel/traverse': 7.29.0
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-computed-properties@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-computed-properties@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
       '@babel/template': 7.28.6
 
-  '@babel/plugin-transform-destructuring@7.28.5(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-destructuring@7.28.5(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/traverse': 7.29.0
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-dotall-regex@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-dotall-regex@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-duplicate-keys@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-duplicate-keys@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-duplicate-named-capturing-groups-regex@7.29.0(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-duplicate-named-capturing-groups-regex@7.29.0(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-dynamic-import@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-dynamic-import@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-explicit-resource-management@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-explicit-resource-management@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/plugin-transform-destructuring': 7.28.5(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/plugin-transform-destructuring': 7.28.5(@babel/core@7.29.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-exponentiation-operator@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-exponentiation-operator@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-export-namespace-from@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-export-namespace-from@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-for-of@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-for-of@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1(supports-color@8.1.1)
+      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-function-name@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-function-name@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-compilation-targets': 7.28.6
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/traverse': 7.29.0
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-json-strings@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-json-strings@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-literals@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-literals@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-logical-assignment-operators@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-logical-assignment-operators@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-member-expression-literals@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-member-expression-literals@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-modules-amd@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-modules-amd@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-modules-commonjs@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-modules-commonjs@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-modules-systemjs@7.29.4(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-modules-systemjs@7.29.4(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
       '@babel/helper-validator-identifier': 7.28.5
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/traverse': 7.29.0
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-modules-umd@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-modules-umd@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-named-capturing-groups-regex@7.29.0(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-named-capturing-groups-regex@7.29.0(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-new-target@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-new-target@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-nullish-coalescing-operator@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-nullish-coalescing-operator@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-numeric-separator@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-numeric-separator@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-object-rest-spread@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-object-rest-spread@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-compilation-targets': 7.28.6
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/plugin-transform-destructuring': 7.28.5(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-parameters': 7.27.7(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/plugin-transform-destructuring': 7.28.5(@babel/core@7.29.0)
+      '@babel/plugin-transform-parameters': 7.27.7(@babel/core@7.29.0)
+      '@babel/traverse': 7.29.0
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-object-super@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-object-super@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/helper-replace-supers': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/helper-replace-supers': 7.28.6(@babel/core@7.29.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-optional-catch-binding@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-optional-catch-binding@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-optional-chaining@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-optional-chaining@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1(supports-color@8.1.1)
+      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-parameters@7.27.7(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-parameters@7.27.7(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-private-methods@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-private-methods@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-private-property-in-object@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-private-property-in-object@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-annotate-as-pure': 7.27.3
-      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-property-literals@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-property-literals@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-regenerator@7.29.0(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-regenerator@7.29.0(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-regexp-modifiers@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-regexp-modifiers@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-reserved-words@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-reserved-words@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-runtime@7.29.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-runtime@7.29.0(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-module-imports': 7.29.7(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-module-imports': 7.29.7
       '@babel/helper-plugin-utils': 7.29.7
-      babel-plugin-polyfill-corejs2: 0.4.17(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      babel-plugin-polyfill-corejs3: 0.13.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      babel-plugin-polyfill-regenerator: 0.6.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      babel-plugin-polyfill-corejs2: 0.4.17(@babel/core@7.29.0)
+      babel-plugin-polyfill-corejs3: 0.13.0(@babel/core@7.29.0)
+      babel-plugin-polyfill-regenerator: 0.6.8(@babel/core@7.29.0)
       semver: 6.3.1
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-shorthand-properties@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-shorthand-properties@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-spread@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-spread@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1(supports-color@8.1.1)
+      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-sticky-regex@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-sticky-regex@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-template-literals@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-template-literals@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-typeof-symbol@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-typeof-symbol@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-typescript@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-typescript@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-annotate-as-pure': 7.27.3
-      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1(supports-color@8.1.1)
-      '@babel/plugin-syntax-typescript': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/helper-skip-transparent-expression-wrappers': 7.27.1
+      '@babel/plugin-syntax-typescript': 7.28.6(@babel/core@7.29.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-typescript@7.4.5(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-typescript@7.4.5(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/plugin-syntax-typescript': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/plugin-syntax-typescript': 7.28.6(@babel/core@7.29.0)
 
-  '@babel/plugin-transform-typescript@7.5.5(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/plugin-transform-typescript@7.5.5(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-create-class-features-plugin': 7.29.3(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
-      '@babel/plugin-syntax-typescript': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/plugin-syntax-typescript': 7.28.6(@babel/core@7.29.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/plugin-transform-unicode-escapes@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-unicode-escapes@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-unicode-property-regex@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-unicode-property-regex@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-unicode-regex@7.27.1(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-unicode-regex@7.27.1(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-unicode-sets-regex@7.28.6(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/plugin-transform-unicode-sets-regex@7.28.6(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/core': 7.29.0
+      '@babel/helper-create-regexp-features-plugin': 7.28.5(@babel/core@7.29.0)
       '@babel/helper-plugin-utils': 7.29.7
 
   '@babel/polyfill@7.12.1':
@@ -9599,86 +9596,86 @@ snapshots:
       core-js: 2.6.12
       regenerator-runtime: 0.13.11
 
-  '@babel/preset-env@7.29.5(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@babel/preset-env@7.29.5(@babel/core@7.29.0)':
     dependencies:
       '@babel/compat-data': 7.29.3
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-compilation-targets': 7.28.6
       '@babel/helper-plugin-utils': 7.29.7
       '@babel/helper-validator-option': 7.27.1
-      '@babel/plugin-bugfix-firefox-class-in-computed-class-key': 7.28.5(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-bugfix-safari-class-field-initializer-scope': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-bugfix-safari-rest-destructuring-rhs-array': 7.29.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-proposal-private-property-in-object': 7.21.0-placeholder-for-preset-env.2(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-syntax-import-assertions': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-syntax-import-attributes': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-syntax-unicode-sets-regex': 7.18.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-arrow-functions': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-async-generator-functions': 7.29.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-async-to-generator': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-block-scoped-functions': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-block-scoping': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-class-properties': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-class-static-block': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-classes': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-computed-properties': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-destructuring': 7.28.5(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-dotall-regex': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-duplicate-keys': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-duplicate-named-capturing-groups-regex': 7.29.0(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-dynamic-import': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-explicit-resource-management': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-exponentiation-operator': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-export-namespace-from': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-for-of': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-function-name': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-json-strings': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-literals': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-logical-assignment-operators': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-member-expression-literals': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-modules-amd': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-modules-commonjs': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-modules-systemjs': 7.29.4(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-modules-umd': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-named-capturing-groups-regex': 7.29.0(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-new-target': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-nullish-coalescing-operator': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-numeric-separator': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-object-rest-spread': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-object-super': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-optional-catch-binding': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-optional-chaining': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-parameters': 7.27.7(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-private-methods': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-private-property-in-object': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-property-literals': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-regenerator': 7.29.0(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-regexp-modifiers': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-reserved-words': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-shorthand-properties': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-spread': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-sticky-regex': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-template-literals': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-typeof-symbol': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-unicode-escapes': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-unicode-property-regex': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-unicode-regex': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-unicode-sets-regex': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/preset-modules': 0.1.6-no-external-plugins(@babel/core@7.29.0(supports-color@8.1.1))
-      babel-plugin-polyfill-corejs2: 0.4.17(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      babel-plugin-polyfill-corejs3: 0.14.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      babel-plugin-polyfill-regenerator: 0.6.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/plugin-bugfix-firefox-class-in-computed-class-key': 7.28.5(@babel/core@7.29.0)
+      '@babel/plugin-bugfix-safari-class-field-initializer-scope': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-bugfix-safari-rest-destructuring-rhs-array': 7.29.3(@babel/core@7.29.0)
+      '@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-proposal-private-property-in-object': 7.21.0-placeholder-for-preset-env.2(@babel/core@7.29.0)
+      '@babel/plugin-syntax-import-assertions': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-syntax-import-attributes': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-syntax-unicode-sets-regex': 7.18.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-arrow-functions': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-async-generator-functions': 7.29.0(@babel/core@7.29.0)
+      '@babel/plugin-transform-async-to-generator': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-block-scoped-functions': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-block-scoping': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-class-properties': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-class-static-block': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-classes': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-computed-properties': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-destructuring': 7.28.5(@babel/core@7.29.0)
+      '@babel/plugin-transform-dotall-regex': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-duplicate-keys': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-duplicate-named-capturing-groups-regex': 7.29.0(@babel/core@7.29.0)
+      '@babel/plugin-transform-dynamic-import': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-explicit-resource-management': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-exponentiation-operator': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-export-namespace-from': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-for-of': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-function-name': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-json-strings': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-literals': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-logical-assignment-operators': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-member-expression-literals': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-modules-amd': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-modules-commonjs': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-modules-systemjs': 7.29.4(@babel/core@7.29.0)
+      '@babel/plugin-transform-modules-umd': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-named-capturing-groups-regex': 7.29.0(@babel/core@7.29.0)
+      '@babel/plugin-transform-new-target': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-nullish-coalescing-operator': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-numeric-separator': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-object-rest-spread': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-object-super': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-optional-catch-binding': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-optional-chaining': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-parameters': 7.27.7(@babel/core@7.29.0)
+      '@babel/plugin-transform-private-methods': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-private-property-in-object': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-property-literals': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-regenerator': 7.29.0(@babel/core@7.29.0)
+      '@babel/plugin-transform-regexp-modifiers': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-reserved-words': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-shorthand-properties': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-spread': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-sticky-regex': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-template-literals': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-typeof-symbol': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-unicode-escapes': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-unicode-property-regex': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-unicode-regex': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-unicode-sets-regex': 7.28.6(@babel/core@7.29.0)
+      '@babel/preset-modules': 0.1.6-no-external-plugins(@babel/core@7.29.0)
+      babel-plugin-polyfill-corejs2: 0.4.17(@babel/core@7.29.0)
+      babel-plugin-polyfill-corejs3: 0.14.2(@babel/core@7.29.0)
+      babel-plugin-polyfill-regenerator: 0.6.8(@babel/core@7.29.0)
       core-js-compat: 3.49.0
       semver: 6.3.1
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/preset-modules@0.1.6-no-external-plugins(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@babel/preset-modules@0.1.6-no-external-plugins(@babel/core@7.29.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-plugin-utils': 7.29.7
       '@babel/types': 7.29.7
       esutils: 2.0.3
@@ -9701,7 +9698,7 @@ snapshots:
       '@babel/parser': 7.29.7
       '@babel/types': 7.29.7
 
-  '@babel/traverse@7.29.0(supports-color@8.1.1)':
+  '@babel/traverse@7.29.0':
     dependencies:
       '@babel/code-frame': 7.29.0
       '@babel/generator': 7.29.1
@@ -9709,11 +9706,11 @@ snapshots:
       '@babel/parser': 7.29.3
       '@babel/template': 7.28.6
       '@babel/types': 7.29.0
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/traverse@7.29.7(supports-color@8.1.1)':
+  '@babel/traverse@7.29.7':
     dependencies:
       '@babel/code-frame': 7.29.7
       '@babel/generator': 7.29.7
@@ -9721,7 +9718,7 @@ snapshots:
       '@babel/parser': 7.29.7
       '@babel/template': 7.29.7
       '@babel/types': 7.29.7
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
 
@@ -9987,136 +9984,136 @@ snapshots:
 
   '@dagrejs/graphlib@2.2.4': {}
 
-  '@ember-data/adapter@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/store@4.12.8)(@ember/string@3.1.1(supports-color@8.1.1))(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@ember-data/adapter@4.12.8(@babel/core@7.29.0)(@ember-data/store@4.12.8)(@ember/string@3.1.1)(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))':
     dependencies:
-      '@ember-data/private-build-infra': 4.12.8(supports-color@8.1.1)
-      '@ember-data/store': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      '@ember/string': 3.1.1(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@ember-data/private-build-infra': 4.12.8
+      '@ember-data/store': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0))(@ember/string@3.1.1)(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      '@ember/string': 3.1.1
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      ember-cli-babel: 7.26.11
       ember-cli-test-info: 1.0.0
-      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
 
-  '@ember-data/debug@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/store@4.12.8)(@ember/string@3.1.1(supports-color@8.1.1))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))':
+  '@ember-data/debug@4.12.8(@babel/core@7.29.0)(@ember-data/store@4.12.8)(@ember/string@3.1.1)(webpack@5.106.2(postcss@8.5.14))':
     dependencies:
-      '@ember-data/private-build-infra': 4.12.8(supports-color@8.1.1)
-      '@ember-data/store': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+      '@ember-data/private-build-infra': 4.12.8
+      '@ember-data/store': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0))(@ember/string@3.1.1)(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
       '@ember/edition-utils': 1.2.0
-      '@ember/string': 3.1.1(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@ember/string': 3.1.1
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
       - webpack
 
-  '@ember-data/graph@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/store@4.12.8)(supports-color@8.1.1)':
+  '@ember-data/graph@4.12.8(@babel/core@7.29.0)(@ember-data/store@4.12.8)':
     dependencies:
-      '@ember-data/private-build-infra': 4.12.8(supports-color@8.1.1)
-      '@ember-data/store': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+      '@ember-data/private-build-infra': 4.12.8
+      '@ember-data/store': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0))(@ember/string@3.1.1)(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
       '@ember/edition-utils': 1.2.0
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
 
-  '@ember-data/json-api@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/store@4.12.8)(supports-color@8.1.1)':
+  '@ember-data/json-api@4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/store@4.12.8)':
     dependencies:
-      '@ember-data/graph': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/store@4.12.8)(supports-color@8.1.1)
-      '@ember-data/private-build-infra': 4.12.8(supports-color@8.1.1)
-      '@ember-data/store': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+      '@ember-data/graph': 4.12.8(@babel/core@7.29.0)(@ember-data/store@4.12.8)
+      '@ember-data/private-build-infra': 4.12.8
+      '@ember-data/store': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0))(@ember/string@3.1.1)(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
       '@ember/edition-utils': 1.2.0
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
 
-  '@ember-data/legacy-compat@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember/string@3.1.1(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@ember-data/legacy-compat@4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember/string@3.1.1)':
     dependencies:
-      '@ember-data/private-build-infra': 4.12.8(supports-color@8.1.1)
-      '@ember/string': 3.1.1(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@ember-data/private-build-infra': 4.12.8
+      '@ember/string': 3.1.1
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      ember-cli-babel: 7.26.11
     optionalDependencies:
-      '@ember-data/graph': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/store@4.12.8)(supports-color@8.1.1)
-      '@ember-data/json-api': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/store@4.12.8)(supports-color@8.1.1)
+      '@ember-data/graph': 4.12.8(@babel/core@7.29.0)(@ember-data/store@4.12.8)
+      '@ember-data/json-api': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/store@4.12.8)
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
 
-  '@ember-data/model@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/debug@4.12.8)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/store@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)':
+  '@ember-data/model@4.12.8(@babel/core@7.29.0)(@ember-data/debug@4.12.8)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/store@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0))(@ember/string@3.1.1)(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))':
     dependencies:
-      '@ember-data/legacy-compat': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember/string@3.1.1(supports-color@8.1.1))(supports-color@8.1.1)
-      '@ember-data/private-build-infra': 4.12.8(supports-color@8.1.1)
-      '@ember-data/store': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      '@ember-data/tracking': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@ember-data/legacy-compat': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember/string@3.1.1)
+      '@ember-data/private-build-infra': 4.12.8
+      '@ember-data/store': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0))(@ember/string@3.1.1)(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      '@ember-data/tracking': 4.12.8(@babel/core@7.29.0)
       '@ember/edition-utils': 1.2.0
-      '@ember/string': 3.1.1(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cached-decorator-polyfill: 1.0.2(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@ember/string': 3.1.1
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      ember-cached-decorator-polyfill: 1.0.2(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-cli-babel: 7.26.11
       ember-cli-string-utils: 1.1.0
       ember-cli-test-info: 1.0.0
-      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
       inflection: 2.0.1
     optionalDependencies:
-      '@ember-data/debug': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/store@4.12.8)(@ember/string@3.1.1(supports-color@8.1.1))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      '@ember-data/graph': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/store@4.12.8)(supports-color@8.1.1)
-      '@ember-data/json-api': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/store@4.12.8)(supports-color@8.1.1)
+      '@ember-data/debug': 4.12.8(@babel/core@7.29.0)(@ember-data/store@4.12.8)(@ember/string@3.1.1)(webpack@5.106.2(postcss@8.5.14))
+      '@ember-data/graph': 4.12.8(@babel/core@7.29.0)(@ember-data/store@4.12.8)
+      '@ember-data/json-api': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/store@4.12.8)
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - ember-source
       - supports-color
 
-  '@ember-data/private-build-infra@4.12.8(supports-color@8.1.1)':
+  '@ember-data/private-build-infra@4.12.8':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/plugin-transform-block-scoping': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/core': 7.29.0
+      '@babel/plugin-transform-block-scoping': 7.28.6(@babel/core@7.29.0)
       '@babel/runtime': 7.29.2
       '@ember/edition-utils': 1.2.0
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
       babel-import-util: 1.4.1
-      babel-plugin-debug-macros: 0.3.4(@babel/core@7.29.0(supports-color@8.1.1))
+      babel-plugin-debug-macros: 0.3.4(@babel/core@7.29.0)
       babel-plugin-filter-imports: 4.0.0
       babel6-plugin-strip-class-callcheck: 6.0.0
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
+      broccoli-debug: 0.6.5
       broccoli-file-creator: 2.1.1
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
-      broccoli-rollup: 5.0.0(supports-color@8.1.1)
+      broccoli-funnel: 3.0.8
+      broccoli-merge-trees: 4.2.0
+      broccoli-rollup: 5.0.0
       calculate-cache-key-for-tree: 2.0.0
       chalk: 4.1.2
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
       ember-cli-path-utils: 1.0.0
       ember-cli-string-utils: 1.1.0
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
+      ember-cli-version-checker: 5.1.2
       git-repo-info: 2.1.1
       glob: 9.3.5
       npm-git-info: 1.0.3
       semver: 7.8.0
-      silent-error: 1.1.1(supports-color@8.1.1)
+      silent-error: 1.1.1
     transitivePeerDependencies:
       - '@glint/template'
       - supports-color
 
-  '@ember-data/request@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@ember-data/request@4.12.8(@babel/core@7.29.0)':
     dependencies:
-      '@ember-data/private-build-infra': 4.12.8(supports-color@8.1.1)
-      '@ember/test-waiters': 3.1.0(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@ember-data/private-build-infra': 4.12.8
+      '@ember/test-waiters': 3.1.0
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
@@ -10124,168 +10121,168 @@ snapshots:
 
   '@ember-data/rfc395-data@0.0.4': {}
 
-  '@ember-data/serializer@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/store@4.12.8)(@ember/string@3.1.1(supports-color@8.1.1))(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@ember-data/serializer@4.12.8(@babel/core@7.29.0)(@ember-data/store@4.12.8)(@ember/string@3.1.1)(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))':
     dependencies:
-      '@ember-data/private-build-infra': 4.12.8(supports-color@8.1.1)
-      '@ember-data/store': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      '@ember/string': 3.1.1(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@ember-data/private-build-infra': 4.12.8
+      '@ember-data/store': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0))(@ember/string@3.1.1)(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      '@ember/string': 3.1.1
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      ember-cli-babel: 7.26.11
       ember-cli-test-info: 1.0.0
-      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
 
-  '@ember-data/store@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)':
+  '@ember-data/store@4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0))(@ember/string@3.1.1)(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))':
     dependencies:
-      '@ember-data/private-build-infra': 4.12.8(supports-color@8.1.1)
-      '@ember-data/tracking': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@ember/string': 3.1.1(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@ember-data/private-build-infra': 4.12.8
+      '@ember-data/tracking': 4.12.8(@babel/core@7.29.0)
+      '@ember/string': 3.1.1
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
       '@glimmer/tracking': 1.1.2
-      ember-cached-decorator-polyfill: 1.0.2(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cached-decorator-polyfill: 1.0.2(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-cli-babel: 7.26.11
     optionalDependencies:
-      '@ember-data/graph': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/store@4.12.8)(supports-color@8.1.1)
-      '@ember-data/json-api': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/store@4.12.8)(supports-color@8.1.1)
-      '@ember-data/legacy-compat': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember/string@3.1.1(supports-color@8.1.1))(supports-color@8.1.1)
-      '@ember-data/model': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/debug@4.12.8)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/store@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+      '@ember-data/graph': 4.12.8(@babel/core@7.29.0)(@ember-data/store@4.12.8)
+      '@ember-data/json-api': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/store@4.12.8)
+      '@ember-data/legacy-compat': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember/string@3.1.1)
+      '@ember-data/model': 4.12.8(@babel/core@7.29.0)(@ember-data/debug@4.12.8)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/store@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0))(@ember/string@3.1.1)(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - ember-source
       - supports-color
 
-  '@ember-data/tracking@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@ember-data/tracking@4.12.8(@babel/core@7.29.0)':
     dependencies:
-      '@ember-data/private-build-infra': 4.12.8(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@ember-data/private-build-infra': 4.12.8
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
 
-  '@ember-decorators/component@6.1.1(supports-color@8.1.1)':
+  '@ember-decorators/component@6.1.1':
     dependencies:
-      '@ember-decorators/utils': 6.1.1(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@ember-decorators/utils': 6.1.1
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - supports-color
 
-  '@ember-decorators/object@6.1.1(supports-color@8.1.1)':
+  '@ember-decorators/object@6.1.1':
     dependencies:
-      '@ember-decorators/utils': 6.1.1(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@ember-decorators/utils': 6.1.1
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - supports-color
 
-  '@ember-decorators/utils@6.1.1(supports-color@8.1.1)':
+  '@ember-decorators/utils@6.1.1':
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - supports-color
 
   '@ember/edition-utils@1.2.0': {}
 
-  '@ember/legacy-built-in-components@0.4.2(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)':
+  '@ember/legacy-built-in-components@0.4.2(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))':
     dependencies:
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 5.7.2(supports-color@8.1.1)
-      ember-cli-typescript: 4.2.1(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 5.7.2
+      ember-cli-typescript: 4.2.1
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
 
-  '@ember/optional-features@2.3.0(supports-color@8.1.1)':
+  '@ember/optional-features@2.3.0':
     dependencies:
       chalk: 4.1.2
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
+      ember-cli-version-checker: 5.1.2
       glob: 7.2.3
       inquirer: 7.3.3
       mkdirp: 1.0.4
-      silent-error: 1.1.1(supports-color@8.1.1)
+      silent-error: 1.1.1
     transitivePeerDependencies:
       - supports-color
 
-  '@ember/render-modifiers@2.1.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)':
+  '@ember/render-modifiers@2.1.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))':
     dependencies:
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-modifier-manager-polyfill: 1.2.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      ember-cli-babel: 7.26.11
+      ember-modifier-manager-polyfill: 1.2.0(@babel/core@7.29.0)
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  '@ember/string@3.1.1(supports-color@8.1.1)':
+  '@ember/string@3.1.1':
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - supports-color
 
-  '@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))':
+  '@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))':
     dependencies:
-      '@ember/test-waiters': 3.1.0(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@ember/test-waiters': 3.1.0
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
       '@simple-dom/interface': 1.4.0
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
+      broccoli-debug: 0.6.5
+      broccoli-funnel: 3.0.8
       dom-element-descriptors: 0.5.1
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-cli-babel: 8.3.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-cli-babel: 8.3.1(@babel/core@7.29.0)
+      ember-cli-htmlbars: 6.3.0
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
       - webpack
 
-  '@ember/test-waiters@3.1.0(supports-color@8.1.1)':
+  '@ember/test-waiters@3.1.0':
     dependencies:
       calculate-cache-key-for-tree: 2.0.0
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-version-checker: 5.1.2
       semver: 7.8.0
     transitivePeerDependencies:
       - supports-color
 
-  '@embroider/addon-shim@1.10.2(supports-color@8.1.1)':
+  '@embroider/addon-shim@1.10.2':
     dependencies:
-      '@embroider/shared-internals': 3.1.0(supports-color@8.1.1)
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
+      '@embroider/shared-internals': 3.1.0
+      broccoli-funnel: 3.0.8
       common-ancestor-path: 1.0.1
       semver: 7.8.2
     transitivePeerDependencies:
       - supports-color
 
-  '@embroider/addon-shim@1.10.3(supports-color@8.1.1)':
+  '@embroider/addon-shim@1.10.3':
     dependencies:
-      '@embroider/shared-internals': 3.1.1(supports-color@8.1.1)
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
+      '@embroider/shared-internals': 3.1.1
+      broccoli-funnel: 3.0.8
       common-ancestor-path: 1.0.1
       semver: 7.8.4
     transitivePeerDependencies:
       - supports-color
 
-  '@embroider/addon@0.30.0(supports-color@8.1.1)':
+  '@embroider/addon@0.30.0':
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - supports-color
 
-  '@embroider/macros@1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@embroider/macros@1.20.2(@babel/core@7.29.0)':
     dependencies:
-      '@embroider/shared-internals': 3.0.2(supports-color@8.1.1)
+      '@embroider/shared-internals': 3.0.2
       assert-never: 1.4.0
       babel-import-util: 3.0.1
-      ember-cli-babel: 8.3.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-cli-babel: 8.3.1(@babel/core@7.29.0)
       find-up: 5.0.0
       lodash: 4.18.1
       resolve: 1.22.12
@@ -10310,10 +10307,10 @@ snapshots:
       semver: 7.8.4
       typescript-memoize: 1.1.1
 
-  '@embroider/shared-internals@2.9.2(supports-color@8.1.1)':
+  '@embroider/shared-internals@2.9.2':
     dependencies:
       babel-import-util: 2.1.1
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       ember-rfc176-data: 0.3.18
       fs-extra: 9.1.0
       is-subdir: 1.2.0
@@ -10327,10 +10324,10 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@embroider/shared-internals@3.0.2(supports-color@8.1.1)':
+  '@embroider/shared-internals@3.0.2':
     dependencies:
       babel-import-util: 3.0.1
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       ember-rfc176-data: 0.3.18
       fs-extra: 9.1.0
       is-subdir: 1.2.0
@@ -10345,10 +10342,10 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@embroider/shared-internals@3.1.0(supports-color@8.1.1)':
+  '@embroider/shared-internals@3.1.0':
     dependencies:
       babel-import-util: 3.0.1
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       ember-rfc176-data: 0.3.18
       fs-extra: 9.1.0
       is-subdir: 1.2.0
@@ -10363,10 +10360,10 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@embroider/shared-internals@3.1.1(supports-color@8.1.1)':
+  '@embroider/shared-internals@3.1.1':
     dependencies:
       babel-import-util: 3.0.1
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       ember-rfc176-data: 0.3.18
       fs-extra: 9.1.0
       is-subdir: 1.2.0
@@ -10386,27 +10383,27 @@ snapshots:
       lodash: 4.18.1
       resolve: 1.22.12
 
-  '@embroider/util@1.13.5(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)':
+  '@embroider/util@1.13.5(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))':
     dependencies:
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      broccoli-funnel: 3.0.8
+      ember-cli-babel: 7.26.11
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  '@eslint-community/eslint-utils@4.9.1(eslint@8.57.1(supports-color@8.1.1))':
+  '@eslint-community/eslint-utils@4.9.1(eslint@8.57.1)':
     dependencies:
-      eslint: 8.57.1(supports-color@8.1.1)
+      eslint: 8.57.1
       eslint-visitor-keys: 3.4.3
 
   '@eslint-community/regexpp@4.12.2': {}
 
-  '@eslint/eslintrc@2.1.4(supports-color@8.1.1)':
+  '@eslint/eslintrc@2.1.4':
     dependencies:
       ajv: 6.15.0
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       espree: 9.6.1
       globals: 13.24.0
       ignore: 5.3.2
@@ -10425,71 +10422,38 @@ snapshots:
     transitivePeerDependencies:
       - '@typescript-eslint/types'
 
-  '@fleetbase/ember-accounting@0.0.1(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)':
+  '@fleetbase/ember-accounting@0.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      ember-cli-babel: 8.3.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@babel/core': 7.29.0
+      ember-cli-babel: 8.3.1(@babel/core@7.29.0)
+      ember-cli-htmlbars: 6.3.0
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - supports-color
 
-  '@fleetbase/ember-core@0.3.24(78f09a12995f47803acc2adcbf41a991)':
+  '@fleetbase/ember-core@0.3.26(@ember/string@3.1.1)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(eslint@8.57.1)(webpack@5.106.2(postcss@8.5.14))':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       compress-json: 3.4.0
       date-fns: 2.30.0
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-can: 6.0.0(@babel/core@7.29.0(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-cli-babel: 8.3.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-cli-notifications: 9.1.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-concurrency: 4.0.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-decorators: 6.1.1(supports-color@8.1.1)
-      ember-get-config: 2.1.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-intl: 6.3.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-loading: 2.0.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-local-storage: 2.0.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-simple-auth: 6.1.0(@babel/core@7.29.0(supports-color@8.1.1))(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(eslint@8.57.1(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-wormhole: 0.6.1(supports-color@8.1.1)
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-can: 6.0.0(@babel/core@7.29.0)(@ember/string@3.1.1)(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-cli-babel: 8.3.1(@babel/core@7.29.0)
+      ember-cli-htmlbars: 6.3.0
+      ember-cli-notifications: 9.1.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-cli-string-helpers: 6.1.0
+      ember-concurrency: 4.0.6(@babel/core@7.29.0)
+      ember-decorators: 6.1.1
+      ember-fetch: 8.1.2
+      ember-get-config: 2.1.1(@babel/core@7.29.0)
+      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-intl: 6.3.2(@babel/core@7.29.0)(webpack@5.106.2(postcss@8.5.14))
+      ember-loading: 2.0.0(@babel/core@7.29.0)
+      ember-local-storage: 2.0.7(@babel/core@7.29.0)
+      ember-simple-auth: 6.1.0(@babel/core@7.29.0)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(eslint@8.57.1)
+      ember-wormhole: 0.6.1
       socketcluster-client: 17.2.2
-    transitivePeerDependencies:
-      - '@ember/string'
-      - '@ember/test-helpers'
-      - '@glint/template'
-      - bufferutil
-      - ember-resolver
-      - ember-source
-      - eslint
-      - supports-color
-      - typescript
-      - utf-8-validate
-      - webpack
-
-  '@fleetbase/ember-core@0.3.25(78f09a12995f47803acc2adcbf41a991)':
-    dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      compress-json: 3.4.0
-      date-fns: 2.30.0
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-can: 6.0.0(@babel/core@7.29.0(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-cli-babel: 8.3.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-cli-notifications: 9.1.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-cli-string-helpers: 6.1.0(supports-color@8.1.1)
-      ember-concurrency: 4.0.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-decorators: 6.1.1(supports-color@8.1.1)
-      ember-fetch: 8.1.2(supports-color@8.1.1)
-      ember-get-config: 2.1.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-intl: 6.3.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-loading: 2.0.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-local-storage: 2.0.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-simple-auth: 6.1.0(@babel/core@7.29.0(supports-color@8.1.1))(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(eslint@8.57.1(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-wormhole: 0.6.1(supports-color@8.1.1)
-      socketcluster-client: 17.2.2
-      tracked-built-ins: 3.4.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      tracked-built-ins: 3.4.0(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@ember/string'
       - '@ember/test-helpers'
@@ -10504,26 +10468,26 @@ snapshots:
       - utf-8-validate
       - webpack
 
-  '@fleetbase/ember-ui@0.4.5(717e8ca975a22bd279331556b4b156ee)':
+  '@fleetbase/ember-ui@0.4.6(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(@glimmer/component@1.1.2(@babel/core@7.29.0))(@glimmer/tracking@1.1.2)(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(eslint@8.57.1)(postcss@8.5.14)(rollup@2.80.0)(tracked-built-ins@3.4.0(@babel/core@7.29.0))(webpack@5.106.2(postcss@8.5.14))(yaml@2.9.0)':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@ember/render-modifiers': 2.1.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      '@ember/string': 3.1.1(supports-color@8.1.1)
-      '@embroider/addon': 0.30.0(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@ember/render-modifiers': 2.1.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      '@ember/string': 3.1.1
+      '@embroider/addon': 0.30.0
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
       '@event-calendar/core': 5.7.0
-      '@fleetbase/ember-accounting': 0.0.1(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      '@fleetbase/ember-core': 0.3.24(78f09a12995f47803acc2adcbf41a991)
-      '@fleetbase/fleetops-data': 0.1.40(78f09a12995f47803acc2adcbf41a991)
+      '@fleetbase/ember-accounting': 0.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      '@fleetbase/ember-core': 0.3.26(@ember/string@3.1.1)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(eslint@8.57.1)(webpack@5.106.2(postcss@8.5.14))
+      '@fleetbase/fleetops-data': 0.1.40(@ember/string@3.1.1)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(eslint@8.57.1)(webpack@5.106.2(postcss@8.5.14))
       '@floating-ui/dom': 1.7.6
-      '@fortawesome/ember-fontawesome': 2.0.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(rollup@2.80.0)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@fortawesome/ember-fontawesome': 2.0.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(rollup@2.80.0)(webpack@5.106.2(postcss@8.5.14))
       '@fortawesome/fontawesome-svg-core': 6.4.0
       '@fortawesome/free-brands-svg-icons': 6.4.0
       '@fortawesome/free-solid-svg-icons': 6.4.0
       '@fullcalendar/core': 6.1.20
       '@fullcalendar/daygrid': 6.1.20(@fullcalendar/core@6.1.20)
       '@fullcalendar/interaction': 6.1.20(@fullcalendar/core@6.1.20)
-      '@makepanic/ember-power-calendar-date-fns': 0.4.2(supports-color@8.1.1)
+      '@makepanic/ember-power-calendar-date-fns': 0.4.2
       '@tailwindcss/forms': 0.5.11(tailwindcss@3.4.19(yaml@2.9.0))
       '@tiptap/core': 2.27.2(@tiptap/pm@2.27.2)
       '@tiptap/extension-color': 2.27.2(@tiptap/core@2.27.2(@tiptap/pm@2.27.2))(@tiptap/extension-text-style@2.27.2(@tiptap/core@2.27.2(@tiptap/pm@2.27.2)))
@@ -10549,36 +10513,36 @@ snapshots:
       chart.js: 4.5.1
       chartjs-adapter-date-fns: 3.0.0(chart.js@4.5.1)(date-fns@2.30.0)
       date-fns: 2.30.0
-      ember-animated: 1.1.4(@babel/core@7.29.0(supports-color@8.1.1))(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-basic-dropdown: 8.4.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-can: 6.0.0(@babel/core@7.29.0(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-cli-babel: 8.3.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-cli-postcss: 8.2.0(supports-color@8.1.1)
-      ember-cli-string-helpers: 6.1.0(supports-color@8.1.1)
-      ember-composable-helpers: 5.0.0(supports-color@8.1.1)
-      ember-concurrency: 4.0.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-drag-sort: 4.2.0(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-file-upload: 8.4.0(@babel/core@7.29.0(supports-color@8.1.1))(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-modifier@4.3.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(supports-color@8.1.1)(tracked-built-ins@3.4.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-focus-trap: 1.2.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-get-config: 2.1.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-gridstack: 4.0.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-leaflet: 5.1.3(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(leaflet@1.9.4)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-loading: 2.0.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-math-helpers: 4.2.1(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-modifier: 4.3.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-on-helper: 0.1.0(supports-color@8.1.1)
-      ember-power-calendar: 0.18.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-power-select: 8.6.2(ec9a6827a6a32bd62122db95d945b3b6)
-      ember-ref-bucket: 4.1.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-responsive: 5.0.0(supports-color@8.1.1)
-      ember-style-modifier: 3.1.1(@babel/core@7.29.0(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-tag-input: 3.1.0(supports-color@8.1.1)
-      ember-truth-helpers: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-window-mock: 0.9.0(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-wormhole: 0.6.1(supports-color@8.1.1)
+      ember-animated: 1.1.4(@babel/core@7.29.0)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-basic-dropdown: 8.4.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(@glimmer/component@1.1.2(@babel/core@7.29.0))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-can: 6.0.0(@babel/core@7.29.0)(@ember/string@3.1.1)(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-cli-babel: 8.3.1(@babel/core@7.29.0)
+      ember-cli-htmlbars: 6.3.0
+      ember-cli-postcss: 8.2.0
+      ember-cli-string-helpers: 6.1.0
+      ember-composable-helpers: 5.0.0
+      ember-concurrency: 4.0.6(@babel/core@7.29.0)
+      ember-drag-sort: 4.2.0(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))
+      ember-file-upload: 8.4.0(@babel/core@7.29.0)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(@glimmer/component@1.1.2(@babel/core@7.29.0))(@glimmer/tracking@1.1.2)(ember-modifier@4.3.0(@babel/core@7.29.0))(tracked-built-ins@3.4.0(@babel/core@7.29.0))(webpack@5.106.2(postcss@8.5.14))
+      ember-focus-trap: 1.2.0(@babel/core@7.29.0)
+      ember-get-config: 2.1.1(@babel/core@7.29.0)
+      ember-gridstack: 4.0.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))
+      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-leaflet: 5.1.3(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(leaflet@1.9.4)(webpack@5.106.2(postcss@8.5.14))
+      ember-loading: 2.0.0(@babel/core@7.29.0)
+      ember-math-helpers: 4.2.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-modifier: 4.3.0(@babel/core@7.29.0)
+      ember-on-helper: 0.1.0
+      ember-power-calendar: 0.18.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-power-select: 8.6.2(@babel/core@7.29.0)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(@glimmer/component@1.1.2(@babel/core@7.29.0))(@glimmer/tracking@1.1.2)(ember-basic-dropdown@8.4.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(@glimmer/component@1.1.2(@babel/core@7.29.0))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-concurrency@4.0.6(@babel/core@7.29.0))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-ref-bucket: 4.1.0(@babel/core@7.29.0)
+      ember-responsive: 5.0.0
+      ember-style-modifier: 3.1.1(@babel/core@7.29.0)(@ember/string@3.1.1)(webpack@5.106.2(postcss@8.5.14))
+      ember-tag-input: 3.1.0
+      ember-truth-helpers: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-window-mock: 0.9.0(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-wormhole: 0.6.1
       gridstack: 7.3.0
       imask: 6.6.3
       interactjs: 1.10.27
@@ -10603,6 +10567,7 @@ snapshots:
       - ember-cli-mirage
       - ember-resolver
       - ember-source
+      - encoding
       - eslint
       - miragejs
       - postcss
@@ -10617,13 +10582,13 @@ snapshots:
       - webpack-command
       - yaml
 
-  '@fleetbase/fleetops-data@0.1.40(78f09a12995f47803acc2adcbf41a991)':
+  '@fleetbase/fleetops-data@0.1.40(@ember/string@3.1.1)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(eslint@8.57.1)(webpack@5.106.2(postcss@8.5.14))':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@fleetbase/ember-core': 0.3.24(78f09a12995f47803acc2adcbf41a991)
+      '@babel/core': 7.29.0
+      '@fleetbase/ember-core': 0.3.26(@ember/string@3.1.1)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(eslint@8.57.1)(webpack@5.106.2(postcss@8.5.14))
       date-fns: 2.30.0
-      ember-cli-babel: 8.3.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
+      ember-cli-babel: 8.3.1(@babel/core@7.29.0)
+      ember-cli-htmlbars: 6.3.0
     transitivePeerDependencies:
       - '@ember/string'
       - '@ember/test-helpers'
@@ -10631,19 +10596,20 @@ snapshots:
       - bufferutil
       - ember-resolver
       - ember-source
+      - encoding
       - eslint
       - supports-color
       - typescript
       - utf-8-validate
       - webpack
 
-  '@fleetbase/fleetops-data@0.2.2(78f09a12995f47803acc2adcbf41a991)':
+  '@fleetbase/fleetops-data@0.2.3(@ember/string@3.1.1)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(eslint@8.57.1)(webpack@5.106.2(postcss@8.5.14))':
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@fleetbase/ember-core': 0.3.25(78f09a12995f47803acc2adcbf41a991)
+      '@babel/core': 7.29.0
+      '@fleetbase/ember-core': 0.3.26(@ember/string@3.1.1)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(eslint@8.57.1)(webpack@5.106.2(postcss@8.5.14))
       date-fns: 2.30.0
-      ember-cli-babel: 8.3.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
+      ember-cli-babel: 8.3.1(@babel/core@7.29.0)
+      ember-cli-htmlbars: 6.3.0
     transitivePeerDependencies:
       - '@ember/string'
       - '@ember/test-helpers'
@@ -10753,23 +10719,23 @@ snapshots:
       intl-messageformat: 10.7.7
       tslib: 2.8.1
 
-  '@fortawesome/ember-fontawesome@2.0.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(rollup@2.80.0)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))':
+  '@fortawesome/ember-fontawesome@2.0.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(rollup@2.80.0)(webpack@5.106.2(postcss@8.5.14))':
     dependencies:
       '@fortawesome/fontawesome-svg-core': 6.4.0
       '@rollup/plugin-node-resolve': 15.3.1(rollup@2.80.0)
       array-unique: 0.3.2
       broccoli-file-creator: 2.1.1
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
-      broccoli-plugin: 4.0.7(supports-color@8.1.1)
-      broccoli-rollup: 5.0.0(supports-color@8.1.1)
+      broccoli-merge-trees: 4.2.0
+      broccoli-plugin: 4.0.7
+      broccoli-rollup: 5.0.0
       broccoli-source: 3.0.1
       camel-case: 4.1.2
       ember-ast-helpers: 0.4.0
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-get-config: 2.1.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 6.3.0
+      ember-get-config: 2.1.1(@babel/core@7.29.0)
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
       find-yarn-workspace-root: 2.0.0
       glob: 10.5.0
     transitivePeerDependencies:
@@ -10813,22 +10779,22 @@ snapshots:
       '@glimmer/wire-format': 0.84.3
       '@simple-dom/interface': 1.4.0
 
-  '@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)':
+  '@glimmer/component@1.1.2(@babel/core@7.29.0)':
     dependencies:
       '@glimmer/di': 0.1.11
       '@glimmer/env': 0.1.7
       '@glimmer/util': 0.44.0
       broccoli-file-creator: 2.1.1
-      broccoli-merge-trees: 3.0.2(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      broccoli-merge-trees: 3.0.2
+      ember-cli-babel: 7.26.11
       ember-cli-get-component-path-option: 1.0.0
       ember-cli-is-package-missing: 1.0.0
-      ember-cli-normalize-entity-name: 1.0.0(supports-color@8.1.1)
+      ember-cli-normalize-entity-name: 1.0.0
       ember-cli-path-utils: 1.0.0
       ember-cli-string-utils: 1.1.0
-      ember-cli-typescript: 3.0.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-cli-typescript: 3.0.0(@babel/core@7.29.0)
       ember-cli-version-checker: 3.1.3
-      ember-compatibility-helpers: 1.2.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-compatibility-helpers: 1.2.7(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
@@ -10969,9 +10935,9 @@ snapshots:
       '@glimmer/env': 0.1.7
       '@glimmer/global-context': 0.84.3
 
-  '@glimmer/vm-babel-plugins@0.84.3(@babel/core@7.29.0(supports-color@8.1.1))':
+  '@glimmer/vm-babel-plugins@0.84.3(@babel/core@7.29.0)':
     dependencies:
-      babel-plugin-debug-macros: 0.3.4(@babel/core@7.29.0(supports-color@8.1.1))
+      babel-plugin-debug-macros: 0.3.4(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
 
@@ -10993,10 +10959,10 @@ snapshots:
 
   '@handlebars/parser@2.2.2': {}
 
-  '@humanwhocodes/config-array@0.13.0(supports-color@8.1.1)':
+  '@humanwhocodes/config-array@0.13.0':
     dependencies:
       '@humanwhocodes/object-schema': 2.0.3
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       minimatch: 3.1.5
     transitivePeerDependencies:
       - supports-color
@@ -11069,14 +11035,14 @@ snapshots:
       tslib: 2.8.1
       upath: 2.0.1
 
-  '@makepanic/ember-power-calendar-date-fns@0.4.2(supports-color@8.1.1)':
+  '@makepanic/ember-power-calendar-date-fns@0.4.2':
     dependencies:
-      broccoli-funnel: 2.0.2(supports-color@8.1.1)
-      broccoli-string-replace: 0.1.2(supports-color@8.1.1)
+      broccoli-funnel: 2.0.2
+      broccoli-string-replace: 0.1.2
       date-fns: 2.30.0
-      ember-auto-import: 1.12.2(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 4.5.0(supports-color@8.1.1)
+      ember-auto-import: 1.12.2
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 4.5.0
     transitivePeerDependencies:
       - supports-color
       - webpack-cli
@@ -11398,9 +11364,9 @@ snapshots:
       '@types/connect': 3.4.38
       '@types/node': 25.9.0
 
-  '@types/broccoli-plugin@3.0.4(supports-color@8.1.1)':
+  '@types/broccoli-plugin@3.0.4':
     dependencies:
-      broccoli-plugin: 4.0.7(supports-color@8.1.1)
+      broccoli-plugin: 4.0.7
     transitivePeerDependencies:
       - supports-color
 
@@ -11716,15 +11682,15 @@ snapshots:
 
   '@xtuc/long@4.2.2': {}
 
-  '@zestia/ember-dragula@12.1.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))':
+  '@zestia/ember-dragula@12.1.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))':
     dependencies:
-      '@ember/render-modifiers': 2.1.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      '@embroider/util': 1.13.5(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+      '@ember/render-modifiers': 2.1.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      '@embroider/util': 1.13.5(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
       dragula: 3.7.3
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 6.3.0
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/environment-ember-loose'
@@ -11858,9 +11824,9 @@ snapshots:
 
   any-promise@1.3.0: {}
 
-  anymatch@2.0.0(supports-color@8.1.1):
+  anymatch@2.0.0:
     dependencies:
-      micromatch: 3.1.10(supports-color@8.1.1)
+      micromatch: 3.1.10
       normalize-path: 2.1.1
     transitivePeerDependencies:
       - supports-color
@@ -11936,9 +11902,9 @@ snapshots:
 
   astral-regex@2.0.0: {}
 
-  async-disk-cache@1.3.5(supports-color@8.1.1):
+  async-disk-cache@1.3.5:
     dependencies:
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       heimdalljs: 0.2.6
       istextorbinary: 2.1.0
       mkdirp: 0.5.6
@@ -11948,9 +11914,9 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  async-disk-cache@2.1.0(supports-color@8.1.1):
+  async-disk-cache@2.1.0:
     dependencies:
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       heimdalljs: 0.2.6
       istextorbinary: 2.6.0
       mkdirp: 0.5.6
@@ -11965,10 +11931,10 @@ snapshots:
 
   async-function@1.0.0: {}
 
-  async-promise-queue@1.0.5(supports-color@8.1.1):
+  async-promise-queue@1.0.5:
     dependencies:
       async: 2.6.4
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
     transitivePeerDependencies:
       - supports-color
 
@@ -12011,20 +11977,20 @@ snapshots:
       esutils: 2.0.3
       js-tokens: 3.0.2
 
-  babel-core@6.26.3(supports-color@8.1.1):
+  babel-core@6.26.3:
     dependencies:
       babel-code-frame: 6.26.0
       babel-generator: 6.26.1
-      babel-helpers: 6.24.1(supports-color@8.1.1)
+      babel-helpers: 6.24.1
       babel-messages: 6.23.0
       babel-register: 6.26.0
       babel-runtime: 6.26.0
-      babel-template: 6.26.0(supports-color@8.1.1)
-      babel-traverse: 6.26.0(supports-color@8.1.1)
+      babel-template: 6.26.0
+      babel-traverse: 6.26.0
       babel-types: 6.26.0
       babylon: 6.18.0
       convert-source-map: 1.9.0
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       json5: 0.5.1
       lodash: 4.18.1
       minimatch: 3.1.5
@@ -12046,10 +12012,10 @@ snapshots:
       source-map: 0.5.7
       trim-right: 1.0.1
 
-  babel-helpers@6.24.1(supports-color@8.1.1):
+  babel-helpers@6.24.1:
     dependencies:
       babel-runtime: 6.26.0
-      babel-template: 6.26.0(supports-color@8.1.1)
+      babel-template: 6.26.0
     transitivePeerDependencies:
       - supports-color
 
@@ -12061,23 +12027,23 @@ snapshots:
 
   babel-import-util@3.0.1: {}
 
-  babel-loader@8.4.1(@babel/core@7.29.0(supports-color@8.1.1))(webpack@4.47.0(supports-color@8.1.1)):
+  babel-loader@8.4.1(@babel/core@7.29.0)(webpack@4.47.0):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       find-cache-dir: 3.3.2
       loader-utils: 2.0.4
       make-dir: 3.1.0
       schema-utils: 2.7.1
-      webpack: 4.47.0(supports-color@8.1.1)
+      webpack: 4.47.0
 
-  babel-loader@8.4.1(@babel/core@7.29.0(supports-color@8.1.1))(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  babel-loader@8.4.1(@babel/core@7.29.0)(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       find-cache-dir: 3.3.2
       loader-utils: 2.0.4
       make-dir: 3.1.0
       schema-utils: 2.7.1
-      webpack: 5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)
+      webpack: 5.106.2(postcss@8.5.14)
 
   babel-messages@6.23.0:
     dependencies:
@@ -12085,14 +12051,14 @@ snapshots:
 
   babel-plugin-compact-reexports@1.1.0: {}
 
-  babel-plugin-debug-macros@0.2.0(@babel/core@7.29.0(supports-color@8.1.1)):
+  babel-plugin-debug-macros@0.2.0(@babel/core@7.29.0):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       semver: 5.7.2
 
-  babel-plugin-debug-macros@0.3.4(@babel/core@7.29.0(supports-color@8.1.1)):
+  babel-plugin-debug-macros@0.3.4(@babel/core@7.29.0):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       semver: 5.7.2
 
   babel-plugin-ember-data-packages-polyfill@0.1.2:
@@ -12139,35 +12105,35 @@ snapshots:
       reselect: 4.1.8
       resolve: 1.22.12
 
-  babel-plugin-polyfill-corejs2@0.4.17(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  babel-plugin-polyfill-corejs2@0.4.17(@babel/core@7.29.0):
     dependencies:
       '@babel/compat-data': 7.29.3
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-define-polyfill-provider': 0.6.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-define-polyfill-provider': 0.6.8(@babel/core@7.29.0)
       semver: 6.3.1
     transitivePeerDependencies:
       - supports-color
 
-  babel-plugin-polyfill-corejs3@0.13.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  babel-plugin-polyfill-corejs3@0.13.0(@babel/core@7.29.0):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-define-polyfill-provider': 0.6.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-define-polyfill-provider': 0.6.8(@babel/core@7.29.0)
       core-js-compat: 3.49.0
     transitivePeerDependencies:
       - supports-color
 
-  babel-plugin-polyfill-corejs3@0.14.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  babel-plugin-polyfill-corejs3@0.14.2(@babel/core@7.29.0):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-define-polyfill-provider': 0.6.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-define-polyfill-provider': 0.6.8(@babel/core@7.29.0)
       core-js-compat: 3.49.0
     transitivePeerDependencies:
       - supports-color
 
-  babel-plugin-polyfill-regenerator@0.6.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  babel-plugin-polyfill-regenerator@0.6.8(@babel/core@7.29.0):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/helper-define-polyfill-provider': 0.6.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/helper-define-polyfill-provider': 0.6.8(@babel/core@7.29.0)
     transitivePeerDependencies:
       - supports-color
 
@@ -12175,37 +12141,39 @@ snapshots:
 
   babel-register@6.26.0:
     dependencies:
-      babel-core: 6.26.3(supports-color@8.1.1)
+      babel-core: 6.26.3
       babel-runtime: 6.26.0
       core-js: 2.6.12
       home-or-tmp: 2.0.0
       lodash: 4.18.1
       mkdirp: 0.5.6
       source-map-support: 0.4.18
+    transitivePeerDependencies:
+      - supports-color
 
   babel-runtime@6.26.0:
     dependencies:
       core-js: 2.6.12
       regenerator-runtime: 0.11.1
 
-  babel-template@6.26.0(supports-color@8.1.1):
+  babel-template@6.26.0:
     dependencies:
       babel-runtime: 6.26.0
-      babel-traverse: 6.26.0(supports-color@8.1.1)
+      babel-traverse: 6.26.0
       babel-types: 6.26.0
       babylon: 6.18.0
       lodash: 4.18.1
     transitivePeerDependencies:
       - supports-color
 
-  babel-traverse@6.26.0(supports-color@8.1.1):
+  babel-traverse@6.26.0:
     dependencies:
       babel-code-frame: 6.26.0
       babel-messages: 6.23.0
       babel-runtime: 6.26.0
       babel-types: 6.26.0
       babylon: 6.18.0
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       globals: 9.18.0
       invariant: 2.2.4
       lodash: 4.18.1
@@ -12294,11 +12262,11 @@ snapshots:
 
   bn.js@5.2.3: {}
 
-  body-parser@1.20.5(supports-color@8.1.1):
+  body-parser@1.20.5:
     dependencies:
       bytes: 3.1.2
       content-type: 1.0.5
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       depd: 2.0.0
       destroy: 1.2.0
       http-errors: 2.0.1
@@ -12311,11 +12279,11 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  body-parser@2.2.2(supports-color@8.1.1):
+  body-parser@2.2.2:
     dependencies:
       bytes: 3.1.2
       content-type: 1.0.5
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       http-errors: 2.0.1
       iconv-lite: 0.7.2
       on-finished: 2.4.1
@@ -12345,7 +12313,7 @@ snapshots:
     dependencies:
       balanced-match: 4.0.4
 
-  braces@2.3.2(supports-color@8.1.1):
+  braces@2.3.2:
     dependencies:
       arr-flatten: 1.1.0
       array-unique: 0.3.2
@@ -12353,7 +12321,7 @@ snapshots:
       fill-range: 4.0.0
       isobject: 3.0.1
       repeat-element: 1.1.4
-      snapdragon: 0.8.2(supports-color@8.1.1)
+      snapdragon: 0.8.2
       snapdragon-node: 2.1.1
       split-string: 3.1.0
       to-regex: 3.0.2
@@ -12364,55 +12332,55 @@ snapshots:
     dependencies:
       fill-range: 7.1.1
 
-  broccoli-asset-rev@3.0.0(supports-color@8.1.1):
+  broccoli-asset-rev@3.0.0:
     dependencies:
-      broccoli-asset-rewrite: 2.0.0(supports-color@8.1.1)
-      broccoli-filter: 1.3.0(supports-color@8.1.1)
-      broccoli-persistent-filter: 1.4.6(supports-color@8.1.1)
+      broccoli-asset-rewrite: 2.0.0
+      broccoli-filter: 1.3.0
+      broccoli-persistent-filter: 1.4.6
       json-stable-stringify: 1.3.0
       minimatch: 3.1.5
       rsvp: 3.6.2
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-asset-rewrite@2.0.0(supports-color@8.1.1):
+  broccoli-asset-rewrite@2.0.0:
     dependencies:
-      broccoli-filter: 1.3.0(supports-color@8.1.1)
+      broccoli-filter: 1.3.0
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-babel-transpiler@7.8.1(supports-color@8.1.1):
+  broccoli-babel-transpiler@7.8.1:
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/polyfill': 7.12.1
-      broccoli-funnel: 2.0.2(supports-color@8.1.1)
-      broccoli-merge-trees: 3.0.2(supports-color@8.1.1)
-      broccoli-persistent-filter: 2.3.1(supports-color@8.1.1)
+      broccoli-funnel: 2.0.2
+      broccoli-merge-trees: 3.0.2
+      broccoli-persistent-filter: 2.3.1
       clone: 2.1.2
-      hash-for-dep: 1.5.2(supports-color@8.1.1)
+      hash-for-dep: 1.5.2
       heimdalljs: 0.2.6
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       json-stable-stringify: 1.3.0
       rsvp: 4.8.5
-      workerpool: 3.1.2(supports-color@8.1.1)
+      workerpool: 3.1.2
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-babel-transpiler@8.0.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  broccoli-babel-transpiler@8.0.2(@babel/core@7.29.0):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      broccoli-persistent-filter: 3.1.3(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      broccoli-persistent-filter: 3.1.3
       clone: 2.1.2
-      hash-for-dep: 1.5.2(supports-color@8.1.1)
+      hash-for-dep: 1.5.2
       heimdalljs: 0.2.6
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       json-stable-stringify: 1.3.0
       rsvp: 4.8.5
       workerpool: 6.5.1
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-builder@0.18.14(supports-color@8.1.1):
+  broccoli-builder@0.18.14:
     dependencies:
       broccoli-node-info: 1.1.0
       heimdalljs: 0.2.6
@@ -12420,84 +12388,84 @@ snapshots:
       quick-temp: 0.1.9
       rimraf: 2.7.1
       rsvp: 3.6.2
-      silent-error: 1.1.1(supports-color@8.1.1)
+      silent-error: 1.1.1
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-caching-writer@2.3.1(supports-color@8.1.1):
+  broccoli-caching-writer@2.3.1:
     dependencies:
       broccoli-kitchen-sink-helpers: 0.2.9
       broccoli-plugin: 1.1.0
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       rimraf: 2.7.1
       rsvp: 3.6.2
       walk-sync: 0.2.7
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-caching-writer@3.1.0(supports-color@8.1.1):
+  broccoli-caching-writer@3.1.0:
     dependencies:
       broccoli-plugin: 1.3.1
-      debug: 3.2.7(supports-color@8.1.1)
+      debug: 3.2.7
       rimraf: 2.7.1
       rsvp: 3.6.2
       walk-sync: 0.3.4
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-clean-css@1.1.0(supports-color@8.1.1):
+  broccoli-clean-css@1.1.0:
     dependencies:
-      broccoli-persistent-filter: 1.4.6(supports-color@8.1.1)
+      broccoli-persistent-filter: 1.4.6
       clean-css-promise: 0.1.1
       inline-source-map-comment: 1.0.5
       json-stable-stringify: 1.3.0
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-concat@4.2.7(supports-color@8.1.1):
+  broccoli-concat@4.2.7:
     dependencies:
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
-      broccoli-plugin: 4.0.7(supports-color@8.1.1)
+      broccoli-debug: 0.6.5
+      broccoli-plugin: 4.0.7
       ensure-posix-path: 1.1.1
-      fast-sourcemap-concat: 2.1.1(supports-color@8.1.1)
+      fast-sourcemap-concat: 2.1.1
       find-index: 1.1.1
       fs-extra: 8.1.0
-      fs-tree-diff: 2.0.1(supports-color@8.1.1)
+      fs-tree-diff: 2.0.1
       lodash: 4.18.1
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-config-loader@1.0.1(supports-color@8.1.1):
+  broccoli-config-loader@1.0.1:
     dependencies:
-      broccoli-caching-writer: 3.1.0(supports-color@8.1.1)
+      broccoli-caching-writer: 3.1.0
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-config-replace@1.1.3(supports-color@8.1.1):
+  broccoli-config-replace@1.1.3:
     dependencies:
       broccoli-plugin: 1.3.1
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       fs-extra: 0.24.0
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-debug@0.6.5(supports-color@8.1.1):
+  broccoli-debug@0.6.5:
     dependencies:
       broccoli-plugin: 1.3.1
-      fs-tree-diff: 0.5.9(supports-color@8.1.1)
+      fs-tree-diff: 0.5.9
       heimdalljs: 0.2.6
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       symlink-or-copy: 1.3.1
-      tree-sync: 1.4.0(supports-color@8.1.1)
+      tree-sync: 1.4.0
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-dependency-funnel@2.1.2(supports-color@8.1.1):
+  broccoli-dependency-funnel@2.1.2:
     dependencies:
       broccoli-plugin: 1.3.1
-      fs-tree-diff: 0.5.9(supports-color@8.1.1)
+      fs-tree-diff: 0.5.9
       heimdalljs: 0.2.6
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       mkdirp: 0.5.6
       mr-dep-walk: 1.4.0
       path-posix: 1.0.0
@@ -12511,12 +12479,12 @@ snapshots:
       broccoli-plugin: 1.3.1
       mkdirp: 0.5.6
 
-  broccoli-filter@1.3.0(supports-color@8.1.1):
+  broccoli-filter@1.3.0:
     dependencies:
       broccoli-kitchen-sink-helpers: 0.3.1
       broccoli-plugin: 1.3.1
       copy-dereference: 1.0.0
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       mkdirp: 0.5.6
       promise-map-series: 0.2.3
       rsvp: 3.6.2
@@ -12527,14 +12495,14 @@ snapshots:
 
   broccoli-funnel-reducer@1.0.0: {}
 
-  broccoli-funnel@2.0.1(supports-color@8.1.1):
+  broccoli-funnel@2.0.1:
     dependencies:
       array-equal: 1.0.2
       blank-object: 1.0.2
       broccoli-plugin: 1.3.1
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       fast-ordered-set: 1.0.3
-      fs-tree-diff: 0.5.9(supports-color@8.1.1)
+      fs-tree-diff: 0.5.9
       heimdalljs: 0.2.6
       minimatch: 3.1.5
       mkdirp: 0.5.6
@@ -12545,14 +12513,14 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-funnel@2.0.2(supports-color@8.1.1):
+  broccoli-funnel@2.0.2:
     dependencies:
       array-equal: 1.0.2
       blank-object: 1.0.2
       broccoli-plugin: 1.3.1
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       fast-ordered-set: 1.0.3
-      fs-tree-diff: 0.5.9(supports-color@8.1.1)
+      fs-tree-diff: 0.5.9
       heimdalljs: 0.2.6
       minimatch: 3.1.5
       mkdirp: 0.5.6
@@ -12563,12 +12531,12 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-funnel@3.0.8(supports-color@8.1.1):
+  broccoli-funnel@3.0.8:
     dependencies:
       array-equal: 1.0.2
-      broccoli-plugin: 4.0.7(supports-color@8.1.1)
-      debug: 4.4.3(supports-color@8.1.1)
-      fs-tree-diff: 2.0.1(supports-color@8.1.1)
+      broccoli-plugin: 4.0.7
+      debug: 4.4.3
+      fs-tree-diff: 2.0.1
       heimdalljs: 0.2.6
       minimatch: 3.1.5
       walk-sync: 2.2.0
@@ -12585,33 +12553,33 @@ snapshots:
       glob: 5.0.15
       mkdirp: 0.5.6
 
-  broccoli-merge-files@0.8.0(supports-color@8.1.1):
+  broccoli-merge-files@0.8.0:
     dependencies:
       broccoli-plugin: 1.3.1
-      fast-glob: 2.2.7(supports-color@8.1.1)
+      fast-glob: 2.2.7
       lodash.defaults: 4.2.0
       p-event: 2.3.1
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-merge-trees@2.0.1(supports-color@8.1.1):
+  broccoli-merge-trees@2.0.1:
     dependencies:
       broccoli-plugin: 1.3.1
-      merge-trees: 1.0.1(supports-color@8.1.1)
+      merge-trees: 1.0.1
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-merge-trees@3.0.2(supports-color@8.1.1):
+  broccoli-merge-trees@3.0.2:
     dependencies:
       broccoli-plugin: 1.3.1
-      merge-trees: 2.0.0(supports-color@8.1.1)
+      merge-trees: 2.0.0
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-merge-trees@4.2.0(supports-color@8.1.1):
+  broccoli-merge-trees@4.2.0:
     dependencies:
-      broccoli-plugin: 4.0.7(supports-color@8.1.1)
-      merge-trees: 2.0.0(supports-color@8.1.1)
+      broccoli-plugin: 4.0.7
+      merge-trees: 2.0.0
     transitivePeerDependencies:
       - supports-color
 
@@ -12628,29 +12596,29 @@ snapshots:
 
   broccoli-node-info@2.2.0: {}
 
-  broccoli-output-wrapper@2.0.0(supports-color@8.1.1):
+  broccoli-output-wrapper@2.0.0:
     dependencies:
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-output-wrapper@3.2.5(supports-color@8.1.1):
+  broccoli-output-wrapper@3.2.5:
     dependencies:
       fs-extra: 8.1.0
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       symlink-or-copy: 1.3.1
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-persistent-filter@1.4.6(supports-color@8.1.1):
+  broccoli-persistent-filter@1.4.6:
     dependencies:
-      async-disk-cache: 1.3.5(supports-color@8.1.1)
-      async-promise-queue: 1.0.5(supports-color@8.1.1)
+      async-disk-cache: 1.3.5
+      async-promise-queue: 1.0.5
       broccoli-plugin: 1.3.1
-      fs-tree-diff: 0.5.9(supports-color@8.1.1)
-      hash-for-dep: 1.5.2(supports-color@8.1.1)
+      fs-tree-diff: 0.5.9
+      hash-for-dep: 1.5.2
       heimdalljs: 0.2.6
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       mkdirp: 0.5.6
       promise-map-series: 0.2.3
       rimraf: 2.7.1
@@ -12660,38 +12628,38 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-persistent-filter@2.3.1(supports-color@8.1.1):
+  broccoli-persistent-filter@2.3.1:
     dependencies:
-      async-disk-cache: 1.3.5(supports-color@8.1.1)
-      async-promise-queue: 1.0.5(supports-color@8.1.1)
+      async-disk-cache: 1.3.5
+      async-promise-queue: 1.0.5
       broccoli-plugin: 1.3.1
-      fs-tree-diff: 2.0.1(supports-color@8.1.1)
-      hash-for-dep: 1.5.2(supports-color@8.1.1)
+      fs-tree-diff: 2.0.1
+      hash-for-dep: 1.5.2
       heimdalljs: 0.2.6
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       mkdirp: 0.5.6
       promise-map-series: 0.2.3
       rimraf: 2.7.1
       rsvp: 4.8.5
       symlink-or-copy: 1.3.1
-      sync-disk-cache: 1.3.4(supports-color@8.1.1)
+      sync-disk-cache: 1.3.4
       walk-sync: 1.1.4
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-persistent-filter@3.1.3(supports-color@8.1.1):
+  broccoli-persistent-filter@3.1.3:
     dependencies:
-      async-disk-cache: 2.1.0(supports-color@8.1.1)
-      async-promise-queue: 1.0.5(supports-color@8.1.1)
-      broccoli-plugin: 4.0.7(supports-color@8.1.1)
-      fs-tree-diff: 2.0.1(supports-color@8.1.1)
-      hash-for-dep: 1.5.2(supports-color@8.1.1)
+      async-disk-cache: 2.1.0
+      async-promise-queue: 1.0.5
+      broccoli-plugin: 4.0.7
+      fs-tree-diff: 2.0.1
+      hash-for-dep: 1.5.2
       heimdalljs: 0.2.6
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       promise-map-series: 0.2.3
       rimraf: 3.0.2
       symlink-or-copy: 1.3.1
-      sync-disk-cache: 2.1.0(supports-color@8.1.1)
+      sync-disk-cache: 2.1.0
     transitivePeerDependencies:
       - supports-color
 
@@ -12716,11 +12684,11 @@ snapshots:
       rimraf: 2.7.1
       symlink-or-copy: 1.3.1
 
-  broccoli-plugin@3.1.0(supports-color@8.1.1):
+  broccoli-plugin@3.1.0:
     dependencies:
       broccoli-node-api: 1.7.0
-      broccoli-output-wrapper: 2.0.0(supports-color@8.1.1)
-      fs-merger: 3.2.1(supports-color@8.1.1)
+      broccoli-output-wrapper: 2.0.0
+      fs-merger: 3.2.1
       promise-map-series: 0.2.3
       quick-temp: 0.1.9
       rimraf: 2.7.1
@@ -12728,11 +12696,11 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-plugin@4.0.7(supports-color@8.1.1):
+  broccoli-plugin@4.0.7:
     dependencies:
       broccoli-node-api: 1.7.0
-      broccoli-output-wrapper: 3.2.5(supports-color@8.1.1)
-      fs-merger: 3.2.1(supports-color@8.1.1)
+      broccoli-output-wrapper: 3.2.5
+      fs-merger: 3.2.1
       promise-map-series: 0.3.0
       quick-temp: 0.1.9
       rimraf: 3.0.2
@@ -12740,9 +12708,9 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-postcss-single@5.0.2(supports-color@8.1.1):
+  broccoli-postcss-single@5.0.2:
     dependencies:
-      broccoli-caching-writer: 3.1.0(supports-color@8.1.1)
+      broccoli-caching-writer: 3.1.0
       include-path-searcher: 0.1.0
       minimist: 1.2.8
       mkdirp: 1.0.4
@@ -12751,24 +12719,24 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-postcss@6.1.0(supports-color@8.1.1):
+  broccoli-postcss@6.1.0:
     dependencies:
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
-      broccoli-persistent-filter: 3.1.3(supports-color@8.1.1)
+      broccoli-funnel: 3.0.8
+      broccoli-persistent-filter: 3.1.3
       minimist: 1.2.8
       object-assign: 4.1.1
       postcss: 8.5.14
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-rollup@2.1.1(supports-color@8.1.1):
+  broccoli-rollup@2.1.1:
     dependencies:
       '@types/node': 9.6.61
       amd-name-resolver: 1.3.1
       broccoli-plugin: 1.3.1
-      fs-tree-diff: 0.5.9(supports-color@8.1.1)
+      fs-tree-diff: 0.5.9
       heimdalljs: 0.2.6
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       magic-string: 0.24.1
       node-modules-path: 1.0.2
       rollup: 0.57.1
@@ -12777,11 +12745,11 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-rollup@5.0.0(supports-color@8.1.1):
+  broccoli-rollup@5.0.0:
     dependencies:
-      '@types/broccoli-plugin': 3.0.4(supports-color@8.1.1)
-      broccoli-plugin: 4.0.7(supports-color@8.1.1)
-      fs-tree-diff: 2.0.1(supports-color@8.1.1)
+      '@types/broccoli-plugin': 3.0.4
+      broccoli-plugin: 4.0.7
+      fs-tree-diff: 2.0.1
       heimdalljs: 0.2.6
       node-modules-path: 1.0.2
       rollup: 2.80.0
@@ -12801,9 +12769,9 @@ snapshots:
     dependencies:
       broccoli-node-api: 1.7.0
 
-  broccoli-sri-hash@2.1.2(supports-color@8.1.1):
+  broccoli-sri-hash@2.1.2:
     dependencies:
-      broccoli-caching-writer: 2.3.1(supports-color@8.1.1)
+      broccoli-caching-writer: 2.3.1
       mkdirp: 0.5.6
       rsvp: 3.6.2
       sri-toolbox: 0.2.0
@@ -12811,15 +12779,15 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-stew@1.6.0(supports-color@8.1.1):
+  broccoli-stew@1.6.0:
     dependencies:
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
-      broccoli-funnel: 2.0.2(supports-color@8.1.1)
-      broccoli-merge-trees: 2.0.1(supports-color@8.1.1)
-      broccoli-persistent-filter: 1.4.6(supports-color@8.1.1)
+      broccoli-debug: 0.6.5
+      broccoli-funnel: 2.0.2
+      broccoli-merge-trees: 2.0.1
+      broccoli-persistent-filter: 1.4.6
       broccoli-plugin: 1.3.1
       chalk: 2.4.2
-      debug: 3.2.7(supports-color@8.1.1)
+      debug: 3.2.7
       ensure-posix-path: 1.1.1
       fs-extra: 5.0.0
       minimatch: 3.1.5
@@ -12830,15 +12798,15 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-stew@3.0.0(supports-color@8.1.1):
+  broccoli-stew@3.0.0:
     dependencies:
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
-      broccoli-funnel: 2.0.2(supports-color@8.1.1)
-      broccoli-merge-trees: 3.0.2(supports-color@8.1.1)
-      broccoli-persistent-filter: 2.3.1(supports-color@8.1.1)
+      broccoli-debug: 0.6.5
+      broccoli-funnel: 2.0.2
+      broccoli-merge-trees: 3.0.2
+      broccoli-persistent-filter: 2.3.1
       broccoli-plugin: 2.1.0
       chalk: 2.4.2
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       ensure-posix-path: 1.1.1
       fs-extra: 8.1.0
       minimatch: 3.1.5
@@ -12849,29 +12817,29 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-string-replace@0.1.2(supports-color@8.1.1):
+  broccoli-string-replace@0.1.2:
     dependencies:
-      broccoli-persistent-filter: 1.4.6(supports-color@8.1.1)
+      broccoli-persistent-filter: 1.4.6
       minimatch: 3.1.5
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-templater@2.0.2(supports-color@8.1.1):
+  broccoli-templater@2.0.2:
     dependencies:
       broccoli-plugin: 1.3.1
-      fs-tree-diff: 0.5.9(supports-color@8.1.1)
+      fs-tree-diff: 0.5.9
       lodash.template: 4.18.1
       rimraf: 2.7.1
       walk-sync: 0.3.4
     transitivePeerDependencies:
       - supports-color
 
-  broccoli-terser-sourcemap@4.1.1(supports-color@8.1.1):
+  broccoli-terser-sourcemap@4.1.1:
     dependencies:
-      async-promise-queue: 1.0.5(supports-color@8.1.1)
-      broccoli-plugin: 4.0.7(supports-color@8.1.1)
+      async-promise-queue: 1.0.5
+      broccoli-plugin: 4.0.7
       convert-source-map: 2.0.0
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       lodash.defaultsdeep: 4.6.1
       matcher-collection: 2.0.1
       symlink-or-copy: 1.3.1
@@ -12881,7 +12849,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  broccoli@3.5.2(supports-color@8.1.1):
+  broccoli@3.5.2:
     dependencies:
       '@types/chai': 4.3.20
       '@types/chai-as-promised': 7.1.8
@@ -12891,22 +12859,22 @@ snapshots:
       broccoli-slow-trees: 3.1.0
       broccoli-source: 3.0.1
       commander: 4.1.1
-      connect: 3.7.0(supports-color@8.1.1)
+      connect: 3.7.0
       console-ui: 3.1.2
       esm: 3.2.25
       findup-sync: 4.0.0
       handlebars: 4.7.9
       heimdalljs: 0.2.6
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       https: 1.0.0
       mime-types: 2.1.35
       resolve-path: 1.4.0
       rimraf: 3.0.2
-      sane: 4.1.0(supports-color@8.1.1)
+      sane: 4.1.0
       tmp: 0.0.33
-      tree-sync: 2.1.0(supports-color@8.1.1)
+      tree-sync: 2.1.0
       underscore.string: 3.3.6
-      watch-detector: 1.0.2(supports-color@8.1.1)
+      watch-detector: 1.0.2
     transitivePeerDependencies:
       - supports-color
 
@@ -13141,18 +13109,18 @@ snapshots:
       chart.js: 4.5.1
       date-fns: 2.30.0
 
-  chokidar@2.1.8(supports-color@8.1.1):
+  chokidar@2.1.8:
     dependencies:
-      anymatch: 2.0.0(supports-color@8.1.1)
+      anymatch: 2.0.0
       async-each: 1.0.6
-      braces: 2.3.2(supports-color@8.1.1)
+      braces: 2.3.2
       glob-parent: 3.1.0
       inherits: 2.0.4
       is-binary-path: 1.0.1
       is-glob: 4.0.3
       normalize-path: 3.0.0
       path-is-absolute: 1.0.1
-      readdirp: 2.2.1(supports-color@8.1.1)
+      readdirp: 2.2.1
       upath: 1.2.0
     optionalDependencies:
       fsevents: 1.2.13
@@ -13321,11 +13289,11 @@ snapshots:
     dependencies:
       mime-db: 1.54.0
 
-  compression@1.8.1(supports-color@8.1.1):
+  compression@1.8.1:
     dependencies:
       bytes: 3.1.2
       compressible: 2.0.18
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       negotiator: 0.6.4
       on-headers: 1.1.0
       safe-buffer: 5.2.1
@@ -13363,10 +13331,10 @@ snapshots:
       write-file-atomic: 3.0.3
       xdg-basedir: 4.0.0
 
-  connect@3.7.0(supports-color@8.1.1):
+  connect@3.7.0:
     dependencies:
-      debug: 2.6.9(supports-color@8.1.1)
-      finalhandler: 1.1.2(supports-color@8.1.1)
+      debug: 2.6.9
+      finalhandler: 1.1.2
       parseurl: 1.3.3
       utils-merge: 1.0.1
     transitivePeerDependencies:
@@ -13382,9 +13350,9 @@ snapshots:
       ora: 3.4.0
       through2: 3.0.2
 
-  consolidate@1.0.4(@babel/core@7.29.0(supports-color@8.1.1))(handlebars@4.7.9)(lodash@4.18.1)(mustache@4.2.0)(underscore@1.13.8):
+  consolidate@1.0.4(@babel/core@7.29.0)(handlebars@4.7.9)(lodash@4.18.1)(mustache@4.2.0)(underscore@1.13.8):
     optionalDependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       handlebars: 4.7.9
       lodash: 4.18.1
       mustache: 4.2.0
@@ -13541,7 +13509,7 @@ snapshots:
       postcss-selector-parser: 6.1.2
       postcss-value-parser: 4.2.0
 
-  css-loader@5.2.7(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  css-loader@5.2.7(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
       icss-utils: 5.1.0(postcss@8.5.14)
       loader-utils: 2.0.4
@@ -13553,7 +13521,7 @@ snapshots:
       postcss-value-parser: 4.2.0
       schema-utils: 3.3.0
       semver: 7.8.0
-      webpack: 5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)
+      webpack: 5.106.2(postcss@8.5.14)
 
   css-prefers-color-scheme@9.0.1(postcss@8.5.14):
     dependencies:
@@ -13604,23 +13572,17 @@ snapshots:
     dependencies:
       time-zone: 1.0.0
 
-  debug@2.6.9(supports-color@8.1.1):
+  debug@2.6.9:
     dependencies:
       ms: 2.0.0
-    optionalDependencies:
-      supports-color: 8.1.1
 
-  debug@3.2.7(supports-color@8.1.1):
+  debug@3.2.7:
     dependencies:
       ms: 2.1.3
-    optionalDependencies:
-      supports-color: 8.1.1
 
-  debug@4.4.3(supports-color@8.1.1):
+  debug@4.4.3:
     dependencies:
       ms: 2.1.3
-    optionalDependencies:
-      supports-color: 8.1.1
 
   decamelize-keys@1.1.1:
     dependencies:
@@ -13639,16 +13601,16 @@ snapshots:
     dependencies:
       mimic-response: 1.0.1
 
-  decorator-transforms@1.2.1(@babel/core@7.29.0(supports-color@8.1.1)):
+  decorator-transforms@1.2.1(@babel/core@7.29.0):
     dependencies:
-      '@babel/plugin-syntax-decorators': 7.29.7(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/plugin-syntax-decorators': 7.29.7(@babel/core@7.29.0)
       babel-import-util: 2.1.1
     transitivePeerDependencies:
       - '@babel/core'
 
-  decorator-transforms@2.4.0(@babel/core@7.29.0(supports-color@8.1.1)):
+  decorator-transforms@2.4.0(@babel/core@7.29.0):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       babel-import-util: 3.0.1
 
   deep-extend@0.6.0: {}
@@ -13789,15 +13751,15 @@ snapshots:
       minimalistic-assert: 1.0.1
       minimalistic-crypto-utils: 1.0.1
 
-  ember-animated@1.1.4(@babel/core@7.29.0(supports-color@8.1.1))(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-animated@1.1.4(@babel/core@7.29.0)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@embroider/util': 1.13.5(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+      '@embroider/addon-shim': 1.10.3
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      '@embroider/util': 1.13.5(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
       assert-never: 1.4.0
-      ember-element-helper: 0.8.8(supports-color@8.1.1)
+      ember-element-helper: 0.8.8
     optionalDependencies:
-      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/environment-ember-loose'
@@ -13805,52 +13767,52 @@ snapshots:
       - ember-source
       - supports-color
 
-  ember-asset-loader@1.0.0(supports-color@8.1.1):
+  ember-asset-loader@1.0.0:
     dependencies:
-      broccoli-caching-writer: 3.1.0(supports-color@8.1.1)
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      broccoli-caching-writer: 3.1.0
+      broccoli-funnel: 3.0.8
+      broccoli-merge-trees: 4.2.0
+      ember-cli-babel: 7.26.11
       fs-extra: 10.1.0
       walk-sync: 3.0.0
     transitivePeerDependencies:
       - supports-color
 
-  ember-assign-helper@0.4.0(supports-color@8.1.1):
+  ember-assign-helper@0.4.0:
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 6.3.0
     transitivePeerDependencies:
       - supports-color
 
-  ember-assign-helper@0.5.1(supports-color@8.1.1):
+  ember-assign-helper@0.5.1:
     dependencies:
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
+      '@embroider/addon-shim': 1.10.3
     transitivePeerDependencies:
       - supports-color
 
   ember-ast-helpers@0.4.0: {}
 
-  ember-auto-import@1.12.2(supports-color@8.1.1):
+  ember-auto-import@1.12.2:
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/preset-env': 7.29.5(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/traverse': 7.29.7(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/preset-env': 7.29.5(@babel/core@7.29.0)
+      '@babel/traverse': 7.29.7
       '@babel/types': 7.29.7
       '@embroider/shared-internals': 1.8.3
-      babel-core: 6.26.3(supports-color@8.1.1)
-      babel-loader: 8.4.1(@babel/core@7.29.0(supports-color@8.1.1))(webpack@4.47.0(supports-color@8.1.1))
+      babel-core: 6.26.3
+      babel-loader: 8.4.1(@babel/core@7.29.0)(webpack@4.47.0)
       babel-plugin-syntax-dynamic-import: 6.18.0
       babylon: 6.18.0
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
+      broccoli-debug: 0.6.5
       broccoli-node-api: 1.7.0
-      broccoli-plugin: 4.0.7(supports-color@8.1.1)
+      broccoli-plugin: 4.0.7
       broccoli-source: 3.0.1
-      debug: 3.2.7(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      debug: 3.2.7
+      ember-cli-babel: 7.26.11
       enhanced-resolve: 4.5.0
       fs-extra: 6.0.1
-      fs-tree-diff: 2.0.1(supports-color@8.1.1)
+      fs-tree-diff: 2.0.1
       handlebars: 4.7.9
       js-string-escape: 1.0.1
       lodash: 4.18.1
@@ -13861,49 +13823,49 @@ snapshots:
       symlink-or-copy: 1.3.1
       typescript-memoize: 1.1.1
       walk-sync: 0.3.4
-      webpack: 4.47.0(supports-color@8.1.1)
+      webpack: 4.47.0
     transitivePeerDependencies:
       - supports-color
       - webpack-cli
       - webpack-command
 
-  ember-auto-import@2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  ember-auto-import@2.13.1(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/plugin-proposal-class-properties': 7.18.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-proposal-decorators': 7.29.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-proposal-private-methods': 7.18.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-class-static-block': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/preset-env': 7.29.5(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/plugin-proposal-class-properties': 7.18.6(@babel/core@7.29.0)
+      '@babel/plugin-proposal-decorators': 7.29.0(@babel/core@7.29.0)
+      '@babel/plugin-proposal-private-methods': 7.18.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-class-static-block': 7.28.6(@babel/core@7.29.0)
+      '@babel/preset-env': 7.29.5(@babel/core@7.29.0)
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
       '@embroider/reverse-exports': 0.2.0
-      '@embroider/shared-internals': 2.9.2(supports-color@8.1.1)
-      babel-loader: 8.4.1(@babel/core@7.29.0(supports-color@8.1.1))(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@embroider/shared-internals': 2.9.2
+      babel-loader: 8.4.1(@babel/core@7.29.0)(webpack@5.106.2(postcss@8.5.14))
       babel-plugin-ember-modules-api-polyfill: 3.5.0
       babel-plugin-ember-template-compilation: 2.4.1
       babel-plugin-htmlbars-inline-precompile: 5.3.1
       babel-plugin-syntax-dynamic-import: 6.18.0
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
-      broccoli-plugin: 4.0.7(supports-color@8.1.1)
+      broccoli-debug: 0.6.5
+      broccoli-funnel: 3.0.8
+      broccoli-merge-trees: 4.2.0
+      broccoli-plugin: 4.0.7
       broccoli-source: 3.0.1
-      css-loader: 5.2.7(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      debug: 4.4.3(supports-color@8.1.1)
+      css-loader: 5.2.7(webpack@5.106.2(postcss@8.5.14))
+      debug: 4.4.3
       fs-extra: 10.1.0
-      fs-tree-diff: 2.0.1(supports-color@8.1.1)
+      fs-tree-diff: 2.0.1
       handlebars: 4.7.9
       is-subdir: 1.2.0
       js-string-escape: 1.0.1
       lodash: 4.18.1
-      mini-css-extract-plugin: 2.10.2(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      mini-css-extract-plugin: 2.10.2(webpack@5.106.2(postcss@8.5.14))
       minimatch: 3.1.5
       parse5: 6.0.1
       pkg-entry-points: 1.1.1
       resolve: 1.22.12
       resolve-package-path: 4.0.3
       semver: 7.8.0
-      style-loader: 2.0.0(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      style-loader: 2.0.0(webpack@5.106.2(postcss@8.5.14))
       typescript-memoize: 1.1.1
       walk-sync: 3.0.0
     transitivePeerDependencies:
@@ -13911,92 +13873,92 @@ snapshots:
       - supports-color
       - webpack
 
-  ember-basic-dropdown@8.4.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-basic-dropdown@8.4.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(@glimmer/component@1.1.2(@babel/core@7.29.0))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@embroider/util': 1.13.5(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      '@glimmer/component': 1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))
+      '@embroider/addon-shim': 1.10.3
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      '@embroider/util': 1.13.5(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      '@glimmer/component': 1.1.2(@babel/core@7.29.0)
       '@glimmer/tracking': 1.1.2
-      decorator-transforms: 2.4.0(@babel/core@7.29.0(supports-color@8.1.1))
-      ember-element-helper: 0.8.8(supports-color@8.1.1)
-      ember-lifeline: 7.0.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-modifier: 4.3.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-style-modifier: 4.6.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-truth-helpers: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+      decorator-transforms: 2.4.0(@babel/core@7.29.0)
+      ember-element-helper: 0.8.8
+      ember-lifeline: 7.0.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))
+      ember-modifier: 4.3.0(@babel/core@7.29.0)
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
+      ember-style-modifier: 4.6.0(@babel/core@7.29.0)
+      ember-truth-helpers: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
     transitivePeerDependencies:
       - '@glint/environment-ember-loose'
       - '@glint/template'
       - supports-color
 
-  ember-cache-primitive-polyfill@1.0.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-cache-primitive-polyfill@1.0.1(@babel/core@7.29.0):
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
-      ember-compatibility-helpers: 1.2.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      silent-error: 1.1.1(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-version-checker: 5.1.2
+      ember-compatibility-helpers: 1.2.7(@babel/core@7.29.0)
+      silent-error: 1.1.1
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-cached-decorator-polyfill@1.0.2(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-cached-decorator-polyfill@1.0.2(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
       '@glimmer/tracking': 1.1.2
       babel-import-util: 1.4.1
-      ember-cache-primitive-polyfill: 1.0.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cache-primitive-polyfill: 1.0.1(@babel/core@7.29.0)
+      ember-cli-babel: 7.26.11
       ember-cli-babel-plugin-helpers: 1.1.1
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
 
-  ember-can@6.0.0(@babel/core@7.29.0(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-can@6.0.0(@babel/core@7.29.0)(@ember/string@3.1.1)(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      '@ember/string': 3.1.1(supports-color@8.1.1)
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
-      decorator-transforms: 2.4.0(@babel/core@7.29.0(supports-color@8.1.1))
-      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-resolver: 11.0.1(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@ember/string': 3.1.1
+      '@embroider/addon-shim': 1.10.3
+      decorator-transforms: 2.4.0(@babel/core@7.29.0)
+      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-resolver: 11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
   ember-cli-babel-plugin-helpers@1.1.1: {}
 
-  ember-cli-babel@7.26.11(supports-color@8.1.1):
+  ember-cli-babel@7.26.11:
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-compilation-targets': 7.28.6
-      '@babel/plugin-proposal-class-properties': 7.18.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-proposal-decorators': 7.29.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-proposal-private-methods': 7.18.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-proposal-private-property-in-object': 7.21.11(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-modules-amd': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-runtime': 7.29.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-typescript': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/plugin-proposal-class-properties': 7.18.6(@babel/core@7.29.0)
+      '@babel/plugin-proposal-decorators': 7.29.0(@babel/core@7.29.0)
+      '@babel/plugin-proposal-private-methods': 7.18.6(@babel/core@7.29.0)
+      '@babel/plugin-proposal-private-property-in-object': 7.21.11(@babel/core@7.29.0)
+      '@babel/plugin-transform-modules-amd': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-runtime': 7.29.0(@babel/core@7.29.0)
+      '@babel/plugin-transform-typescript': 7.28.6(@babel/core@7.29.0)
       '@babel/polyfill': 7.12.1
-      '@babel/preset-env': 7.29.5(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/preset-env': 7.29.5(@babel/core@7.29.0)
       '@babel/runtime': 7.12.18
       amd-name-resolver: 1.3.1
-      babel-plugin-debug-macros: 0.3.4(@babel/core@7.29.0(supports-color@8.1.1))
+      babel-plugin-debug-macros: 0.3.4(@babel/core@7.29.0)
       babel-plugin-ember-data-packages-polyfill: 0.1.2
       babel-plugin-ember-modules-api-polyfill: 3.5.0
       babel-plugin-module-resolver: 3.2.0
-      broccoli-babel-transpiler: 7.8.1(supports-color@8.1.1)
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
-      broccoli-funnel: 2.0.2(supports-color@8.1.1)
+      broccoli-babel-transpiler: 7.8.1
+      broccoli-debug: 0.6.5
+      broccoli-funnel: 2.0.2
       broccoli-source: 2.1.2
       calculate-cache-key-for-tree: 2.0.0
       clone: 2.1.2
       ember-cli-babel-plugin-helpers: 1.1.1
-      ember-cli-version-checker: 4.1.1(supports-color@8.1.1)
+      ember-cli-version-checker: 4.1.1
       ensure-posix-path: 1.1.1
       fixturify-project: 1.10.0
       resolve-package-path: 3.1.0
@@ -14005,80 +13967,80 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-babel@8.3.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-cli-babel@8.3.1(@babel/core@7.29.0):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       '@babel/helper-compilation-targets': 7.28.6
-      '@babel/plugin-proposal-decorators': 7.29.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-class-properties': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-class-static-block': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-modules-amd': 7.27.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-private-methods': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-private-property-in-object': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-runtime': 7.29.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-typescript': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/preset-env': 7.29.5(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/plugin-proposal-decorators': 7.29.0(@babel/core@7.29.0)
+      '@babel/plugin-transform-class-properties': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-class-static-block': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-modules-amd': 7.27.1(@babel/core@7.29.0)
+      '@babel/plugin-transform-private-methods': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-private-property-in-object': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-runtime': 7.29.0(@babel/core@7.29.0)
+      '@babel/plugin-transform-typescript': 7.28.6(@babel/core@7.29.0)
+      '@babel/preset-env': 7.29.5(@babel/core@7.29.0)
       '@babel/runtime': 7.12.18
       amd-name-resolver: 1.3.1
-      babel-plugin-debug-macros: 0.3.4(@babel/core@7.29.0(supports-color@8.1.1))
+      babel-plugin-debug-macros: 0.3.4(@babel/core@7.29.0)
       babel-plugin-ember-data-packages-polyfill: 0.1.2
       babel-plugin-ember-modules-api-polyfill: 3.5.0
       babel-plugin-module-resolver: 5.0.3
-      broccoli-babel-transpiler: 8.0.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
+      broccoli-babel-transpiler: 8.0.2(@babel/core@7.29.0)
+      broccoli-debug: 0.6.5
+      broccoli-funnel: 3.0.8
       broccoli-source: 3.0.1
       calculate-cache-key-for-tree: 2.0.0
       clone: 2.1.2
       ember-cli-babel-plugin-helpers: 1.1.1
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
+      ember-cli-version-checker: 5.1.2
       ensure-posix-path: 1.1.1
       resolve-package-path: 4.0.3
       semver: 7.8.0
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-clean-css@3.0.0(supports-color@8.1.1):
+  ember-cli-clean-css@3.0.0:
     dependencies:
-      broccoli-persistent-filter: 3.1.3(supports-color@8.1.1)
+      broccoli-persistent-filter: 3.1.3
       clean-css: 5.3.3
       json-stable-stringify: 1.3.0
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-dependency-checker@3.3.3(ember-cli@5.4.2(@babel/core@7.29.0(supports-color@8.1.1))(@types/node@25.9.0)(debug@4.4.3(supports-color@8.1.1))(handlebars@4.7.9)(supports-color@8.1.1)(underscore@1.13.8)):
+  ember-cli-dependency-checker@3.3.3(ember-cli@5.4.2(@babel/core@7.29.0)(@types/node@25.9.0)(handlebars@4.7.9)(underscore@1.13.8)):
     dependencies:
       chalk: 2.4.2
-      ember-cli: 5.4.2(@babel/core@7.29.0(supports-color@8.1.1))(@types/node@25.9.0)(debug@4.4.3(supports-color@8.1.1))(handlebars@4.7.9)(supports-color@8.1.1)(underscore@1.13.8)
+      ember-cli: 5.4.2(@babel/core@7.29.0)(@types/node@25.9.0)(handlebars@4.7.9)(underscore@1.13.8)
       find-yarn-workspace-root: 2.0.0
       is-git-url: 1.0.0
       resolve: 1.22.12
       semver: 5.7.2
 
-  ember-cli-element-closest-polyfill@0.0.2(supports-color@8.1.1):
+  ember-cli-element-closest-polyfill@0.0.2:
     dependencies:
-      broccoli-funnel: 2.0.2(supports-color@8.1.1)
+      broccoli-funnel: 2.0.2
       caniuse-api: 3.0.0
       element-closest: 3.0.2
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      fastboot-transform: 0.1.3(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      fastboot-transform: 0.1.3
     transitivePeerDependencies:
       - supports-color
 
   ember-cli-get-component-path-option@1.0.0: {}
 
-  ember-cli-htmlbars@4.5.0(supports-color@8.1.1):
+  ember-cli-htmlbars@4.5.0:
     dependencies:
       '@ember/edition-utils': 1.2.0
       babel-plugin-htmlbars-inline-precompile: 3.2.0
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
-      broccoli-persistent-filter: 2.3.1(supports-color@8.1.1)
-      broccoli-plugin: 3.1.0(supports-color@8.1.1)
+      broccoli-debug: 0.6.5
+      broccoli-persistent-filter: 2.3.1
+      broccoli-plugin: 3.1.0
       common-tags: 1.8.2
       ember-cli-babel-plugin-helpers: 1.1.1
-      fs-tree-diff: 2.0.1(supports-color@8.1.1)
-      hash-for-dep: 1.5.2(supports-color@8.1.1)
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      fs-tree-diff: 2.0.1
+      hash-for-dep: 1.5.2
+      heimdalljs-logger: 0.1.10
       json-stable-stringify: 1.3.0
       semver: 6.3.1
       strip-bom: 4.0.0
@@ -14086,42 +14048,42 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-htmlbars@5.7.2(supports-color@8.1.1):
+  ember-cli-htmlbars@5.7.2:
     dependencies:
       '@ember/edition-utils': 1.2.0
       babel-plugin-htmlbars-inline-precompile: 5.3.1
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
-      broccoli-persistent-filter: 3.1.3(supports-color@8.1.1)
-      broccoli-plugin: 4.0.7(supports-color@8.1.1)
+      broccoli-debug: 0.6.5
+      broccoli-persistent-filter: 3.1.3
+      broccoli-plugin: 4.0.7
       common-tags: 1.8.2
       ember-cli-babel-plugin-helpers: 1.1.1
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
-      fs-tree-diff: 2.0.1(supports-color@8.1.1)
-      hash-for-dep: 1.5.2(supports-color@8.1.1)
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      ember-cli-version-checker: 5.1.2
+      fs-tree-diff: 2.0.1
+      hash-for-dep: 1.5.2
+      heimdalljs-logger: 0.1.10
       json-stable-stringify: 1.3.0
       semver: 7.8.0
-      silent-error: 1.1.1(supports-color@8.1.1)
+      silent-error: 1.1.1
       strip-bom: 4.0.0
       walk-sync: 2.2.0
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-htmlbars@6.3.0(supports-color@8.1.1):
+  ember-cli-htmlbars@6.3.0:
     dependencies:
       '@ember/edition-utils': 1.2.0
       babel-plugin-ember-template-compilation: 2.4.1
       babel-plugin-htmlbars-inline-precompile: 5.3.1
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
-      broccoli-persistent-filter: 3.1.3(supports-color@8.1.1)
-      broccoli-plugin: 4.0.7(supports-color@8.1.1)
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
-      fs-tree-diff: 2.0.1(supports-color@8.1.1)
-      hash-for-dep: 1.5.2(supports-color@8.1.1)
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      broccoli-debug: 0.6.5
+      broccoli-persistent-filter: 3.1.3
+      broccoli-plugin: 4.0.7
+      ember-cli-version-checker: 5.1.2
+      fs-tree-diff: 2.0.1
+      hash-for-dep: 1.5.2
+      heimdalljs-logger: 0.1.10
       js-string-escape: 1.0.1
       semver: 7.8.0
-      silent-error: 1.1.1(supports-color@8.1.1)
+      silent-error: 1.1.1
       walk-sync: 2.2.0
     transitivePeerDependencies:
       - supports-color
@@ -14135,69 +14097,69 @@ snapshots:
 
   ember-cli-lodash-subset@2.0.1: {}
 
-  ember-cli-normalize-entity-name@1.0.0(supports-color@8.1.1):
+  ember-cli-normalize-entity-name@1.0.0:
     dependencies:
-      silent-error: 1.1.1(supports-color@8.1.1)
+      silent-error: 1.1.1
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-notifications@9.1.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-cli-notifications@9.1.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
-      decorator-transforms: 2.4.0(@babel/core@7.29.0(supports-color@8.1.1))
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@embroider/addon-shim': 1.10.3
+      decorator-transforms: 2.4.0(@babel/core@7.29.0)
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
   ember-cli-path-utils@1.0.0: {}
 
-  ember-cli-postcss@8.2.0(supports-color@8.1.1):
+  ember-cli-postcss@8.2.0:
     dependencies:
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
-      broccoli-postcss: 6.1.0(supports-color@8.1.1)
-      broccoli-postcss-single: 5.0.2(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      broccoli-merge-trees: 4.2.0
+      broccoli-postcss: 6.1.0
+      broccoli-postcss-single: 5.0.2
+      ember-cli-babel: 7.26.11
       merge: 2.1.1
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-preprocess-registry@3.3.0(supports-color@8.1.1):
+  ember-cli-preprocess-registry@3.3.0:
     dependencies:
-      broccoli-clean-css: 1.1.0(supports-color@8.1.1)
-      broccoli-funnel: 2.0.2(supports-color@8.1.1)
-      debug: 3.2.7(supports-color@8.1.1)
+      broccoli-clean-css: 1.1.0
+      broccoli-funnel: 2.0.2
+      debug: 3.2.7
       process-relative-require: 1.0.0
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-preprocess-registry@5.0.1(supports-color@8.1.1):
+  ember-cli-preprocess-registry@5.0.1:
     dependencies:
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
-      debug: 4.4.3(supports-color@8.1.1)
+      broccoli-funnel: 3.0.8
+      debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-sri@2.1.1(supports-color@8.1.1):
+  ember-cli-sri@2.1.1:
     dependencies:
-      broccoli-sri-hash: 2.1.2(supports-color@8.1.1)
+      broccoli-sri-hash: 2.1.2
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-string-helpers@6.1.0(supports-color@8.1.1):
+  ember-cli-string-helpers@6.1.0:
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      broccoli-funnel: 3.0.8
+      ember-cli-babel: 7.26.11
       resolve: 1.22.12
     transitivePeerDependencies:
       - supports-color
 
   ember-cli-string-utils@1.1.0: {}
 
-  ember-cli-terser@4.0.2(supports-color@8.1.1):
+  ember-cli-terser@4.0.2:
     dependencies:
-      broccoli-terser-sourcemap: 4.1.1(supports-color@8.1.1)
+      broccoli-terser-sourcemap: 4.1.1
     transitivePeerDependencies:
       - supports-color
 
@@ -14205,80 +14167,80 @@ snapshots:
     dependencies:
       ember-cli-string-utils: 1.1.0
 
-  ember-cli-test-loader@3.1.0(supports-color@8.1.1):
+  ember-cli-test-loader@3.1.0:
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-typescript-blueprint-polyfill@0.1.0(supports-color@8.1.1):
+  ember-cli-typescript-blueprint-polyfill@0.1.0:
     dependencies:
       chalk: 4.1.2
-      remove-types: 1.0.0(supports-color@8.1.1)
+      remove-types: 1.0.0
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-typescript@2.0.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-cli-typescript@2.0.2(@babel/core@7.29.0):
     dependencies:
-      '@babel/plugin-proposal-class-properties': 7.18.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@babel/plugin-transform-typescript': 7.4.5(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/plugin-proposal-class-properties': 7.18.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-typescript': 7.4.5(@babel/core@7.29.0)
       ansi-to-html: 0.6.15
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       ember-cli-babel-plugin-helpers: 1.1.1
       execa: 1.0.0
       fs-extra: 7.0.1
       resolve: 1.22.12
       rsvp: 4.8.5
       semver: 6.3.1
-      stagehand: 1.0.1(supports-color@8.1.1)
+      stagehand: 1.0.1
       walk-sync: 1.1.4
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-cli-typescript@3.0.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-cli-typescript@3.0.0(@babel/core@7.29.0):
     dependencies:
-      '@babel/plugin-transform-typescript': 7.5.5(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/plugin-transform-typescript': 7.5.5(@babel/core@7.29.0)
       ansi-to-html: 0.6.15
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       ember-cli-babel-plugin-helpers: 1.1.1
       execa: 2.1.0
       fs-extra: 8.1.0
       resolve: 1.22.12
       rsvp: 4.8.5
       semver: 6.3.1
-      stagehand: 1.0.1(supports-color@8.1.1)
+      stagehand: 1.0.1
       walk-sync: 2.2.0
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-cli-typescript@4.2.1(supports-color@8.1.1):
+  ember-cli-typescript@4.2.1:
     dependencies:
       ansi-to-html: 0.6.15
-      broccoli-stew: 3.0.0(supports-color@8.1.1)
-      debug: 4.4.3(supports-color@8.1.1)
+      broccoli-stew: 3.0.0
+      debug: 4.4.3
       execa: 4.1.0
       fs-extra: 9.1.0
       resolve: 1.22.12
       rsvp: 4.8.5
       semver: 7.8.0
-      stagehand: 1.0.1(supports-color@8.1.1)
+      stagehand: 1.0.1
       walk-sync: 2.2.0
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-typescript@5.3.0(supports-color@8.1.1):
+  ember-cli-typescript@5.3.0:
     dependencies:
       ansi-to-html: 0.6.15
-      broccoli-stew: 3.0.0(supports-color@8.1.1)
-      debug: 4.4.3(supports-color@8.1.1)
+      broccoli-stew: 3.0.0
+      debug: 4.4.3
       execa: 4.1.0
       fs-extra: 9.1.0
       resolve: 1.22.12
       rsvp: 4.8.5
       semver: 7.8.0
-      stagehand: 1.0.1(supports-color@8.1.1)
+      stagehand: 1.0.1
       walk-sync: 2.2.0
     transitivePeerDependencies:
       - supports-color
@@ -14293,44 +14255,44 @@ snapshots:
       resolve-package-path: 1.2.7
       semver: 5.7.2
 
-  ember-cli-version-checker@4.1.1(supports-color@8.1.1):
+  ember-cli-version-checker@4.1.1:
     dependencies:
       resolve-package-path: 2.0.0
       semver: 6.3.1
-      silent-error: 1.1.1(supports-color@8.1.1)
+      silent-error: 1.1.1
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli-version-checker@5.1.2(supports-color@8.1.1):
+  ember-cli-version-checker@5.1.2:
     dependencies:
       resolve-package-path: 3.1.0
       semver: 7.8.0
-      silent-error: 1.1.1(supports-color@8.1.1)
+      silent-error: 1.1.1
     transitivePeerDependencies:
       - supports-color
 
-  ember-cli@5.4.2(@babel/core@7.29.0(supports-color@8.1.1))(@types/node@25.9.0)(debug@4.4.3(supports-color@8.1.1))(handlebars@4.7.9)(supports-color@8.1.1)(underscore@1.13.8):
+  ember-cli@5.4.2(@babel/core@7.29.0)(@types/node@25.9.0)(handlebars@4.7.9)(underscore@1.13.8):
     dependencies:
       '@pnpm/find-workspace-dir': 6.0.3
-      broccoli: 3.5.2(supports-color@8.1.1)
-      broccoli-builder: 0.18.14(supports-color@8.1.1)
-      broccoli-concat: 4.2.7(supports-color@8.1.1)
-      broccoli-config-loader: 1.0.1(supports-color@8.1.1)
-      broccoli-config-replace: 1.1.3(supports-color@8.1.1)
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
+      broccoli: 3.5.2
+      broccoli-builder: 0.18.14
+      broccoli-concat: 4.2.7
+      broccoli-config-loader: 1.0.1
+      broccoli-config-replace: 1.1.3
+      broccoli-debug: 0.6.5
+      broccoli-funnel: 3.0.8
       broccoli-funnel-reducer: 1.0.0
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
+      broccoli-merge-trees: 4.2.0
       broccoli-middleware: 2.1.2
       broccoli-slow-trees: 3.1.0
       broccoli-source: 3.0.1
-      broccoli-stew: 3.0.0(supports-color@8.1.1)
+      broccoli-stew: 3.0.0
       calculate-cache-key-for-tree: 2.0.0
       capture-exit: 2.0.0
       chalk: 4.1.2
       ci-info: 3.9.0
       clean-base-url: 1.0.0
-      compression: 1.8.1(supports-color@8.1.1)
+      compression: 1.8.1
       configstore: 5.0.1
       console-ui: 3.1.2
       core-object: 3.1.5
@@ -14338,27 +14300,27 @@ snapshots:
       diff: 5.2.2
       ember-cli-is-package-missing: 1.0.0
       ember-cli-lodash-subset: 2.0.1
-      ember-cli-normalize-entity-name: 1.0.0(supports-color@8.1.1)
-      ember-cli-preprocess-registry: 5.0.1(supports-color@8.1.1)
+      ember-cli-normalize-entity-name: 1.0.0
+      ember-cli-preprocess-registry: 5.0.1
       ember-cli-string-utils: 1.1.0
       ensure-posix-path: 1.1.1
       execa: 5.1.1
       exit: 0.1.2
-      express: 4.22.2(supports-color@8.1.1)
+      express: 4.22.2
       filesize: 10.1.6
       find-up: 5.0.0
       find-yarn-workspace-root: 2.0.0
       fixturify-project: 2.1.1
       fs-extra: 11.3.5
-      fs-tree-diff: 2.0.1(supports-color@8.1.1)
+      fs-tree-diff: 2.0.1
       get-caller-file: 2.0.5
       git-repo-info: 2.1.1
       glob: 8.1.0
       heimdalljs: 0.2.6
-      heimdalljs-fs-monitor: 1.1.2(supports-color@8.1.1)
+      heimdalljs-fs-monitor: 1.1.2
       heimdalljs-graph: 1.0.0
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
-      http-proxy: 1.18.1(debug@4.4.3(supports-color@8.1.1))
+      heimdalljs-logger: 0.1.10
+      http-proxy: 1.18.1
       inflection: 2.0.1
       inquirer: 9.3.8(@types/node@25.9.0)
       is-git-url: 1.0.0
@@ -14368,30 +14330,30 @@ snapshots:
       markdown-it: 13.0.2
       markdown-it-terminal: 0.4.0(markdown-it@13.0.2)
       minimatch: 7.4.9
-      morgan: 1.10.1(supports-color@8.1.1)
+      morgan: 1.10.1
       nopt: 3.0.6
       npm-package-arg: 10.1.0
       os-locale: 5.0.0
       p-defer: 3.0.0
-      portfinder: 1.0.38(supports-color@8.1.1)
+      portfinder: 1.0.38
       promise-map-series: 0.3.0
       promise.hash.helper: 1.0.8
       quick-temp: 0.1.9
-      remove-types: 1.0.0(supports-color@8.1.1)
+      remove-types: 1.0.0
       resolve: 1.22.12
       resolve-package-path: 4.0.3
       safe-stable-stringify: 2.5.0
       sane: 5.0.1
       semver: 7.8.0
-      silent-error: 1.1.1(supports-color@8.1.1)
+      silent-error: 1.1.1
       sort-package-json: 1.57.0
       symlink-or-copy: 1.3.1
       temp: 0.9.4
-      testem: 3.20.0(@babel/core@7.29.0(supports-color@8.1.1))(debug@4.4.3(supports-color@8.1.1))(handlebars@4.7.9)(supports-color@8.1.1)(underscore@1.13.8)
-      tiny-lr: 2.0.0(supports-color@8.1.1)
-      tree-sync: 2.1.0(supports-color@8.1.1)
+      testem: 3.20.0(@babel/core@7.29.0)(handlebars@4.7.9)(underscore@1.13.8)
+      tiny-lr: 2.0.0
+      tree-sync: 2.1.0
       walk-sync: 3.0.0
-      watch-detector: 1.0.2(supports-color@8.1.1)
+      watch-detector: 1.0.2
       workerpool: 6.5.1
       yam: 1.0.0
     transitivePeerDependencies:
@@ -14447,10 +14409,10 @@ snapshots:
       - walrus
       - whiskers
 
-  ember-compatibility-helpers@1.2.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-compatibility-helpers@1.2.7(@babel/core@7.29.0):
     dependencies:
-      babel-plugin-debug-macros: 0.2.0(@babel/core@7.29.0(supports-color@8.1.1))
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
+      babel-plugin-debug-macros: 0.2.0(@babel/core@7.29.0)
+      ember-cli-version-checker: 5.1.2
       find-up: 5.0.0
       fs-extra: 9.1.0
       semver: 5.7.2
@@ -14458,109 +14420,109 @@ snapshots:
       - '@babel/core'
       - supports-color
 
-  ember-composability-tools@1.3.0(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  ember-composability-tools@1.3.0(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@ember/render-modifiers': 2.1.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      '@glimmer/component': 1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-cli-babel: 8.3.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-element-helper: 0.8.8(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@babel/core': 7.29.0
+      '@ember/render-modifiers': 2.1.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      '@glimmer/component': 1.1.2(@babel/core@7.29.0)
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-cli-babel: 8.3.1(@babel/core@7.29.0)
+      ember-cli-htmlbars: 6.3.0
+      ember-element-helper: 0.8.8
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
       remote-promises: 1.0.0
     transitivePeerDependencies:
       - '@glint/template'
       - supports-color
       - webpack
 
-  ember-composable-helpers@5.0.0(supports-color@8.1.1):
+  ember-composable-helpers@5.0.0:
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      broccoli-funnel: 2.0.1(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      broccoli-funnel: 2.0.1
+      ember-cli-babel: 7.26.11
       resolve: 1.22.12
     transitivePeerDependencies:
       - supports-color
 
-  ember-concurrency-async@1.0.0(ember-concurrency@2.3.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-concurrency-async@1.0.0(ember-concurrency@2.3.7(@babel/core@7.29.0)):
     dependencies:
       '@babel/helper-plugin-utils': 7.29.7
       '@babel/types': 7.29.7
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
       ember-cli-babel-plugin-helpers: 1.1.1
-      ember-cli-htmlbars: 4.5.0(supports-color@8.1.1)
-      ember-concurrency: 2.3.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-cli-htmlbars: 4.5.0
+      ember-concurrency: 2.3.7(@babel/core@7.29.0)
     transitivePeerDependencies:
       - supports-color
 
-  ember-concurrency-ts@0.3.1(ember-concurrency@2.3.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-concurrency-ts@0.3.1(ember-concurrency@2.3.7(@babel/core@7.29.0)):
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 4.5.0(supports-color@8.1.1)
-      ember-concurrency: 2.3.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 4.5.0
+      ember-concurrency: 2.3.7(@babel/core@7.29.0)
     transitivePeerDependencies:
       - supports-color
 
-  ember-concurrency@2.3.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-concurrency@2.3.7(@babel/core@7.29.0):
     dependencies:
       '@babel/helper-plugin-utils': 7.29.7
       '@babel/types': 7.29.7
       '@glimmer/tracking': 1.1.2
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
       ember-cli-babel-plugin-helpers: 1.1.1
-      ember-cli-htmlbars: 5.7.2(supports-color@8.1.1)
-      ember-compatibility-helpers: 1.2.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-destroyable-polyfill: 2.0.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-cli-htmlbars: 5.7.2
+      ember-compatibility-helpers: 1.2.7(@babel/core@7.29.0)
+      ember-destroyable-polyfill: 2.0.3(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-concurrency@4.0.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-concurrency@4.0.6(@babel/core@7.29.0):
     dependencies:
-      '@babel/helper-module-imports': 7.29.7(supports-color@8.1.1)
+      '@babel/helper-module-imports': 7.29.7
       '@babel/helper-plugin-utils': 7.29.7
       '@babel/types': 7.29.7
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
-      decorator-transforms: 1.2.1(@babel/core@7.29.0(supports-color@8.1.1))
+      '@embroider/addon-shim': 1.10.3
+      decorator-transforms: 1.2.1(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-cookies@1.3.0(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-cookies@1.3.0(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@embroider/addon-shim': 1.10.3
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - supports-color
 
-  ember-copy@2.0.1(supports-color@8.1.1):
+  ember-copy@2.0.1:
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - supports-color
 
-  ember-data@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  ember-data@4.12.8(@babel/core@7.29.0)(@ember/string@3.1.1)(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
-      '@ember-data/adapter': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/store@4.12.8)(@ember/string@3.1.1(supports-color@8.1.1))(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(supports-color@8.1.1)
-      '@ember-data/debug': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/store@4.12.8)(@ember/string@3.1.1(supports-color@8.1.1))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      '@ember-data/graph': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/store@4.12.8)(supports-color@8.1.1)
-      '@ember-data/json-api': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/store@4.12.8)(supports-color@8.1.1)
-      '@ember-data/legacy-compat': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember/string@3.1.1(supports-color@8.1.1))(supports-color@8.1.1)
-      '@ember-data/model': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/debug@4.12.8)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/store@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      '@ember-data/private-build-infra': 4.12.8(supports-color@8.1.1)
-      '@ember-data/request': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@ember-data/serializer': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/store@4.12.8)(@ember/string@3.1.1(supports-color@8.1.1))(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(supports-color@8.1.1)
-      '@ember-data/store': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      '@ember-data/tracking': 4.12.8(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@ember-data/adapter': 4.12.8(@babel/core@7.29.0)(@ember-data/store@4.12.8)(@ember/string@3.1.1)(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))
+      '@ember-data/debug': 4.12.8(@babel/core@7.29.0)(@ember-data/store@4.12.8)(@ember/string@3.1.1)(webpack@5.106.2(postcss@8.5.14))
+      '@ember-data/graph': 4.12.8(@babel/core@7.29.0)(@ember-data/store@4.12.8)
+      '@ember-data/json-api': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/store@4.12.8)
+      '@ember-data/legacy-compat': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember/string@3.1.1)
+      '@ember-data/model': 4.12.8(@babel/core@7.29.0)(@ember-data/debug@4.12.8)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/store@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0))(@ember/string@3.1.1)(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      '@ember-data/private-build-infra': 4.12.8
+      '@ember-data/request': 4.12.8(@babel/core@7.29.0)
+      '@ember-data/serializer': 4.12.8(@babel/core@7.29.0)(@ember-data/store@4.12.8)(@ember/string@3.1.1)(ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))
+      '@ember-data/store': 4.12.8(@babel/core@7.29.0)(@ember-data/graph@4.12.8)(@ember-data/json-api@4.12.8)(@ember-data/legacy-compat@4.12.8)(@ember-data/model@4.12.8)(@ember-data/tracking@4.12.8(@babel/core@7.29.0))(@ember/string@3.1.1)(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      '@ember-data/tracking': 4.12.8(@babel/core@7.29.0)
       '@ember/edition-utils': 1.2.0
-      '@ember/string': 3.1.1(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@ember/string': 3.1.1
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
       '@glimmer/env': 0.1.7
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+      broccoli-merge-trees: 4.2.0
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-cli-babel: 7.26.11
+      ember-inflector: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
     transitivePeerDependencies:
       - '@babel/core'
       - '@glimmer/tracking'
@@ -14569,161 +14531,161 @@ snapshots:
       - supports-color
       - webpack
 
-  ember-decorators@6.1.1(supports-color@8.1.1):
+  ember-decorators@6.1.1:
     dependencies:
-      '@ember-decorators/component': 6.1.1(supports-color@8.1.1)
-      '@ember-decorators/object': 6.1.1(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@ember-decorators/component': 6.1.1
+      '@ember-decorators/object': 6.1.1
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - supports-color
 
-  ember-destroyable-polyfill@2.0.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-destroyable-polyfill@2.0.3(@babel/core@7.29.0):
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
-      ember-compatibility-helpers: 1.2.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-version-checker: 5.1.2
+      ember-compatibility-helpers: 1.2.7(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-drag-sort@3.0.1(supports-color@8.1.1):
+  ember-drag-sort@3.0.1:
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 6.3.0
     transitivePeerDependencies:
       - supports-color
 
-  ember-drag-sort@4.2.0(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  ember-drag-sort@4.2.0(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-cli-babel: 8.3.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-element-helper: 0.8.8(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-template-imports: 4.4.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-cli-babel: 8.3.1(@babel/core@7.29.0)
+      ember-cli-htmlbars: 6.3.0
+      ember-element-helper: 0.8.8
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
+      ember-template-imports: 4.4.0
     transitivePeerDependencies:
       - '@glint/template'
       - supports-color
       - webpack
 
-  ember-element-helper@0.6.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-element-helper@0.6.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      '@embroider/util': 1.13.5(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@embroider/util': 1.13.5(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 6.3.0
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/environment-ember-loose'
       - '@glint/template'
       - supports-color
 
-  ember-element-helper@0.8.8(supports-color@8.1.1):
+  ember-element-helper@0.8.8:
     dependencies:
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
+      '@embroider/addon-shim': 1.10.3
     transitivePeerDependencies:
       - supports-color
 
-  ember-engines@0.9.0(@babel/core@7.29.0(supports-color@8.1.1))(@ember/legacy-built-in-components@0.4.2(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-engines@0.9.0(@babel/core@7.29.0)(@ember/legacy-built-in-components@0.4.2(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
       amd-name-resolver: 1.3.1
       babel-plugin-compact-reexports: 1.1.0
-      broccoli-babel-transpiler: 7.8.1(supports-color@8.1.1)
-      broccoli-concat: 4.2.7(supports-color@8.1.1)
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
-      broccoli-dependency-funnel: 2.1.2(supports-color@8.1.1)
+      broccoli-babel-transpiler: 7.8.1
+      broccoli-concat: 4.2.7
+      broccoli-debug: 0.6.5
+      broccoli-dependency-funnel: 2.1.2
       broccoli-file-creator: 2.1.1
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
+      broccoli-funnel: 3.0.8
+      broccoli-merge-trees: 4.2.0
       calculate-cache-key-for-tree: 2.0.0
-      ember-asset-loader: 1.0.0(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-preprocess-registry: 3.3.0(supports-color@8.1.1)
+      ember-asset-loader: 1.0.0
+      ember-cli-babel: 7.26.11
+      ember-cli-preprocess-registry: 3.3.0
       ember-cli-string-utils: 1.1.0
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      ember-cli-version-checker: 5.1.2
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
       lodash: 4.18.1
     optionalDependencies:
-      '@ember/legacy-built-in-components': 0.4.2(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+      '@ember/legacy-built-in-components': 0.4.2(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
 
-  ember-fetch@8.1.2(supports-color@8.1.1):
+  ember-fetch@8.1.2:
     dependencies:
       abortcontroller-polyfill: 1.7.8
-      broccoli-concat: 4.2.7(supports-color@8.1.1)
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
-      broccoli-rollup: 2.1.1(supports-color@8.1.1)
-      broccoli-stew: 3.0.0(supports-color@8.1.1)
-      broccoli-templater: 2.0.2(supports-color@8.1.1)
+      broccoli-concat: 4.2.7
+      broccoli-debug: 0.6.5
+      broccoli-merge-trees: 4.2.0
+      broccoli-rollup: 2.1.1
+      broccoli-stew: 3.0.0
+      broccoli-templater: 2.0.2
       calculate-cache-key-for-tree: 2.0.0
       caniuse-api: 3.0.0
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-typescript: 4.2.1(supports-color@8.1.1)
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-typescript: 4.2.1
+      ember-cli-version-checker: 5.1.2
       node-fetch: 2.7.0
       whatwg-fetch: 3.6.20
     transitivePeerDependencies:
       - encoding
       - supports-color
 
-  ember-file-upload@8.4.0(@babel/core@7.29.0(supports-color@8.1.1))(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-modifier@4.3.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(supports-color@8.1.1)(tracked-built-ins@3.4.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  ember-file-upload@8.4.0(@babel/core@7.29.0)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(@glimmer/component@1.1.2(@babel/core@7.29.0))(@glimmer/tracking@1.1.2)(ember-modifier@4.3.0(@babel/core@7.29.0))(tracked-built-ins@3.4.0(@babel/core@7.29.0))(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
-      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      '@ember/test-waiters': 3.1.0(supports-color@8.1.1)
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      '@glimmer/component': 1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))
+      '@ember/test-waiters': 3.1.0
+      '@embroider/addon-shim': 1.10.3
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      '@glimmer/component': 1.1.2(@babel/core@7.29.0)
       '@glimmer/tracking': 1.1.2
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-modifier: 4.3.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      tracked-built-ins: 3.4.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-modifier: 4.3.0(@babel/core@7.29.0)
+      tracked-built-ins: 3.4.0(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
       - webpack
 
-  ember-focus-trap@1.2.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-focus-trap@1.2.0(@babel/core@7.29.0):
     dependencies:
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
-      decorator-transforms: 2.4.0(@babel/core@7.29.0(supports-color@8.1.1))
+      '@embroider/addon-shim': 1.10.3
+      decorator-transforms: 2.4.0(@babel/core@7.29.0)
       focus-trap: 7.8.0
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-functions-as-helper-polyfill@2.1.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-functions-as-helper-polyfill@2.1.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-typescript: 5.3.0(supports-color@8.1.1)
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      ember-cli-babel: 7.26.11
+      ember-cli-typescript: 5.3.0
+      ember-cli-version-checker: 5.1.2
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - supports-color
 
-  ember-get-config@2.1.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-get-config@2.1.1(@babel/core@7.29.0):
     dependencies:
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
 
-  ember-gridstack@4.0.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  ember-gridstack@4.0.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
-      '@ember/render-modifiers': 2.1.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-modifier: 4.3.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@ember/render-modifiers': 2.1.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 6.3.0
+      ember-modifier: 4.3.0(@babel/core@7.29.0)
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
       gridstack: 7.3.0
     transitivePeerDependencies:
       - '@babel/core'
@@ -14731,63 +14693,63 @@ snapshots:
       - supports-color
       - webpack
 
-  ember-in-element-polyfill@1.0.1(supports-color@8.1.1):
+  ember-in-element-polyfill@1.0.1:
     dependencies:
-      debug: 4.4.3(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 5.7.2(supports-color@8.1.1)
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
+      debug: 4.4.3
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 5.7.2
+      ember-cli-version-checker: 5.1.2
     transitivePeerDependencies:
       - supports-color
 
-  ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-inflector@4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      ember-cli-babel: 7.26.11
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - supports-color
 
-  ember-intl@6.3.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  ember-intl@6.3.2(@babel/core@7.29.0)(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
       '@formatjs/icu-messageformat-parser': 2.11.4
       '@formatjs/intl': 2.10.15
-      broccoli-caching-writer: 3.1.0(supports-color@8.1.1)
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
-      broccoli-merge-files: 0.8.0(supports-color@8.1.1)
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
+      broccoli-caching-writer: 3.1.0
+      broccoli-funnel: 3.0.8
+      broccoli-merge-files: 0.8.0
+      broccoli-merge-trees: 4.2.0
       broccoli-source: 3.0.1
-      broccoli-stew: 3.0.0(supports-color@8.1.1)
+      broccoli-stew: 3.0.0
       calculate-cache-key-for-tree: 2.0.0
       cldr-core: 44.1.0
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-cli-babel: 8.3.1(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-typescript: 5.3.0(supports-color@8.1.1)
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-cli-babel: 8.3.1(@babel/core@7.29.0)
+      ember-cli-typescript: 5.3.0
       eventemitter3: 5.0.4
       extend: 3.0.2
       fast-memoize: 2.5.2
       intl-messageformat: 10.7.18
       js-yaml: 4.1.1
       json-stable-stringify: 1.3.0
-      silent-error: 1.1.1(supports-color@8.1.1)
+      silent-error: 1.1.1
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
       - webpack
 
-  ember-leaflet@5.1.3(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(leaflet@1.9.4)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  ember-leaflet@5.1.3(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(leaflet@1.9.4)(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
-      '@glimmer/component': 1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@glimmer/component': 1.1.2(@babel/core@7.29.0)
       '@glimmer/tracking': 1.1.2
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-composability-tools: 1.3.0(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-in-element-polyfill: 1.0.1(supports-color@8.1.1)
-      ember-render-helpers: 0.2.1(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      fastboot-transform: 0.1.3(supports-color@8.1.1)
+      broccoli-funnel: 3.0.8
+      broccoli-merge-trees: 4.2.0
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 6.3.0
+      ember-composability-tools: 1.3.0(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))
+      ember-in-element-polyfill: 1.0.1
+      ember-render-helpers: 0.2.1
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
+      fastboot-transform: 0.1.3
       leaflet: 1.9.4
       resolve: 1.22.12
     transitivePeerDependencies:
@@ -14796,116 +14758,116 @@ snapshots:
       - supports-color
       - webpack
 
-  ember-lifeline@7.0.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-lifeline@7.0.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
+      '@embroider/addon-shim': 1.10.3
     optionalDependencies:
-      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - supports-color
 
-  ember-load-initializers@2.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-load-initializers@2.1.2(@babel/core@7.29.0):
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-typescript: 2.0.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-typescript: 2.0.2(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-loading@2.0.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-loading@2.0.0(@babel/core@7.29.0):
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 5.7.2(supports-color@8.1.1)
-      ember-cli-typescript: 4.2.1(supports-color@8.1.1)
-      ember-concurrency: 2.3.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-concurrency-async: 1.0.0(ember-concurrency@2.3.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-concurrency-ts: 0.3.1(ember-concurrency@2.3.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 5.7.2
+      ember-cli-typescript: 4.2.1
+      ember-concurrency: 2.3.7(@babel/core@7.29.0)
+      ember-concurrency-async: 1.0.0(ember-concurrency@2.3.7(@babel/core@7.29.0))
+      ember-concurrency-ts: 0.3.1(ember-concurrency@2.3.7(@babel/core@7.29.0))
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-local-storage@2.0.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-local-storage@2.0.7(@babel/core@7.29.0):
     dependencies:
       blob-polyfill: 7.0.20220408
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
-      broccoli-stew: 3.0.0(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      broccoli-funnel: 3.0.8
+      broccoli-merge-trees: 4.2.0
+      broccoli-stew: 3.0.0
+      ember-cli-babel: 7.26.11
       ember-cli-string-utils: 1.1.0
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
-      ember-copy: 2.0.1(supports-color@8.1.1)
-      ember-destroyable-polyfill: 2.0.3(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-cli-version-checker: 5.1.2
+      ember-copy: 2.0.1
+      ember-destroyable-polyfill: 2.0.3(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-math-helpers@4.2.1(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-math-helpers@4.2.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      '@embroider/addon-shim': 1.10.2(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@embroider/addon-shim': 1.10.2
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - supports-color
 
-  ember-maybe-in-element@2.1.0(supports-color@8.1.1):
+  ember-maybe-in-element@2.1.0:
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 6.3.0
+      ember-cli-version-checker: 5.1.2
     transitivePeerDependencies:
       - supports-color
 
-  ember-modifier-manager-polyfill@1.2.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-modifier-manager-polyfill@1.2.0(@babel/core@7.29.0):
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
       ember-cli-version-checker: 2.2.0
-      ember-compatibility-helpers: 1.2.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-compatibility-helpers: 1.2.7(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-modifier@3.2.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-modifier@3.2.7(@babel/core@7.29.0):
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-normalize-entity-name: 1.0.0(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-normalize-entity-name: 1.0.0
       ember-cli-string-utils: 1.1.0
-      ember-cli-typescript: 5.3.0(supports-color@8.1.1)
-      ember-compatibility-helpers: 1.2.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-cli-typescript: 5.3.0
+      ember-compatibility-helpers: 1.2.7(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-modifier@4.3.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-modifier@4.3.0(@babel/core@7.29.0):
     dependencies:
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
-      decorator-transforms: 2.4.0(@babel/core@7.29.0(supports-color@8.1.1))
+      '@embroider/addon-shim': 1.10.3
+      decorator-transforms: 2.4.0(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-on-helper@0.1.0(supports-color@8.1.1):
+  ember-on-helper@0.1.0:
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - supports-color
 
-  ember-page-title@8.2.4(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-page-title@8.2.4(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      '@embroider/addon-shim': 1.10.2(supports-color@8.1.1)
+      '@embroider/addon-shim': 1.10.2
       '@simple-dom/document': 1.4.0
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - supports-color
 
-  ember-power-calendar@0.18.0(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-power-calendar@0.18.0(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      ember-assign-helper: 0.4.0(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-element-closest-polyfill: 0.0.2(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-concurrency: 2.3.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-decorators: 6.1.1(supports-color@8.1.1)
-      ember-element-helper: 0.6.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-truth-helpers: 3.1.1(supports-color@8.1.1)
+      ember-assign-helper: 0.4.0
+      ember-cli-babel: 7.26.11
+      ember-cli-element-closest-polyfill: 0.0.2
+      ember-cli-htmlbars: 6.3.0
+      ember-concurrency: 2.3.7(@babel/core@7.29.0)
+      ember-decorators: 6.1.1
+      ember-element-helper: 0.6.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-truth-helpers: 3.1.1
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/environment-ember-loose'
@@ -14913,34 +14875,34 @@ snapshots:
       - ember-source
       - supports-color
 
-  ember-power-select@8.6.2(ec9a6827a6a32bd62122db95d945b3b6):
+  ember-power-select@8.6.2(@babel/core@7.29.0)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(@glimmer/component@1.1.2(@babel/core@7.29.0))(@glimmer/tracking@1.1.2)(ember-basic-dropdown@8.4.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(@glimmer/component@1.1.2(@babel/core@7.29.0))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))))(ember-concurrency@4.0.6(@babel/core@7.29.0))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
-      '@embroider/util': 1.13.5(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      '@glimmer/component': 1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))
+      '@embroider/addon-shim': 1.10.3
+      '@embroider/util': 1.13.5(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      '@glimmer/component': 1.1.2(@babel/core@7.29.0)
       '@glimmer/tracking': 1.1.2
-      decorator-transforms: 2.4.0(@babel/core@7.29.0(supports-color@8.1.1))
-      ember-assign-helper: 0.5.1(supports-color@8.1.1)
-      ember-basic-dropdown: 8.4.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-concurrency: 4.0.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-lifeline: 7.0.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-modifier: 4.3.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-truth-helpers: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
+      decorator-transforms: 2.4.0(@babel/core@7.29.0)
+      ember-assign-helper: 0.5.1
+      ember-basic-dropdown: 8.4.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(@glimmer/component@1.1.2(@babel/core@7.29.0))(@glimmer/tracking@1.1.2)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-concurrency: 4.0.6(@babel/core@7.29.0)
+      ember-lifeline: 7.0.0(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))
+      ember-modifier: 4.3.0(@babel/core@7.29.0)
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
+      ember-truth-helpers: 4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/environment-ember-loose'
       - '@glint/template'
       - supports-color
 
-  ember-qunit@8.1.1(@babel/core@7.29.0(supports-color@8.1.1))(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(qunit@2.25.0)(supports-color@8.1.1):
+  ember-qunit@8.1.1(@babel/core@7.29.0)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(qunit@2.25.0):
     dependencies:
-      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      '@embroider/addon-shim': 1.10.2(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
-      ember-cli-test-loader: 3.1.0(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))
+      '@embroider/addon-shim': 1.10.2
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
+      ember-cli-test-loader: 3.1.0
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
       qunit: 2.25.0
       qunit-theme-ember: 1.0.0
     transitivePeerDependencies:
@@ -14948,11 +14910,11 @@ snapshots:
       - '@glint/template'
       - supports-color
 
-  ember-radio-button@3.0.0-beta.1(clean-css@5.3.3)(postcss@8.5.14)(supports-color@8.1.1)(uglify-js@3.19.3):
+  ember-radio-button@3.0.0-beta.1(postcss@8.5.14):
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 5.7.2(supports-color@8.1.1)
-      webpack: 5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 5.7.2
+      webpack: 5.106.2(postcss@8.5.14)
     transitivePeerDependencies:
       - '@minify-html/node'
       - '@swc/core'
@@ -14969,57 +14931,57 @@ snapshots:
       - uglify-js
       - webpack-cli
 
-  ember-ref-bucket@4.1.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-ref-bucket@4.1.0(@babel/core@7.29.0):
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-modifier: 3.2.7(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 6.3.0
+      ember-modifier: 3.2.7(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-render-helpers@0.2.1(supports-color@8.1.1):
+  ember-render-helpers@0.2.1:
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-typescript: 4.2.1(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-typescript: 4.2.1
     transitivePeerDependencies:
       - supports-color
 
-  ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-resolver@11.0.1(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
     optionalDependencies:
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - supports-color
 
-  ember-responsive@5.0.0(supports-color@8.1.1):
+  ember-responsive@5.0.0:
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - supports-color
 
   ember-rfc176-data@0.3.18: {}
 
-  ember-router-generator@2.0.0(supports-color@8.1.1):
+  ember-router-generator@2.0.0:
     dependencies:
       '@babel/parser': 7.29.3
-      '@babel/traverse': 7.29.0(supports-color@8.1.1)
+      '@babel/traverse': 7.29.0
       recast: 0.18.10
     transitivePeerDependencies:
       - supports-color
 
-  ember-simple-auth@6.1.0(@babel/core@7.29.0(supports-color@8.1.1))(@ember/test-helpers@3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(eslint@8.57.1(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-simple-auth@6.1.0(@babel/core@7.29.0)(@ember/test-helpers@3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14)))(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(eslint@8.57.1):
     dependencies:
-      '@babel/eslint-parser': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(eslint@8.57.1(supports-color@8.1.1))
-      '@ember/test-waiters': 3.1.0(supports-color@8.1.1)
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
-      '@embroider/macros': 1.20.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/eslint-parser': 7.28.6(@babel/core@7.29.0)(eslint@8.57.1)
+      '@ember/test-waiters': 3.1.0
+      '@embroider/addon-shim': 1.10.3
+      '@embroider/macros': 1.20.2(@babel/core@7.29.0)
       ember-cli-is-package-missing: 1.0.0
-      ember-cookies: 1.3.0(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      silent-error: 1.1.1(supports-color@8.1.1)
+      ember-cookies: 1.3.0(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      silent-error: 1.1.1
     optionalDependencies:
-      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0(supports-color@8.1.1))(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@ember/test-helpers': 3.3.1(@babel/core@7.29.0)(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
@@ -15033,13 +14995,13 @@ snapshots:
     transitivePeerDependencies:
       - encoding
 
-  ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
-      '@babel/helper-module-imports': 7.28.6(supports-color@8.1.1)
-      '@babel/plugin-transform-block-scoping': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
+      '@babel/helper-module-imports': 7.28.6
+      '@babel/plugin-transform-block-scoping': 7.28.6(@babel/core@7.29.0)
       '@ember/edition-utils': 1.2.0
       '@glimmer/compiler': 0.84.3
-      '@glimmer/component': 1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@glimmer/component': 1.1.2(@babel/core@7.29.0)
       '@glimmer/destroyable': 0.84.3
       '@glimmer/env': 0.1.7
       '@glimmer/global-context': 0.84.3
@@ -15054,33 +15016,33 @@ snapshots:
       '@glimmer/syntax': 0.84.3
       '@glimmer/util': 0.84.3
       '@glimmer/validator': 0.84.3
-      '@glimmer/vm-babel-plugins': 0.84.3(@babel/core@7.29.0(supports-color@8.1.1))
+      '@glimmer/vm-babel-plugins': 0.84.3(@babel/core@7.29.0)
       '@simple-dom/interface': 1.4.0
-      babel-plugin-debug-macros: 0.3.4(@babel/core@7.29.0(supports-color@8.1.1))
+      babel-plugin-debug-macros: 0.3.4(@babel/core@7.29.0)
       babel-plugin-filter-imports: 4.0.0
       backburner.js: 2.8.0
-      broccoli-concat: 4.2.7(supports-color@8.1.1)
-      broccoli-debug: 0.6.5(supports-color@8.1.1)
+      broccoli-concat: 4.2.7
+      broccoli-debug: 0.6.5
       broccoli-file-creator: 2.1.1
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
+      broccoli-funnel: 3.0.8
+      broccoli-merge-trees: 4.2.0
       chalk: 4.1.2
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-cli-babel: 7.26.11
       ember-cli-get-component-path-option: 1.0.0
       ember-cli-is-package-missing: 1.0.0
-      ember-cli-normalize-entity-name: 1.0.0(supports-color@8.1.1)
+      ember-cli-normalize-entity-name: 1.0.0
       ember-cli-path-utils: 1.0.0
       ember-cli-string-utils: 1.1.0
-      ember-cli-typescript-blueprint-polyfill: 0.1.0(supports-color@8.1.1)
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
-      ember-router-generator: 2.0.0(supports-color@8.1.1)
+      ember-cli-typescript-blueprint-polyfill: 0.1.0
+      ember-cli-version-checker: 5.1.2
+      ember-router-generator: 2.0.0
       inflection: 2.0.1
       resolve: 1.22.12
       route-recognizer: 0.3.4
       router_js: 8.0.6(route-recognizer@0.3.4)(rsvp@4.8.5)
       semver: 7.8.0
-      silent-error: 1.1.1(supports-color@8.1.1)
+      silent-error: 1.1.1
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
@@ -15088,41 +15050,41 @@ snapshots:
       - supports-color
       - webpack
 
-  ember-style-modifier@3.1.1(@babel/core@7.29.0(supports-color@8.1.1))(@ember/string@3.1.1(supports-color@8.1.1))(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  ember-style-modifier@3.1.1(@babel/core@7.29.0)(@ember/string@3.1.1)(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
-      '@ember/string': 3.1.1(supports-color@8.1.1)
-      ember-auto-import: 2.13.1(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-modifier: 4.3.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@ember/string': 3.1.1
+      ember-auto-import: 2.13.1(webpack@5.106.2(postcss@8.5.14))
+      ember-cli-babel: 7.26.11
+      ember-modifier: 4.3.0(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
       - '@glint/template'
       - supports-color
       - webpack
 
-  ember-style-modifier@4.6.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  ember-style-modifier@4.6.0(@babel/core@7.29.0):
     dependencies:
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
+      '@embroider/addon-shim': 1.10.3
       csstype: 3.2.3
-      decorator-transforms: 2.4.0(@babel/core@7.29.0(supports-color@8.1.1))
-      ember-modifier: 4.3.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      decorator-transforms: 2.4.0(@babel/core@7.29.0)
+      ember-modifier: 4.3.0(@babel/core@7.29.0)
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
-  ember-tag-input@3.1.0(supports-color@8.1.1):
+  ember-tag-input@3.1.0:
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 6.3.0
     transitivePeerDependencies:
       - supports-color
 
-  ember-template-imports@3.4.2(supports-color@8.1.1):
+  ember-template-imports@3.4.2:
     dependencies:
       babel-import-util: 0.2.0
-      broccoli-stew: 3.0.0(supports-color@8.1.1)
+      broccoli-stew: 3.0.0
       ember-cli-babel-plugin-helpers: 1.1.1
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
+      ember-cli-version-checker: 5.1.2
       line-column: 1.0.2
       magic-string: 0.25.9
       parse-static-imports: 1.1.0
@@ -15131,23 +15093,23 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  ember-template-imports@4.4.0(supports-color@8.1.1):
+  ember-template-imports@4.4.0:
     dependencies:
-      broccoli-stew: 3.0.0(supports-color@8.1.1)
+      broccoli-stew: 3.0.0
       content-tag: 4.2.0
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
+      ember-cli-version-checker: 5.1.2
     transitivePeerDependencies:
       - supports-color
 
-  ember-template-lint@5.13.0(supports-color@8.1.1):
+  ember-template-lint@5.13.0:
     dependencies:
       '@lint-todo/utils': 13.1.1
       aria-query: 5.3.2
       chalk: 5.6.2
       ci-info: 3.9.0
       date-fns: 2.30.0
-      ember-template-imports: 3.4.2(supports-color@8.1.1)
-      ember-template-recast: 6.1.5(supports-color@8.1.1)
+      ember-template-imports: 3.4.2
+      ember-template-recast: 6.1.5
       eslint-formatter-kakoune: 1.0.0
       find-up: 6.3.0
       fuse.js: 6.6.2
@@ -15162,12 +15124,12 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  ember-template-recast@6.1.5(supports-color@8.1.1):
+  ember-template-recast@6.1.5:
     dependencies:
       '@glimmer/reference': 0.84.3
       '@glimmer/syntax': 0.84.3
       '@glimmer/validator': 0.84.3
-      async-promise-queue: 1.0.5(supports-color@8.1.1)
+      async-promise-queue: 1.0.5
       colors: 1.4.0
       commander: 8.3.0
       globby: 11.1.0
@@ -15178,23 +15140,23 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  ember-tracked-storage-polyfill@1.0.1(supports-color@8.1.1):
+  ember-tracked-storage-polyfill@1.0.1:
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - supports-color
 
-  ember-truth-helpers@3.1.1(supports-color@8.1.1):
+  ember-truth-helpers@3.1.1:
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
     transitivePeerDependencies:
       - supports-color
 
-  ember-truth-helpers@4.0.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-truth-helpers@4.0.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
-      ember-functions-as-helper-polyfill: 2.1.3(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      '@embroider/addon-shim': 1.10.3
+      ember-functions-as-helper-polyfill: 2.1.3(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14)))
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - supports-color
 
@@ -15208,12 +15170,12 @@ snapshots:
     transitivePeerDependencies:
       - encoding
 
-  ember-try@3.0.0(supports-color@8.1.1):
+  ember-try@3.0.0:
     dependencies:
       chalk: 4.1.2
       cli-table3: 0.6.5
       core-object: 3.1.5
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       ember-try-config: 4.0.0
       execa: 4.1.0
       fs-extra: 6.0.1
@@ -15225,18 +15187,18 @@ snapshots:
       - encoding
       - supports-color
 
-  ember-window-mock@0.9.0(ember-source@5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)))(supports-color@8.1.1):
+  ember-window-mock@0.9.0(ember-source@5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))):
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 6.3.0(supports-color@8.1.1)
-      ember-source: 5.4.1(@babel/core@7.29.0(supports-color@8.1.1))(@glimmer/component@1.1.2(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1))(rsvp@4.8.5)(supports-color@8.1.1)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 6.3.0
+      ember-source: 5.4.1(@babel/core@7.29.0)(@glimmer/component@1.1.2(@babel/core@7.29.0))(rsvp@4.8.5)(webpack@5.106.2(postcss@8.5.14))
     transitivePeerDependencies:
       - supports-color
 
-  ember-wormhole@0.6.1(supports-color@8.1.1):
+  ember-wormhole@0.6.1:
     dependencies:
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-htmlbars: 5.7.2(supports-color@8.1.1)
+      ember-cli-babel: 7.26.11
+      ember-cli-htmlbars: 5.7.2
     transitivePeerDependencies:
       - supports-color
 
@@ -15256,7 +15218,7 @@ snapshots:
 
   engine.io-parser@5.2.3: {}
 
-  engine.io@6.6.7(supports-color@8.1.1):
+  engine.io@6.6.7:
     dependencies:
       '@types/cors': 2.8.19
       '@types/node': 25.9.0
@@ -15265,7 +15227,7 @@ snapshots:
       base64id: 2.0.0
       cookie: 0.7.2
       cors: 2.8.6
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       engine.io-parser: 5.2.3
       ws: 8.18.3
     transitivePeerDependencies:
@@ -15394,27 +15356,27 @@ snapshots:
 
   escape-string-regexp@4.0.0: {}
 
-  eslint-compat-utils@0.5.1(eslint@8.57.1(supports-color@8.1.1)):
+  eslint-compat-utils@0.5.1(eslint@8.57.1):
     dependencies:
-      eslint: 8.57.1(supports-color@8.1.1)
+      eslint: 8.57.1
       semver: 7.8.0
 
-  eslint-config-prettier@9.1.2(eslint@8.57.1(supports-color@8.1.1)):
+  eslint-config-prettier@9.1.2(eslint@8.57.1):
     dependencies:
-      eslint: 8.57.1(supports-color@8.1.1)
+      eslint: 8.57.1
 
   eslint-formatter-kakoune@1.0.0: {}
 
-  eslint-plugin-ember@11.12.0(eslint@8.57.1(supports-color@8.1.1))(supports-color@8.1.1):
+  eslint-plugin-ember@11.12.0(eslint@8.57.1):
     dependencies:
       '@ember-data/rfc395-data': 0.0.4
       '@glimmer/syntax': 0.84.3
       css-tree: 2.3.1
       ember-rfc176-data: 0.3.18
-      ember-template-imports: 3.4.2(supports-color@8.1.1)
-      ember-template-recast: 6.1.5(supports-color@8.1.1)
-      eslint: 8.57.1(supports-color@8.1.1)
-      eslint-utils: 3.0.0(eslint@8.57.1(supports-color@8.1.1))
+      ember-template-imports: 3.4.2
+      ember-template-recast: 6.1.5
+      eslint: 8.57.1
+      eslint-utils: 3.0.0(eslint@8.57.1)
       estraverse: 5.3.0
       lodash.camelcase: 4.3.0
       lodash.kebabcase: 4.1.1
@@ -15424,19 +15386,19 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-plugin-es-x@7.8.0(eslint@8.57.1(supports-color@8.1.1)):
+  eslint-plugin-es-x@7.8.0(eslint@8.57.1):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@8.57.1(supports-color@8.1.1))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@8.57.1)
       '@eslint-community/regexpp': 4.12.2
-      eslint: 8.57.1(supports-color@8.1.1)
-      eslint-compat-utils: 0.5.1(eslint@8.57.1(supports-color@8.1.1))
+      eslint: 8.57.1
+      eslint-compat-utils: 0.5.1(eslint@8.57.1)
 
-  eslint-plugin-n@16.6.2(eslint@8.57.1(supports-color@8.1.1)):
+  eslint-plugin-n@16.6.2(eslint@8.57.1):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@8.57.1(supports-color@8.1.1))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@8.57.1)
       builtins: 5.1.0
-      eslint: 8.57.1(supports-color@8.1.1)
-      eslint-plugin-es-x: 7.8.0(eslint@8.57.1(supports-color@8.1.1))
+      eslint: 8.57.1
+      eslint-plugin-es-x: 7.8.0(eslint@8.57.1)
       get-tsconfig: 4.14.0
       globals: 13.24.0
       ignore: 5.3.2
@@ -15446,20 +15408,20 @@ snapshots:
       resolve: 1.22.12
       semver: 7.8.0
 
-  eslint-plugin-prettier@5.5.5(@types/eslint@9.6.1)(eslint-config-prettier@9.1.2(eslint@8.57.1(supports-color@8.1.1)))(eslint@8.57.1(supports-color@8.1.1))(prettier@3.8.3):
+  eslint-plugin-prettier@5.5.5(@types/eslint@9.6.1)(eslint-config-prettier@9.1.2(eslint@8.57.1))(eslint@8.57.1)(prettier@3.8.3):
     dependencies:
-      eslint: 8.57.1(supports-color@8.1.1)
+      eslint: 8.57.1
       prettier: 3.8.3
       prettier-linter-helpers: 1.0.1
       synckit: 0.11.12
     optionalDependencies:
       '@types/eslint': 9.6.1
-      eslint-config-prettier: 9.1.2(eslint@8.57.1(supports-color@8.1.1))
+      eslint-config-prettier: 9.1.2(eslint@8.57.1)
 
-  eslint-plugin-qunit@8.2.6(eslint@8.57.1(supports-color@8.1.1)):
+  eslint-plugin-qunit@8.2.6(eslint@8.57.1):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@8.57.1(supports-color@8.1.1))
-      eslint: 8.57.1(supports-color@8.1.1)
+      '@eslint-community/eslint-utils': 4.9.1(eslint@8.57.1)
+      eslint: 8.57.1
       requireindex: 1.2.0
 
   eslint-scope@4.0.3:
@@ -15477,29 +15439,29 @@ snapshots:
       esrecurse: 4.3.0
       estraverse: 5.3.0
 
-  eslint-utils@3.0.0(eslint@8.57.1(supports-color@8.1.1)):
+  eslint-utils@3.0.0(eslint@8.57.1):
     dependencies:
-      eslint: 8.57.1(supports-color@8.1.1)
+      eslint: 8.57.1
       eslint-visitor-keys: 2.1.0
 
   eslint-visitor-keys@2.1.0: {}
 
   eslint-visitor-keys@3.4.3: {}
 
-  eslint@8.57.1(supports-color@8.1.1):
+  eslint@8.57.1:
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@8.57.1(supports-color@8.1.1))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@8.57.1)
       '@eslint-community/regexpp': 4.12.2
-      '@eslint/eslintrc': 2.1.4(supports-color@8.1.1)
+      '@eslint/eslintrc': 2.1.4
       '@eslint/js': 8.57.1
-      '@humanwhocodes/config-array': 0.13.0(supports-color@8.1.1)
+      '@humanwhocodes/config-array': 0.13.0
       '@humanwhocodes/module-importer': 1.0.1
       '@nodelib/fs.walk': 1.2.8
       '@ungap/structured-clone': 1.3.1
       ajv: 6.15.0
       chalk: 4.1.2
       cross-spawn: 7.0.6
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       doctrine: 3.0.0
       escape-string-regexp: 4.0.0
       eslint-scope: 7.2.2
@@ -15645,14 +15607,14 @@ snapshots:
 
   exit@0.1.2: {}
 
-  expand-brackets@2.1.4(supports-color@8.1.1):
+  expand-brackets@2.1.4:
     dependencies:
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       define-property: 0.2.5
       extend-shallow: 2.0.1
       posix-character-classes: 0.1.1
       regex-not: 1.0.2
-      snapdragon: 0.8.2(supports-color@8.1.1)
+      snapdragon: 0.8.2
       to-regex: 3.0.2
     transitivePeerDependencies:
       - supports-color
@@ -15661,21 +15623,21 @@ snapshots:
     dependencies:
       homedir-polyfill: 1.0.3
 
-  express@4.22.2(supports-color@8.1.1):
+  express@4.22.2:
     dependencies:
       accepts: 1.3.8
       array-flatten: 1.1.1
-      body-parser: 1.20.5(supports-color@8.1.1)
+      body-parser: 1.20.5
       content-disposition: 0.5.4
       content-type: 1.0.5
       cookie: 0.7.2
       cookie-signature: 1.0.7
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       depd: 2.0.0
       encodeurl: 2.0.0
       escape-html: 1.0.3
       etag: 1.8.1
-      finalhandler: 1.3.2(supports-color@8.1.1)
+      finalhandler: 1.3.2
       fresh: 0.5.2
       http-errors: 2.0.1
       merge-descriptors: 1.0.3
@@ -15687,8 +15649,8 @@ snapshots:
       qs: 6.15.2
       range-parser: 1.2.1
       safe-buffer: 5.2.1
-      send: 0.19.2(supports-color@8.1.1)
-      serve-static: 1.16.3(supports-color@8.1.1)
+      send: 0.19.2
+      serve-static: 1.16.3
       setprototypeof: 1.2.0
       statuses: 2.0.2
       type-is: 1.6.18
@@ -15697,20 +15659,20 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  express@5.2.1(supports-color@8.1.1):
+  express@5.2.1:
     dependencies:
       accepts: 2.0.0
-      body-parser: 2.2.2(supports-color@8.1.1)
+      body-parser: 2.2.2
       content-disposition: 1.1.0
       content-type: 1.0.5
       cookie: 0.7.2
       cookie-signature: 1.2.2
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       depd: 2.0.0
       encodeurl: 2.0.0
       escape-html: 1.0.3
       etag: 1.8.1
-      finalhandler: 2.1.1(supports-color@8.1.1)
+      finalhandler: 2.1.1
       fresh: 2.0.0
       http-errors: 2.0.1
       merge-descriptors: 2.0.0
@@ -15721,9 +15683,9 @@ snapshots:
       proxy-addr: 2.0.7
       qs: 6.15.2
       range-parser: 1.2.1
-      router: 2.2.0(supports-color@8.1.1)
-      send: 1.2.1(supports-color@8.1.1)
-      serve-static: 2.2.1(supports-color@8.1.1)
+      router: 2.2.0
+      send: 1.2.1
+      serve-static: 2.2.1
       statuses: 2.0.2
       type-is: 2.1.0
       vary: 1.1.2
@@ -15747,15 +15709,15 @@ snapshots:
       iconv-lite: 0.4.24
       tmp: 0.0.33
 
-  extglob@2.0.4(supports-color@8.1.1):
+  extglob@2.0.4:
     dependencies:
       array-unique: 0.3.2
       define-property: 1.0.0
-      expand-brackets: 2.1.4(supports-color@8.1.1)
+      expand-brackets: 2.1.4
       extend-shallow: 2.0.1
       fragment-cache: 0.2.1
       regex-not: 1.0.2
-      snapdragon: 0.8.2(supports-color@8.1.1)
+      snapdragon: 0.8.2
       to-regex: 3.0.2
     transitivePeerDependencies:
       - supports-color
@@ -15766,14 +15728,14 @@ snapshots:
 
   fast-diff@1.3.0: {}
 
-  fast-glob@2.2.7(supports-color@8.1.1):
+  fast-glob@2.2.7:
     dependencies:
       '@mrmlnc/readdir-enhanced': 2.2.1
       '@nodelib/fs.stat': 1.1.3
       glob-parent: 3.1.0
       is-glob: 4.0.3
       merge2: 1.4.1
-      micromatch: 3.1.10(supports-color@8.1.1)
+      micromatch: 3.1.10
     transitivePeerDependencies:
       - supports-color
 
@@ -15795,11 +15757,11 @@ snapshots:
     dependencies:
       blank-object: 1.0.2
 
-  fast-sourcemap-concat@2.1.1(supports-color@8.1.1):
+  fast-sourcemap-concat@2.1.1:
     dependencies:
       chalk: 2.4.2
       fs-extra: 5.0.0
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       memory-streams: 0.1.3
       mkdirp: 0.5.6
       source-map: 0.4.4
@@ -15809,9 +15771,9 @@ snapshots:
 
   fast-uri@3.1.2: {}
 
-  fastboot-transform@0.1.3(supports-color@8.1.1):
+  fastboot-transform@0.1.3:
     dependencies:
-      broccoli-stew: 1.6.0(supports-color@8.1.1)
+      broccoli-stew: 1.6.0
       convert-source-map: 1.9.0
     transitivePeerDependencies:
       - supports-color
@@ -15872,9 +15834,9 @@ snapshots:
     dependencies:
       to-regex-range: 5.0.1
 
-  finalhandler@1.1.2(supports-color@8.1.1):
+  finalhandler@1.1.2:
     dependencies:
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       encodeurl: 1.0.2
       escape-html: 1.0.3
       on-finished: 2.3.0
@@ -15884,9 +15846,9 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  finalhandler@1.3.2(supports-color@8.1.1):
+  finalhandler@1.3.2:
     dependencies:
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       encodeurl: 2.0.0
       escape-html: 1.0.3
       on-finished: 2.4.1
@@ -15896,9 +15858,9 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  finalhandler@2.1.1(supports-color@8.1.1):
+  finalhandler@2.1.1:
     dependencies:
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       encodeurl: 2.0.0
       escape-html: 1.0.3
       on-finished: 2.4.1
@@ -16009,9 +15971,7 @@ snapshots:
     dependencies:
       tabbable: 6.4.0
 
-  follow-redirects@1.16.0(debug@4.4.3(supports-color@8.1.1)):
-    optionalDependencies:
-      debug: 4.4.3(supports-color@8.1.1)
+  follow-redirects@1.16.0: {}
 
   for-each@0.3.5:
     dependencies:
@@ -16105,41 +16065,41 @@ snapshots:
       jsonfile: 6.2.1
       universalify: 2.0.1
 
-  fs-merger@3.2.1(supports-color@8.1.1):
+  fs-merger@3.2.1:
     dependencies:
       broccoli-node-api: 1.7.0
       broccoli-node-info: 2.2.0
       fs-extra: 8.1.0
-      fs-tree-diff: 2.0.1(supports-color@8.1.1)
+      fs-tree-diff: 2.0.1
       walk-sync: 2.2.0
     transitivePeerDependencies:
       - supports-color
 
-  fs-tree-diff@0.5.9(supports-color@8.1.1):
+  fs-tree-diff@0.5.9:
     dependencies:
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       object-assign: 4.1.1
       path-posix: 1.0.0
       symlink-or-copy: 1.3.1
     transitivePeerDependencies:
       - supports-color
 
-  fs-tree-diff@2.0.1(supports-color@8.1.1):
+  fs-tree-diff@2.0.1:
     dependencies:
       '@types/symlink-or-copy': 1.2.2
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       object-assign: 4.1.1
       path-posix: 1.0.0
       symlink-or-copy: 1.3.1
     transitivePeerDependencies:
       - supports-color
 
-  fs-updater@1.0.4(supports-color@8.1.1):
+  fs-updater@1.0.4:
     dependencies:
       can-symlink: 1.0.0
       clean-up-path: 1.0.0
       heimdalljs: 0.2.6
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       rimraf: 2.7.1
     transitivePeerDependencies:
       - supports-color
@@ -16467,10 +16427,10 @@ snapshots:
       safe-buffer: 5.2.1
       to-buffer: 1.2.2
 
-  hash-for-dep@1.5.2(supports-color@8.1.1):
+  hash-for-dep@1.5.2:
     dependencies:
       heimdalljs: 0.2.6
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       resolve: 1.22.12
       resolve-package-path: 1.2.7
     transitivePeerDependencies:
@@ -16485,21 +16445,21 @@ snapshots:
     dependencies:
       function-bind: 1.1.2
 
-  heimdalljs-fs-monitor@1.1.2(supports-color@8.1.1):
+  heimdalljs-fs-monitor@1.1.2:
     dependencies:
       callsites: 3.1.0
       clean-stack: 2.2.0
       extract-stack: 2.0.0
       heimdalljs: 0.2.6
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
     transitivePeerDependencies:
       - supports-color
 
   heimdalljs-graph@1.0.0: {}
 
-  heimdalljs-logger@0.1.10(supports-color@8.1.1):
+  heimdalljs-logger@0.1.10:
     dependencies:
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       heimdalljs: 0.2.6
     transitivePeerDependencies:
       - supports-color
@@ -16552,10 +16512,10 @@ snapshots:
 
   http-parser-js@0.5.10: {}
 
-  http-proxy@1.18.1(debug@4.4.3(supports-color@8.1.1)):
+  http-proxy@1.18.1:
     dependencies:
       eventemitter3: 4.0.7
-      follow-redirects: 1.16.0(debug@4.4.3(supports-color@8.1.1))
+      follow-redirects: 1.16.0
       requires-port: 1.0.0
     transitivePeerDependencies:
       - debug
@@ -17291,7 +17251,7 @@ snapshots:
 
   md5.js@1.3.5:
     dependencies:
-      hash-base: 3.0.5
+      hash-base: 3.1.2
       inherits: 2.0.4
       safe-buffer: 5.2.1
 
@@ -17351,20 +17311,20 @@ snapshots:
 
   merge-stream@2.0.0: {}
 
-  merge-trees@1.0.1(supports-color@8.1.1):
+  merge-trees@1.0.1:
     dependencies:
       can-symlink: 1.0.0
-      fs-tree-diff: 0.5.9(supports-color@8.1.1)
+      fs-tree-diff: 0.5.9
       heimdalljs: 0.2.6
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
       rimraf: 2.7.1
       symlink-or-copy: 1.3.1
     transitivePeerDependencies:
       - supports-color
 
-  merge-trees@2.0.0(supports-color@8.1.1):
+  merge-trees@2.0.0:
     dependencies:
-      fs-updater: 1.0.4(supports-color@8.1.1)
+      fs-updater: 1.0.4
       heimdalljs: 0.2.6
     transitivePeerDependencies:
       - supports-color
@@ -17375,20 +17335,20 @@ snapshots:
 
   methods@1.1.2: {}
 
-  micromatch@3.1.10(supports-color@8.1.1):
+  micromatch@3.1.10:
     dependencies:
       arr-diff: 4.0.0
       array-unique: 0.3.2
-      braces: 2.3.2(supports-color@8.1.1)
+      braces: 2.3.2
       define-property: 2.0.2
       extend-shallow: 3.0.2
-      extglob: 2.0.4(supports-color@8.1.1)
+      extglob: 2.0.4
       fragment-cache: 0.2.1
       kind-of: 6.0.3
-      nanomatch: 1.2.13(supports-color@8.1.1)
+      nanomatch: 1.2.13
       object.pick: 1.3.0
       regex-not: 1.0.2
-      snapdragon: 0.8.2(supports-color@8.1.1)
+      snapdragon: 0.8.2
       to-regex: 3.0.2
     transitivePeerDependencies:
       - supports-color
@@ -17425,11 +17385,11 @@ snapshots:
 
   mimic-response@1.0.1: {}
 
-  mini-css-extract-plugin@2.10.2(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  mini-css-extract-plugin@2.10.2(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
       schema-utils: 4.3.3
       tapable: 2.3.3
-      webpack: 5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)
+      webpack: 5.106.2(postcss@8.5.14)
 
   mini-svg-data-uri@1.4.4: {}
 
@@ -17501,10 +17461,10 @@ snapshots:
 
   mktemp@2.0.3: {}
 
-  morgan@1.10.1(supports-color@8.1.1):
+  morgan@1.10.1:
     dependencies:
       basic-auth: 2.0.1
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       depd: 2.0.0
       on-finished: 2.3.0
       on-headers: 1.1.0
@@ -17549,7 +17509,7 @@ snapshots:
 
   nanoid@3.3.12: {}
 
-  nanomatch@1.2.13(supports-color@8.1.1):
+  nanomatch@1.2.13:
     dependencies:
       arr-diff: 4.0.0
       array-unique: 0.3.2
@@ -17560,7 +17520,7 @@ snapshots:
       kind-of: 6.0.3
       object.pick: 1.3.0
       regex-not: 1.0.2
-      snapdragon: 0.8.2(supports-color@8.1.1)
+      snapdragon: 0.8.2
       to-regex: 3.0.2
     transitivePeerDependencies:
       - supports-color
@@ -17991,10 +17951,10 @@ snapshots:
     dependencies:
       robust-predicates: 3.0.3
 
-  portfinder@1.0.38(supports-color@8.1.1):
+  portfinder@1.0.38:
     dependencies:
       async: 3.2.6
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
 
@@ -18526,12 +18486,12 @@ snapshots:
       rimraf: 5.0.10
       underscore.string: 3.3.6
 
-  qunit-dom@2.0.0(supports-color@8.1.1):
+  qunit-dom@2.0.0:
     dependencies:
-      broccoli-funnel: 3.0.8(supports-color@8.1.1)
-      broccoli-merge-trees: 4.2.0(supports-color@8.1.1)
-      ember-cli-babel: 7.26.11(supports-color@8.1.1)
-      ember-cli-version-checker: 5.1.2(supports-color@8.1.1)
+      broccoli-funnel: 3.0.8
+      broccoli-merge-trees: 4.2.0
+      ember-cli-babel: 7.26.11
+      ember-cli-version-checker: 5.1.2
     transitivePeerDependencies:
       - supports-color
 
@@ -18620,10 +18580,10 @@ snapshots:
       string_decoder: 1.3.0
       util-deprecate: 1.0.2
 
-  readdirp@2.2.1(supports-color@8.1.1):
+  readdirp@2.2.1:
     dependencies:
       graceful-fs: 4.2.11
-      micromatch: 3.1.10(supports-color@8.1.1)
+      micromatch: 3.1.10
       readable-stream: 2.3.8
     transitivePeerDependencies:
       - supports-color
@@ -18715,11 +18675,11 @@ snapshots:
 
   remove-trailing-separator@1.1.0: {}
 
-  remove-types@1.0.0(supports-color@8.1.1):
+  remove-types@1.0.0:
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
-      '@babel/plugin-syntax-decorators': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))
-      '@babel/plugin-transform-typescript': 7.28.6(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1)
+      '@babel/core': 7.29.0
+      '@babel/plugin-syntax-decorators': 7.28.6(@babel/core@7.29.0)
+      '@babel/plugin-transform-typescript': 7.28.6(@babel/core@7.29.0)
       prettier: 2.8.8
     transitivePeerDependencies:
       - supports-color
@@ -18866,9 +18826,9 @@ snapshots:
 
   route-recognizer@0.3.4: {}
 
-  router@2.2.0(supports-color@8.1.1):
+  router@2.2.0:
     dependencies:
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       depd: 2.0.0
       is-promise: 4.0.0
       parseurl: 1.3.3
@@ -18941,15 +18901,15 @@ snapshots:
 
   safer-buffer@2.1.2: {}
 
-  sane@4.1.0(supports-color@8.1.1):
+  sane@4.1.0:
     dependencies:
       '@cnakazawa/watch': 1.0.4
-      anymatch: 2.0.0(supports-color@8.1.1)
+      anymatch: 2.0.0
       capture-exit: 2.0.0
       exec-sh: 0.3.6
       execa: 1.0.0
       fb-watchman: 2.0.2
-      micromatch: 3.1.10(supports-color@8.1.1)
+      micromatch: 3.1.10
       minimist: 1.2.8
       walker: 1.0.8
     transitivePeerDependencies:
@@ -19008,9 +18968,9 @@ snapshots:
 
   semver@7.8.4: {}
 
-  send@0.19.2(supports-color@8.1.1):
+  send@0.19.2:
     dependencies:
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       depd: 2.0.0
       destroy: 1.2.0
       encodeurl: 2.0.0
@@ -19026,9 +18986,9 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  send@1.2.1(supports-color@8.1.1):
+  send@1.2.1:
     dependencies:
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       encodeurl: 2.0.0
       escape-html: 1.0.3
       etag: 1.8.1
@@ -19046,21 +19006,21 @@ snapshots:
     dependencies:
       randombytes: 2.1.0
 
-  serve-static@1.16.3(supports-color@8.1.1):
+  serve-static@1.16.3:
     dependencies:
       encodeurl: 2.0.0
       escape-html: 1.0.3
       parseurl: 1.3.3
-      send: 0.19.2(supports-color@8.1.1)
+      send: 0.19.2
     transitivePeerDependencies:
       - supports-color
 
-  serve-static@2.2.1(supports-color@8.1.1):
+  serve-static@2.2.1:
     dependencies:
       encodeurl: 2.0.0
       escape-html: 1.0.3
       parseurl: 1.3.3
-      send: 1.2.1(supports-color@8.1.1)
+      send: 1.2.1
     transitivePeerDependencies:
       - supports-color
 
@@ -19159,9 +19119,9 @@ snapshots:
 
   signature_pad@5.1.4: {}
 
-  silent-error@1.1.1(supports-color@8.1.1):
+  silent-error@1.1.1:
     dependencies:
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
     transitivePeerDependencies:
       - supports-color
 
@@ -19194,10 +19154,10 @@ snapshots:
     dependencies:
       kind-of: 3.2.2
 
-  snapdragon@0.8.2(supports-color@8.1.1):
+  snapdragon@0.8.2:
     dependencies:
       base: 0.11.2
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       define-property: 0.2.5
       extend-shallow: 2.0.1
       map-cache: 0.2.2
@@ -19207,31 +19167,31 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  socket.io-adapter@2.5.6(supports-color@8.1.1):
+  socket.io-adapter@2.5.6:
     dependencies:
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       ws: 8.18.3
     transitivePeerDependencies:
       - bufferutil
       - supports-color
       - utf-8-validate
 
-  socket.io-parser@4.2.6(supports-color@8.1.1):
+  socket.io-parser@4.2.6:
     dependencies:
       '@socket.io/component-emitter': 3.1.2
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
 
-  socket.io@4.8.3(supports-color@8.1.1):
+  socket.io@4.8.3:
     dependencies:
       accepts: 1.3.8
       base64id: 2.0.0
       cors: 2.8.6
-      debug: 4.4.3(supports-color@8.1.1)
-      engine.io: 6.6.7(supports-color@8.1.1)
-      socket.io-adapter: 2.5.6(supports-color@8.1.1)
-      socket.io-parser: 4.2.6(supports-color@8.1.1)
+      debug: 4.4.3
+      engine.io: 6.6.7
+      socket.io-adapter: 2.5.6
+      socket.io-parser: 4.2.6
     transitivePeerDependencies:
       - bufferutil
       - supports-color
@@ -19335,9 +19295,9 @@ snapshots:
     dependencies:
       figgy-pudding: 3.5.2
 
-  stagehand@1.0.1(supports-color@8.1.1):
+  stagehand@1.0.1:
     dependencies:
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
 
@@ -19482,32 +19442,32 @@ snapshots:
 
   strip-json-comments@3.1.1: {}
 
-  style-loader@2.0.0(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  style-loader@2.0.0(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
       loader-utils: 2.0.4
       schema-utils: 3.3.0
-      webpack: 5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)
+      webpack: 5.106.2(postcss@8.5.14)
 
   style-search@0.1.0: {}
 
   styled_string@0.0.1: {}
 
-  stylelint-config-recommended@13.0.0(stylelint@15.11.0(supports-color@8.1.1)):
+  stylelint-config-recommended@13.0.0(stylelint@15.11.0):
     dependencies:
-      stylelint: 15.11.0(supports-color@8.1.1)
+      stylelint: 15.11.0
 
-  stylelint-config-standard@34.0.0(stylelint@15.11.0(supports-color@8.1.1)):
+  stylelint-config-standard@34.0.0(stylelint@15.11.0):
     dependencies:
-      stylelint: 15.11.0(supports-color@8.1.1)
-      stylelint-config-recommended: 13.0.0(stylelint@15.11.0(supports-color@8.1.1))
+      stylelint: 15.11.0
+      stylelint-config-recommended: 13.0.0(stylelint@15.11.0)
 
-  stylelint-prettier@4.1.0(prettier@3.8.3)(stylelint@15.11.0(supports-color@8.1.1)):
+  stylelint-prettier@4.1.0(prettier@3.8.3)(stylelint@15.11.0):
     dependencies:
       prettier: 3.8.3
       prettier-linter-helpers: 1.0.1
-      stylelint: 15.11.0(supports-color@8.1.1)
+      stylelint: 15.11.0
 
-  stylelint@15.11.0(supports-color@8.1.1):
+  stylelint@15.11.0:
     dependencies:
       '@csstools/css-parser-algorithms': 2.7.1(@csstools/css-tokenizer@2.4.1)
       '@csstools/css-tokenizer': 2.4.1
@@ -19518,7 +19478,7 @@ snapshots:
       cosmiconfig: 8.3.6
       css-functions-list: 3.3.3
       css-tree: 2.3.1
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       fast-glob: 3.3.3
       fastest-levenshtein: 1.0.16
       file-entry-cache: 7.0.2
@@ -19617,9 +19577,9 @@ snapshots:
 
   symlink-or-copy@1.3.1: {}
 
-  sync-disk-cache@1.3.4(supports-color@8.1.1):
+  sync-disk-cache@1.3.4:
     dependencies:
-      debug: 2.6.9(supports-color@8.1.1)
+      debug: 2.6.9
       heimdalljs: 0.2.6
       mkdirp: 0.5.6
       rimraf: 2.7.1
@@ -19627,9 +19587,9 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  sync-disk-cache@2.1.0(supports-color@8.1.1):
+  sync-disk-cache@2.1.0:
     dependencies:
-      debug: 4.4.3(supports-color@8.1.1)
+      debug: 4.4.3
       heimdalljs: 0.2.6
       mkdirp: 0.5.6
       rimraf: 3.0.2
@@ -19698,7 +19658,7 @@ snapshots:
       mkdirp: 0.5.6
       rimraf: 2.6.3
 
-  terser-webpack-plugin@1.4.6(webpack@4.47.0(supports-color@8.1.1)):
+  terser-webpack-plugin@1.4.6(webpack@4.47.0):
     dependencies:
       cacache: 12.0.4
       find-cache-dir: 2.1.0
@@ -19707,21 +19667,19 @@ snapshots:
       serialize-javascript: 4.0.0
       source-map: 0.6.1
       terser: 4.8.1
-      webpack: 4.47.0(supports-color@8.1.1)
+      webpack: 4.47.0
       webpack-sources: 1.4.3
       worker-farm: 1.7.0
 
-  terser-webpack-plugin@5.6.0(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)):
+  terser-webpack-plugin@5.6.0(postcss@8.5.14)(webpack@5.106.2(postcss@8.5.14)):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
       jest-worker: 27.5.1
       schema-utils: 4.3.3
       terser: 5.47.1
-      webpack: 5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)
+      webpack: 5.106.2(postcss@8.5.14)
     optionalDependencies:
-      clean-css: 5.3.3
       postcss: 8.5.14
-      uglify-js: 3.19.3
 
   terser@4.8.1:
     dependencies:
@@ -19737,19 +19695,19 @@ snapshots:
       commander: 2.20.3
       source-map-support: 0.5.21
 
-  testem@3.20.0(@babel/core@7.29.0(supports-color@8.1.1))(debug@4.4.3(supports-color@8.1.1))(handlebars@4.7.9)(supports-color@8.1.1)(underscore@1.13.8):
+  testem@3.20.0(@babel/core@7.29.0)(handlebars@4.7.9)(underscore@1.13.8):
     dependencies:
       '@xmldom/xmldom': 0.9.10
       backbone: 1.6.1
       charm: 1.0.2
       chokidar: 5.0.0
       commander: 14.0.3
-      compression: 1.8.1(supports-color@8.1.1)
-      consolidate: 1.0.4(@babel/core@7.29.0(supports-color@8.1.1))(handlebars@4.7.9)(lodash@4.18.1)(mustache@4.2.0)(underscore@1.13.8)
+      compression: 1.8.1
+      consolidate: 1.0.4(@babel/core@7.29.0)(handlebars@4.7.9)(lodash@4.18.1)(mustache@4.2.0)(underscore@1.13.8)
       execa: 9.6.1
-      express: 5.2.1(supports-color@8.1.1)
+      express: 5.2.1
       glob: 13.0.6
-      http-proxy: 1.18.1(debug@4.4.3(supports-color@8.1.1))
+      http-proxy: 1.18.1
       js-yaml: 4.1.1
       lodash: 4.18.1
       minimatch: 10.2.5
@@ -19759,7 +19717,7 @@ snapshots:
       printf: 0.6.1
       proc-log: 6.1.0
       rimraf: 6.1.3
-      socket.io: 4.8.3(supports-color@8.1.1)
+      socket.io: 4.8.3
       spawn-args: 0.2.0
       styled_string: 0.0.1
       tap-parser: 18.3.4
@@ -19852,10 +19810,10 @@ snapshots:
       globalyzer: 0.1.0
       globrex: 0.1.2
 
-  tiny-lr@2.0.0(supports-color@8.1.1):
+  tiny-lr@2.0.0:
     dependencies:
       body: 5.1.0
-      debug: 3.2.7(supports-color@8.1.1)
+      debug: 3.2.7
       faye-websocket: 0.11.4
       livereload-js: 3.4.1
       object-assign: 4.1.1
@@ -19920,31 +19878,31 @@ snapshots:
 
   tr46@0.0.3: {}
 
-  tracked-built-ins@3.4.0(@babel/core@7.29.0(supports-color@8.1.1))(supports-color@8.1.1):
+  tracked-built-ins@3.4.0(@babel/core@7.29.0):
     dependencies:
-      '@embroider/addon-shim': 1.10.3(supports-color@8.1.1)
-      decorator-transforms: 2.4.0(@babel/core@7.29.0(supports-color@8.1.1))
-      ember-tracked-storage-polyfill: 1.0.1(supports-color@8.1.1)
+      '@embroider/addon-shim': 1.10.3
+      decorator-transforms: 2.4.0(@babel/core@7.29.0)
+      ember-tracked-storage-polyfill: 1.0.1
     transitivePeerDependencies:
       - '@babel/core'
       - supports-color
 
   tree-kill@1.2.2: {}
 
-  tree-sync@1.4.0(supports-color@8.1.1):
+  tree-sync@1.4.0:
     dependencies:
-      debug: 2.6.9(supports-color@8.1.1)
-      fs-tree-diff: 0.5.9(supports-color@8.1.1)
+      debug: 2.6.9
+      fs-tree-diff: 0.5.9
       mkdirp: 0.5.6
       quick-temp: 0.1.9
       walk-sync: 0.3.4
     transitivePeerDependencies:
       - supports-color
 
-  tree-sync@2.1.0(supports-color@8.1.1):
+  tree-sync@2.1.0:
     dependencies:
-      debug: 4.4.3(supports-color@8.1.1)
-      fs-tree-diff: 2.0.1(supports-color@8.1.1)
+      debug: 4.4.3
+      fs-tree-diff: 2.0.1
       mkdirp: 0.5.6
       quick-temp: 0.1.9
       walk-sync: 0.3.4
@@ -20198,28 +20156,28 @@ snapshots:
     dependencies:
       makeerror: 1.0.12
 
-  watch-detector@1.0.2(supports-color@8.1.1):
+  watch-detector@1.0.2:
     dependencies:
-      heimdalljs-logger: 0.1.10(supports-color@8.1.1)
-      silent-error: 1.1.1(supports-color@8.1.1)
+      heimdalljs-logger: 0.1.10
+      silent-error: 1.1.1
       tmp: 0.1.0
     transitivePeerDependencies:
       - supports-color
 
-  watchpack-chokidar2@2.0.1(supports-color@8.1.1):
+  watchpack-chokidar2@2.0.1:
     dependencies:
-      chokidar: 2.1.8(supports-color@8.1.1)
+      chokidar: 2.1.8
     transitivePeerDependencies:
       - supports-color
     optional: true
 
-  watchpack@1.7.5(supports-color@8.1.1):
+  watchpack@1.7.5:
     dependencies:
       graceful-fs: 4.2.11
       neo-async: 2.6.2
     optionalDependencies:
       chokidar: 3.6.0
-      watchpack-chokidar2: 2.0.1(supports-color@8.1.1)
+      watchpack-chokidar2: 2.0.1
     transitivePeerDependencies:
       - supports-color
 
@@ -20241,7 +20199,7 @@ snapshots:
 
   webpack-sources@3.4.1: {}
 
-  webpack@4.47.0(supports-color@8.1.1):
+  webpack@4.47.0:
     dependencies:
       '@webassemblyjs/ast': 1.9.0
       '@webassemblyjs/helper-module-context': 1.9.0
@@ -20257,19 +20215,19 @@ snapshots:
       loader-runner: 2.4.0
       loader-utils: 1.4.2
       memory-fs: 0.4.1
-      micromatch: 3.1.10(supports-color@8.1.1)
+      micromatch: 3.1.10
       mkdirp: 0.5.6
       neo-async: 2.6.2
       node-libs-browser: 2.2.1
       schema-utils: 1.0.0
       tapable: 1.1.3
-      terser-webpack-plugin: 1.4.6(webpack@4.47.0(supports-color@8.1.1))
-      watchpack: 1.7.5(supports-color@8.1.1)
+      terser-webpack-plugin: 1.4.6(webpack@4.47.0)
+      watchpack: 1.7.5
       webpack-sources: 1.4.3
     transitivePeerDependencies:
       - supports-color
 
-  webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3):
+  webpack@5.106.2(postcss@8.5.14):
     dependencies:
       '@types/eslint-scope': 3.7.7
       '@types/estree': 1.0.9
@@ -20292,7 +20250,7 @@ snapshots:
       neo-async: 2.6.2
       schema-utils: 4.3.3
       tapable: 2.3.3
-      terser-webpack-plugin: 5.6.0(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3)(webpack@5.106.2(clean-css@5.3.3)(postcss@8.5.14)(uglify-js@3.19.3))
+      terser-webpack-plugin: 5.6.0(postcss@8.5.14)(webpack@5.106.2(postcss@8.5.14))
       watchpack: 2.5.1
       webpack-sources: 3.4.1
     transitivePeerDependencies:
@@ -20385,9 +20343,9 @@ snapshots:
     dependencies:
       errno: 0.1.8
 
-  workerpool@3.1.2(supports-color@8.1.1):
+  workerpool@3.1.2:
     dependencies:
-      '@babel/core': 7.29.0(supports-color@8.1.1)
+      '@babel/core': 7.29.0
       object-assign: 4.1.1
       rsvp: 4.8.5
     transitivePeerDependencies:

From 4b5828ca53b3dc314bb0903444c9c7695afd27c3 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Wed, 14 Oct 2026 13:48:14 +0800
Subject: [PATCH 85/87] test: keep the SMS guard off in the harness and give
 each code lookup its own row

Against core-api 1.6.69 the suite hit the real guard with its counters in the
shared cache: a second text to the same number inside a file tripped the
60-second cooldown, so driver login tests got a 429 refusal where they expect
the transport failure or the refusal they staged themselves. The bootstrap now
seeds sms.guard.enabled = false, as core-api's and storefront's do; the tests
that exercise refusals raise them from the provider fake.

The helper-seams test reused one code for two lookups and omitted the purpose;
a code is used up by the lookup that accepts it and the live-code query is per
purpose, so each check gets its own row and carries 'for'.
---
 scripts/pest-bootstrap.php                                | 4 ++++
 .../Http/Api/CustomerControllerHelperSeamsTest.php        | 8 +++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/scripts/pest-bootstrap.php b/scripts/pest-bootstrap.php
index 6ea5bf5ed..95b00ad3a 100644
--- a/scripts/pest-bootstrap.php
+++ b/scripts/pest-bootstrap.php
@@ -53,6 +53,10 @@ function config(string|array|null $key = null, mixed $default = null): mixed
             'fleetops'   => [],
             'services'   => [],
             'telematics' => [],
+            // The core SMS guard is off unless a test turns it on: its counters live in the
+            // shared cache, so one file's sends would otherwise rate-limit the next's, and
+            // a second text to the same number inside a test trips its cooldown.
+            'sms'        => ['guard' => ['enabled' => false]],
         ]));
     }
 
diff --git a/server/tests/Feature/Http/Api/CustomerControllerHelperSeamsTest.php b/server/tests/Feature/Http/Api/CustomerControllerHelperSeamsTest.php
index bd034d946..d886630d2 100644
--- a/server/tests/Feature/Http/Api/CustomerControllerHelperSeamsTest.php
+++ b/server/tests/Feature/Http/Api/CustomerControllerHelperSeamsTest.php
@@ -452,14 +452,16 @@ public function parameters()
 test('verification codes files contacts and customer auth resolve', function () {
     $connection = fleetopsCustomerHelperBoot();
     $connection->table('verification_codes')->insert(['uuid' => 'vc-1', 'subject_uuid' => 'user-1', 'subject_type' => 'user', 'code' => '123456', 'for' => 'customer_verification']);
+    // A code is used up by the lookup that accepts it, so each check gets its own row.
+    $connection->table('verification_codes')->insert(['uuid' => 'vc-2', 'subject_uuid' => 'user-1', 'subject_type' => 'user', 'code' => '654321', 'for' => 'customer_verification']);
     $connection->table('files')->insert(['uuid' => 'file-1', 'public_id' => 'file_custhelp1', 'company_uuid' => 'company-1', 'name' => 'photo.png']);
     $connection->table('contacts')->insert(['uuid' => 'contact-1', 'public_id' => 'contact_custhelp1', 'company_uuid' => 'company-1', 'name' => 'Casey', 'type' => 'customer']);
 
     $probe = new FleetOpsCustomerControllerProbe();
 
-    expect($probe->callHelper('verificationCodeExists', ['code' => '123456', 'for' => 'customer_verification']))->toBeTrue()
-        ->and($probe->callHelper('findVerificationCode', ['code' => '123456'])?->uuid)->toBe('vc-1')
-        ->and($probe->callHelper('findVerificationCode', ['code' => '999999']))->toBeNull()
+    expect($probe->callHelper('verificationCodeExists', ['code' => '654321', 'for' => 'customer_verification']))->toBeTrue()
+        ->and($probe->callHelper('findVerificationCode', ['code' => '123456', 'for' => 'customer_verification'])?->uuid)->toBe('vc-1')
+        ->and($probe->callHelper('findVerificationCode', ['code' => '999999', 'for' => 'customer_verification']))->toBeNull()
         ->and($probe->callHelper('findFileByPublicId', 'file_custhelp1')?->uuid)->toBe('file-1');
 
     expect($probe->callHelper('findCustomerContact', ['uuid' => 'contact-1'])?->name)->toBe('Casey')

From 10a5d9167016aeea6bc4028841fd9207a84a8108 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Wed, 14 Oct 2026 14:56:30 +0800
Subject: [PATCH 86/87] test: cover the order operations branches the coverage
 gate flagged

The gate never ran before: the suite failed first. With the tests passing it
reports 57 statements short across the order edit, its event, notifications,
policy, tracking publisher, payload sync and the controllers that begin and
refuse edits. This covers them: an edit's policy, marked changes, schedule,
cash, contact and item detection with the kitchen flag, orders with no or an
unsaved payload, the summary's fallbacks; order.changed's customer channel,
session editor, missing driver and null place; push builders reaching for the
FCM and APN clients; a config that cannot answer, cannot load, and times that
do not parse; route changes queued for tracking; caching switched off; the
controllers' begin, locked-edit and switched-payload cash paths; replaced
drivers told on bulk assignment; and the entity sync's non-array inputs.

The older-core branch in ApiCacheThrottle::telemetryWrite() cannot run against
the core this package requires and is marked for coverage with the reason.
---
 server/src/Support/ApiCacheThrottle.php       |   4 +
 .../tests/ApiOrderControllerContractsTest.php |  26 ++++
 .../Internal/OrderControllerHelpersTest.php   |  12 +-
 .../OrderChangeNotificationsTest.php          |   7 +
 .../Unit/Support/ApiCacheDependenciesTest.php |  10 ++
 .../Unit/Support/OrderEditPolicyTest.php      |  28 ++++
 .../Unit/Support/OrderOperationsTest.php      | 129 +++++++++++++++++-
 .../Unit/Support/TrackingPublisherTest.php    |   6 +-
 8 files changed, 213 insertions(+), 9 deletions(-)

diff --git a/server/src/Support/ApiCacheThrottle.php b/server/src/Support/ApiCacheThrottle.php
index 65b571bf9..d98f542c1 100644
--- a/server/src/Support/ApiCacheThrottle.php
+++ b/server/src/Support/ApiCacheThrottle.php
@@ -39,9 +39,13 @@ class ApiCacheThrottle
      */
     public static function telemetryWrite(Model $model, \Closure $write, int $seconds = self::LOCATION_WINDOW): mixed
     {
+        // @codeCoverageIgnoreStart
+        // fleetbase/core-api ^1.6.69, which this package requires, always has it; the
+        // branch only serves an install that pinned an older core by hand.
         if (!method_exists(ApiModelCache::class, 'withoutInvalidating')) {
             return $write();
         }
+        // @codeCoverageIgnoreEnd
 
         $result = ApiModelCache::withoutInvalidating($write);
         static::invalidate($model, $model->company_uuid, $seconds);
diff --git a/server/tests/ApiOrderControllerContractsTest.php b/server/tests/ApiOrderControllerContractsTest.php
index 5b87e94d8..228827ff1 100644
--- a/server/tests/ApiOrderControllerContractsTest.php
+++ b/server/tests/ApiOrderControllerContractsTest.php
@@ -59,6 +59,13 @@ protected function findOrder(string $id, array $with = [], array $withCount = []
         return $this->order;
     }
 
+    public ?FleetOpsApiOrderPayloadFake $switchedPayload = null;
+
+    protected function findPayloadByUuid(?string $uuid): ?Payload
+    {
+        return $this->switchedPayload;
+    }
+
     protected function beginOrderEdit(Order $order): OrderEdit
     {
         $this->edit ??= new FleetOpsApiOrderEditFake($order);
@@ -825,6 +832,25 @@ public function isString(string $key): bool
         ->and($payload->removedWaypoints)->toBeTrue();
 });
 
+test('api order controller moves the cash to collect onto the payload it switches to by id', function () {
+    $order          = new FleetOpsApiOrderCrudFake();
+    $order->payload = new FleetOpsApiOrderPayloadFake();
+    $switched       = new FleetOpsApiOrderPayloadFake();
+
+    $controller                  = new FleetOpsApiOrderCrudControllerProbe();
+    $controller->order           = $order;
+    $controller->switchedPayload = $switched;
+
+    $controller->update('order-public', new FleetOpsApiOrderUpdateRequestFake([
+        'payload'    => 'payload_public',
+        'cod_amount' => '1800',
+    ]));
+
+    expect($order->updates[0])->toMatchArray(['payload_uuid' => 'payloads-uuid'])
+        ->and($switched->getAttributes()['cod_amount'])->toBe(1800)
+        ->and($switched->savedForTest)->toBeTrue();
+});
+
 test('api order controller finds deletes and updates distance matrices without database records', function () {
     $order              = new FleetOpsApiOrderCrudFake();
     $controller         = new FleetOpsApiOrderCrudControllerProbe();
diff --git a/server/tests/Feature/Http/Internal/OrderControllerHelpersTest.php b/server/tests/Feature/Http/Internal/OrderControllerHelpersTest.php
index 1760fbc3f..f0b15b9a6 100644
--- a/server/tests/Feature/Http/Internal/OrderControllerHelpersTest.php
+++ b/server/tests/Feature/Http/Internal/OrderControllerHelpersTest.php
@@ -157,18 +157,20 @@ public function __call($method, $arguments)
     expect($valid['driver'])->toBe('22222222-2222-4222-8222-222222222222');
 });
 
-test('assign driver to orders updates the assignment column', function () {
+test('assign driver to orders updates the assignment column and tells the drivers it replaces', function () {
     $connection = fleetopsInternalOrderHelpersBoot();
     $connection->table('orders')->insert([
-        ['uuid' => 'order-1', 'company_uuid' => 'company-1'],
-        ['uuid' => 'order-2', 'company_uuid' => 'company-1'],
+        ['uuid' => 'order-1', 'company_uuid' => 'company-1', 'driver_assigned_uuid' => null],
+        ['uuid' => 'order-2', 'company_uuid' => 'company-1', 'driver_assigned_uuid' => null],
+        // already with another driver, who no longer exists: nothing to tell, nothing to fail
+        ['uuid' => 'order-3', 'company_uuid' => 'company-1', 'driver_assigned_uuid' => 'driver-gone'],
     ]);
     $driver = new Driver();
     $driver->setRawAttributes(['uuid' => 'driver-1'], true);
 
-    (new FleetOpsInternalOrderHelpersProbe())->callProtected('assignDriverToOrders', ['order-1', 'order-2'], $driver);
+    (new FleetOpsInternalOrderHelpersProbe())->callProtected('assignDriverToOrders', ['order-1', 'order-2', 'order-3'], $driver);
 
-    expect($connection->table('orders')->where('driver_assigned_uuid', 'driver-1')->count())->toBe(2);
+    expect($connection->table('orders')->where('driver_assigned_uuid', 'driver-1')->count())->toBe(3);
 });
 
 test('dispatch domain event helper emits and returns the event', function () {
diff --git a/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php b/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
index ae9005236..7fbd15f48 100644
--- a/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
+++ b/server/tests/Unit/Notifications/OrderChangeNotificationsTest.php
@@ -40,6 +40,10 @@ function fleetopsOrderChangeNotificationOrder(): Order
         ->and($notification->toArray())->toMatchArray(['event' => 'order.changed_notification', 'data' => $notification->data])
         ->and(array_map(fn ($channel) => $channel->name, $notification->broadcastOn()))->toContain('driver.driver-uuid')
         ->and((new OrderChanged(fleetopsOrderChangeNotificationOrder()))->message)->toBe('This order was changed, tap for details.');
+
+    // The push builders reach for the FCM and APN clients, which the harness does not configure
+    expect(fn () => $notification->toFcm(null))->toThrow(Exception::class)
+        ->and(fn () => $notification->toApn(null))->toThrow(Error::class);
 });
 
 test('order unassigned tells the driver the order is no longer theirs', function () {
@@ -49,4 +53,7 @@ function fleetopsOrderChangeNotificationOrder(): Order
         ->and($notification->data)->toBe(['type' => 'order_unassigned', 'id' => 'order_change'])
         ->and($notification->via(null))->toBe([FcmChannel::class, ApnChannel::class])
         ->and($notification->toArray()['event'])->toBe('order.unassigned_notification');
+
+    expect(fn () => $notification->toFcm(null))->toThrow(Exception::class)
+        ->and(fn () => $notification->toApn(null))->toThrow(Error::class);
 });
diff --git a/server/tests/Unit/Support/ApiCacheDependenciesTest.php b/server/tests/Unit/Support/ApiCacheDependenciesTest.php
index d721343e0..94135bfca 100644
--- a/server/tests/Unit/Support/ApiCacheDependenciesTest.php
+++ b/server/tests/Unit/Support/ApiCacheDependenciesTest.php
@@ -296,6 +296,16 @@ public function log(string $description): ?Spatie\Activitylog\Contracts\Activity
     app()->forgetInstance(Spatie\Activitylog\ActivityLogStatus::class);
 });
 
+test('throttled invalidation does nothing while api caching is off', function () {
+    config(['api.cache.enabled' => false]);
+
+    ApiCacheThrottle::invalidate(new Vehicle(), 'co-1');
+
+    config(['api.cache.enabled' => true]);
+
+    expect(apiCacheQueryVersion('vehicles', 'co-1'))->toBe(0);
+});
+
 test('a cache outage never fails a throttled location invalidation', function () {
     Cache::swap(new Repository(new class extends ArrayStore {
         public function add($key, $value, $seconds)
diff --git a/server/tests/Unit/Support/OrderEditPolicyTest.php b/server/tests/Unit/Support/OrderEditPolicyTest.php
index 8153865e0..802883f23 100644
--- a/server/tests/Unit/Support/OrderEditPolicyTest.php
+++ b/server/tests/Unit/Support/OrderEditPolicyTest.php
@@ -126,3 +126,31 @@ function fleetopsEditPolicyOrder(string $status, array $attributes = [], ?OrderC
         ->and((array) $serialized['restrictions'])->toBe(['items' => 'removal_only', 'schedule' => 'earlier_only'])
         ->and(fleetopsEditPolicyOrder('ready')->editPolicy())->toBeInstanceOf(OrderEditPolicy::class);
 });
+
+class FleetOpsEditPolicyBrokenConfig extends OrderConfig
+{
+    public function isTerminalActivityCode(?string $code): bool
+    {
+        throw new RuntimeException('activities unavailable');
+    }
+}
+
+class FleetOpsEditPolicyOrderWithoutDatabase extends Order
+{
+    public function orderConfig(): Illuminate\Database\Eloquent\Relations\BelongsTo
+    {
+        throw new RuntimeException('no database');
+    }
+}
+
+test('a config that cannot answer, a config that cannot load and times that do not parse all fail safe', function () {
+    $brokenConfig = OrderEditPolicy::for(fleetopsEditPolicyOrder('custom_status', [], new FleetOpsEditPolicyBrokenConfig()));
+
+    $withoutDatabase = new FleetOpsEditPolicyOrderWithoutDatabase();
+    $withoutDatabase->setRawAttributes(['uuid' => 'order-uuid', 'public_id' => 'order_policy', 'status' => 'custom_status'], true);
+
+    expect($brokenConfig->isTerminal())->toBeFalse()
+        ->and(OrderEditPolicy::for($withoutDatabase)->isTerminal())->toBeFalse()
+        // "earlier only" cannot be judged from times that do not parse, so the move is refused
+        ->and(OrderEditPolicy::for(fleetopsEditPolicyOrder('ready'))->check('schedule', ['from' => 'soon', 'to' => 'later']))->toBeString();
+});
diff --git a/server/tests/Unit/Support/OrderOperationsTest.php b/server/tests/Unit/Support/OrderOperationsTest.php
index 5ac197271..b84999e24 100644
--- a/server/tests/Unit/Support/OrderOperationsTest.php
+++ b/server/tests/Unit/Support/OrderOperationsTest.php
@@ -16,6 +16,8 @@ function event(...$arguments)
 }
 
 use Fleetbase\FleetOps\Events\OrderChanged;
+use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
+use Fleetbase\FleetOps\Models\Contact;
 use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\FleetOps\Models\Entity;
 use Fleetbase\FleetOps\Models\Order;
@@ -73,6 +75,30 @@ public function listen($events, $listener = null)
     }
 }
 
+class FleetOpsOrderOpsPayloadControllerProbe extends Fleetbase\FleetOps\Http\Controllers\Api\v1\PayloadController
+{
+    public function edit(Order $order): OrderEdit
+    {
+        return $this->beginOrderEdit($order);
+    }
+}
+
+class FleetOpsOrderOpsEntityControllerProbe extends Fleetbase\FleetOps\Http\Controllers\Api\v1\EntityController
+{
+    public function editFor(?string $payloadUuid): ?OrderEdit
+    {
+        return $this->orderEditForPayload($payloadUuid);
+    }
+}
+
+class FleetOpsOrderOpsApiOrderControllerProbe extends Fleetbase\FleetOps\Http\Controllers\Api\v1\OrderController
+{
+    public function locked(OrderEditLockedException $exception): mixed
+    {
+        return $this->lockedEditResponse($exception);
+    }
+}
+
 class FleetOpsOrderOpsDriver extends Driver
 {
     public array $notified = [];
@@ -111,7 +137,7 @@ public function __call($method, $arguments)
         }
     });
     Illuminate\Support\Facades\DB::clearResolvedInstance('db');
-    class_exists(Fleetbase\FleetOps\Models\Contact::class);
+    class_exists(Contact::class);
 
     foreach (['DNS2D', 'DNS1D'] as $barcode) {
         app()->instance($barcode, new class {
@@ -222,7 +248,11 @@ function fleetopsOrderOpsOrder(SQLiteConnection $connection, array $order = [],
         ->and($result['updated'])->toBe([$latte->uuid])
         ->and($result['deleted'])->toBe([$muffin->uuid])
         ->and($result['created'])->toHaveCount(1)
-        ->and($payload->syncEntities([['uuid' => $latte->uuid, 'name' => 'Latte', 'price' => '500']])['updated'])->toBe([]);
+        ->and($payload->syncEntities([['uuid' => $latte->uuid, 'name' => 'Latte', 'price' => '500']])['updated'])->toBe([])
+        // entries that are not arrays are skipped, and a list that is not an array changes nothing
+        ->and($payload->syncEntities([['uuid' => $latte->uuid, 'name' => 'Latte', 'price' => '500'], 'junk'])['deleted'])->toBe([])
+        ->and($payload->syncEntities('junk'))->toBe(['created' => [], 'updated' => [], 'deleted' => []])
+        ->and(Entity::where('payload_uuid', 'payload-1')->count())->toBe(1);
 });
 
 test('route signatures report changed parts and a not started order restarts at the first stop', function () {
@@ -369,7 +399,7 @@ function fleetopsOrderOpsOrder(SQLiteConnection $connection, array $order = [],
     $edit->guard($edit->requestedChanges(['entities' => [['id' => $latte->public_id]], 'scheduled_at' => '2026-10-13 11:00:00'], OrderEdit::ENTITIES_REPLACE));
 
     expect(fn () => $edit->guard($edit->requestedChanges(['entities' => [['name' => 'Cake']]])))
-        ->toThrow(Fleetbase\FleetOps\Exceptions\OrderEditLockedException::class, 'Once the order is ready, items can only be removed.')
+        ->toThrow(OrderEditLockedException::class, 'Once the order is ready, items can only be removed.')
         ->and(OrderEdit::entitiesMode('replace'))->toBe('replace')
         ->and(OrderEdit::entitiesMode('sync'))->toBe('replace')
         ->and(OrderEdit::entitiesMode(null))->toBe('append');
@@ -387,5 +417,98 @@ function fleetopsOrderOpsOrder(SQLiteConnection $connection, array $order = [],
     expect($events)->toHaveCount(1)
         ->and($events[0]->broadcastAs())->toBe('order.driver_unassigned')
         ->and($events[0]->channelNames)->toBe(['driver.driver_one', 'driver.driver-1', 'company.company-1'])
+        ->and(array_map(fn ($channel) => $channel->name, $events[0]->broadcastOn()))->toBe($events[0]->channelNames)
         ->and($events[0]->broadcastWith()['data'])->toBe(['id' => 'order_one', 'driver' => 'driver_one']);
 });
+
+test('an edit exposes its policy and detects schedule cash contact and item changes, flagging the kitchen while preparing', function () {
+    $connection = fleetopsOrderOpsBoot();
+    $connection->table('contacts')->insert(['uuid' => 'contact-1', 'public_id' => 'contact_one', 'company_uuid' => 'company-1', 'name' => 'Ada', 'type' => 'customer']);
+    $order = fleetopsOrderOpsOrder($connection, [
+        'status'        => 'preparing',
+        'scheduled_at'  => '2026-10-13 12:00:00',
+        'notes'         => 'Same',
+        'customer_uuid' => 'contact-1',
+        'customer_type' => Contact::class,
+    ], ['cod_amount' => '0']);
+    $edit = OrderEdit::begin($order);
+
+    expect($edit->policy())->toBeInstanceOf(Fleetbase\FleetOps\Support\OrderEditPolicy::class)
+        ->and($edit->requestedChanges([
+            // a time that does not parse is kept as given, and still counts as a change
+            'scheduled_at' => 'not a date',
+            'notes'        => 'Ring twice',
+            'cod_amount'   => '12.50',
+            'customer'     => 'contact_two',
+        ]))->toBe([
+            'schedule'   => ['from' => '2026-10-13T12:00:00Z', 'to' => 'not a date'],
+            'notes'      => true,
+            'cod_amount' => true,
+            'contact'    => true,
+        ])
+        // the customer already on the order, by public id, is not a change; anything but a public id is
+        ->and($edit->requestedChanges(['customer' => 'contact_one']))->toBe([])
+        ->and($edit->requestedChanges(['customer' => 'contact-1']))->toBe([])
+        ->and($edit->requestedChanges(['customer' => ['id' => 'contact_one']]))->toBe(['contact' => true]);
+
+    $edit = OrderEdit::begin($order);
+    $edit->markChanged('total', 'total');
+    $connection->table('payloads')->where('uuid', 'payload-1')->update(['cod_amount' => '900']);
+    $order->payload->setEntities([['name' => 'Latte']]);
+    $order->scheduled_at  = '2026-10-14 09:30:00';
+    $order->customer_uuid = 'contact-2';
+    $order->save();
+
+    expect($edit->commit())->toBe(['items', 'cod_amount', 'schedule', 'contact', 'total'])
+        ->and(fleetopsOrderOpsEvents()->of(OrderChanged::class)[0]->data['summary'])->toContain('Rescheduled to 14 Oct 09:30')
+        ->and(OrderEdit::summarize(['pickup', 'schedule'], null, null))->toBe('Pickup changed · Schedule cleared')
+        ->and(OrderEdit::summarize(['service_type']))->toBe('Service type changed');
+});
+
+test('an order with no payload, or an unsaved one, commits without touching the database', function () {
+    $connection = fleetopsOrderOpsBoot();
+    $connection->table('orders')->insert(['uuid' => 'order-2', 'public_id' => 'order_two', 'company_uuid' => 'company-1', 'status' => 'created']);
+
+    $bare = Order::where('uuid', 'order-2')->first();
+    expect(OrderEdit::begin($bare)->commit())->toBe([]);
+
+    $unsaved = Order::where('uuid', 'order-2')->first();
+    $unsaved->setRelation('payload', new Payload());
+    expect(OrderEdit::begin($unsaved)->commit())->toBe([])
+        ->and(fleetopsOrderOpsEvents()->of(OrderChanged::class))->toBe([]);
+});
+
+test('order changed names the customer channel, reads the editor from the session and copes with a driver that is gone', function () {
+    $connection = fleetopsOrderOpsBoot();
+    $connection->table('contacts')->insert(['uuid' => 'contact-1', 'public_id' => 'contact_one', 'company_uuid' => 'company-1', 'name' => 'Ada', 'type' => 'customer']);
+    $order = fleetopsOrderOpsOrder($connection, ['driver_assigned_uuid' => 'ghost-driver', 'customer_uuid' => 'contact-1', 'customer_type' => Contact::class]);
+    // No users table here: the editor's name lookup fails quietly
+    session(['user' => 'user-1']);
+
+    $event = OrderChanged::dispatchFor($order, ['dropoff'], 'Drop-off changed');
+    session(['user' => null]);
+
+    $noDriver = new Order();
+    $noDriver->setRawAttributes(['uuid' => 'order-9', 'public_id' => 'order_nine'], true);
+
+    expect($event->channelNames)->toBe(['order.order_one', 'order.order-1', 'driver.ghost-driver', 'customer.contact_one', 'company.company-1'])
+        ->and(array_map(fn ($channel) => $channel->name, $event->broadcastOn()))->toBe($event->channelNames)
+        ->and($event->data['changed_by'])->toBeNull()
+        ->and(OrderChanged::notifyDriver($order, $event))->toBeFalse()
+        ->and(OrderChanged::assignedDriver($noDriver))->toBeNull()
+        ->and(OrderChanged::placeData(null))->toBeNull();
+});
+
+test('the api controllers begin an order edit for a payload and answer a locked edit with 422', function () {
+    $connection = fleetopsOrderOpsBoot();
+    $order      = fleetopsOrderOpsOrder($connection);
+
+    $response = (new FleetOpsOrderOpsApiOrderControllerProbe())->locked(new OrderEditLockedException(['items' => 'Items cannot be changed once a driver has the order.']));
+
+    expect((new FleetOpsOrderOpsPayloadControllerProbe())->edit($order))->toBeInstanceOf(OrderEdit::class)
+        ->and((new FleetOpsOrderOpsEntityControllerProbe())->editFor('payload-1'))->toBeInstanceOf(OrderEdit::class)
+        ->and((new FleetOpsOrderOpsEntityControllerProbe())->editFor('payload-missing'))->toBeNull()
+        ->and((new FleetOpsOrderOpsEntityControllerProbe())->editFor(null))->toBeNull()
+        ->and($response->getStatusCode())->toBe(422)
+        ->and($response->getData(true)['locked'])->toBe(['items' => 'Items cannot be changed once a driver has the order.']);
+});
diff --git a/server/tests/Unit/Support/TrackingPublisherTest.php b/server/tests/Unit/Support/TrackingPublisherTest.php
index b588b462a..1ef383f22 100644
--- a/server/tests/Unit/Support/TrackingPublisherTest.php
+++ b/server/tests/Unit/Support/TrackingPublisherTest.php
@@ -267,12 +267,16 @@ function trackingPublisherUseStops(Collection $stops, array|Throwable $tracker =
     $unsaved         = trackingPublisherOrder(['uuid' => null]);
     $unsaved->status = 'started';
     $unsaved->syncChanges();
-    expect($publisher->orderChanged($unsaved))->toBeFalse();
+    expect($publisher->orderChanged($unsaved))->toBeFalse()
+        // an edited route queues its own update; an unsaved order has nothing to publish
+        ->and($publisher->routeChanged($order))->toBeTrue()
+        ->and($publisher->routeChanged($unsaved))->toBeFalse();
 
     expect(array_map(fn ($dispatch) => [$dispatch['job'], ...$dispatch['arguments']], DispatchRecorder::$dispatched))->toBe([
         [PublishTrackingUpdate::class, 'order-started', 'eta', 'mysql'],
         [PublishTrackingUpdate::class, 'order-started', 'assignment', 'mysql'],
         [PublishTrackingUpdate::class, 'order-started', 'status', 'mysql'],
+        [PublishTrackingUpdate::class, 'order-started', 'route', 'mysql'],
     ]);
 });
 

From 7cb016e214bebd3a6c34dd91187c851e59e3b40d Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Wed, 14 Oct 2026 15:58:14 +0800
Subject: [PATCH 87/87] ci: track the shared API contract workflow on main

The contract caller pinned fleetbase/fleetbase at a commit from before the run-order
fixes that the Fleetbase API collection now needs (tracking deletes ahead of the
order delete, the self-terminating activity cycle). Storefront's caller is
deliberately unpinned for the same reason; this matches it. Each run still records
the image digest it resolved.
---
 .github/workflows/postman.yml | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/postman.yml b/.github/workflows/postman.yml
index d58143299..157d770b0 100644
--- a/.github/workflows/postman.yml
+++ b/.github/workflows/postman.yml
@@ -5,9 +5,16 @@ name: API Contract (Postman)
 # fleetbase/fleetbase. Requires org secrets POSTMAN_API_KEY + _GITHUB_AUTH_TOKEN
 # (inherited); no-ops until POSTMAN_API_KEY is set.
 #
-# Pin the workflow and host checkout together so branch installation resolves the
-# required published Core release before migrating and exercising this module.
-# The workflow records the API image digest and resolved dependencies for traceability.
+# Deliberately unpinned, like storefront's. The reusable workflow defaults to booting
+# fleetbase/fleetbase@main against fleetbase/fleetbase-api:latest, so every release and
+# every fix to the run order (scripts/ci/order-collection-requests.py) is picked up
+# automatically, with no ref here to remember to bump. Each run records the image digest
+# it actually resolved in its job summary, so a result stays traceable. To reproduce an
+# older run:
+#
+#   with:
+#     fleetbase-ref: v0.7.53
+#     api-image: fleetbase/fleetbase-api:v0.7.53
 
 on:
   push:
@@ -20,9 +27,8 @@ permissions:
 
 jobs:
   contract:
-    uses: fleetbase/fleetbase/.github/workflows/api-contract.yml@880c7392c67c93e3a65f01916d7a04036c098935
+    uses: fleetbase/fleetbase/.github/workflows/api-contract.yml@main
     with:
-      fleetbase-ref: 880c7392c67c93e3a65f01916d7a04036c098935
       collections: "Fleetbase API"
       build-from-source: false
       # Without this the run tests the version of fleetbase/fleetops-api baked into the