diff --git a/api/src/models/user.model.js b/api/src/models/user.model.js
index ad5b56669..fccebd25f 100644
--- a/api/src/models/user.model.js
+++ b/api/src/models/user.model.js
@@ -1040,6 +1040,20 @@ userSchema.statics.userInsertUpdate = async function (data, id, context) {
     const verify_password = data.check_password;
     let password = '';
     if (verify_password === 'yes' && data.usertype !== 'api') {
+      if (
+        typeof data.password !== 'string' ||
+        data.password.length < 5 ||
+        data.password.length > 20
+      ) {
+        return {
+          status: false,
+          data: null,
+          message: 'Password must contain between 5 and 20 characters',
+        };
+      }
+      if (data.retype_password !== undefined && data.retype_password !== data.password) {
+        return { status: false, data: null, message: 'Passwords do not match' };
+      }
       // PHP: 'password' => 'trim|base64_encode' filter applied first
       const base64Password = Buffer.from(data.password).toString('base64');
       password = await bcrypt.hash(base64Password, 12);
@@ -1336,6 +1350,13 @@ userSchema.statics.userInsertUpdate = async function (data, id, context) {
       license: context.license,
     };
 
+    // updateOne does not run the save hook. Explicit resets must persist the
+    // hash and invalidate older sessions; ordinary edits preserve credentials.
+    if (id && verify_password === 'yes' && data.usertype !== 'api') {
+      updateData.password = password;
+      updateData.passwordChangedAt = new Date();
+    }
+
     // Existing API credentials are write-only: a blank edit keeps the key.
     if (id && data.usertype === 'api' && !appKey.trim()) delete updateData.apikey;
 
diff --git a/api/src/repositories/sale.repository.js b/api/src/repositories/sale.repository.js
index d30dda77c..b27adc198 100644
--- a/api/src/repositories/sale.repository.js
+++ b/api/src/repositories/sale.repository.js
@@ -1,3 +1,4 @@
+const { recordedUserName } = require('../utils/recorded-user-name');
 const { reportableSales, reportSaleTotal } = require('../helpers/reportable-sales');
 const pricingAuthority = require('../services/pricing-authority');
 const Money = require('../utils/currency');
@@ -4102,6 +4103,7 @@ class SalesRepository {
         branch_name: 1,
         user_id: 1,
         user_name: 1,
+        'origin.actor_name': 1,
         sales_id: 1,
         date: 1,
         items: 1,
@@ -4175,6 +4177,10 @@ class SalesRepository {
         .lean();
 
       const list = (Array.isArray(rawList) ? rawList : []).map((row) => {
+        row = {
+          ...row,
+          user_name: recordedUserName(row.user_name, row.created_by, row.origin?.actor_name),
+        };
         if (!row.captain_payments?.length || row.payment_status !== 'Paid') return row;
         const digits = row.captain_transfer_allocation?.currencyDigits;
         return {
@@ -4459,6 +4465,7 @@ class SalesRepository {
         branch_name: 1,
         user_id: 1,
         user_name: 1,
+        'origin.actor_name': 1,
         sales_id: 1,
         date: 1,
         items: 1,
@@ -4528,7 +4535,10 @@ class SalesRepository {
         .limit(limit)
         .lean();
 
-      const list = Array.isArray(rawList) ? rawList : [];
+      const list = (Array.isArray(rawList) ? rawList : []).map((row) => ({
+        ...row,
+        user_name: recordedUserName(row.user_name, row.created_by, row.origin?.actor_name),
+      }));
 
       const total = await Model.countDocuments(filters);
 
diff --git a/api/src/services/tax-reporting/decimal.js b/api/src/services/tax-reporting/decimal.js
new file mode 100644
index 000000000..171a5d6e7
--- /dev/null
+++ b/api/src/services/tax-reporting/decimal.js
@@ -0,0 +1,41 @@
+'use strict';
+
+// Reporting uses exact decimal strings. Never silently round a source value or
+// coerce missing/invalid evidence to zero. JSON output must not contain BigInt.
+function decimal(value) {
+  if (typeof value !== 'string' || !/^-?\d{1,30}(?:\.\d{1,12})?$/.test(value)) {
+    throw new TypeError('Expected a decimal string with at most 12 decimal places');
+  }
+  const [whole, fraction = ''] = value.split('.');
+  return { units: BigInt(whole + fraction), scale: fraction.length };
+}
+
+function format(units, scale) {
+  const sign = units < 0n ? '-' : '';
+  const digits = (units < 0n ? -units : units).toString().padStart(scale + 1, '0');
+  if (!scale) return sign + digits;
+  return (sign + digits.slice(0, -scale) + '.' + digits.slice(-scale))
+    .replace(/0+$/, '')
+    .replace(/\.$/, '');
+}
+
+function sum(values) {
+  const parsed = values.map(decimal);
+  const scale = parsed.reduce((maximum, n) => Math.max(maximum, n.scale), 0);
+  return format(
+    parsed.reduce((total, n) => total + n.units * 10n ** BigInt(scale - n.scale), 0n),
+    scale
+  );
+}
+
+function negate(value) {
+  const n = decimal(value);
+  return format(-n.units, n.scale);
+}
+
+function nonNegative(value) {
+  if (decimal(value).units < 0n) throw new RangeError('Expected a non-negative source amount');
+  return sum([value]);
+}
+
+module.exports = { sum, negate, nonNegative };
diff --git a/api/src/services/tax-reporting/ledger.js b/api/src/services/tax-reporting/ledger.js
new file mode 100644
index 000000000..0f94fa407
--- /dev/null
+++ b/api/src/services/tax-reporting/ledger.js
@@ -0,0 +1,177 @@
+'use strict';
+
+const { sum, negate, nonNegative } = require('./decimal');
+const { calendarPeriod } = require('./period');
+const moment = require('moment-timezone');
+
+const SOURCES = ['sales', 'purchases', 'salesAdjustments', 'purchaseAdjustments', 'expenses'];
+const TYPES = {
+  sale: ['sales', 'sales', 1],
+  purchase: ['purchases', 'purchases', 1],
+  saleCredit: ['salesAdjustments', 'sales', -1],
+  saleDebit: ['salesAdjustments', 'sales', 1],
+  purchaseCredit: ['purchaseAdjustments', 'purchases', -1],
+  purchaseDebit: ['purchaseAdjustments', 'purchases', 1],
+  expense: ['expenses', 'expenses', 1],
+};
+const NATURES = ['taxable', 'exempt', 'nilRated', 'nonTax', 'zeroRated', 'unknown'];
+
+function required(value, name) {
+  if (typeof value !== 'string' || !value.trim()) throw new TypeError(name + ' is required');
+  return value;
+}
+
+function instant(value) {
+  if (typeof value !== 'string' || !/^\d{4}-\d\d-\d\dT.*(?:Z|[+-]\d\d:\d\d)$/.test(value)) {
+    throw new TypeError('Document date requires an explicit UTC offset');
+  }
+  const result = moment.parseZone(value, moment.ISO_8601, true);
+  if (!result.isValid()) throw new TypeError('Invalid document date');
+  return result.toDate();
+}
+
+/**
+ * Pure aggregation boundary for source adapters. Scope comes from an authorised
+ * server context; callers must also scope their database queries. Input records
+ * are immutable document snapshots, not unwound rows or current item masters.
+ * This function neither grants credit nor prepares a statutory return.
+ */
+function buildLedger({ scope, period: requestedPeriod, sources, documents }) {
+  for (const key of ['tenantId', 'registrationId', 'currency']) required(scope[key], key);
+  if (!Array.isArray(scope.branchIds) || !scope.branchIds.length) {
+    throw new TypeError('At least one authorised branch is required');
+  }
+  scope.branchIds.forEach((id) => required(id, 'branchId'));
+  const period = calendarPeriod(requestedPeriod);
+  const exceptions = [];
+  const coverage = SOURCES.map((name) => {
+    const source = sources?.[name];
+    const complete =
+      source?.status === 'complete' && typeof source.watermark === 'string' && !!source.watermark;
+    if (!complete) exceptions.push({ code: 'SOURCE_INCOMPLETE', source: name });
+    return { source: name, complete, watermark: source?.watermark || null };
+  });
+  const registers = { sales: [], purchases: [], expenses: [] };
+  const seen = new Set();
+  const excluded = [];
+
+  for (const document of documents) {
+    const type = TYPES[document.type];
+    if (!type) throw new TypeError('Unsupported tax document type');
+    for (const key of ['tenantId', 'registrationId', 'currency']) {
+      if (document[key] !== scope[key]) throw new Error('Document is outside report scope: ' + key);
+    }
+    if (!scope.branchIds.includes(document.branchId))
+      throw new Error('Unauthorised document branch');
+    const sourceId = required(document.sourceId, 'sourceId');
+    required(document.revision, 'revision');
+    const identity = JSON.stringify([type[0], document.branchId, sourceId]);
+    if (seen.has(identity)) throw new Error('Duplicate source document: ' + sourceId);
+    seen.add(identity);
+    const date = instant(document.documentDate);
+    if (date < period.start || date >= period.endExclusive) {
+      excluded.push({ sourceId, source: type[0], reason: 'OUTSIDE_PERIOD' });
+      continue;
+    }
+    // Source adapters must explicitly resolve holds, cancellations and deletes.
+    // An unknown status cannot silently become either an invoice or a reversal.
+    if (document.status !== 'posted') throw new Error('Unresolved document status: ' + sourceId);
+    if (type[0].endsWith('Adjustments')) required(document.originalSourceId, 'originalSourceId');
+    const sign = (value) => (type[2] < 0 ? negate(nonNegative(value)) : nonNegative(value));
+    const gross = sign(document.gross);
+    const row = {
+      sourceId,
+      source: type[0],
+      type: document.type,
+      revision: document.revision,
+      branchId: document.branchId,
+      documentDate: document.documentDate,
+      originalSourceId: document.originalSourceId || null,
+      gross,
+      lines: [],
+    };
+    if (document.type === 'expense' && document.taxEvidence === 'notRecorded') {
+      row.net = null;
+      row.tax = null;
+      row.taxEvidence = 'notRecorded';
+      exceptions.push({ code: 'EXPENSE_TAX_NOT_RECORDED', sourceId });
+    } else {
+      if (!Array.isArray(document.lines) || !document.lines.length) {
+        throw new TypeError('Document lines are required: ' + sourceId);
+      }
+      const lineIds = new Set();
+      row.lines = document.lines.map((line) => {
+        const lineId = required(line.lineId, 'lineId');
+        if (lineIds.has(lineId)) throw new Error('Duplicate line identity: ' + sourceId);
+        lineIds.add(lineId);
+        const net = sign(line.net);
+        const tax = sign(line.tax);
+        const quantity = sign(line.quantity);
+        if (!NATURES.includes(line.nature)) throw new TypeError('Supply nature must be explicit');
+        if (line.nature === 'unknown')
+          exceptions.push({ code: 'SUPPLY_NATURE_UNKNOWN', sourceId, lineId });
+        // Missing classification is retained. Never fetch a current HSN/rate.
+        return {
+          lineId,
+          net,
+          tax,
+          quantity,
+          nature: line.nature,
+          hsn: line.hsn || null,
+          unit: line.unit || null,
+        };
+      });
+      row.net = sum(row.lines.map((line) => line.net));
+      row.tax = sum(row.lines.map((line) => line.tax));
+      // Round-off is a signed source value, unlike gross and line magnitudes.
+      row.adjustment =
+        type[2] < 0 ? negate(document.adjustment ?? '0') : sum([document.adjustment ?? '0']);
+      const difference = sum([gross, negate(row.net), negate(row.tax), negate(row.adjustment)]);
+      row.difference = difference;
+      if (difference !== '0')
+        exceptions.push({ code: 'DOCUMENT_TOTAL_MISMATCH', sourceId, difference });
+    }
+    registers[type[1]].push(row);
+  }
+
+  const observedTotals = Object.fromEntries(
+    Object.entries(registers).map(([name, rows]) => [
+      name,
+      {
+        documents: rows.length,
+        gross: sum(rows.map((row) => row.gross)),
+        net: rows.some((row) => row.net === null) ? null : sum(rows.map((row) => row.net)),
+        tax: rows.some((row) => row.tax === null) ? null : sum(rows.map((row) => row.tax)),
+      },
+    ])
+  );
+  const totals = Object.fromEntries(
+    Object.entries(observedTotals).map(([name, values]) => {
+      const dependencies =
+        name === 'expenses'
+          ? ['expenses']
+          : [name, name === 'sales' ? 'salesAdjustments' : 'purchaseAdjustments'];
+      const complete = dependencies.every(
+        (source) => coverage.find((entry) => entry.source === source).complete
+      );
+      return [name, complete ? values : { documents: null, gross: null, net: null, tax: null }];
+    })
+  );
+  return {
+    schemaVersion: 1,
+    scope: { ...scope, branchIds: [...scope.branchIds] },
+    period,
+    status: exceptions.length ? 'needsAttention' : 'readyForReview',
+    coverage,
+    registers,
+    totals,
+    observedTotals,
+    exceptions,
+    excluded,
+    recordedPurchaseTax: totals.purchases.tax,
+    reviewedEligibleCredit: null,
+    filingReady: false,
+  };
+}
+
+module.exports = { buildLedger, SOURCES };
diff --git a/api/src/services/tax-reporting/period.js b/api/src/services/tax-reporting/period.js
new file mode 100644
index 000000000..f9a74a441
--- /dev/null
+++ b/api/src/services/tax-reporting/period.js
@@ -0,0 +1,22 @@
+'use strict';
+
+const moment = require('moment-timezone');
+
+// A calendar period belongs to the registration timezone, not the server's.
+function calendarPeriod({ from, through, timezone }) {
+  if (!moment.tz.zone(timezone)) throw new RangeError('A valid reporting timezone is required');
+  const start = moment.tz(from, 'YYYY-MM-DD', true, timezone);
+  const last = moment.tz(through, 'YYYY-MM-DD', true, timezone);
+  if (!start.isValid() || !last.isValid() || last.isBefore(start)) {
+    throw new RangeError('A valid inclusive calendar date range is required');
+  }
+  return {
+    from,
+    through,
+    timezone,
+    start: start.toDate(),
+    endExclusive: last.add(1, 'day').startOf('day').toDate(),
+  };
+}
+
+module.exports = { calendarPeriod };
diff --git a/api/src/utils/recorded-user-name.js b/api/src/utils/recorded-user-name.js
new file mode 100644
index 000000000..218ce00fd
--- /dev/null
+++ b/api/src/utils/recorded-user-name.js
@@ -0,0 +1,17 @@
+'use strict';
+
+// Use the recorded creator, never whoever happens to be viewing/editing a bill.
+function recordedUserName(...values) {
+  return (
+    values
+      .find(
+        (value) =>
+          typeof value === 'string' &&
+          value.trim() &&
+          !/^(undefined|null|\[object Object\])$/i.test(value.trim())
+      )
+      ?.trim() || ''
+  );
+}
+
+module.exports = { recordedUserName };
diff --git a/api/tests/unit/security/reported-tenant-boundaries.test.js b/api/tests/unit/security/reported-tenant-boundaries.test.js
index ae35000ab..0c4a9274e 100644
--- a/api/tests/unit/security/reported-tenant-boundaries.test.js
+++ b/api/tests/unit/security/reported-tenant-boundaries.test.js
@@ -294,3 +294,156 @@ test('API key validation allows blank edits but rejects blank creates and short
     ).toBe(invalid);
   }
 });
+
+test('explicit staff password reset persists the hash and revokes old sessions without changing other tenants', async () => {
+  const User = require('../../../src/models/user.model');
+  const bcrypt = require('bcryptjs');
+  const id = new ObjectId();
+  const original = await bcrypt.hash(Buffer.from('Old@12345').toString('base64'), 4);
+  await db.collection('users').insertOne({
+    _id: id,
+    license: licenseA,
+    username: 'staff',
+    email: 'staff@example.com',
+    password: original,
+    usertype: 'staff',
+  });
+  await db.collection('branches').insertOne({ _id: branchA, license: licenseA, branch_name: 'A' });
+  const plan = jest.spyOn(BaseModel.prototype, 'checkPlan').mockResolvedValue(0);
+  const log = jest.spyOn(BaseModel.prototype, 'changeLog').mockResolvedValue();
+  try {
+    const data = {
+      usertype: 'staff',
+      name: 'staff',
+      email: 'staff@example.com',
+      firstname: 'Staff',
+      branch_data: [{ branch_id: String(branchA), branch_name: 'A' }],
+      user_status: 'active',
+      check_password: 'no',
+    };
+    const context = {
+      license: licenseA,
+      user: { ...request(id).user, username: 'owner', usertype: 'super_admin' },
+    };
+    expect((await User.userInsertUpdate(data, String(id), context)).status).toBe(true);
+    expect((await db.collection('users').findOne({ _id: id })).password).toBe(original);
+    for (const password of ['', 'a']) {
+      expect(
+        (
+          await User.userInsertUpdate(
+            { ...data, check_password: 'yes', password },
+            String(id),
+            context
+          )
+        ).status
+      ).toBe(false);
+    }
+    expect(
+      (
+        await User.userInsertUpdate(
+          { ...data, check_password: 'yes', password: 'New@12345', retype_password: 'Different' },
+          String(id),
+          context
+        )
+      ).status
+    ).toBe(false);
+    expect(
+      (
+        await User.userInsertUpdate(
+          { ...data, check_password: 'yes', password: 'New@12345', retype_password: 'New@12345' },
+          String(id),
+          context
+        )
+      ).status
+    ).toBe(true);
+    const stored = await db.collection('users').findOne({ _id: id });
+    expect(await bcrypt.compare(Buffer.from('New@12345').toString('base64'), stored.password)).toBe(
+      true
+    );
+    expect(await bcrypt.compare(Buffer.from('Old@12345').toString('base64'), stored.password)).toBe(
+      false
+    );
+    expect(User.hydrate(stored).changedPasswordAfter(Math.floor(Date.now() / 1000) - 60)).toBe(
+      true
+    );
+    await User.userInsertUpdate(
+      { ...data, check_password: 'yes', password: 'Wrong@12345' },
+      String(id),
+      { ...context, license: licenseB }
+    );
+    expect((await db.collection('users').findOne({ _id: id })).password).toBe(stored.password);
+  } finally {
+    plan.mockRestore();
+    log.mockRestore();
+  }
+});
+
+test('payment reports recover Captain origin names and preserve saved POS names in tenant scope', async () => {
+  const sales = require('../../../src/repositories/sale.repository');
+  const Model =
+    mongoose.models.ReportAttribution ||
+    mongoose.model(
+      'ReportAttribution',
+      new mongoose.Schema({}, { strict: false, collection: 'sales' })
+    );
+  const template = {
+    license: licenseA,
+    branch_id: branchA,
+    date: new Date('2026-10-17T12:00:00Z'),
+    payment_status: 'Paid',
+    sale_process: 'Add',
+    sales_total: 100,
+  };
+  await db.collection('sales').deleteMany({});
+  await db.collection('sales').insertMany([
+    {
+      ...template,
+      sales_id: 'captain',
+      origin: { actor_name: 'Captain original' },
+      updated_by: 'Later cashier',
+    },
+    { ...template, sales_id: 'pos', user_name: 'POS original', origin: { actor_name: 'Other' } },
+    { ...template, sales_id: 'legacy', user_name: 'undefined', created_by: 'Legacy original' },
+    { ...template, sales_id: 'unknown' },
+    { ...template, license: licenseB, sales_id: 'foreign', origin: { actor_name: 'Foreign user' } },
+  ]);
+  const result = await runWithRequestContext({ license: licenseA, currentBranch: branchA }, () =>
+    sales.paymentSalesTransactionReportPage(
+      {
+        branchid: [String(branchA)],
+        starting_date: '2026-10-17T00:00:00Z',
+        ending_date: '2026-10-17T23:59:59Z',
+      },
+      { limit: 20 },
+      { SaleModel: Model }
+    )
+  );
+  expect(result.status).toBe(true);
+  expect(Object.fromEntries(result.data.list.map((row) => [row.sales_id, row.user_name]))).toEqual({
+    captain: 'Captain original',
+    pos: 'POS original',
+    legacy: 'Legacy original',
+    unknown: '',
+  });
+  await db.collection('sales').updateMany({}, { $set: { sale_process: 'PartialReturn' } });
+  const returned = await runWithRequestContext({ license: licenseA, currentBranch: branchA }, () =>
+    sales.paymentReturnSalesTranscationReportTable(
+      {
+        branchid: [String(branchA)],
+        starting_date: '2026-10-17T00:00:00Z',
+        ending_date: '2026-10-17T23:59:59Z',
+      },
+      { limit: 20 },
+      { SaleModel: Model }
+    )
+  );
+  expect(returned.status).toBe(true);
+  expect(
+    Object.fromEntries(returned.data.list.map((row) => [row.sales_id, row.user_name]))
+  ).toEqual({
+    captain: 'Captain original',
+    pos: 'POS original',
+    legacy: 'Legacy original',
+    unknown: '',
+  });
+});
diff --git a/api/tests/unit/services/tax-reporting-ledger.test.js b/api/tests/unit/services/tax-reporting-ledger.test.js
new file mode 100644
index 000000000..ff8d9b95b
--- /dev/null
+++ b/api/tests/unit/services/tax-reporting-ledger.test.js
@@ -0,0 +1,203 @@
+'use strict';
+
+const { buildLedger, SOURCES } = require('../../../src/services/tax-reporting/ledger');
+const { calendarPeriod } = require('../../../src/services/tax-reporting/period');
+const { sum, negate } = require('../../../src/services/tax-reporting/decimal');
+
+const scope = {
+  tenantId: 'tenant-a',
+  registrationId: 'registration-a',
+  currency: 'INR',
+  branchIds: ['branch-a'],
+};
+const period = { from: '2024-02-01', through: '2024-02-29', timezone: 'Asia/Kolkata' };
+function document(overrides = {}) {
+  return {
+    ...scope,
+    branchId: 'branch-a',
+    sourceId: 'invoice-1',
+    revision: 'revision-1',
+    type: 'sale',
+    status: 'posted',
+    documentDate: '2024-02-15T10:00:00+05:30',
+    gross: '118',
+    lines: [
+      { lineId: '1', quantity: '0.125', net: '100', tax: '18', nature: 'taxable', unit: 'kg' },
+    ],
+    ...overrides,
+  };
+}
+function run(documents, overrides = {}) {
+  return buildLedger({
+    scope,
+    period,
+    sources: Object.fromEntries(
+      SOURCES.map((name) => [name, { status: 'complete', watermark: 'cutoff-1' }])
+    ),
+    documents,
+    ...overrides,
+  });
+}
+
+describe('tax reporting exact decimals', () => {
+  test('keeps source precision and does not use floating point summation', () => {
+    expect(sum(['0.1', '0.2', '0.000001'])).toBe('0.300001');
+    expect(sum(['999999999999999999.99', '0.01'])).toBe('1000000000000000000');
+    expect(negate('-0.125')).toBe('0.125');
+  });
+  test.each([null, undefined, '', 'NaN', '1,000', '1e3', 1, '0.0000000000001'])(
+    'rejects invalid evidence %s',
+    (value) => {
+      expect(() => sum([value])).toThrow();
+    }
+  );
+  test('sums more than a spreadsheet page without an argument-stack limit', () => {
+    expect(sum(Array(150000).fill('0.01'))).toBe('1500');
+  });
+});
+
+describe('tax calendar boundaries', () => {
+  test('leap February ends at local March midnight, exclusively', () => {
+    const p = calendarPeriod(period);
+    expect(p.start.toISOString()).toBe('2024-01-31T18:30:00.000Z');
+    expect(p.endExclusive.toISOString()).toBe('2024-02-29T18:30:00.000Z');
+  });
+  test('daylight saving is a calendar day, not an added 24 hours', () => {
+    const p = calendarPeriod({
+      from: '2024-03-10',
+      through: '2024-03-10',
+      timezone: 'America/New_York',
+    });
+    expect(p.endExclusive - p.start).toBe(23 * 60 * 60 * 1000);
+  });
+  test.each([{ through: '2024-02-31' }, { timezone: 'invalid' }, { from: '2024-03-01' }])(
+    'rejects invalid period %j',
+    (change) => {
+      expect(() => calendarPeriod({ ...period, ...change })).toThrow();
+    }
+  );
+});
+
+describe('canonical tax ledger contract', () => {
+  test('equal-valued purchases remain separate documents and both count', () => {
+    const result = run([
+      document({ type: 'purchase' }),
+      document({ type: 'purchase', sourceId: 'invoice-2' }),
+    ]);
+    expect(result.totals.purchases).toEqual({ documents: 2, net: '200', tax: '36', gross: '236' });
+    expect(result.recordedPurchaseTax).toBe('36');
+    expect(result.reviewedEligibleCredit).toBeNull();
+    expect(result.filingReady).toBe(false);
+  });
+  test('mixed rate invoice gross counts once; fractional units survive', () => {
+    const first = document();
+    const result = run([
+      document({
+        gross: '223',
+        lines: [
+          ...first.lines,
+          { lineId: '2', quantity: '1.75', unit: 'meter', net: '100', tax: '5', nature: 'taxable' },
+        ],
+      }),
+    ]);
+    expect(result.totals.sales).toEqual({ documents: 1, net: '200', tax: '23', gross: '223' });
+    expect(result.registers.sales[0].lines.map((line) => line.quantity)).toEqual(['0.125', '1.75']);
+  });
+  test('source edit date never moves an invoice across reporting periods', () => {
+    expect(run([document({ updated_date: '2024-06-01' })]).totals.sales.gross).toBe('118');
+  });
+  test('includes start, excludes next period start', () => {
+    const result = run([
+      document({ documentDate: '2024-01-31T18:30:00Z' }),
+      document({ sourceId: 'next', documentDate: '2024-02-29T18:30:00Z' }),
+    ]);
+    expect(result.totals.sales.documents).toBe(1);
+    expect(result.excluded).toEqual([
+      { sourceId: 'next', source: 'sales', reason: 'OUTSIDE_PERIOD' },
+    ]);
+  });
+  test('later credit note reverses in its own period with original reference', () => {
+    const result = run([
+      document({ documentDate: '2024-01-15T10:00:00Z' }),
+      document({ type: 'saleCredit', sourceId: 'credit-1', originalSourceId: 'invoice-1' }),
+    ]);
+    expect(result.totals.sales).toEqual({ documents: 1, net: '-100', tax: '-18', gross: '-118' });
+    expect(result.registers.sales[0].originalSourceId).toBe('invoice-1');
+  });
+  test('negative source round-off reconciles without changing tax', () => {
+    const result = run([document({ gross: '117.99', adjustment: '-0.01' })]);
+    expect(result.registers.sales[0].difference).toBe('0');
+    expect(result.status).toBe('readyForReview');
+  });
+  test('missing expense tax stays unknown, never becomes credit', () => {
+    const result = run([
+      document({ type: 'expense', taxEvidence: 'notRecorded', lines: undefined }),
+    ]);
+    expect(result.totals.expenses).toEqual({ documents: 1, gross: '118', net: null, tax: null });
+    expect(result.status).toBe('needsAttention');
+    expect(result.reviewedEligibleCredit).toBeNull();
+  });
+  test('a failed or absent source cannot produce a complete report', () => {
+    const result = run([], { sources: { sales: { status: 'failed' } } });
+    expect(result.coverage.every((entry) => !entry.complete)).toBe(true);
+    expect(result.exceptions).toHaveLength(5);
+    expect(result.status).toBe('needsAttention');
+    expect(result.totals.purchases.tax).toBeNull();
+    expect(result.recordedPurchaseTax).toBeNull();
+  });
+  test('missing watermark is incomplete even if the query says complete', () => {
+    expect(run([], { sources: { sales: { status: 'complete' } } }).coverage[0].complete).toBe(
+      false
+    );
+  });
+  test('totals mismatch is exposed and retained for review', () => {
+    const result = run([document({ gross: '120' })]);
+    expect(result.exceptions).toContainEqual({
+      code: 'DOCUMENT_TOTAL_MISMATCH',
+      sourceId: 'invoice-1',
+      difference: '2',
+    });
+    expect(result.totals.sales.gross).toBe('120');
+  });
+  test.each(['tenantId', 'registrationId', 'currency', 'branchId'])(
+    'rejects out-of-scope %s',
+    (key) => {
+      expect(() => run([document({ [key]: 'other' })])).toThrow();
+    }
+  );
+  test('rejects duplicate documents instead of silently double counting', () => {
+    expect(() => run([document(), document()])).toThrow('Duplicate source document');
+  });
+  test('rejects duplicate line identities without collapsing equal-valued distinct lines', () => {
+    const doc = document();
+    expect(() => run([document({ lines: [...doc.lines, ...doc.lines] })])).toThrow(
+      'Duplicate line'
+    );
+  });
+  test.each([
+    { type: 'saleCredit' },
+    { status: 'cancelled' },
+    { documentDate: '2024-02-01' },
+    { documentDate: '2024-02-31T00:00:00Z' },
+    { gross: null },
+    { lines: [] },
+  ])('rejects unresolved source contract %j', (change) => {
+    expect(() => run([document(change)])).toThrow();
+  });
+  test('unknown supply nature stays visible and never guesses exemption', () => {
+    const doc = document();
+    doc.lines[0].nature = 'unknown';
+    const result = run([doc]);
+    expect(result.exceptions).toContainEqual({
+      code: 'SUPPLY_NATURE_UNKNOWN',
+      sourceId: 'invoice-1',
+      lineId: '1',
+    });
+  });
+  test('does not modify source documents and produces JSON-safe output', () => {
+    const doc = document();
+    const before = JSON.stringify(doc);
+    expect(() => JSON.stringify(run([doc]))).not.toThrow();
+    expect(JSON.stringify(doc)).toBe(before);
+  });
+});
diff --git a/docs/PAYMENT_ATTRIBUTION_EDITOR_FOLLOWUP.md b/docs/PAYMENT_ATTRIBUTION_EDITOR_FOLLOWUP.md
new file mode 100644
index 000000000..232e0c490
--- /dev/null
+++ b/docs/PAYMENT_ATTRIBUTION_EDITOR_FOLLOWUP.md
@@ -0,0 +1,28 @@
+# Payment attribution and record-editor follow-up
+
+Captain orders retain the creator in `origin.actor_name`. Payment reports previously read only `user_name`, producing literal `undefined`. Sale and return transaction endpoints now prefer saved user_name, legacy created_by, then the original Captain actor name. Frontend rows and exports share this fallback, reject placeholder strings and escape names. No later editor or viewer is substituted. Unknown names show an em dash. Existing bills need no backfill.
+
+Edit User offers an explicit Change Password option. Ordinary edits preserve credentials. Explicit resets validate the password and confirmation, persist the bcrypt hash, and stamp passwordChangedAt to invalidate older sessions. Existing user-write authorization and tenant filters remain. No real account was reset during testing.
+
+Shared record dialogs fit their contents despite legacy inline height styles. Supplier and Units browser checks at 1200px and 390px measured 17px below the buttons without horizontal overflow.
+
+## Earlier reports
+
+Existing regression tests cover branch Save, active-tab preservation, phone binding, saved-state selection, stale country responses, optional country-specific branch tax registration, new branch regional fields, user permission errors, Accountant-role saving, paired passwords and category shape colors. The preceding change restored the desktop menu and table text alignment. Device counts are already unlimited by default.
+
+State defaults use the saved branch, not IP geolocation. Missing state cannot safely be inferred from city. Legacy Core Settings reminder preferences do not implement a sending scheduler; this change does not send messages. Partner venue commission is under Restaurant > Hotels and other venues, with results under Reports > Money > Commission owed. The separate tax calculation foundation remains internal, not a new report screen.
+
+## Sync and rollout
+
+Report attribution is read-only. Branch-scoped sales already carry origin. No migration or new collection is needed. Users already have a global-within-tenant batch lane in POS api/src/sync/collections.json, Gateway apps/sync-gateway/src/collections.js and apps/sync-agent/sync-config.json. Reset uses existing password/passwordChangedAt fields and advances updated_date. The agent transfers whole documents using updated_date/_id checkpoints and last-write-wins. No plaintext password, session or reset command is newly replicated; hashes follow the existing user lane.
+
+Offline tills retain their last synchronized account until reconnect. They need the updated user document before the password/session cutoff applies locally. There are no new deletion or file behaviors. Physical cross-till credential delivery remains unverified. The installed white-label 1.9.2 still contains old branch validation code and uses its own branded stable feed. Source checks do not mean that installation is updated.
+
+## Validation
+
+- Read-only inspection confirmed the original actor on the three reported Captain bills.
+- 283 API regressions passed for user model, tenant isolation and Captain transfer; follow-up sale/return attribution checks passed.
+- 27 payment/display/export regressions passed.
+- Form regressions, frontend production build and offscreen Chromium layout checks passed.
+
+Full local checks: lint, formatting, API docs, packaging and attribution passed when run directly. The final desktop run passed 4,339 tests, with four skipped; its customer-branding guard found a branded name in this note. The name was removed and all six branding tests passed. An earlier stale server-message catalog was corrected and all 51 i18n tests passed on rerun.
diff --git a/docs/TAX_REPORTING_CORE.md b/docs/TAX_REPORTING_CORE.md
new file mode 100644
index 000000000..29f4b1167
--- /dev/null
+++ b/docs/TAX_REPORTING_CORE.md
@@ -0,0 +1,88 @@
+# Tax reporting core: first implementation increment
+
+17 October 2026. Implements the first calculation boundary from
+[Tax & Compliance roadmap](TAX_COMPLIANCE_ROADMAP.md). This is an internal,
+tested module, not yet a customer report, endpoint, accountant pack or filing
+export. The legacy reports remain in place until replacement reconciliation
+passes. No customer records were changed to develop or test this increment.
+
+## Implemented
+
+`api/src/services/tax-reporting/ledger.js` accepts canonical document snapshots
+and a server-authorised tenant, registration, branch and currency scope. It
+rejects mismatched scope, duplicate document/line identities, unresolved status,
+missing amounts and adjustments without original-document references.
+
+- Exact decimal strings preserve up to 12 fractional places. No floating-point
+  summation, missing-to-zero conversion or rounding at every row.
+- Inclusive local calendar dates become UTC start / exclusive next-day end.
+  The registration's timezone controls boundaries, including daylight saving.
+- Document dates determine the period; modification dates are not consulted.
+- Gross values count once per document; line net/tax are summed independently.
+- Credits reverse magnitudes once; debits add them. Source adapters must resolve
+  cancellation/deletion/return relationships before passing posted documents.
+- Signed round-off is separate from line tax. Differences remain visible.
+- Cash Book expenses without recorded tax retain gross amounts and null net/tax.
+- Purchase tax is recorded tax. Reviewed eligible credit remains null.
+- Source failure, absent source or missing watermark marks coverage incomplete.
+  Affected totals are null. `observedTotals` separately describes only the rows
+  that arrived, and must never be presented as complete-period totals.
+- Unknown supply nature remains an exception; HSN and units are never fetched
+  from today's product master. Quantities remain decimal strings.
+
+`readyForReview` means only that this boundary found no exceptions. It does not
+mean accountant-reviewed, filed, statutory-export-ready or independently verified
+against an official statement. `filingReady` is always false in this increment.
+
+## Source adapter inventory and unresolved evidence
+
+| Source           | Current implementation                                                                                     | Required next step                                                                                                                             |
+| ---------------- | ---------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
+| Sales            | `sale.model.js`, `sale.service.js`, `sale.repository.js`; stored `date`, invoice totals and item snapshots | Map actual legacy/current line formats; document treatment of holds, voids, deletion and discounts; preserve component tax                     |
+| Purchases        | `receiving.model.js`, receiving controller/model write paths                                               | Support both legacy PHP fields and current schema without treating one layout's missing values as zero                                         |
+| Sales credits    | Nested return structures on sales                                                                          | Stable event identity, return date and original-invoice link; verify partial/repeated returns                                                  |
+| Purchase credits | `receiving-return.model.js` mutates/removes original purchase lines and writes return evidence             | Reconstruct only from verifiable evidence; flag unrecoverable originals; never reverse both the residual purchase and its original full amount |
+| Expenses         | `expense.model.js`: date, amount, type, category, recipient, description; attachments added separately     | Preserve legacy tax as not recorded; distinguish movements and purchase settlements; do not infer classification from category text            |
+| Registration     | Branch settings contain tax/regional data                                                                  | Effective-dated registration-to-branch membership and authorised scope resolver still required                                                 |
+
+Canonical input IDs, revision, status, dates and scope are mandatory. Monetary
+fields and quantities are decimal strings, not formatted amounts. Credits carry
+positive source magnitudes; the document type supplies their sign. Round-off
+may be signed. Distinct invoices with equal amounts must keep distinct IDs.
+Do not split one document into repeated header rows before invoking this core.
+
+Source completeness and watermark assertions must be produced by trusted
+adapters after reading the full bounded source, not accepted from a browser.
+Adapters must query within authorised tenant/branch scope as well as use the
+defensive scope check in this core. The core does not establish user permissions.
+
+## Synchronisation decision
+
+This increment is pure computation: no collections, persisted fields, write or
+delete paths, jobs, or external messages. Consequently it requires no new sync
+lane or migration. Existing `sales`, `receivings` and `expenses` are branch-scoped
+in POS `api/src/sync/collections.json`, Gateway
+`apps/sync-gateway/src/collections.js`, and the agent
+`apps/sync-agent/sync-config.json`; `branches` is global in the POS/Gateway maps.
+These definitions were inspected, not treated as proof of live delivery.
+
+Cloud, originating till and other authorised tills can calculate the same
+result only from the same source snapshots and cutoff. Offline or late sources
+must remain incomplete until reconciled. The future run/export persistence needs
+its own scope, file storage, sync and recovery design before it is shipped.
+No physical till sync or reconnection test has been performed for this core.
+
+## Remaining before the first usable accountant pack
+
+1. Implement and test actual source adapters, component tax summaries,
+   cancellations/returns and source cutoffs; reproduce defects against database
+   fixtures, not just canonical inputs.
+2. Add registration settings and server-side permissions for view/export/review.
+3. Persist immutable report runs and resumable export jobs with sync decisions.
+4. Build the approved Overview, Sales, Purchases, Adjustments, Expenses,
+   Exceptions and Exports screens; Excel/PDF pack with manifest and safe cells.
+5. Reconcile source, report and export totals, including 100,000-line fixtures,
+   failure/retry, branch isolation, offline/late sync and accountant review.
+
+Official statement import and country-specific statutory mappings remain later
+roadmap increments. This core introduces no statutory tax rule or current rate.
diff --git a/frontend/dashboard.html b/frontend/dashboard.html
index 37c5543f7..54f3e993e 100644
--- a/frontend/dashboard.html
+++ b/frontend/dashboard.html
@@ -1012,7 +1012,160 @@ <h6><span> <lang class="lang_do_you_want_remove_this_image">Do you want remove t
                                         }
                                     });
             </script>
-        <!-- Desktop configuration is in Manage > Settings. Recovery remains in Electron. -->
+        <script>
+            // Desktop tools quick-access (Electron only). Same actions as the
+            // File menu and tray - this is the discoverable, in-app door.
+            (function () {
+                if (!window.electronAPI || !window.electronAPI.desktop) return;
+                const style = document.createElement('style');
+                // Keep the familiar green shortcut; the menu follows the app theme.
+                style.textContent =
+                    '#posnic-desktop-fab{position:fixed;bottom:18px;right:18px;z-index:99990;font-family:inherit}' +
+                    '#posnic-desktop-fab .fab-btn{background:#15803d;' +
+                    'color:#fff;border:1px solid #15803d;border-radius:24px;' +
+                    'height:46px;min-width:46px;padding:0 14px;display:flex;align-items:center;justify-content:center;' +
+                    'font-size:13px;font-weight:600;cursor:pointer;box-shadow:0 2px 8px rgba(0,0,0,.10)}' +
+                    '#posnic-desktop-fab .fab-label{white-space:nowrap;margin-inline-start:8px}' +
+                    '#posnic-desktop-fab button:focus-visible{outline:2px solid var(--theme-primary-color,#506fe4);outline-offset:-3px}' +
+                    '#posnic-desktop-fab .fab-menu{display:none;position:absolute;bottom:48px;right:0;' +
+                    'background:var(--theme-card-bg,#fff);border:1px solid var(--theme-border-color,#e6e6e6);' +
+                    'border-radius:8px;box-shadow:0 8px 24px rgba(0,0,0,.12);padding:6px;min-width:250px;max-width:calc(100vw - 36px);max-height:calc(100vh - 90px);overflow:auto}' +
+                    '#posnic-desktop-fab.open .fab-menu{display:block}' +
+                    '#posnic-desktop-fab .fab-menu button{display:flex;gap:12px;align-items:center;width:100%;text-align:start;background:none;' +
+                    'border:none;border-radius:5px;padding:10px 12px;font:inherit;font-size:13px;color:var(--theme-text-primary,#16203a);cursor:pointer}' +
+                    '#posnic-desktop-fab .fab-menu button:hover{background:var(--theme-menu-active-bg,#f0f2ff);' +
+                    'color:var(--theme-menu-active-text,inherit)}';
+                document.head.appendChild(style);
+
+                const fab = document.createElement('div');
+                fab.id = 'posnic-desktop-fab';
+                fab.innerHTML = '<div class="fab-menu" id="posnic-desktop-menu" role="menu"></div><button type="button" class="fab-btn" aria-haspopup="menu" aria-expanded="false" aria-controls="posnic-desktop-menu" title="Desktop tools" data-t-title="lang_desktop_tools"><i class="feather icon-monitor" aria-hidden="true"></i><span class="fab-label"><lang class="lang_desktop">Desktop</lang></span><span id="posnic-sync-dot"></span></button>';
+                document.body.appendChild(fab);
+
+                const dotStyle = document.createElement('style');
+                dotStyle.textContent =
+                    '#posnic-sync-dot{display:none;width:9px;height:9px;border-radius:50%;margin-left:8px;' +
+                    'vertical-align:middle;display:inline-block}' +
+                    '#posnic-sync-dot.on{background:#4ade80;box-shadow:0 0 5px #4ade80}' +
+                    '#posnic-sync-dot.off{background:#f87171;box-shadow:0 0 5px #f87171}' +
+                    '#posnic-sync-dot.none{display:none}';
+                document.head.appendChild(dotStyle);
+
+                // Live cloud sync indicator on the button (only when activated)
+                const syncDot = fab.querySelector('#posnic-sync-dot');
+                const refreshSyncDot = async () => {
+                    try {
+                        const status = await window.electronAPI.cloud.status();
+                        if (!status.connected) { syncDot.className = 'none'; return; }
+                        syncDot.className = status.sync && status.sync.online ? 'on' : 'off';
+                    } catch (e) { syncDot.className = 'none'; }
+                };
+                refreshSyncDot();
+                setInterval(refreshSyncDot, 30000);
+
+                const menu = fab.querySelector('.fab-menu');
+                const trigger = fab.querySelector('.fab-btn');
+                const closeMenu = () => { fab.classList.remove('open'); trigger.setAttribute('aria-expanded', 'false'); };
+                const updateDesktopToolVisibility = () => {
+                    const working = /^#\/(?:kot(?:_v2)?(?:\/|$)|sales\/(?:new(?:\/|$)|[^/]+\/(?:edit|hold)(?:\/|$)))/.test(location.hash);
+                    fab.hidden = working;
+                    if (working) closeMenu();
+                };
+                window.addEventListener('hashchange', updateDesktopToolVisibility);
+                updateDesktopToolVisibility();
+                const addItem = (label, target, icon, settings) => {
+                    const b = document.createElement('button');
+                    b.type = 'button'; b.setAttribute('role', 'menuitem');
+                    const glyph = document.createElement('i'); glyph.className = 'feather icon-' + icon; glyph.setAttribute('aria-hidden', 'true');
+                    b.appendChild(glyph); b.appendChild(document.createTextNode(label));
+                    b.addEventListener('click', async () => {
+                        closeMenu();
+                        if (settings) hasher.setHash('settings/' + target);
+                        else {
+                            try {
+                                const opened = await window.electronAPI.desktop.open(target);
+                                if (opened === false || (opened && opened.ok === false)) throw new Error('Desktop action unavailable');
+                            } catch (error) {
+                                console.error('[Desktop tools] Could not open ' + target, error);
+                                PosnicPro.alert('error', PosnicPro.i18n.t('lang_request_failed', 'Request failed'));
+                            }
+                        }
+                    });
+                    menu.appendChild(b);
+                };
+
+                window.electronAPI.desktop.capabilities().then((caps) => {
+                    if (PosnicPro.userACL && PosnicPro.userACL.branch && PosnicPro.userACL.branch.write) addItem(PosnicPro.i18n.t('lang_desktop_app', 'App Settings'), 'app', 'settings', true);
+                    addItem(PosnicPro.i18n.t('lang_hardware_manager', 'Hardware Manager'), 'hardware', 'printer');
+                    if (['enable', 'true', true].includes(PosnicPro.local.get('table_options'))) addItem(PosnicPro.i18n.t('lang_desktop_kitchen', 'Kitchen Printing'), 'hardware:kot', 'clipboard');
+                    addItem(PosnicPro.i18n.t('lang_desktop_kitchen_screen', 'Kitchen screen'), 'hardware:screen', 'monitor');
+                    addItem(PosnicPro.i18n.t('lang_desktop_kitchen_sound', 'Kitchen sound'), 'hardware:sound', 'volume-2');
+                    if (caps.backup) addItem(PosnicPro.i18n.t('lang_desktop_backups', 'Backup & Recovery'), 'backup', 'database');
+                    addItem(PosnicPro.i18n.t('lang_desktop_update_recovery', 'Updates & recovery'), 'update', 'download-cloud');
+                    addItem(PosnicPro.i18n.t('lang_desktop_cloudsync', 'Cloud Sync'), 'cloud', 'cloud');
+                    addItem(PosnicPro.i18n.t('lang_desktop_view_logs', 'View application logs'), 'log', 'file-text');
+                    addItem(PosnicPro.i18n.t('lang_about_posnic', 'About Posnic'), 'about', 'info');
+                }).catch(() => {});
+
+                fab.querySelector('.fab-btn').addEventListener('click', (e) => {
+                    e.stopPropagation();
+                    fab.classList.toggle('open');
+                    trigger.setAttribute('aria-expanded', String(fab.classList.contains('open')));
+                    if (fab.classList.contains('open')) menu.querySelector('button')?.focus();
+                });
+                fab.addEventListener('keydown', (e) => {
+                    if (e.key === 'Escape') { closeMenu(); trigger.focus(); e.preventDefault(); }
+                    const items = Array.from(menu.querySelectorAll('button'));
+                    if (!items.length || !['ArrowDown', 'ArrowUp', 'Home', 'End'].includes(e.key)) return;
+                    e.preventDefault(); fab.classList.add('open'); trigger.setAttribute('aria-expanded', 'true');
+                    const at = items.indexOf(document.activeElement);
+                    const next = e.key === 'Home' ? 0 : e.key === 'End' ? items.length - 1 : e.key === 'ArrowDown' ? (at + 1) % items.length : (at + items.length - 1) % items.length;
+                    items[next].focus();
+                });
+                document.addEventListener('click', (e) => { if (!fab.contains(e.target)) closeMenu(); });
+                // Chromium can run a microtask between blur and focus. At that
+                // point activeElement is body, even when focus is moving to a
+                // different menu item. Hiding the menu then cancels its click.
+                fab.addEventListener('focusout', (e) => {
+                    if (!fab.contains(e.relatedTarget)) closeMenu();
+                });
+
+                // --- Tray branch switching ---------------------------------
+                // Mirror the header's branch dropdown into the tray menu, and
+                // run the app's own switch flow (incl. open-register guard)
+                // when a branch is picked from the tray.
+                if (window.electronAPI.tray) {
+                    const harvestBranches = () => {
+                        const items = document.querySelectorAll('#change_branch_list a[data-id]');
+                        if (!items.length) return;
+                        const branches = Array.from(items).map((a) => ({
+                            id: a.getAttribute('data-id'),
+                            name: (a.textContent || '').trim()
+                        })).filter((b) => b.id && b.name);
+                        const currentName = (document.querySelector('.branch-name, #current_branch_name')?.textContent || '').trim() || null;
+                        if (branches.length) {
+                            window.electronAPI.tray.setBranches({ branches, currentName });
+                        }
+                    };
+                    const list = () => document.getElementById('change_branch_list');
+                    const arm = () => {
+                        const el = list();
+                        if (!el) return setTimeout(arm, 2000);
+                        new MutationObserver(harvestBranches).observe(el, { childList: true, subtree: true });
+                        harvestBranches();
+                    };
+                    arm();
+
+                    window.electronAPI.tray.onSwitchBranch((id) => {
+                        if (window.PosnicPro?.branches?.showChange) {
+                            PosnicPro.branches.showChange(id);
+                        } else {
+                            window.location.hash = '#/branches/' + id + '/change';
+                        }
+                    });
+                }
+            })();
+        </script>
         <script>
         /* Static-asset service worker (web / LAN counters only). The desktop
            shell is skipped: its assets are local files owned by the installer
diff --git a/frontend/modals/tableorder.html b/frontend/modals/tableorder.html
index 6df9d600d..0f50e8346 100644
--- a/frontend/modals/tableorder.html
+++ b/frontend/modals/tableorder.html
@@ -16,7 +16,7 @@ <h4 id="exampleModalCenterTitle"><span id="tableorder-heading"><lang class="lang
                         </label>
 
                         <input id="tableorder_value" type="text" name="tableorder_value"
-                            class="form-control border-control text-right" style="display: block;" minlength="1"
+                            class="form-control border-control" style="display: block;" minlength="1"
                             maxlength="6" pattern="[A-Za-z0-9]{1,6}"
                             title="Max 6 characters. Only letters and numbers allowed." data-t-title="lang_max_6_characters_only_letters_and_numbers" required>
                         <input type="hidden" id="tableorder_id" name="tableorder_id">
diff --git a/frontend/modals/user.html b/frontend/modals/user.html
index 39f0043d9..0bd5729b8 100644
--- a/frontend/modals/user.html
+++ b/frontend/modals/user.html
@@ -97,6 +97,12 @@ <h4 id="exampleModalCenterTitle">
                         </label>
                         <input type="text" class="form-control border-control user-text-clear" name="name" id="users_name"  minlength="3" maxlength="250" placeholder="Enter the username" data-t-placeholder="lang_enter_the_username" autocomplete="off" required>                        
                     </div>
+                    <div class="form-group col-md-12" id="user_password_change_row" hidden>
+                        <label for="user_change_password">
+                            <input type="checkbox" id="user_change_password" onchange="PosnicPro.users.setPasswordEditing(this.checked)">
+                            <lang class="lang_changepassword_title">Change Password</lang>
+                        </label>
+                    </div>
                     <div class="form-group col-md-12">
                         <label for="users_password">
                             <lang class="lang_enterpassword_title">Password</lang>
@@ -107,7 +113,7 @@ <h4 id="exampleModalCenterTitle">
                         <input type="hidden" name="id" id="users_id">
                     </div>
                     <div class="form-group col-md-12">
-                        <label for="users_password">
+                        <label for="users_retype_password">
                             <lang class="lang_retypepassword_title">Retype Password </lang>
                             <span class="text-danger">*</span>
                         </label>
diff --git a/frontend/static/script/js/core/record-workspace.js b/frontend/static/script/js/core/record-workspace.js
index d56d3764b..6c7822df2 100644
--- a/frontend/static/script/js/core/record-workspace.js
+++ b/frontend/static/script/js/core/record-workspace.js
@@ -314,7 +314,7 @@
         if (user) {
             var profile = section(user, 'lang_vieweditprofile_title', 'Profile Details');
             profile.parentElement.classList.add('record-staff-profile');
-            moveFields(user, profile, ['users_firstname', 'users_lastname', 'users_name', 'users_email', 'users_password', 'users_retype_password']);
+            moveFields(user, profile, ['users_firstname', 'users_lastname', 'users_name', 'users_email', 'user_change_password', 'users_password', 'users_retype_password']);
             user.prepend(profile.parentElement);
             var photo = user.querySelector('.profilebox');
             if (photo) user.prepend(photo);
diff --git a/frontend/static/script/js/modules/js/report_payment.js b/frontend/static/script/js/modules/js/report_payment.js
index 844a81f0e..03e5b7380 100644
--- a/frontend/static/script/js/modules/js/report_payment.js
+++ b/frontend/static/script/js/modules/js/report_payment.js
@@ -1,4 +1,9 @@
 PosnicPro.paymentreport = {
+    recordedUser: function (row) {
+        return [row.user_name, row.created_by, row.origin && row.origin.actor_name].find(function (value) {
+            return typeof value === 'string' && value.trim() && !/^(undefined|null|\[object Object\])$/i.test(value.trim());
+        }) || '—';
+    },
     showDataTablePage: function () {
         var loader = $(".loader-sales-payment-report");
         loader.find(".loadingSpinner:first").remove();
@@ -190,7 +195,7 @@ PosnicPro.paymentransaction = {
                             let DateFormat = moment(update_timeStamp_value).tz(timeZone).format('YYYY/MM/DD LT');
                             let updateDate = PosnicPro.convertDate(DateFormat);
                             let row_no = (table.data('current_page') - 1) * table.data('per_page') + i + 1;
-                            let trow = '<tr> <td scope="row">' + row_no + '</td>  <td>' + row.sales_id + '</td> <td>' + updateDate + '</td> <td>' + row.user_name + '</td> <td>' + row.payment_mode + '</td> <td class="text-right">' + currency + '&nbsp;<span class="number">' + (row.report_amount ?? row.items_total) + '</span></td></tr>';
+                            let trow = '<tr> <td scope="row">' + row_no + '</td>  <td>' + row.sales_id + '</td> <td>' + updateDate + '</td> <td>' + $('<span>').text(PosnicPro.paymentreport.recordedUser(row)).html() + '</td> <td>' + row.payment_mode + '</td> <td class="text-right">' + currency + '&nbsp;<span class="number">' + (row.report_amount ?? row.items_total) + '</span></td></tr>';
                             $('#view_paymentransaction').children('tbody').append(trow);
                             var digits = Number.isInteger(row.currencyDigits) && row.currencyDigits >= 0 && row.currencyDigits <= 4 ? row.currencyDigits : 2;
                             $('#view_paymentransaction tbody tr:last span.number').number(true, digits);
@@ -204,7 +209,7 @@ PosnicPro.paymentransaction = {
                             let DateFormat = moment(update_timeStamp_value).tz(timeZone).format('YYYY/MM/DD LT');
                             let date = PosnicPro.convertDate(DateFormat);
                             let id = val.sales_id;
-                            let customer = val.user_name;
+                            let customer = PosnicPro.paymentreport.recordedUser(val);
                             let mode = val.payment_mode;
                             let total = val.report_amount ?? val.items_total;
                             paymentsalereportexportdata.push({SaleId: id, Date: date, UserName: customer, PaymentMethod: mode, Amount: total});
@@ -300,7 +305,7 @@ PosnicPro.paymentreturntransaction = {
                             let DateFormat = moment(update_timeStamp_value).tz(timeZone).format('YYYY/MM/DD LT');
                             let updateDate = PosnicPro.convertDate(DateFormat);
                             let row_no = (table.data('current_page') - 1) * table.data('per_page') + i + 1;
-                            let trow = '<tr> <td scope="row">' + row_no + '</td>  <td>' + row.sales_id + '</td> <td>' + updateDate + '</td> <td>' + row.user_name + '</td> <td>' + row.payment_mode + '</td> <td class="text-right">' + currency + '&nbsp;<span class="number">' + row.items_return_total + '</span></td></tr>';
+                            let trow = '<tr> <td scope="row">' + row_no + '</td>  <td>' + row.sales_id + '</td> <td>' + updateDate + '</td> <td>' + $('<span>').text(PosnicPro.paymentreport.recordedUser(row)).html() + '</td> <td>' + row.payment_mode + '</td> <td class="text-right">' + currency + '&nbsp;<span class="number">' + row.items_return_total + '</span></td></tr>';
                             $('#view_paymentreturntransaction').children('tbody').append(trow);
                             $('span.number').number(true, 2);
                         }
@@ -313,7 +318,7 @@ PosnicPro.paymentreturntransaction = {
                             let DateFormat = moment(update_timeStamp_value).tz(timeZone).format('YYYY/MM/DD LT');
                             let date = PosnicPro.convertDate(DateFormat);
                             let id = val.sales_id;
-                            let customer = val.user_name;
+                            let customer = PosnicPro.paymentreport.recordedUser(val);
                             let mode = val.payment_mode;
                             let total = val.items_return_total;
                             paymentsalereportexportdata.push({SaleId: id, Date: date, UserName: customer, PaymentMethod: mode, Amount: total});
diff --git a/frontend/static/script/js/modules/js/users.js b/frontend/static/script/js/modules/js/users.js
index 6c39b65ec..f47f1c5ca 100644
--- a/frontend/static/script/js/modules/js/users.js
+++ b/frontend/static/script/js/modules/js/users.js
@@ -1,4 +1,9 @@
 PosnicPro.users = {
+    setPasswordEditing: function (enabled) {
+        $("#user_change_password").prop("checked", enabled);
+        $("#users_password,#users_retype_password").prop("disabled", !enabled).css("cursor", enabled ? "auto" : "not-allowed").val("");
+        $("#check_password").val(enabled ? "yes" : "no");
+    },
     roleLabel: function (user) {
         var roleId = user.role_id && (user.role_id.$oid || user.role_id);
         var role = (PosnicPro.users.rolesCache || []).find(function (entry) { return String(entry._id || entry.id) === String(roleId); });
@@ -599,8 +604,8 @@ PosnicPro.users = {
                 $('#user_target_daily').val(st.daily === null || st.daily === undefined ? '' : st.daily);
                 $('#user_target_weekly').val(st.weekly === null || st.weekly === undefined ? '' : st.weekly);
                 $('#user_target_monthly').val(st.monthly === null || st.monthly === undefined ? '' : st.monthly);
-                $("#users_password,#users_retype_password").css({cursor: "not-allowed"}).attr('disabled', 'disabled');
-                $("#users_password,#users_retype_password").val('Demo@000');
+                $("#user_password_change_row").prop("hidden", data.usertype === "api");
+                PosnicPro.users.setPasswordEditing(false);
                 $('#usertype').val(data.usertype);
                 $('#hide_show_user_type').hide();
                 $('#accordionExample').show();
@@ -975,7 +980,8 @@ PosnicPro.users = {
         $('#user_title').text(PosnicPro.i18n.t('lang_new_title', 'Add'));
         $('.user-image-label-title').html('<i class="feather icon-plus-circle mr-2"></i>Add Image');
         $('#user_button_title,#submit_user_img').text(PosnicPro.i18n.t('lang_save_title', 'Save'));
-        $("#users_password,#users_retype_password").css({cursor: "auto"}).removeAttr('disabled');
+        $("#user_password_change_row").prop("hidden", true);
+        PosnicPro.users.setPasswordEditing(true);
         $('.update-button').attr('disabled', 'disabled').removeClass('btn-outline-success');
         $("#check_password").val('yes');
         $('.icon-help-circle').hide();
@@ -2039,6 +2045,8 @@ PosnicPro.users = {
         }
     },
     userClearForm: function () {
+        $('#user_password_change_row').prop('hidden', true);
+        PosnicPro.users.setPasswordEditing(true);
         $('#user_save_errors').remove();
         $('#checkbox_error').text('').removeClass('error').hide();
         $("#branchtype").select2({
diff --git a/frontend/static/style/css/record-workspace.css b/frontend/static/style/css/record-workspace.css
index 965bc9690..e1297b416 100644
--- a/frontend/static/style/css/record-workspace.css
+++ b/frontend/static/style/css/record-workspace.css
@@ -2,7 +2,8 @@
 .record-dialog.sidebarshow {
     width: min(820px, calc(100vw - 64px)) !important;
     max-width: none !important;
-    height: auto;
+    height: fit-content !important;
+    min-height: 0 !important;
     max-height: calc(100dvh - 64px);
     bottom: auto;
     top: 32px;
@@ -131,3 +132,6 @@
     height: fit-content !important;
     min-height: 0 !important;
 }
+
+#user_password_change_row { grid-column: 1 / -1; }
+#user_password_change_row[hidden] { display: none !important; }
diff --git a/languages/_english.json b/languages/_english.json
index 44d7b5d29..3c262a9a9 100644
--- a/languages/_english.json
+++ b/languages/_english.json
@@ -1260,6 +1260,7 @@
   "lang_desktop_this_computer": "This computer",
   "lang_desktop_time": "Time",
   "lang_desktop_time_required": "Choose a backup time.",
+  "lang_desktop_tools": "Desktop tools",
   "lang_desktop_update_channel": "Release channel",
   "lang_desktop_update_preferences": "Update preferences",
   "lang_desktop_update_recovery": "Updates & recovery",
diff --git a/languages/server/_english.json b/languages/server/_english.json
index b6b216d55..dac4b52dd 100644
--- a/languages/server/_english.json
+++ b/languages/server/_english.json
@@ -1636,6 +1636,9 @@
     "src/controllers/users.controller.js",
     "src/repositories/user.repository.js"
   ],
+  "Password must contain between 5 and 20 characters": [
+    "src/models/user.model.js"
+  ],
   "Password reset is not configured for this shop. Please contact support.": [
     "src/models/setting.model.js"
   ],
@@ -1653,7 +1656,8 @@
     "src/models/setting.model.js"
   ],
   "Passwords do not match": [
-    "src/models/setting.model.js"
+    "src/models/setting.model.js",
+    "src/models/user.model.js"
   ],
   "Payment Gateway Updated": [
     "src/models/setting.model.js"
diff --git a/tests/desktop-menu-actions.test.js b/tests/desktop-menu-actions.test.js
index c62aa687b..734e1ed1c 100644
--- a/tests/desktop-menu-actions.test.js
+++ b/tests/desktop-menu-actions.test.js
@@ -3,18 +3,65 @@ const assert = require('node:assert/strict');
 const fs = require('node:fs');
 const path = require('node:path');
 const { JSDOM } = require('jsdom');
-const read = name => fs.readFileSync(path.join(__dirname, '..', name), 'utf8');
-test('desktop settings have one in-app entry and no floating duplicate menu', () => {
-  assert.doesNotMatch(read('frontend/dashboard.html'), /posnic-desktop-fab|Desktop tools quick-access/);
-  const dom = new JSDOM(read('frontend/layouts/sidebar.html'));
-  for (const name of ['hardware', 'app', 'updates', 'backups', 'cloudsync', 'systemstatus']) {
-    const nodes = dom.window.document.querySelectorAll('[href="#/settings/' + name + '"]');
-    assert.equal(nodes.length, 1, name);
-    assert.equal(nodes[0].getAttribute('data-access'), 'write');
-    assert.ok(nodes[0].closest('[data-desktop-only]'));
+const source = fs.readFileSync(path.join(__dirname, '../frontend/dashboard.html'), 'utf8');
+const doc = new JSDOM(source);
+const script = [...doc.window.document.scripts].map(x => x.textContent).find(x => x.includes('Desktop tools quick-access'));
+doc.window.close();
+async function menu(t, open) {
+  const dom = new JSDOM('<button id="outside">Outside</button>', { runScripts: 'outside-only' });
+  t.after(() => dom.window.close());
+  const w = dom.window, opened = [], alerts = [];
+  w.PosnicPro = { i18n: { t: (_key, text) => text }, local: { get: () => true },
+    userACL: { branch: { write: true } }, alert: (...args) => alerts.push(args) };
+  w.hasher = { setHash: target => opened.push(target) };
+  w.console.error = () => {};
+  w.electronAPI = { desktop: { capabilities: async () => ({ backup: true }), open: open || (async target => { opened.push(target); return true; }) }, cloud: { status: async () => ({ connected: false }) } };
+  w.eval(script);
+  await new Promise(r => setImmediate(r));
+  return { w, opened, alerts, fab: w.document.querySelector('#posnic-desktop-fab'), trigger: w.document.querySelector('.fab-btn') };
+}
+test('moving focus between Desktop items must not hide the item before its click', async t => {
+  const { w, fab, trigger, opened } = await menu(t);
+  const items = [...fab.querySelectorAll('[role=menuitem]')];
+  assert.equal(items.find(x => x.textContent === 'Hardware Manager').textContent, 'Hardware Manager');
+  const targets = ['settings/app', 'hardware', 'hardware:kot', 'hardware:screen', 'hardware:sound', 'backup', 'update', 'cloud', 'log', 'about'];
+  for (let i = 0; i < items.length; i++) {
+    trigger.click();
+    // Chromium delivers focusout while activeElement is temporarily body.
+    // Flush the microtask here, before the destination receives focus/click.
+    items[0].blur();
+    fab.classList.add('open');
+    items[0].dispatchEvent(new w.FocusEvent('focusout', { bubbles: true, relatedTarget: items[i] }));
+    await Promise.resolve();
+    assert.ok(fab.classList.contains('open'), targets[i] + ' disappeared before click');
+    items[i].focus(); items[i].click();
+    await Promise.resolve();
+    assert.equal(opened.at(-1), targets[i]);
+    assert.equal(trigger.getAttribute('aria-expanded'), 'false');
   }
-  dom.window.close();
 });
+test('moving focus outside closes the menu', async t => {
+  const { w, fab, trigger } = await menu(t);
+  trigger.click(); w.document.querySelector('#outside').focus();
+  assert.equal(fab.classList.contains('open'), false);
+  assert.equal(trigger.getAttribute('aria-expanded'), 'false');
+});
+for (const [name, open] of [['rejected IPC', async () => { throw Error('Unavailable'); }], ['unsupported action', async () => false]]) {
+  test(name + ' gives feedback instead of a silent failure', async t => {
+    const { fab, alerts } = await menu(t, open);
+    [...fab.querySelectorAll('[role=menuitem]')].find(x => x.textContent === 'Cloud Sync').click();
+    await new Promise(r => setImmediate(r));
+    assert.equal(alerts.length, 1);
+    assert.match(alerts[0][1], /Request failed/);
+  });
+}
+test('the application log viewer can read its log through the guarded bridge', () => {
+  const { isTrustedFrame } = require('../src/ipc-guard');
+  assert.equal(isTrustedFrame({ url: 'file:///C:/app/resources/app.asar/src/log-viewer.html' }), true);
+  assert.equal(isTrustedFrame({ url: 'https://example.com/log-viewer.html' }), false);
+});
+
+const read = name => fs.readFileSync(path.join(__dirname, '..', name), 'utf8');
 test('desktop recovery tools remain independent of the app renderer', () => {
   const main = read('src/main.js');
   assert.match(main, /recoveryMenu.label = 'Help && Recovery'/);
@@ -22,8 +69,10 @@ test('desktop recovery tools remain independent of the app renderer', () => {
   for (const handler of ['openHardwareManager', 'openBackupManager', 'openCloudManager', 'openUpdateManager', 'openLogFolder']) assert.match(main, new RegExp(handler + '\\('));
   assert.match(main, /accelerator: 'CmdOrCtrl\+R'/);
 });
-test('the application log viewer keeps its guarded bridge', () => {
-  const { isTrustedFrame } = require('../src/ipc-guard');
-  assert.equal(isTrustedFrame({ url: 'file:///C:/app/resources/app.asar/src/log-viewer.html' }), true);
-  assert.equal(isTrustedFrame({ url: 'https://example.com/log-viewer.html' }), false);
+
+test('web browsers do not get desktop controls', () => {
+  const dom = new JSDOM('', { runScripts: 'outside-only' });
+  dom.window.eval(script);
+  assert.equal(dom.window.document.querySelector('#posnic-desktop-fab'), null);
+  dom.window.close();
 });
diff --git a/tests/payment-recorded-user.test.js b/tests/payment-recorded-user.test.js
new file mode 100644
index 000000000..94852f5bc
--- /dev/null
+++ b/tests/payment-recorded-user.test.js
@@ -0,0 +1,20 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const vm = require('node:vm');
+const { recordedUserName } = require('../api/src/utils/recorded-user-name');
+const source = fs.readFileSync(require('node:path').join(__dirname, '../frontend/static/script/js/modules/js/report_payment.js'),'utf8');
+const start = source.indexOf('recordedUser: function');
+const recordedUser = vm.runInNewContext('({' + source.slice(start, source.indexOf('    showDataTablePage:', start)) + '})').recordedUser;
+test('payment names prefer the original saved user and support Captain and legacy records', () => {
+  for (const [row, expected] of [
+    [{user_name:'Cashier',created_by:'Creator',origin:{actor_name:'Captain'}},'Cashier'],
+    [{user_name:'undefined',origin:{actor_name:'Captain'},updated_by:'Later editor'},'Captain'],
+    [{user_name:null,created_by:'Creator'},'Creator'],
+    [{user_name:'undefined',created_by:'null',origin:{actor_name:'[object Object]'},updated_by:'Editor'},'\u2014'],
+    [{},'\u2014']
+  ]) {
+    assert.equal(recordedUser(row),expected);
+    assert.equal(recordedUserName(row.user_name,row.created_by,row.origin?.actor_name),expected==='\u2014'?'':expected);
+  }
+});
diff --git a/tests/transferred-sale-history-precision.test.js b/tests/transferred-sale-history-precision.test.js
index 09d22e2a7..e59393577 100644
--- a/tests/transferred-sale-history-precision.test.js
+++ b/tests/transferred-sale-history-precision.test.js
@@ -83,6 +83,8 @@ for (const exporting of [false, true]) {
             } })
         };
         const script = fs.readFileSync(path.join(__dirname, '../frontend/static/script/js/modules/js/report_payment.js'), 'utf8');
+        const helper = script.indexOf('    recordedUser: function');
+        win.eval('PosnicPro.paymentreport = {' + script.slice(helper, script.indexOf('    showDataTablePage:', helper)) + '};');
         const first = script.indexOf('    paymentransactionTable: function');
         const last = script.indexOf('    paymentransactionexport:', first);
         win.eval('PosnicPro.paymentransaction = {' + script.slice(first, last).trim().replace(/,$/, '') + '};');
diff --git a/tests/user-save-validation.test.js b/tests/user-save-validation.test.js
index aef6d6119..31bcb7e7f 100644
--- a/tests/user-save-validation.test.js
+++ b/tests/user-save-validation.test.js
@@ -27,7 +27,7 @@ function fixture() {
     request: params => requests.push(params)
   };
   const u = w.PosnicPro.users;
-  for (const [name,next] of [['showPermissionError','clickNormalForm'],['clickNormalForm','clickApiForm'],['userForm','insertLocalStorage'],['user','viewUser'],['fillPosForm','collectPosForm'],['collectPosForm','updatePinRowVisibility'],['applyRoleToForm','setManagerPin']]) u[name] = method(w,name,next);
+  for (const [name,next] of [['setPasswordEditing','roleLabel'],['showPermissionError','clickNormalForm'],['clickNormalForm','clickApiForm'],['userForm','insertLocalStorage'],['user','viewUser'],['fillPosForm','collectPosForm'],['collectPosForm','updatePinRowVisibility'],['applyRoleToForm','setManagerPin']]) u[name] = method(w,name,next);
   u.POS_ACTION_KEYS = ['discount_apply', 'refund', 'register_open']; u.updatePinRowVisibility = () => {};
   w.eval(read('frontend/static/script/js/core/record-workspace.js')); u.rolesCache = [];
   w.PosnicPro.recordWorkspace.init();
@@ -81,3 +81,26 @@ test('missing Select2 branch selection has a visible error and never sends the r
   assert.equal($('#user_form_upload-section-1')[0].hidden,false);
   dom.window.close();
 });
+
+ test('editing keeps the password unless an explicit reset is selected and validated', async () => {
+  const {dom,$,u,requests} = fixture();
+  $('#users_id').val('existing-user');
+  $('#sales_read').prop('checked',true);
+  u.setPasswordEditing(false);
+  assert.equal($('#users_password').val(),'');
+  assert.equal($('#users_password').prop('disabled'),true);
+  assert.equal($('#check_password').val(),'no');
+  u.setPasswordEditing(true);
+  $('#clicksubmit')[0].click(); await tick();
+  assert.equal(requests.length,0);
+  $('#users_password,#users_retype_password').val('New@12345');
+  $('#clicksubmit')[0].click(); await tick();
+  assert.equal(requests.length,1);
+  const payload=JSON.parse(requests[0].data);
+  assert.equal(payload.password,'New@12345');
+  assert.equal(payload.check_password,'yes');
+  u.setPasswordEditing(false);
+  assert.equal($('#users_retype_password').val(),'');
+  assert.equal($('#check_password').val(),'no');
+  dom.window.close();
+});