[sridharkalaibala]

Captain sales saved their creator in origin.actor_name, while payment reports read only user_name. Sale and return reports now recover the recorded creator, reject placeholder strings, safely render names and keep exports consistent. No existing sale is rewritten and later editors are never substituted for the creator.

Edit User now has an explicit Change Password option. The API persists an explicitly requested password hash and session cutoff; ordinary edits preserve the password. Supplier and Units dialogs fit their contents instead of inheriting a full-height sidebar.

Validation: 283 focused API tests, 27 report/display/export checks, form regressions, production frontend build and offscreen desktop/narrow-window layout checks. Full local checks are recorded in the follow-up document. Real customer accounts were not reset.

Sync: reports read the existing branch-scoped sales/origin data. Password changes use existing user fields and updated_date on the tenant-wide users batch lane already declared in POS, Gateway and agent. No new collections, plaintext credentials or commands are replicated. Offline tills need reconnection before updated credentials take effect. Physical cross-till delivery remains unverified.

The installed branded white-label build still needs a corrected release. This PR does not claim the user's installed app is updated. Earlier report audit and rollout limitations: docs/PAYMENT_ATTRIBUTION_EDITOR_FOLLOWUP.md.

Final integration verification: merged the current develop base, then all eight local checks passed, including 4,348 desktop tests (five skipped). The initial fix commit also passed all required GitHub checks, including the full API suite.

Installed-app audit: the configured branded stable update feed currently advertises version 1.3.0, while the installed executable is 1.9.2. It cannot deliver these fixes through the normal newer-version update check. A corrected branded installer/feed release is still required.

[github-actions]

Merged to develop. Anyone can test this - you do not need write access.

Try it at https://develop.posnic.io, or run it yourself:

git fetch origin develop && git checkout develop
npm install && npm --prefix api install
npm run dev   # then http://localhost:3000

When you have tested it, say what you did and what happened, and set
QA passed or QA failed. If you cannot set labels, just comment -
a maintainer will.

Reporting that something is broken is as useful as fixing it. It is
better found here than by a shopkeeper.