diff --git a/apps/api/src/app.ts b/apps/api/src/app.ts
index 228388a..613a30a 100644
--- a/apps/api/src/app.ts
+++ b/apps/api/src/app.ts
@@ -24,6 +24,7 @@ import subscriptionsRouter, {
   subscriptionWebhookRouter,
 } from './modules/subscriptions/subscription.routes'
 import paymentsRouter      from './modules/payments/payment.routes'
+import billingRouter       from './modules/billing/billing.routes'
 import customersRouter     from './modules/customers/customer.routes'
 import vehiclesRouter      from './modules/vehicles/vehicle.routes'
 import companiesRouter     from './modules/companies/company.routes'
@@ -202,6 +203,7 @@ export function createApp() {
   app.use(`${v1}/companies`,      apiLimiter, companiesRouter)
   app.use(`${v1}/subscriptions`,  apiLimiter, subscriptionsRouter)
   app.use(`${v1}/payments`,       apiLimiter, paymentsRouter)
+  app.use(`${v1}/billing`,        apiLimiter, billingRouter)
   app.use(`${v1}/reviews`,        apiLimiter, reviewsRouter)
   app.use(`${v1}/complaints`,     apiLimiter, complaintsRouter)
   app.use(`${v1}/licenses`,       publicLimiter, licenseValidationRouter)
diff --git a/apps/api/src/modules/billing/billing.routes.ts b/apps/api/src/modules/billing/billing.routes.ts
new file mode 100644
index 0000000..26089c4
--- /dev/null
+++ b/apps/api/src/modules/billing/billing.routes.ts
@@ -0,0 +1,49 @@
+import { Router } from 'express'
+import { requireCompanyAuth } from '../../middleware/requireCompanyAuth'
+import { requireTenant } from '../../middleware/requireTenant'
+import { requireSubscription } from '../../middleware/requireSubscription'
+import { requireRole } from '../../middleware/requireRole'
+import { parseBody, parseParams, parseQuery } from '../../http/validate'
+import { ok } from '../../http/respond'
+import * as service from './billing.service'
+import {
+  billingListQuerySchema,
+  billingSummaryQuerySchema,
+  invoiceParamSchema,
+  manualBillingPaymentSchema,
+} from './billing.schemas'
+
+const router = Router()
+
+router.use(requireCompanyAuth, requireTenant, requireSubscription, requireRole('OWNER'))
+
+router.get('/summary', async (req, res, next) => {
+  try {
+    const query = parseQuery(billingSummaryQuerySchema, req)
+    ok(res, await service.getSummary(req.companyId, query))
+  } catch (err) { next(err) }
+})
+
+router.get('/invoices', async (req, res, next) => {
+  try {
+    const query = parseQuery(billingListQuerySchema, req)
+    ok(res, await service.listInvoices(req.companyId, query))
+  } catch (err) { next(err) }
+})
+
+router.get('/invoices/:invoiceId', async (req, res, next) => {
+  try {
+    const { invoiceId } = parseParams(invoiceParamSchema, req)
+    ok(res, await service.getInvoice(req.companyId, invoiceId))
+  } catch (err) { next(err) }
+})
+
+router.post('/invoices/:invoiceId/payments/manual', async (req, res, next) => {
+  try {
+    const { invoiceId } = parseParams(invoiceParamSchema, req)
+    const body = parseBody(manualBillingPaymentSchema, req)
+    ok(res, await service.recordManualPayment(req.companyId, req.employee.id, invoiceId, body))
+  } catch (err) { next(err) }
+})
+
+export default router
diff --git a/apps/api/src/modules/billing/billing.schemas.test.ts b/apps/api/src/modules/billing/billing.schemas.test.ts
new file mode 100644
index 0000000..7257f5a
--- /dev/null
+++ b/apps/api/src/modules/billing/billing.schemas.test.ts
@@ -0,0 +1,13 @@
+import { describe, expect, it } from 'vitest'
+import { billingListQuerySchema } from './billing.schemas'
+
+describe('billing.schemas billingListQuerySchema', () => {
+  it('parses explicit outstandingOnly query strings as booleans', () => {
+    expect(billingListQuerySchema.parse({ outstandingOnly: 'false' }).outstandingOnly).toBe(false)
+    expect(billingListQuerySchema.parse({ outstandingOnly: 'true' }).outstandingOnly).toBe(true)
+  })
+
+  it('defaults outstandingOnly to false', () => {
+    expect(billingListQuerySchema.parse({}).outstandingOnly).toBe(false)
+  })
+})
diff --git a/apps/api/src/modules/billing/billing.schemas.ts b/apps/api/src/modules/billing/billing.schemas.ts
new file mode 100644
index 0000000..5020d61
--- /dev/null
+++ b/apps/api/src/modules/billing/billing.schemas.ts
@@ -0,0 +1,34 @@
+import { z } from 'zod'
+
+const queryBooleanSchema = z.preprocess((value) => {
+  if (value === 'true') return true
+  if (value === 'false') return false
+  return value
+}, z.boolean())
+
+export const billingListQuerySchema = z.object({
+  page: z.coerce.number().int().positive().default(1),
+  pageSize: z.coerce.number().int().positive().max(100).default(25),
+  search: z.string().trim().max(120).optional().default(''),
+  paymentStatus: z.enum(['ALL', 'UNPAID', 'PARTIAL', 'PAID']).optional().default('ALL'),
+  outstandingOnly: queryBooleanSchema.optional().default(false),
+})
+
+export const billingSummaryQuerySchema = z.object({
+  search: z.string().trim().max(120).optional().default(''),
+})
+
+export const invoiceParamSchema = z.object({
+  invoiceId: z.string().min(1),
+})
+
+export const manualBillingPaymentSchema = z.object({
+  amountMinor: z.number().int().positive(),
+  currency: z.literal('MAD').default('MAD'),
+  type: z.enum(['CHARGE', 'DEPOSIT']),
+  method: z.enum(['CASH', 'CHECK', 'BANK_TRANSFER', 'CARD', 'PAYPAL', 'OTHER']),
+  receivedAt: z.string().datetime().optional(),
+  reference: z.string().trim().max(120).optional(),
+  note: z.string().trim().max(1000).optional(),
+  idempotencyKey: z.string().uuid(),
+})
diff --git a/apps/api/src/modules/billing/billing.service.test.ts b/apps/api/src/modules/billing/billing.service.test.ts
new file mode 100644
index 0000000..b302f0c
--- /dev/null
+++ b/apps/api/src/modules/billing/billing.service.test.ts
@@ -0,0 +1,66 @@
+import { describe, expect, it } from 'vitest'
+import { buildBillingInvoice } from './billing.service'
+
+const baseReservation = {
+  id: 'reservation_1',
+  invoiceNumber: 'INV-001',
+  contractNumber: 'CON-001',
+  status: 'CONFIRMED',
+  paymentStatus: 'UNPAID',
+  startDate: new Date('2026-06-01T10:00:00.000Z'),
+  endDate: new Date('2026-06-05T10:00:00.000Z'),
+  totalAmount: 100000,
+  depositAmount: 20000,
+  customer: { firstName: 'Nora', lastName: 'Driver', email: 'nora@example.com' },
+  vehicle: { make: 'Dacia', model: 'Duster', licensePlate: '123-A-6' },
+}
+
+function payment(overrides: Partial<any>) {
+  return {
+    id: `payment_${Math.random()}`,
+    reservationId: 'reservation_1',
+    amount: 10000,
+    currency: 'MAD',
+    status: 'SUCCEEDED',
+    type: 'CHARGE',
+    paymentProvider: 'MANUAL',
+    paymentMethod: 'CASH',
+    paidAt: new Date('2026-06-01T12:00:00.000Z'),
+    createdAt: new Date('2026-06-01T12:00:00.000Z'),
+    ...overrides,
+  }
+}
+
+describe('billing.service buildBillingInvoice', () => {
+  it('keeps invoice charges and security deposits in separate balances', () => {
+    const invoice = buildBillingInvoice({
+      ...baseReservation,
+      rentalPayments: [
+        payment({ amount: 100000, type: 'CHARGE' }),
+        payment({ amount: 5000, type: 'DEPOSIT' }),
+      ],
+    })
+
+    expect(invoice.invoicePaid).toBe(100000)
+    expect(invoice.invoiceBalanceDue).toBe(0)
+    expect(invoice.depositCollected).toBe(5000)
+    expect(invoice.depositOutstanding).toBe(15000)
+    expect(invoice.paymentStatus).toBe('PAID')
+    expect(invoice.depositStatus).toBe('PARTIALLY_COLLECTED')
+  })
+
+  it('does not count failed or pending payments as collected', () => {
+    const invoice = buildBillingInvoice({
+      ...baseReservation,
+      rentalPayments: [
+        payment({ amount: 30000, type: 'CHARGE', status: 'PENDING' }),
+        payment({ amount: 20000, type: 'DEPOSIT', status: 'FAILED' }),
+      ],
+    })
+
+    expect(invoice.invoicePaid).toBe(0)
+    expect(invoice.invoiceBalanceDue).toBe(100000)
+    expect(invoice.depositCollected).toBe(0)
+    expect(invoice.depositOutstanding).toBe(20000)
+  })
+})
diff --git a/apps/api/src/modules/billing/billing.service.ts b/apps/api/src/modules/billing/billing.service.ts
new file mode 100644
index 0000000..8bc9723
--- /dev/null
+++ b/apps/api/src/modules/billing/billing.service.ts
@@ -0,0 +1,323 @@
+import { ConflictError, NotFoundError, ValidationError } from '../../http/errors'
+import { prisma } from '../../lib/prisma'
+
+type BillingPayment = {
+  id: string
+  reservationId: string
+  amount: number
+  currency: string
+  status: string
+  type: string
+  paymentProvider: string
+  paymentMethod: string | null
+  reference?: string | null
+  note?: string | null
+  receivedAt?: Date | null
+  paidAt: Date | null
+  createdAt: Date
+  recordedByEmployee?: { firstName: string; lastName: string; email: string } | null
+}
+
+type BillingReservation = {
+  id: string
+  invoiceNumber: string | null
+  contractNumber: string | null
+  status: string
+  paymentStatus: string
+  startDate: Date
+  endDate: Date
+  totalAmount: number
+  depositAmount: number
+  customer: { firstName: string; lastName: string; email: string }
+  vehicle: { make: string; model: string; licensePlate: string }
+  rentalPayments: BillingPayment[]
+}
+
+type ListQuery = {
+  page: number
+  pageSize: number
+  search: string
+  paymentStatus: 'ALL' | 'UNPAID' | 'PARTIAL' | 'PAID'
+  outstandingOnly: boolean
+}
+
+type SummaryQuery = {
+  search: string
+}
+
+type ManualPaymentInput = {
+  amountMinor: number
+  currency: 'MAD'
+  type: 'CHARGE' | 'DEPOSIT'
+  method: 'CASH' | 'CHECK' | 'BANK_TRANSFER' | 'CARD' | 'PAYPAL' | 'OTHER'
+  receivedAt?: string
+  reference?: string
+  note?: string
+  idempotencyKey: string
+}
+
+const BILLING_CURRENCY = 'MAD'
+const COLLECTED_STATUS = new Set(['SUCCEEDED'])
+
+function sumCollected(payments: BillingPayment[], type: 'CHARGE' | 'DEPOSIT') {
+  return payments.reduce((total, payment) => {
+    if (payment.type !== type || !COLLECTED_STATUS.has(payment.status)) return total
+    return total + payment.amount
+  }, 0)
+}
+
+function derivePaymentStatus(invoiceBalanceDue: number, invoicePaid: number) {
+  if (invoiceBalanceDue <= 0) return 'PAID'
+  if (invoicePaid > 0) return 'PARTIAL'
+  return 'UNPAID'
+}
+
+function deriveDepositStatus(depositRequired: number, depositCollected: number) {
+  if (depositRequired <= 0) return 'NOT_REQUIRED'
+  if (depositCollected <= 0) return 'OUTSTANDING'
+  if (depositCollected < depositRequired) return 'PARTIALLY_COLLECTED'
+  return 'HELD'
+}
+
+export function buildBillingInvoice(reservation: BillingReservation) {
+  const invoiceTotal = reservation.totalAmount
+  const invoicePaid = sumCollected(reservation.rentalPayments, 'CHARGE')
+  const invoiceRefunded = 0
+  const invoiceBalanceDue = Math.max(invoiceTotal - invoicePaid, 0)
+  const depositRequired = reservation.depositAmount
+  const depositCollected = sumCollected(reservation.rentalPayments, 'DEPOSIT')
+  const depositRefunded = 0
+  const depositHeld = Math.max(depositCollected - depositRefunded, 0)
+  const depositOutstanding = Math.max(depositRequired - depositCollected, 0)
+
+  const payments = [...reservation.rentalPayments]
+    .sort((a, b) => new Date(b.paidAt ?? b.receivedAt ?? b.createdAt).getTime() - new Date(a.paidAt ?? a.receivedAt ?? a.createdAt).getTime())
+    .map((payment) => ({
+      id: payment.id,
+      reservationId: payment.reservationId,
+      amountMinor: payment.amount,
+      currency: payment.currency,
+      type: payment.type,
+      channel: payment.paymentProvider === 'MANUAL' ? 'OFFLINE' : 'ONLINE',
+      provider: payment.paymentProvider,
+      method: payment.paymentMethod,
+      status: payment.status,
+      reference: payment.reference ?? null,
+      note: payment.note ?? null,
+      receivedAt: payment.receivedAt?.toISOString() ?? payment.paidAt?.toISOString() ?? payment.createdAt.toISOString(),
+      paidAt: payment.paidAt?.toISOString() ?? null,
+      createdAt: payment.createdAt.toISOString(),
+      recordedBy: payment.recordedByEmployee
+        ? {
+            name: `${payment.recordedByEmployee.firstName} ${payment.recordedByEmployee.lastName}`,
+            email: payment.recordedByEmployee.email,
+          }
+        : null,
+      refundedAmountMinor: 0,
+    }))
+
+  return {
+    id: reservation.id,
+    reservationId: reservation.id,
+    invoiceNumber: reservation.invoiceNumber,
+    contractNumber: reservation.contractNumber,
+    customer: reservation.customer,
+    vehicle: reservation.vehicle,
+    rentalPeriod: {
+      startDate: reservation.startDate.toISOString(),
+      endDate: reservation.endDate.toISOString(),
+    },
+    currency: BILLING_CURRENCY,
+    status: reservation.status,
+    paymentStatus: derivePaymentStatus(invoiceBalanceDue, invoicePaid),
+    issuedAt: null,
+    dueAt: reservation.startDate.toISOString(),
+    subtotal: invoiceTotal,
+    taxTotal: 0,
+    discountTotal: 0,
+    adjustmentTotal: 0,
+    invoiceTotal,
+    invoicePaid,
+    invoiceRefunded,
+    invoiceBalanceDue,
+    depositRequired,
+    depositCollected,
+    depositRefunded,
+    depositHeld,
+    depositOutstanding,
+    depositStatus: deriveDepositStatus(depositRequired, depositCollected),
+    paymentCount: payments.length,
+    latestPayment: payments[0] ?? null,
+    payments,
+  }
+}
+
+function buildReservationWhere(companyId: string, search = '') {
+  const trimmedSearch = search.trim()
+  const where: any = { companyId }
+
+  if (trimmedSearch) {
+    where.OR = [
+      { invoiceNumber: { contains: trimmedSearch, mode: 'insensitive' } },
+      { contractNumber: { contains: trimmedSearch, mode: 'insensitive' } },
+      { customer: { firstName: { contains: trimmedSearch, mode: 'insensitive' } } },
+      { customer: { lastName: { contains: trimmedSearch, mode: 'insensitive' } } },
+      { customer: { email: { contains: trimmedSearch, mode: 'insensitive' } } },
+      { vehicle: { make: { contains: trimmedSearch, mode: 'insensitive' } } },
+      { vehicle: { model: { contains: trimmedSearch, mode: 'insensitive' } } },
+      { vehicle: { licensePlate: { contains: trimmedSearch, mode: 'insensitive' } } },
+    ]
+  }
+
+  return where
+}
+
+const reservationInclude = {
+  customer: true,
+  vehicle: true,
+  rentalPayments: {
+    include: {
+      recordedByEmployee: {
+        select: { firstName: true, lastName: true, email: true },
+      },
+    },
+    orderBy: { createdAt: 'desc' },
+  },
+} as const
+
+export async function listInvoices(companyId: string, query: ListQuery) {
+  const where = buildReservationWhere(companyId, query.search)
+  const reservations = await prisma.reservation.findMany({
+    where,
+    include: reservationInclude as any,
+    orderBy: { createdAt: 'desc' },
+  })
+
+  let items = reservations.map((reservation) => buildBillingInvoice(reservation as any))
+  if (query.paymentStatus !== 'ALL') {
+    items = items.filter((invoice) => invoice.paymentStatus === query.paymentStatus)
+  }
+  if (query.outstandingOnly) {
+    items = items.filter((invoice) => invoice.invoiceBalanceDue > 0 || invoice.depositOutstanding > 0)
+  }
+
+  const totalRecords = items.length
+  const pagedItems = items.slice((query.page - 1) * query.pageSize, query.page * query.pageSize)
+
+  return {
+    items: pagedItems,
+    page: query.page,
+    pageSize: query.pageSize,
+    totalItems: totalRecords,
+    totalPages: Math.max(Math.ceil(totalRecords / query.pageSize), 1),
+  }
+}
+
+export async function getSummary(companyId: string, query: SummaryQuery) {
+  const reservations = await prisma.reservation.findMany({
+    where: buildReservationWhere(companyId, query.search),
+    include: reservationInclude as any,
+  })
+
+  const totals = reservations.reduce(
+    (acc, reservation) => {
+      const invoice = buildBillingInvoice(reservation as any)
+      acc.totalInvoiced += invoice.invoiceTotal
+      acc.totalCollected += invoice.invoicePaid
+      acc.totalRefunded += invoice.invoiceRefunded
+      acc.totalOutstanding += invoice.invoiceBalanceDue
+      acc.depositsHeld += invoice.depositHeld
+      if (invoice.invoiceBalanceDue > 0) acc.openInvoiceCount += 1
+      return acc
+    },
+    {
+      currency: BILLING_CURRENCY,
+      totalInvoiced: 0,
+      totalCollected: 0,
+      totalRefunded: 0,
+      totalOutstanding: 0,
+      depositsHeld: 0,
+      openInvoiceCount: 0,
+      overdueInvoiceCount: 0,
+    },
+  )
+
+  return totals
+}
+
+export async function getInvoice(companyId: string, invoiceId: string) {
+  const reservation = await prisma.reservation.findFirst({
+    where: { id: invoiceId, companyId },
+    include: reservationInclude as any,
+  })
+
+  if (!reservation) throw new NotFoundError('Billing invoice not found')
+  return buildBillingInvoice(reservation as any)
+}
+
+export async function recordManualPayment(companyId: string, employeeId: string, invoiceId: string, body: ManualPaymentInput) {
+  const result = await prisma.$transaction(async (tx: any) => {
+    const existingPayment = await tx.rentalPayment.findFirst({
+      where: { companyId, idempotencyKey: body.idempotencyKey },
+    })
+
+    if (existingPayment) {
+      return existingPayment
+    }
+
+    const reservation = await tx.reservation.findFirst({
+      where: { id: invoiceId, companyId },
+      include: reservationInclude as any,
+    })
+
+    if (!reservation) throw new NotFoundError('Billing invoice not found')
+
+    const invoice = buildBillingInvoice(reservation)
+    if (body.currency !== invoice.currency) {
+      throw new ValidationError('Payment currency must match the invoice currency')
+    }
+
+    const permittedAmount = body.type === 'DEPOSIT' ? invoice.depositOutstanding : invoice.invoiceBalanceDue
+    if (permittedAmount <= 0) {
+      throw new ConflictError(body.type === 'DEPOSIT' ? 'Security deposit is already fully collected' : 'Invoice is already fully paid')
+    }
+    if (body.amountMinor > permittedAmount) {
+      throw new ValidationError(body.type === 'DEPOSIT' ? 'Payment amount exceeds deposit outstanding' : 'Payment amount exceeds invoice balance due')
+    }
+
+    const receivedAt = body.receivedAt ? new Date(body.receivedAt) : new Date()
+    const payment = await tx.rentalPayment.create({
+      data: {
+        companyId,
+        reservationId: reservation.id,
+        amount: body.amountMinor,
+        currency: body.currency,
+        status: 'SUCCEEDED',
+        type: body.type,
+        paymentProvider: 'MANUAL',
+        paymentMethod: body.method,
+        reference: body.reference,
+        note: body.note,
+        receivedAt,
+        paidAt: receivedAt,
+        recordedByEmployeeId: employeeId,
+        idempotencyKey: body.idempotencyKey,
+      },
+    })
+
+    if (body.type === 'CHARGE') {
+      const paidAmount = invoice.invoicePaid + body.amountMinor
+      await tx.reservation.update({
+        where: { id: reservation.id },
+        data: {
+          paidAmount,
+          paymentStatus: paidAmount >= invoice.invoiceTotal ? 'PAID' : 'PARTIAL',
+        },
+      })
+    }
+
+    return payment
+  })
+
+  return result
+}
diff --git a/apps/api/src/modules/companies/company.routes.ts b/apps/api/src/modules/companies/company.routes.ts
index 0fa7fbf..adebcf8 100644
--- a/apps/api/src/modules/companies/company.routes.ts
+++ b/apps/api/src/modules/companies/company.routes.ts
@@ -8,6 +8,12 @@ import { parseBody, parseParams } from '../../http/validate'
 import { ok, created, noContent } from '../../http/respond'
 import { imageUpload, assertImageFile } from '../../http/upload'
 import * as service from './company.service'
+import {
+  normalizeSettingsLocale,
+  requireSettingsFeature,
+  resolveSettingsEntitlements,
+  resolveSettingsMenu,
+} from './settingsEntitlements'
 import {
   companySchema, brandSchema, contractSettingsSchema,
   insurancePolicySchema, pricingRuleSchema, accountingSettingsSchema,
@@ -40,7 +46,7 @@ router.get('/me/brand', async (req, res, next) => {
   } catch (err) { next(err) }
 })
 
-router.patch('/me/brand', requireRole('OWNER'), async (req, res, next) => {
+router.patch('/me/brand', requireRole('OWNER'), requireSettingsFeature('settings.branding_basic'), async (req, res, next) => {
   try {
     const body = parseBody(brandSchema, req)
     const brand = await service.updateBrand(req.companyId, body, req.company.name, req.company.slug)
@@ -48,7 +54,7 @@ router.patch('/me/brand', requireRole('OWNER'), async (req, res, next) => {
   } catch (err) { next(err) }
 })
 
-router.post('/me/brand/logo', requireRole('OWNER'), imageUpload.single('file'), async (req, res, next) => {
+router.post('/me/brand/logo', requireRole('OWNER'), requireSettingsFeature('settings.branding_basic'), imageUpload.single('file'), async (req, res, next) => {
   try {
     assertImageFile(req.file, 'logo')
     const brand = await service.uploadLogo(req.companyId, req.company.name, req.company.slug, req.file.buffer)
@@ -56,7 +62,7 @@ router.post('/me/brand/logo', requireRole('OWNER'), imageUpload.single('file'),
   } catch (err) { next(err) }
 })
 
-router.post('/me/brand/hero', requireRole('OWNER'), imageUpload.single('file'), async (req, res, next) => {
+router.post('/me/brand/hero', requireRole('OWNER'), requireSettingsFeature('settings.branding_hero'), imageUpload.single('file'), async (req, res, next) => {
   try {
     assertImageFile(req.file, 'hero image')
     const brand = await service.uploadHeroImage(req.companyId, req.company.name, req.company.slug, req.file.buffer)
@@ -64,6 +70,18 @@ router.post('/me/brand/hero', requireRole('OWNER'), imageUpload.single('file'),
   } catch (err) { next(err) }
 })
 
+router.get('/me/settings-menu', async (req, res, next) => {
+  try {
+    ok(res, await resolveSettingsMenu(req.companyId, normalizeSettingsLocale(req.query.locale as string | undefined)))
+  } catch (err) { next(err) }
+})
+
+router.get('/me/settings-entitlements', async (req, res, next) => {
+  try {
+    ok(res, await resolveSettingsEntitlements(req.companyId))
+  } catch (err) { next(err) }
+})
+
 router.post('/me/brand/subdomain/check', requireRole('OWNER'), async (req, res, next) => {
   try {
     const { subdomain } = parseBody(subdomainSchema, req)
@@ -101,7 +119,7 @@ router.get('/me/contract-settings', async (req, res, next) => {
   } catch (err) { next(err) }
 })
 
-router.patch('/me/contract-settings', requireRole('MANAGER'), async (req, res, next) => {
+router.patch('/me/contract-settings', requireRole('MANAGER'), requireSettingsFeature('settings.rental_policies_basic'), async (req, res, next) => {
   try {
     const body = parseBody(contractSettingsSchema, req)
     const settings = await service.updateContractSettings(req.companyId, body)
@@ -116,7 +134,7 @@ router.get('/me/insurance-policies', async (req, res, next) => {
   } catch (err) { next(err) }
 })
 
-router.post('/me/insurance-policies', requireRole('MANAGER'), async (req, res, next) => {
+router.post('/me/insurance-policies', requireRole('MANAGER'), requireSettingsFeature('settings.insurance_policies'), async (req, res, next) => {
   try {
     const body = parseBody(insurancePolicySchema, req)
     const policy = await service.createInsurancePolicy(req.companyId, body)
@@ -124,7 +142,7 @@ router.post('/me/insurance-policies', requireRole('MANAGER'), async (req, res, n
   } catch (err) { next(err) }
 })
 
-router.patch('/me/insurance-policies/:id', requireRole('MANAGER'), async (req, res, next) => {
+router.patch('/me/insurance-policies/:id', requireRole('MANAGER'), requireSettingsFeature('settings.insurance_policies'), async (req, res, next) => {
   try {
     const { id } = parseParams(idParamSchema, req)
     const body = parseBody(insurancePolicySchema.partial(), req)
@@ -133,7 +151,7 @@ router.patch('/me/insurance-policies/:id', requireRole('MANAGER'), async (req, r
   } catch (err) { next(err) }
 })
 
-router.delete('/me/insurance-policies/:id', requireRole('MANAGER'), async (req, res, next) => {
+router.delete('/me/insurance-policies/:id', requireRole('MANAGER'), requireSettingsFeature('settings.insurance_policies'), async (req, res, next) => {
   try {
     const { id } = parseParams(idParamSchema, req)
     await service.deleteInsurancePolicy(id, req.companyId)
@@ -148,7 +166,7 @@ router.get('/me/pricing-rules', async (req, res, next) => {
   } catch (err) { next(err) }
 })
 
-router.post('/me/pricing-rules', requireRole('MANAGER'), async (req, res, next) => {
+router.post('/me/pricing-rules', requireRole('MANAGER'), requireSettingsFeature('settings.pricing_rules'), async (req, res, next) => {
   try {
     const body = parseBody(pricingRuleSchema, req)
     const rule = await service.createPricingRule(req.companyId, body)
@@ -156,7 +174,7 @@ router.post('/me/pricing-rules', requireRole('MANAGER'), async (req, res, next)
   } catch (err) { next(err) }
 })
 
-router.patch('/me/pricing-rules/:id', requireRole('MANAGER'), async (req, res, next) => {
+router.patch('/me/pricing-rules/:id', requireRole('MANAGER'), requireSettingsFeature('settings.pricing_rules'), async (req, res, next) => {
   try {
     const { id } = parseParams(idParamSchema, req)
     const body = parseBody(pricingRuleSchema.partial(), req)
@@ -165,7 +183,7 @@ router.patch('/me/pricing-rules/:id', requireRole('MANAGER'), async (req, res, n
   } catch (err) { next(err) }
 })
 
-router.delete('/me/pricing-rules/:id', requireCompanyPolicy('deletePricingRule'), async (req, res, next) => {
+router.delete('/me/pricing-rules/:id', requireCompanyPolicy('deletePricingRule'), requireSettingsFeature('settings.pricing_rules'), async (req, res, next) => {
   try {
     const { id } = parseParams(idParamSchema, req)
     await service.deletePricingRule(id, req.companyId)
@@ -180,7 +198,7 @@ router.get('/me/accounting-settings', async (req, res, next) => {
   } catch (err) { next(err) }
 })
 
-router.patch('/me/accounting-settings', requireCompanyPolicy('updateAccountingSettings'), async (req, res, next) => {
+router.patch('/me/accounting-settings', requireCompanyPolicy('updateAccountingSettings'), requireSettingsFeature('settings.accounting_defaults'), async (req, res, next) => {
   try {
     const body = parseBody(accountingSettingsSchema, req)
     const settings = await service.updateAccountingSettings(req.companyId, body)
diff --git a/apps/api/src/modules/companies/company.service.ts b/apps/api/src/modules/companies/company.service.ts
index f2adf6b..8a947bd 100644
--- a/apps/api/src/modules/companies/company.service.ts
+++ b/apps/api/src/modules/companies/company.service.ts
@@ -1,7 +1,8 @@
 import { uploadImage } from '../../lib/storage'
-import { ConflictError, NotFoundError } from '../../http/errors'
+import { ConflictError, ForbiddenError, NotFoundError } from '../../http/errors'
 import { presentCompany, presentBrand } from './company.presenter'
 import * as repo from './company.repo'
+import { resolveSettingsEntitlements, SettingsFeatureKey } from './settingsEntitlements'
 
 function buildPaymentMethodsEnabled(input: {
   amanpayMerchantId?: string | null
@@ -27,6 +28,12 @@ export async function getBrand(companyId: string) {
 }
 
 export async function updateBrand(companyId: string, body: any, companyName: string, companySlug: string) {
+  await assertSettingsFeature(companyId, 'settings.branding_basic')
+  if (body.primaryColor || body.accentColor) await assertSettingsFeature(companyId, 'settings.branding_custom')
+  if (body.amanpayMerchantId || body.amanpaySecretKey || body.paypalEmail || body.paypalMerchantId) {
+    await assertSettingsFeature(companyId, 'settings.renter_payments')
+  }
+
   const current = await repo.findBrand(companyId)
   const paymentMethodsEnabled = buildPaymentMethodsEnabled({
     amanpayMerchantId: body.amanpayMerchantId ?? current?.amanpayMerchantId,
@@ -41,6 +48,7 @@ export async function updateBrand(companyId: string, body: any, companyName: str
 }
 
 export async function uploadLogo(companyId: string, companyName: string, companySlug: string, file: Buffer) {
+  await assertSettingsFeature(companyId, 'settings.branding_basic')
   const url = await uploadImage(file, `companies/${companyId}/brand`, 'logo')
   return presentBrand(await repo.upsertBrand(
     companyId,
@@ -50,6 +58,7 @@ export async function uploadLogo(companyId: string, companyName: string, company
 }
 
 export async function uploadHeroImage(companyId: string, companyName: string, companySlug: string, file: Buffer) {
+  await assertSettingsFeature(companyId, 'settings.branding_hero')
   const url = await uploadImage(file, `companies/${companyId}/brand`, 'hero')
   return presentBrand(await repo.upsertBrand(
     companyId,
@@ -95,6 +104,14 @@ export async function getContractSettings(companyId: string) {
 }
 
 export async function updateContractSettings(companyId: string, data: any) {
+  await assertSettingsFeature(companyId, 'settings.rental_policies_basic')
+  if (
+    data.additionalDriverCharge ||
+    data.additionalDriverDailyRate !== undefined ||
+    data.additionalDriverFlatRate !== undefined
+  ) {
+    await assertSettingsFeature(companyId, 'settings.additional_driver_fees')
+  }
   return repo.upsertContractSettings(companyId, data)
 }
 
@@ -103,16 +120,19 @@ export async function getInsurancePolicies(companyId: string) {
 }
 
 export async function createInsurancePolicy(companyId: string, data: any) {
+  await assertSettingsFeature(companyId, 'settings.insurance_policies')
   return repo.createInsurancePolicy(companyId, data)
 }
 
 export async function updateInsurancePolicy(id: string, companyId: string, data: any) {
+  await assertSettingsFeature(companyId, 'settings.insurance_policies')
   const result = await repo.updateInsurancePolicy(id, companyId, data)
   if (result.count === 0) throw new NotFoundError('Insurance policy not found')
   return repo.findInsurancePolicyOrThrow(id)
 }
 
 export async function deleteInsurancePolicy(id: string, companyId: string) {
+  await assertSettingsFeature(companyId, 'settings.insurance_policies')
   const result = await repo.deleteInsurancePolicy(id, companyId)
   if (result.count === 0) throw new NotFoundError('Insurance policy not found')
 }
@@ -122,16 +142,19 @@ export async function getPricingRules(companyId: string) {
 }
 
 export async function createPricingRule(companyId: string, data: any) {
+  await assertSettingsFeature(companyId, 'settings.pricing_rules')
   return repo.createPricingRule(companyId, data)
 }
 
 export async function updatePricingRule(id: string, companyId: string, data: any) {
+  await assertSettingsFeature(companyId, 'settings.pricing_rules')
   const result = await repo.updatePricingRule(id, companyId, data)
   if (result.count === 0) throw new NotFoundError('Pricing rule not found')
   return repo.findPricingRuleOrThrow(id)
 }
 
 export async function deletePricingRule(id: string, companyId: string) {
+  await assertSettingsFeature(companyId, 'settings.pricing_rules')
   const result = await repo.deletePricingRule(id, companyId)
   if (result.count === 0) throw new NotFoundError('Pricing rule not found')
 }
@@ -141,6 +164,9 @@ export async function getAccountingSettings(companyId: string) {
 }
 
 export async function updateAccountingSettings(companyId: string, data: any) {
+  await assertSettingsFeature(companyId, 'settings.accounting_defaults')
+  if (data.autoSendReport) await assertSettingsFeature(companyId, 'settings.accounting_scheduled_delivery')
+  if (data.reportFormat === 'BOTH') await assertSettingsFeature(companyId, 'settings.accounting_advanced_formats')
   return repo.upsertAccountingSettings(companyId, data)
 }
 
@@ -151,3 +177,10 @@ export async function getApiKey(companyId: string) {
 export async function regenerateApiKey(companyId: string) {
   return repo.regenerateApiKey(companyId)
 }
+
+async function assertSettingsFeature(companyId: string, featureKey: SettingsFeatureKey) {
+  const entitlements = await resolveSettingsEntitlements(companyId)
+  if (!entitlements.features[featureKey]?.editable) {
+    throw new ForbiddenError('This settings feature is not available for your current subscription.')
+  }
+}
diff --git a/apps/api/src/modules/companies/settingsEntitlements.test.ts b/apps/api/src/modules/companies/settingsEntitlements.test.ts
new file mode 100644
index 0000000..500d4a0
--- /dev/null
+++ b/apps/api/src/modules/companies/settingsEntitlements.test.ts
@@ -0,0 +1,81 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('../../lib/prisma', () => ({
+  prisma: {
+    subscription: {
+      findUnique: vi.fn(),
+    },
+  },
+}))
+
+import { prisma } from '../../lib/prisma'
+import { resolveSettingsEntitlements, resolveSettingsMenu } from './settingsEntitlements'
+
+describe('settingsEntitlements', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('keeps company profile available while locking premium STARTER capabilities', async () => {
+    vi.mocked(prisma.subscription.findUnique).mockResolvedValue({
+      plan: 'STARTER',
+      status: 'ACTIVE',
+      currentPeriodEnd: null,
+      trialEndAt: null,
+    } as never)
+
+    const result = await resolveSettingsEntitlements('company_1')
+
+    expect(result.features['settings.company_profile']).toMatchObject({ available: true, editable: true })
+    expect(result.features['settings.renter_payments']).toMatchObject({
+      available: false,
+      editable: false,
+      requiredPlan: 'GROWTH',
+    })
+    expect(result.features['settings.accounting_scheduled_delivery']).toMatchObject({
+      available: false,
+      requiredPlan: 'PRO',
+    })
+  })
+
+  it('returns the approved seven settings sections with localized locked states', async () => {
+    vi.mocked(prisma.subscription.findUnique).mockResolvedValue({
+      plan: 'STARTER',
+      status: 'ACTIVE',
+      currentPeriodEnd: null,
+      trialEndAt: null,
+    } as never)
+
+    const result = await resolveSettingsMenu('company_1', 'fr')
+
+    expect(result.items).toHaveLength(7)
+    expect(result.items.map((item) => item.sectionKey)).toEqual([
+      'company',
+      'storefront',
+      'payments',
+      'rental-policies',
+      'insurance',
+      'pricing',
+      'accounting',
+    ])
+    expect(result.items.find((item) => item.sectionKey === 'payments')).toMatchObject({
+      label: 'Méthodes de paiement',
+      state: 'LOCKED',
+      requiredPlan: 'GROWTH',
+    })
+  })
+
+  it('makes premium features read-only during past-due access', async () => {
+    vi.mocked(prisma.subscription.findUnique).mockResolvedValue({
+      plan: 'PRO',
+      status: 'PAST_DUE',
+      currentPeriodEnd: null,
+      trialEndAt: null,
+    } as never)
+
+    const result = await resolveSettingsEntitlements('company_1')
+
+    expect(result.features['settings.company_profile']).toMatchObject({ available: true, editable: true })
+    expect(result.features['settings.pricing_rules']).toMatchObject({ available: true, editable: false })
+  })
+})
diff --git a/apps/api/src/modules/companies/settingsEntitlements.ts b/apps/api/src/modules/companies/settingsEntitlements.ts
new file mode 100644
index 0000000..c48aa15
--- /dev/null
+++ b/apps/api/src/modules/companies/settingsEntitlements.ts
@@ -0,0 +1,227 @@
+import { NextFunction, Request, Response } from 'express'
+import { prisma } from '../../lib/prisma'
+import { getAccessLevel } from '../subscriptions/subscription.policy'
+import { sendForbidden, sendUnauthorized } from '../../middleware/authHelpers'
+
+export type SettingsFeatureKey =
+  | 'settings.company_profile'
+  | 'settings.public_contact'
+  | 'settings.locale_currency'
+  | 'settings.storefront_listing'
+  | 'settings.branding_basic'
+  | 'settings.branding_custom'
+  | 'settings.branding_hero'
+  | 'settings.renter_payments'
+  | 'settings.rental_policies_basic'
+  | 'settings.additional_driver_fees'
+  | 'settings.insurance_policies'
+  | 'settings.pricing_rules'
+  | 'settings.accounting_defaults'
+  | 'settings.accounting_scheduled_delivery'
+  | 'settings.accounting_advanced_formats'
+
+export type SettingsSectionKey =
+  | 'company'
+  | 'storefront'
+  | 'payments'
+  | 'rental-policies'
+  | 'insurance'
+  | 'pricing'
+  | 'accounting'
+
+type Locale = 'en' | 'fr' | 'ar'
+type Plan = 'STARTER' | 'GROWTH' | 'PRO'
+type SubscriptionStatus =
+  | 'TRIALING'
+  | 'ACTIVE'
+  | 'PAYMENT_PENDING'
+  | 'PAST_DUE'
+  | 'SUSPENDED'
+  | 'CANCELLED'
+  | 'EXPIRED'
+  | 'PAUSED'
+  | 'UNPAID'
+
+type MenuState = 'ENABLED' | 'LOCKED'
+
+const ALL_PLANS: Plan[] = ['STARTER', 'GROWTH', 'PRO']
+const GROWTH_PLUS: Plan[] = ['GROWTH', 'PRO']
+const PRO_ONLY: Plan[] = ['PRO']
+
+const SECTION_COPY: Record<Locale, Record<SettingsSectionKey, { label: string; description: string }>> = {
+  en: {
+    company: { label: 'Company Profile', description: 'Manage public company details and defaults.' },
+    storefront: { label: 'Branding and Storefront', description: 'Control marketplace listing, logo, colors, and storefront media.' },
+    payments: { label: 'Payment Methods', description: 'Configure renter payment providers.' },
+    'rental-policies': { label: 'Rental Policies', description: 'Set fuel, damage, and additional-driver policies.' },
+    insurance: { label: 'Insurance Policies', description: 'Manage optional and required insurance products.' },
+    pricing: { label: 'Pricing Rules', description: 'Automate surcharges, discounts, and driver-based pricing.' },
+    accounting: { label: 'Accounting and Reports', description: 'Configure accounting defaults and report delivery.' },
+  },
+  fr: {
+    company: { label: 'Profil entreprise', description: 'Gérez les informations publiques et les valeurs par défaut.' },
+    storefront: { label: 'Marque et vitrine', description: 'Contrôlez la publication, le logo, les couleurs et les médias.' },
+    payments: { label: 'Méthodes de paiement', description: 'Configurez les prestataires de paiement des locataires.' },
+    'rental-policies': { label: 'Politiques de location', description: 'Définissez les règles carburant, dommages et conducteurs.' },
+    insurance: { label: 'Polices d’assurance', description: 'Gérez les assurances optionnelles et obligatoires.' },
+    pricing: { label: 'Règles tarifaires', description: 'Automatisez les suppléments, remises et règles conducteur.' },
+    accounting: { label: 'Comptabilité et rapports', description: 'Configurez les paramètres comptables et l’envoi des rapports.' },
+  },
+  ar: {
+    company: { label: 'ملف الشركة', description: 'إدارة بيانات الشركة العامة والإعدادات الافتراضية.' },
+    storefront: { label: 'العلامة والواجهة', description: 'التحكم في الظهور والشعار والألوان ووسائط الواجهة.' },
+    payments: { label: 'طرق الدفع', description: 'إعداد مزودي دفع المستأجرين.' },
+    'rental-policies': { label: 'سياسات الإيجار', description: 'ضبط سياسات الوقود والأضرار والسائق الإضافي.' },
+    insurance: { label: 'سياسات التأمين', description: 'إدارة منتجات التأمين الاختيارية والإلزامية.' },
+    pricing: { label: 'قواعد التسعير', description: 'أتمتة الرسوم والخصومات وقواعد السائق.' },
+    accounting: { label: 'المحاسبة والتقارير', description: 'إعداد الافتراضات المحاسبية وتسليم التقارير.' },
+  },
+}
+
+export const SETTINGS_MENU_CATALOG: Array<{
+  menuKey: SettingsSectionKey
+  sectionKey: SettingsSectionKey
+  iconKey: string
+  sortOrder: number
+  plans: Plan[]
+  requiredPlan: Plan | null
+}> = [
+  { menuKey: 'company', sectionKey: 'company', iconKey: 'building', sortOrder: 10, plans: ALL_PLANS, requiredPlan: null },
+  { menuKey: 'storefront', sectionKey: 'storefront', iconKey: 'palette', sortOrder: 20, plans: ALL_PLANS, requiredPlan: null },
+  { menuKey: 'payments', sectionKey: 'payments', iconKey: 'credit-card', sortOrder: 30, plans: GROWTH_PLUS, requiredPlan: 'GROWTH' },
+  { menuKey: 'rental-policies', sectionKey: 'rental-policies', iconKey: 'file-text', sortOrder: 40, plans: ALL_PLANS, requiredPlan: null },
+  { menuKey: 'insurance', sectionKey: 'insurance', iconKey: 'shield', sortOrder: 50, plans: GROWTH_PLUS, requiredPlan: 'GROWTH' },
+  { menuKey: 'pricing', sectionKey: 'pricing', iconKey: 'tags', sortOrder: 60, plans: GROWTH_PLUS, requiredPlan: 'GROWTH' },
+  { menuKey: 'accounting', sectionKey: 'accounting', iconKey: 'bar-chart', sortOrder: 70, plans: GROWTH_PLUS, requiredPlan: 'GROWTH' },
+]
+
+const FEATURE_PLANS: Record<SettingsFeatureKey, { plans: Plan[]; requiredPlan: Plan | null }> = {
+  'settings.company_profile': { plans: ALL_PLANS, requiredPlan: null },
+  'settings.public_contact': { plans: ALL_PLANS, requiredPlan: null },
+  'settings.locale_currency': { plans: ALL_PLANS, requiredPlan: null },
+  'settings.storefront_listing': { plans: ALL_PLANS, requiredPlan: null },
+  'settings.branding_basic': { plans: ALL_PLANS, requiredPlan: null },
+  'settings.branding_custom': { plans: GROWTH_PLUS, requiredPlan: 'GROWTH' },
+  'settings.branding_hero': { plans: GROWTH_PLUS, requiredPlan: 'GROWTH' },
+  'settings.renter_payments': { plans: GROWTH_PLUS, requiredPlan: 'GROWTH' },
+  'settings.rental_policies_basic': { plans: ALL_PLANS, requiredPlan: null },
+  'settings.additional_driver_fees': { plans: GROWTH_PLUS, requiredPlan: 'GROWTH' },
+  'settings.insurance_policies': { plans: GROWTH_PLUS, requiredPlan: 'GROWTH' },
+  'settings.pricing_rules': { plans: GROWTH_PLUS, requiredPlan: 'GROWTH' },
+  'settings.accounting_defaults': { plans: GROWTH_PLUS, requiredPlan: 'GROWTH' },
+  'settings.accounting_scheduled_delivery': { plans: PRO_ONLY, requiredPlan: 'PRO' },
+  'settings.accounting_advanced_formats': { plans: PRO_ONLY, requiredPlan: 'PRO' },
+}
+
+export function normalizeSettingsLocale(value?: string): Locale {
+  return value === 'fr' || value === 'ar' ? value : 'en'
+}
+
+async function getSubscription(companyId: string) {
+  const subscriptionModel = (prisma as any).subscription
+  if (!subscriptionModel?.findUnique) {
+    return {
+      plan: 'GROWTH' as Plan,
+      subscriptionStatus: 'ACTIVE' as SubscriptionStatus,
+      currentPeriodEnd: null,
+      trialEndAt: null,
+    }
+  }
+
+  const subscription = await subscriptionModel.findUnique({ where: { companyId } })
+  return {
+    plan: subscription?.plan ?? 'STARTER',
+    subscriptionStatus: subscription?.status ?? 'EXPIRED',
+    currentPeriodEnd: subscription?.currentPeriodEnd?.toISOString() ?? null,
+    trialEndAt: subscription?.trialEndAt?.toISOString() ?? null,
+  }
+}
+
+function statusAllowsAvailability(status: SubscriptionStatus) {
+  return getAccessLevel(status) !== 'none'
+}
+
+function statusAllowsEditing(status: SubscriptionStatus, featureKey: SettingsFeatureKey) {
+  const accessLevel = getAccessLevel(status)
+  if (accessLevel === 'full') return true
+  if (status === 'PAST_DUE') {
+    return [
+      'settings.company_profile',
+      'settings.public_contact',
+      'settings.locale_currency',
+      'settings.storefront_listing',
+      'settings.branding_basic',
+      'settings.rental_policies_basic',
+    ].includes(featureKey)
+  }
+  return false
+}
+
+export async function resolveSettingsEntitlements(companyId: string) {
+  const subscription = await getSubscription(companyId)
+  const accessLevel = getAccessLevel(subscription.subscriptionStatus)
+  const features = Object.fromEntries(
+    Object.entries(FEATURE_PLANS).map(([featureKey, assignment]) => {
+      const assigned = assignment.plans.includes(subscription.plan)
+      const available = assigned && statusAllowsAvailability(subscription.subscriptionStatus)
+      const editable = available && statusAllowsEditing(subscription.subscriptionStatus, featureKey as SettingsFeatureKey)
+      return [featureKey, {
+        available,
+        editable,
+        requiredPlan: assigned ? null : assignment.requiredPlan,
+        reason: available ? null : assigned ? 'subscription_status_restricted' : 'plan_required',
+      }]
+    }),
+  )
+
+  return {
+    plan: subscription.plan,
+    subscriptionStatus: subscription.subscriptionStatus,
+    currentPeriodEnd: subscription.currentPeriodEnd,
+    trialEndAt: subscription.trialEndAt,
+    accessLevel,
+    features,
+  }
+}
+
+export async function resolveSettingsMenu(companyId: string, locale: Locale) {
+  const entitlements = await resolveSettingsEntitlements(companyId)
+  return {
+    version: 1,
+    items: SETTINGS_MENU_CATALOG.map((item) => {
+      const assigned = item.plans.includes(entitlements.plan)
+      const coreAvailable = entitlements.accessLevel !== 'none' || item.sectionKey === 'company'
+      const state: MenuState = assigned && coreAvailable ? 'ENABLED' : 'LOCKED'
+      const copy = SECTION_COPY[locale][item.sectionKey]
+      return {
+        menuKey: item.menuKey,
+        sectionKey: item.sectionKey,
+        label: copy.label,
+        description: copy.description,
+        iconKey: item.iconKey,
+        sortOrder: item.sortOrder,
+        state,
+        requiredPlan: state === 'LOCKED' ? item.requiredPlan : null,
+      }
+    }),
+  }
+}
+
+export function requireSettingsFeature(featureKey: SettingsFeatureKey) {
+  return async (req: Request, res: Response, next: NextFunction) => {
+    if (!req.companyId) return sendUnauthorized(res, 'unauthenticated', 'Authentication required')
+
+    const entitlements = await resolveSettingsEntitlements(req.companyId)
+    const feature = entitlements.features[featureKey]
+    if (!feature?.editable) {
+      return sendForbidden(res, 'feature_unavailable', 'This settings feature is not available for your current subscription.', {
+        featureKey,
+        requiredPlan: feature?.requiredPlan ?? null,
+        subscriptionStatus: entitlements.subscriptionStatus,
+        accessLevel: entitlements.accessLevel,
+      })
+    }
+
+    next()
+  }
+}
diff --git a/apps/api/src/modules/payments/payment.repo.edge.test.ts b/apps/api/src/modules/payments/payment.repo.edge.test.ts
index fd95514..ac3b871 100644
--- a/apps/api/src/modules/payments/payment.repo.edge.test.ts
+++ b/apps/api/src/modules/payments/payment.repo.edge.test.ts
@@ -3,7 +3,17 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 vi.mock('../../lib/prisma', () => ({
   prisma: {
     rentalPayment: { findMany: vi.fn(), findFirst: vi.fn(), findFirstOrThrow: vi.fn(), update: vi.fn(), updateMany: vi.fn(), create: vi.fn() },
-    reservation: { findFirstOrThrow: vi.fn(), update: vi.fn() },
+    reservation: { findFirstOrThrow: vi.fn(), update: vi.fn(), findUniqueOrThrow: vi.fn() },
+    $transaction: vi.fn(async (callback) => callback({
+      reservation: {
+        findUniqueOrThrow: vi.fn().mockResolvedValue({
+          id: 'reservation_1',
+          totalAmount: 5000,
+          rentalPayments: [{ amount: 2500 }, { amount: 1500 }],
+        }),
+        update: vi.fn(),
+      },
+    })),
   },
 }))
 
@@ -46,13 +56,10 @@ describe('payment.repo edge queries', () => {
     vi.useRealTimers()
   })
 
-  it('increments paid amount and promotes reservation payment status to paid', async () => {
+  it('recomputes paid amount from successful charge payments', async () => {
     await repo.incrementReservationPaid('reservation_1', 2500)
 
-    expect(prisma.reservation.update).toHaveBeenCalledWith({
-      where: { id: 'reservation_1' },
-      data: { paymentStatus: 'PAID', paidAmount: { increment: 2500 } },
-    })
+    expect(prisma.$transaction).toHaveBeenCalled()
   })
 
   it('maps partial refunds to the correct payment status', async () => {
diff --git a/apps/api/src/modules/payments/payment.repo.ts b/apps/api/src/modules/payments/payment.repo.ts
index b40514c..7c1ee5f 100644
--- a/apps/api/src/modules/payments/payment.repo.ts
+++ b/apps/api/src/modules/payments/payment.repo.ts
@@ -32,12 +32,15 @@ export function findPaymentOrThrow(paymentId: string, companyId: string, reserva
 export function findReservationOrThrow(id: string, companyId: string) {
   return prisma.reservation.findFirstOrThrow({
     where: { id, companyId },
-    include: { vehicle: true, customer: true },
+    include: { vehicle: true, customer: true, rentalPayments: true },
   })
 }
 
 export function findReservation(id: string, companyId: string) {
-  return prisma.reservation.findFirstOrThrow({ where: { id, companyId } })
+  return prisma.reservation.findFirstOrThrow({
+    where: { id, companyId },
+    include: { rentalPayments: true },
+  })
 }
 
 export function markPaymentSucceeded(id: string) {
@@ -48,8 +51,26 @@ export function markPaymentFailed(query: { amanpayTransactionId?: string; paypal
   return prisma.rentalPayment.updateMany({ where: query, data: { status: 'FAILED' } })
 }
 
-export function incrementReservationPaid(reservationId: string, amount: number) {
-  return prisma.reservation.update({ where: { id: reservationId }, data: { paymentStatus: 'PAID', paidAmount: { increment: amount } } })
+export function incrementReservationPaid(reservationId: string, _amount: number) {
+  return prisma.$transaction(async (tx) => {
+    const reservation = await tx.reservation.findUniqueOrThrow({
+      where: { id: reservationId },
+      include: {
+        rentalPayments: {
+          where: { type: 'CHARGE', status: 'SUCCEEDED' },
+          select: { amount: true },
+        },
+      },
+    })
+    const paidAmount = reservation.rentalPayments.reduce((total, payment) => total + payment.amount, 0)
+    return tx.reservation.update({
+      where: { id: reservationId },
+      data: {
+        paidAmount,
+        paymentStatus: paidAmount >= reservation.totalAmount ? 'PAID' : 'PARTIAL',
+      },
+    })
+  })
 }
 
 export function createPayment(data: {
diff --git a/apps/api/src/modules/payments/payment.routes.ts b/apps/api/src/modules/payments/payment.routes.ts
index 0f8f4a7..fa708e1 100644
--- a/apps/api/src/modules/payments/payment.routes.ts
+++ b/apps/api/src/modules/payments/payment.routes.ts
@@ -72,7 +72,7 @@ router.post('/reservations/:id/capture-paypal', requireRole('MANAGER'), async (r
   } catch (err) { next(err) }
 })
 
-router.post('/reservations/:id/manual', requireRole('MANAGER'), async (req, res, next) => {
+router.post('/reservations/:id/manual', requireRole('OWNER'), async (req, res, next) => {
   try {
     const { id } = parseParams(reservationParamSchema, req)
     const body   = parseBody(manualPaymentSchema, req)
diff --git a/apps/api/src/modules/payments/payment.service.test.ts b/apps/api/src/modules/payments/payment.service.test.ts
index 6b5cca5..bda6570 100644
--- a/apps/api/src/modules/payments/payment.service.test.ts
+++ b/apps/api/src/modules/payments/payment.service.test.ts
@@ -52,6 +52,7 @@ const reservation = {
   depositAmount: 300,
   totalAmount: 1200,
   paidAmount: 200,
+  rentalPayments: [],
   vehicle: { make: 'Dacia', model: 'Duster' },
   customer: { firstName: 'Nora', lastName: 'Driver', email: 'nora@example.com' },
 }
@@ -106,7 +107,11 @@ describe('payment.service', () => {
   })
 
   it('refuses to initialize a charge for a fully paid reservation before touching gateways', async () => {
-    vi.mocked(repo.findReservationOrThrow).mockResolvedValue({ ...reservation, paymentStatus: 'PAID' } as never)
+    vi.mocked(repo.findReservationOrThrow).mockResolvedValue({
+      ...reservation,
+      paymentStatus: 'PAID',
+      rentalPayments: [{ type: 'CHARGE', status: 'SUCCEEDED', amount: 1200 }],
+    } as never)
 
     await expect(initCharge('reservation_1', 'company_1', {
       provider: 'PAYPAL',
@@ -120,8 +125,36 @@ describe('payment.service', () => {
     expect(repo.createPayment).not.toHaveBeenCalled()
   })
 
+  it('allows an outstanding deposit when the rental invoice is fully paid', async () => {
+    vi.mocked(repo.findReservationOrThrow).mockResolvedValue({
+      ...reservation,
+      paymentStatus: 'PAID',
+      rentalPayments: [{ type: 'CHARGE', status: 'SUCCEEDED', amount: 1200 }],
+    } as never)
+    vi.mocked(amanpay.isConfigured).mockReturnValue(true)
+    vi.mocked(amanpay.createCheckout).mockResolvedValue({ checkoutUrl: 'https://pay.example/checkout', transactionId: 'aman_txn_2' } as never)
+    vi.mocked(repo.createPayment).mockResolvedValue({ id: 'payment_2', status: 'PENDING' } as never)
+
+    await initCharge('reservation_1', 'company_1', {
+      provider: 'AMANPAY',
+      type: 'DEPOSIT',
+      currency: 'MAD',
+      successUrl: 'https://app.example/success',
+      failureUrl: 'https://app.example/failure',
+    })
+
+    expect(amanpay.createCheckout).toHaveBeenCalledWith(expect.objectContaining({ amount: 300 }))
+    expect(repo.createPayment).toHaveBeenCalledWith(expect.objectContaining({ type: 'DEPOSIT' }))
+  })
+
   it('records manual payments and marks the reservation as partially or fully paid from the balance math', async () => {
-    vi.mocked(repo.findReservation).mockResolvedValue({ id: 'reservation_1', totalAmount: 1000, paidAmount: 700 } as never)
+    vi.mocked(repo.findReservation).mockResolvedValue({
+      id: 'reservation_1',
+      totalAmount: 1000,
+      depositAmount: 300,
+      paidAmount: 700,
+      rentalPayments: [{ type: 'CHARGE', status: 'SUCCEEDED', amount: 700 }],
+    } as never)
     vi.mocked(repo.createPayment).mockResolvedValue({ id: 'payment_1', amount: 300, status: 'SUCCEEDED' } as never)
 
     const payment = await recordManualPayment('reservation_1', 'company_1', {
@@ -133,7 +166,7 @@ describe('payment.service', () => {
 
     expect(repo.createPayment).toHaveBeenCalledWith(expect.objectContaining({
       status: 'SUCCEEDED',
-      paymentProvider: 'AMANPAY',
+      paymentProvider: 'MANUAL',
       paymentMethod: 'CASH',
       paidAt: expect.any(Date),
     }))
@@ -142,7 +175,13 @@ describe('payment.service', () => {
   })
 
   it('rejects manual overpayments instead of silently corrupting the reservation balance', async () => {
-    vi.mocked(repo.findReservation).mockResolvedValue({ id: 'reservation_1', totalAmount: 1000, paidAmount: 950 } as never)
+    vi.mocked(repo.findReservation).mockResolvedValue({
+      id: 'reservation_1',
+      totalAmount: 1000,
+      depositAmount: 300,
+      paidAmount: 950,
+      rentalPayments: [{ type: 'CHARGE', status: 'SUCCEEDED', amount: 950 }],
+    } as never)
 
     await expect(recordManualPayment('reservation_1', 'company_1', {
       amount: 100,
@@ -156,8 +195,8 @@ describe('payment.service', () => {
   })
 
   it('applies paid AmanPay and denied PayPal webhook events to the matching records', async () => {
-    vi.mocked(repo.findByAmanpay).mockResolvedValue({ id: 'payment_1', reservationId: 'reservation_1', amount: 450 } as never)
-    vi.mocked(repo.findByPaypal).mockResolvedValue({ id: 'payment_2', reservationId: 'reservation_2', amount: 500 } as never)
+    vi.mocked(repo.findByAmanpay).mockResolvedValue({ id: 'payment_1', reservationId: 'reservation_1', amount: 450, type: 'CHARGE' } as never)
+    vi.mocked(repo.findByPaypal).mockResolvedValue({ id: 'payment_2', reservationId: 'reservation_2', amount: 500, type: 'CHARGE' } as never)
 
     await handleAmanpayWebhook({ transaction_id: 'aman_txn_1', status: 'paid' })
     await handlePaypalWebhook({ event_type: 'PAYMENT.CAPTURE.COMPLETED', resource: { id: 'paypal_capture_1' } })
@@ -171,7 +210,7 @@ describe('payment.service', () => {
   })
 
   it('captures PayPal orders, stores the capture id, and increments the original reservation payment', async () => {
-    vi.mocked(repo.findByPaypalForCompany).mockResolvedValue({ id: 'payment_1', reservationId: 'reservation_1', amount: 800 } as never)
+    vi.mocked(repo.findByPaypalForCompany).mockResolvedValue({ id: 'payment_1', reservationId: 'reservation_1', amount: 800, type: 'CHARGE' } as never)
     vi.mocked(paypal.captureOrder).mockResolvedValue({ purchase_units: [{ payments: { captures: [{ id: 'capture_123' }] } }] } as never)
     vi.mocked(repo.updatePaypalCapture).mockResolvedValue({ id: 'payment_1', status: 'SUCCEEDED', paypalCaptureId: 'capture_123' } as never)
 
diff --git a/apps/api/src/modules/payments/payment.service.ts b/apps/api/src/modules/payments/payment.service.ts
index dd41846..9e6ba0b 100644
--- a/apps/api/src/modules/payments/payment.service.ts
+++ b/apps/api/src/modules/payments/payment.service.ts
@@ -19,7 +19,9 @@ async function applyAmanpayWebhook(event: any) {
     const payment = await repo.findByAmanpay(transactionId)
     if (payment && payment.status !== 'SUCCEEDED') {
       await repo.markPaymentSucceeded(payment.id)
-      await repo.incrementReservationPaid(payment.reservationId, payment.amount)
+      if (payment.type === 'CHARGE') {
+        await repo.incrementReservationPaid(payment.reservationId, payment.amount)
+      }
     }
   } else if (status === 'FAILED') {
     await repo.markPaymentFailed({ amanpayTransactionId: transactionId })
@@ -33,7 +35,9 @@ async function applyPaypalWebhook(event: any) {
     const payment   = await repo.findByPaypal(captureId)
     if (payment && payment.status !== 'SUCCEEDED') {
       await repo.markPaymentSucceeded(payment.id)
-      await repo.incrementReservationPaid(payment.reservationId, payment.amount)
+      if (payment.type === 'CHARGE') {
+        await repo.incrementReservationPaid(payment.reservationId, payment.amount)
+      }
     }
   } else if (eventType === 'PAYMENT.CAPTURE.DENIED') {
     await repo.markPaymentFailed({ paypalCaptureId: event.resource?.id })
@@ -65,9 +69,23 @@ export async function initCharge(reservationId: string, companyId: string, body:
   currency: 'MAD'; successUrl: string; failureUrl: string
 }) {
   const reservation = await repo.findReservationOrThrow(reservationId, companyId)
-  if (reservation.paymentStatus === 'PAID') throw new ConflictError('Reservation is already fully paid')
+  const rentalPayments = (reservation as any).rentalPayments ?? []
+  const invoicePaid = rentalPayments.reduce((total: number, payment: any) => {
+    if (payment.type !== 'CHARGE' || payment.status !== 'SUCCEEDED') return total
+    return total + payment.amount
+  }, 0)
+  const depositCollected = rentalPayments.reduce((total: number, payment: any) => {
+    if (payment.type !== 'DEPOSIT' || payment.status !== 'SUCCEEDED') return total
+    return total + payment.amount
+  }, 0)
+  const chargeRemaining = Math.max(reservation.totalAmount - invoicePaid, 0)
+  const depositRemaining = Math.max(reservation.depositAmount - depositCollected, 0)
+  const amount = body.type === 'DEPOSIT' ? depositRemaining : chargeRemaining
+
+  if (amount <= 0) {
+    throw new ConflictError(body.type === 'DEPOSIT' ? 'Security deposit is already fully collected' : 'Reservation is already fully paid')
+  }
 
-  const amount      = body.type === 'DEPOSIT' ? reservation.depositAmount : reservation.totalAmount
   const description = `${body.type === 'DEPOSIT' ? 'Deposit' : 'Rental'}: ${reservation.vehicle.make} ${reservation.vehicle.model}`
   const orderId     = `${reservationId}-${body.type}-${Date.now()}`
   const webhookBase = process.env.API_URL ?? 'http://localhost:4000'
@@ -103,7 +121,9 @@ export async function capturePaypal(reservationId: string, companyId: string, pa
   const capture   = await paypal.captureOrder(paypalOrderId) as Record<string, any>
   const captureId = capture.purchase_units?.[0]?.payments?.captures?.[0]?.id ?? paypalOrderId
   const updated   = await repo.updatePaypalCapture(payment.id, captureId)
-  await repo.incrementReservationPaid(payment.reservationId, payment.amount)
+  if (payment.type === 'CHARGE') {
+    await repo.incrementReservationPaid(payment.reservationId, payment.amount)
+  }
   return updated
 }
 
@@ -111,13 +131,31 @@ export async function recordManualPayment(reservationId: string, companyId: stri
   amount: number; currency: string; type: string; paymentMethod: string
 }) {
   const reservation   = await repo.findReservation(reservationId, companyId)
-  const remaining     = Math.max(reservation.totalAmount - reservation.paidAmount, 0)
-  if (remaining <= 0)          throw new ConflictError('Reservation is already fully paid')
-  if (body.amount > remaining) throw new ValidationError('Payment amount exceeds remaining balance')
+  const rentalPayments = (reservation as any).rentalPayments ?? []
+  const invoicePaid = rentalPayments.reduce((total: number, payment: any) => {
+    if (payment.type !== 'CHARGE' || payment.status !== 'SUCCEEDED') return total
+    return total + payment.amount
+  }, 0)
+  const depositCollected = rentalPayments.reduce((total: number, payment: any) => {
+    if (payment.type !== 'DEPOSIT' || payment.status !== 'SUCCEEDED') return total
+    return total + payment.amount
+  }, 0)
+  const chargeRemaining = Math.max(reservation.totalAmount - invoicePaid, 0)
+  const depositRemaining = Math.max(reservation.depositAmount - depositCollected, 0)
+  const remaining = body.type === 'DEPOSIT' ? depositRemaining : chargeRemaining
 
-  const payment      = await repo.createPayment({ companyId, reservationId, amount: body.amount, currency: body.currency, status: 'SUCCEEDED', type: body.type, paymentProvider: body.paymentMethod === 'PAYPAL' ? 'PAYPAL' : 'AMANPAY', paymentMethod: body.paymentMethod, paidAt: new Date() })
-  const newPaidAmount = reservation.paidAmount + body.amount
-  await repo.setReservationPaidAmount(reservationId, newPaidAmount, newPaidAmount >= reservation.totalAmount ? 'PAID' : 'PARTIAL')
+  if (remaining <= 0) {
+    throw new ConflictError(body.type === 'DEPOSIT' ? 'Security deposit is already fully collected' : 'Reservation is already fully paid')
+  }
+  if (body.amount > remaining) {
+    throw new ValidationError(body.type === 'DEPOSIT' ? 'Payment amount exceeds deposit outstanding' : 'Payment amount exceeds remaining balance')
+  }
+
+  const payment      = await repo.createPayment({ companyId, reservationId, amount: body.amount, currency: body.currency, status: 'SUCCEEDED', type: body.type, paymentProvider: 'MANUAL', paymentMethod: body.paymentMethod, paidAt: new Date() })
+  if (body.type === 'CHARGE') {
+    const newPaidAmount = invoicePaid + body.amount
+    await repo.setReservationPaidAmount(reservationId, newPaidAmount, newPaidAmount >= reservation.totalAmount ? 'PAID' : 'PARTIAL')
+  }
   return payment
 }
 
diff --git a/apps/api/src/services/additionalDriverService.ts b/apps/api/src/services/additionalDriverService.ts
index 8b03c57..0f44a54 100644
--- a/apps/api/src/services/additionalDriverService.ts
+++ b/apps/api/src/services/additionalDriverService.ts
@@ -1,7 +1,8 @@
 import { prisma } from '../lib/prisma'
+import { resolveSettingsEntitlements } from '../modules/companies/settingsEntitlements'
+import { validateLicense } from './licenseValidationService'
 
 type AdditionalDriverCharge = 'PER_DAY' | 'FLAT' | 'FREE'
-import { validateLicense } from './licenseValidationService'
 
 export interface AdditionalDriverInput {
   firstName: string
@@ -40,7 +41,11 @@ export async function applyAdditionalDriversToReservation(
     return { records: [], additionalDriverTotal: 0, requiresManualApproval: false }
   }
 
-  const settings = await prisma.contractSettings.findUnique({ where: { companyId } })
+  const entitlements = await resolveSettingsEntitlements(companyId)
+  const canApplyAutomatedFees = entitlements.features['settings.additional_driver_fees']?.available
+  const settings = canApplyAutomatedFees
+    ? await prisma.contractSettings.findUnique({ where: { companyId } })
+    : null
   const chargeType = settings?.additionalDriverCharge ?? 'FREE'
   const chargeValue =
     chargeType === 'PER_DAY'
diff --git a/apps/api/src/services/insuranceService.ts b/apps/api/src/services/insuranceService.ts
index 3925a1c..d5b585a 100644
--- a/apps/api/src/services/insuranceService.ts
+++ b/apps/api/src/services/insuranceService.ts
@@ -1,5 +1,6 @@
 import { InsurancePolicy } from '@rentaldrivego/database'
 import { prisma } from '../lib/prisma'
+import { resolveSettingsEntitlements } from '../modules/companies/settingsEntitlements'
 
 export function calculateInsuranceCharge(
   policy: InsurancePolicy,
@@ -21,6 +22,11 @@ export async function applyInsurancesToReservation(
   totalDays: number,
   baseRentalAmount: number
 ) {
+  const entitlements = await resolveSettingsEntitlements(companyId)
+  if (!entitlements.features['settings.insurance_policies']?.available) {
+    return { records: [], insuranceTotal: 0 }
+  }
+
   const allPolicies = await prisma.insurancePolicy.findMany({ where: { companyId, isActive: true } })
   const required = allPolicies.filter((p: InsurancePolicy) => p.isRequired)
   const selected = allPolicies.filter((p: InsurancePolicy) => selectedPolicyIds.includes(p.id) && !p.isRequired)
diff --git a/apps/api/src/services/invoicePdfService.test.ts b/apps/api/src/services/invoicePdfService.test.ts
index 94da41c..1c51e5c 100644
--- a/apps/api/src/services/invoicePdfService.test.ts
+++ b/apps/api/src/services/invoicePdfService.test.ts
@@ -54,4 +54,32 @@ describe('invoicePdfService', () => {
       props: expect.objectContaining({ data: expect.objectContaining({ invoiceNumber: 'INV-2026-000001' }) }),
     }))
   })
+
+  it('falls back to a simple PDF when the React PDF renderer fails', async () => {
+    renderToBufferMock.mockRejectedValueOnce(new Error('renderer failed'))
+
+    const result = await generateInvoicePdf({
+      invoiceNumber: 'INV-2026-000002',
+      issueDate: '2026-06-09T00:00:00.000Z',
+      dueDate: null,
+      company: { name: 'Atlas Cars', email: 'billing@atlas.test', address: { formatted: 'Casablanca' } },
+      amount: 80000,
+      currency: 'MAD',
+      status: 'OPEN',
+      paymentProvider: 'MANUAL',
+      lineItems: [{ description: 'Migration assistance', amount: 30000, currency: 'MAD', quantity: 2, unitAmount: 15000 }],
+      totals: {
+        subtotalAmount: 80000,
+        discountAmount: 0,
+        creditAmount: 0,
+        taxAmount: 0,
+        totalAmount: 80000,
+        amountPaid: 0,
+        amountDue: 80000,
+      },
+    })
+
+    expect(result.subarray(0, 8).toString()).toBe('%PDF-1.4')
+    expect(result.toString()).toContain('INV-2026-000002')
+  })
 })
diff --git a/apps/api/src/services/invoicePdfService.ts b/apps/api/src/services/invoicePdfService.ts
index 7b78a58..6b9ed25 100644
--- a/apps/api/src/services/invoicePdfService.ts
+++ b/apps/api/src/services/invoicePdfService.ts
@@ -318,17 +318,27 @@ function fmt(amount: number, currency: string) {
 }
 
 function fmtDate(iso: string | null | undefined) {
-  if (!iso) return '—'
+  if (!iso) return '-'
   return new Date(iso).toLocaleDateString('en-GB', { day: '2-digit', month: 'long', year: 'numeric' })
 }
 
 function formatAddress(address: any): string {
   if (!address) return ''
   if (typeof address === 'string') return address
+  if (typeof address.formatted === 'string') return address.formatted
   const parts = [address.street, address.city, address.region, address.country, address.zip]
   return parts.filter(Boolean).join(', ')
 }
 
+function pdfText(value: unknown) {
+  return String(value ?? '')
+    .normalize('NFKD')
+    .replace(/[\u0300-\u036f]/g, '')
+    .replace(/[\u2013\u2014]/g, '-')
+    .replace(/\u00d7/g, 'x')
+    .replace(/[^\x20-\x7E]/g, '')
+}
+
 function InvoiceDocument({ data }: { data: InvoiceData }) {
   const statusColor = STATUS_COLORS[data.status] ?? '#6b7280'
   const addressStr = formatAddress(data.company.address)
@@ -374,11 +384,11 @@ function InvoiceDocument({ data }: { data: InvoiceData }) {
           View,
           { style: s.invoiceMeta },
           React.createElement(Text, { style: s.invoiceTitle }, 'INVOICE'),
-          React.createElement(Text, { style: s.invoiceNumber }, data.invoiceNumber),
+          React.createElement(Text, { style: s.invoiceNumber }, pdfText(data.invoiceNumber)),
           React.createElement(
             View,
             { style: [s.statusBadge, { backgroundColor: statusColor }] },
-            React.createElement(Text, { style: s.statusText }, data.status),
+            React.createElement(Text, { style: s.statusText }, pdfText(data.status)),
           ),
         ),
       ),
@@ -391,13 +401,13 @@ function InvoiceDocument({ data }: { data: InvoiceData }) {
           View,
           { style: s.col },
           React.createElement(Text, { style: s.colLabel }, 'Bill To'),
-          React.createElement(Text, { style: s.companyName }, data.company.name),
-          React.createElement(Text, { style: s.companyDetail }, data.company.email),
+          React.createElement(Text, { style: s.companyName }, pdfText(data.company.name)),
+          React.createElement(Text, { style: s.companyDetail }, pdfText(data.company.email)),
           data.company.phone
-            ? React.createElement(Text, { style: s.companyDetail }, data.company.phone)
+            ? React.createElement(Text, { style: s.companyDetail }, pdfText(data.company.phone))
             : null,
           addressStr
-            ? React.createElement(Text, { style: [s.companyDetail, { marginTop: 4 }] }, addressStr)
+            ? React.createElement(Text, { style: [s.companyDetail, { marginTop: 4 }] }, pdfText(addressStr))
             : null,
         ),
         React.createElement(
@@ -408,7 +418,7 @@ function InvoiceDocument({ data }: { data: InvoiceData }) {
             View,
             { style: s.metaRow },
             React.createElement(Text, { style: s.metaKey }, 'Invoice Number'),
-            React.createElement(Text, { style: s.metaValue }, data.invoiceNumber),
+            React.createElement(Text, { style: s.metaValue }, pdfText(data.invoiceNumber)),
           ),
           React.createElement(
             View,
@@ -428,20 +438,20 @@ function InvoiceDocument({ data }: { data: InvoiceData }) {
             View,
             { style: s.metaRow },
             React.createElement(Text, { style: s.metaKey }, 'Currency'),
-            React.createElement(Text, { style: s.metaValue }, data.currency),
+            React.createElement(Text, { style: s.metaValue }, pdfText(data.currency)),
           ),
           React.createElement(
             View,
             { style: s.metaRow },
             React.createElement(Text, { style: s.metaKey }, 'Billing Period'),
-            React.createElement(Text, { style: s.metaValue }, periodLabel),
+            React.createElement(Text, { style: s.metaValue }, pdfText(periodLabel)),
           ),
           data.subscription
             ? React.createElement(
                 View,
                 { style: s.metaRow },
                 React.createElement(Text, { style: s.metaKey }, 'Plan'),
-                React.createElement(Text, { style: s.metaValue }, planLabel),
+                React.createElement(Text, { style: s.metaValue }, pdfText(planLabel)),
               )
             : null,
         ),
@@ -460,17 +470,17 @@ function InvoiceDocument({ data }: { data: InvoiceData }) {
         ),
         ...lineItems.map((item) => {
           const periodStr = item.periodStart && item.periodEnd
-            ? `${fmtDate(item.periodStart)} – ${fmtDate(item.periodEnd)}`
-            : '—'
+            ? `${fmtDate(item.periodStart)} - ${fmtDate(item.periodEnd)}`
+            : '-'
           const description = item.quantity && item.quantity > 1 && item.unitAmount !== undefined
-            ? `${item.description} (${item.quantity} × ${fmt(item.unitAmount, item.currency)})`
+            ? `${item.description} (${item.quantity} x ${fmt(item.unitAmount, item.currency)})`
             : item.description
           return React.createElement(
             View,
             { key: `${item.description}-${item.amount}-${item.periodStart ?? ''}`, style: s.tableRow },
-            React.createElement(Text, { style: [s.tableCell, s.col60] }, description),
-            React.createElement(Text, { style: [s.tableCellMuted, s.col20Center, { textAlign: 'center' }] }, periodStr),
-            React.createElement(Text, { style: [s.tableCell, s.col20, { textAlign: 'right' }] }, fmt(item.amount, item.currency)),
+            React.createElement(Text, { style: [s.tableCell, s.col60] }, pdfText(description)),
+            React.createElement(Text, { style: [s.tableCellMuted, s.col20Center, { textAlign: 'center' }] }, pdfText(periodStr)),
+            React.createElement(Text, { style: [s.tableCell, s.col20, { textAlign: 'right' }] }, pdfText(fmt(item.amount, item.currency))),
           )
         }),
       ),
@@ -522,14 +532,14 @@ function InvoiceDocument({ data }: { data: InvoiceData }) {
           View,
           { style: s.paymentRow },
           React.createElement(Text, { style: s.paymentKey }, 'Payment Provider'),
-          React.createElement(Text, { style: s.paymentValue }, data.paymentProvider),
+          React.createElement(Text, { style: s.paymentValue }, pdfText(data.paymentProvider)),
         ),
         data.transactionId
           ? React.createElement(
               View,
               { style: s.paymentRow },
               React.createElement(Text, { style: s.paymentKey }, 'Transaction ID'),
-              React.createElement(Text, { style: s.paymentValue }, data.transactionId),
+              React.createElement(Text, { style: s.paymentValue }, pdfText(data.transactionId)),
             )
           : null,
         React.createElement(
@@ -542,7 +552,7 @@ function InvoiceDocument({ data }: { data: InvoiceData }) {
           View,
           { style: s.paymentRow },
           React.createElement(Text, { style: s.paymentKey }, 'Status'),
-          React.createElement(Text, { style: [s.paymentValue, { color: statusColor }] }, data.status),
+          React.createElement(Text, { style: [s.paymentValue, { color: statusColor }] }, pdfText(data.status)),
         ),
       ),
 
@@ -550,7 +560,7 @@ function InvoiceDocument({ data }: { data: InvoiceData }) {
       React.createElement(
         View,
         { style: s.footer },
-        React.createElement(Text, { style: s.footerText }, 'RentalDriveGo — Car Rental Management Platform'),
+        React.createElement(Text, { style: s.footerText }, 'RentalDriveGo - Car Rental Management Platform'),
         React.createElement(Text, { style: s.footerText }, `Generated on ${fmtDate(new Date().toISOString())}`),
       ),
     ),
@@ -559,8 +569,12 @@ function InvoiceDocument({ data }: { data: InvoiceData }) {
 
 export async function generateInvoicePdf(data: InvoiceData): Promise<Buffer> {
   const doc = React.createElement(InvoiceDocument, { data })
-  const buffer = await renderToBuffer(doc as any)
-  return buffer as unknown as Buffer
+  try {
+    const buffer = await renderToBuffer(doc as any)
+    return buffer as unknown as Buffer
+  } catch {
+    return buildSimpleInvoicePdf(data)
+  }
 }
 
 export function buildInvoiceNumber(invoiceId: string, createdAt: Date): string {
@@ -568,3 +582,81 @@ export function buildInvoiceNumber(invoiceId: string, createdAt: Date): string {
   const short = invoiceId.slice(-6).toUpperCase()
   return `INV-${year}-${short}`
 }
+
+function pdfEscape(value: unknown) {
+  return pdfText(value).replace(/\\/g, '\\\\').replace(/\(/g, '\\(').replace(/\)/g, '\\)')
+}
+
+function buildSimpleInvoicePdf(data: InvoiceData) {
+  const lineItems = data.lineItems?.length
+    ? data.lineItems
+    : [{ description: 'Invoice charge', amount: data.amount, currency: data.currency }]
+  const totals = data.totals ?? {
+    subtotalAmount: data.amount,
+    discountAmount: 0,
+    creditAmount: 0,
+    taxAmount: 0,
+    totalAmount: data.amount,
+    amountPaid: data.paidAt ? data.amount : 0,
+    amountDue: data.paidAt ? 0 : data.amount,
+  }
+  const address = formatAddress(data.company.address)
+  const lines = [
+    'RentalDriveGo - Invoice',
+    `Invoice Number: ${data.invoiceNumber}`,
+    `Status: ${data.status}`,
+    `Issue Date: ${fmtDate(data.issueDate)}`,
+    data.dueDate ? `Due Date: ${fmtDate(data.dueDate)}` : null,
+    `Bill To: ${data.company.name}`,
+    `Email: ${data.company.email}`,
+    data.company.phone ? `Phone: ${data.company.phone}` : null,
+    address ? `Address: ${address}` : null,
+    '',
+    'Line Items',
+    ...lineItems.map((item) => `${item.description} - ${fmt(item.amount, item.currency)}`),
+    '',
+    `Subtotal: ${fmt(totals.subtotalAmount, data.currency)}`,
+    totals.discountAmount ? `Discounts: -${fmt(totals.discountAmount, data.currency)}` : null,
+    totals.creditAmount ? `Credits: -${fmt(totals.creditAmount, data.currency)}` : null,
+    totals.taxAmount ? `Tax: ${fmt(totals.taxAmount, data.currency)}` : null,
+    `Total: ${fmt(totals.totalAmount, data.currency)}`,
+    `Amount Paid: ${fmt(totals.amountPaid, data.currency)}`,
+    `Amount Due: ${fmt(totals.amountDue, data.currency)}`,
+    '',
+    `Payment Provider: ${data.paymentProvider}`,
+    data.transactionId ? `Transaction ID: ${data.transactionId}` : null,
+  ].filter((line): line is string => line !== null)
+
+  const content = [
+    'BT',
+    '/F1 18 Tf',
+    '50 790 Td',
+    `(${pdfEscape(lines[0])}) Tj`,
+    '/F1 10 Tf',
+    ...lines.slice(1).flatMap((line) => ['0 -18 Td', `(${pdfEscape(line)}) Tj`]),
+    'ET',
+  ].join('\n')
+  const objects = [
+    '<< /Type /Catalog /Pages 2 0 R >>',
+    '<< /Type /Pages /Kids [3 0 R] /Count 1 >>',
+    '<< /Type /Page /Parent 2 0 R /MediaBox [0 0 595 842] /Resources << /Font << /F1 4 0 R >> >> /Contents 5 0 R >>',
+    '<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>',
+    `<< /Length ${Buffer.byteLength(content, 'utf8')} >>\nstream\n${content}\nendstream`,
+  ]
+
+  let pdf = '%PDF-1.4\n'
+  const offsets = [0]
+  objects.forEach((object, index) => {
+    offsets.push(Buffer.byteLength(pdf, 'utf8'))
+    pdf += `${index + 1} 0 obj\n${object}\nendobj\n`
+  })
+  const xrefOffset = Buffer.byteLength(pdf, 'utf8')
+  pdf += `xref\n0 ${objects.length + 1}\n`
+  pdf += '0000000000 65535 f \n'
+  for (let i = 1; i < offsets.length; i += 1) {
+    pdf += `${String(offsets[i]).padStart(10, '0')} 00000 n \n`
+  }
+  pdf += `trailer\n<< /Size ${objects.length + 1} /Root 1 0 R >>\nstartxref\n${xrefOffset}\n%%EOF\n`
+
+  return Buffer.from(pdf, 'utf8')
+}
diff --git a/apps/api/src/services/pricingRuleService.ts b/apps/api/src/services/pricingRuleService.ts
index 657503f..bc65c06 100644
--- a/apps/api/src/services/pricingRuleService.ts
+++ b/apps/api/src/services/pricingRuleService.ts
@@ -1,4 +1,5 @@
 import { prisma } from '../lib/prisma'
+import { resolveSettingsEntitlements } from '../modules/companies/settingsEntitlements'
 
 interface DriverInfo {
   dateOfBirth?: Date | null
@@ -12,6 +13,11 @@ export async function applyPricingRules(
   dailyRate: number,
   totalDays: number
 ): Promise<{ applied: any[]; total: number }> {
+  const entitlements = await resolveSettingsEntitlements(companyId)
+  if (!entitlements.features['settings.pricing_rules']?.available) {
+    return { applied: [], total: 0 }
+  }
+
   const rules = await prisma.pricingRule.findMany({ where: { companyId, isActive: true } })
   const customer = await prisma.customer.findFirstOrThrow({ where: { id: customerId, companyId } })
   const allDrivers: DriverInfo[] = [customer, ...additionalDrivers]
diff --git a/apps/dashboard.zip b/apps/dashboard.zip
new file mode 100644
index 0000000..e879a7a
Binary files /dev/null and b/apps/dashboard.zip differ
diff --git a/apps/dashboard/src/app/(dashboard)/billing/page.tsx b/apps/dashboard/src/app/(dashboard)/billing/page.tsx
index b70f929..36f2b9c 100644
--- a/apps/dashboard/src/app/(dashboard)/billing/page.tsx
+++ b/apps/dashboard/src/app/(dashboard)/billing/page.tsx
@@ -1,372 +1,309 @@
 'use client'
 
-import { useEffect, useMemo, useState } from 'react'
+import { useCallback, useEffect, useMemo, useState } from 'react'
 import Link from 'next/link'
 import { formatCurrency, SupportedCurrency } from '@rentaldrivego/types'
 import { apiFetch } from '@/lib/api'
 import { useDashboardI18n } from '@/components/I18nProvider'
 
-type ReservationRow = {
+type BillingPaymentType = 'CHARGE' | 'DEPOSIT'
+type ManualPaymentMethod = 'CASH' | 'CHECK' | 'BANK_TRANSFER' | 'CARD' | 'PAYPAL' | 'OTHER'
+
+type BillingPayment = {
   id: string
-  invoiceNumber: string | null
-  contractNumber: string | null
+  amountMinor: number
+  currency: SupportedCurrency
+  type: BillingPaymentType
+  channel: 'ONLINE' | 'OFFLINE' | 'TERMINAL'
+  provider: string
+  method: string | null
   status: string
-  paymentStatus: string
-  startDate: string
-  endDate: string
-  totalAmount: number
-  depositAmount: number
-  paidAmount: number
-  customer: { firstName: string; lastName: string; email: string }
-  vehicle: { make: string; model: string; licensePlate: string }
+  reference: string | null
+  receivedAt: string
+  createdAt: string
+  recordedBy: { name: string; email: string } | null
 }
 
-type PaymentRow = {
+type BillingInvoice = {
   id: string
   reservationId: string
-  amount: number
+  invoiceNumber: string | null
+  contractNumber: string | null
+  customer: { firstName: string; lastName: string; email: string }
+  vehicle: { make: string; model: string; licensePlate: string }
+  rentalPeriod: { startDate: string; endDate: string }
   currency: SupportedCurrency
-  status: string
-  type: 'CHARGE' | 'DEPOSIT'
-  paymentProvider: 'AMANPAY' | 'PAYPAL'
-  paymentMethod: string | null
-  paidAt: string | null
-  createdAt: string
-}
-
-type BillingRow = ReservationRow & {
-  balanceDue: number
+  paymentStatus: 'UNPAID' | 'PARTIAL' | 'PAID'
+  invoiceTotal: number
+  invoicePaid: number
+  invoiceBalanceDue: number
+  depositRequired: number
+  depositCollected: number
+  depositHeld: number
+  depositOutstanding: number
+  depositStatus: string
   paymentCount: number
-  latestPayment: PaymentRow | null
+  latestPayment: BillingPayment | null
 }
 
-type ManualPaymentMethod = 'CASH' | 'CHECK' | 'BANK_TRANSFER' | 'CARD' | 'PAYPAL'
+type BillingSummary = {
+  currency: SupportedCurrency
+  totalInvoiced: number
+  totalCollected: number
+  totalRefunded: number
+  totalOutstanding: number
+  depositsHeld: number
+  openInvoiceCount: number
+  overdueInvoiceCount: number
+}
 
-const PAYMENT_STATUS_BADGE: Record<string, string> = {
+type BillingInvoiceResponse = {
+  items: BillingInvoice[]
+  page: number
+  pageSize: number
+  totalItems: number
+  totalPages: number
+}
+
+const STATUS_BADGE: Record<string, string> = {
   UNPAID: 'bg-rose-100 text-rose-700',
-  PAID: 'bg-emerald-100 text-emerald-700',
   PARTIAL: 'bg-orange-100 text-orange-700',
-  PENDING: 'bg-sky-100 text-sky-700',
-  REFUNDED: 'bg-slate-100 text-slate-700',
-  FAILED: 'bg-rose-100 text-rose-700',
-  OVERDUE: 'bg-orange-100 text-orange-700',
-}
-
-const PAYMENT_EVENT_BADGE: Record<string, string> = {
-  PENDING: 'bg-orange-100 text-orange-700',
-  SUCCEEDED: 'bg-emerald-100 text-emerald-700',
-  FAILED: 'bg-rose-100 text-rose-700',
-  REFUNDED: 'bg-slate-100 text-slate-700',
-  PARTIALLY_REFUNDED: 'bg-sky-100 text-sky-700',
+  PAID: 'bg-emerald-100 text-emerald-700',
+  OUTSTANDING: 'bg-rose-100 text-rose-700',
+  PARTIALLY_COLLECTED: 'bg-orange-100 text-orange-700',
+  HELD: 'bg-emerald-100 text-emerald-700',
+  NOT_REQUIRED: 'bg-slate-100 text-slate-700',
 }
 
 export default function BillingPage() {
   const { language } = useDashboardI18n()
   const localeCode = language === 'fr' ? 'fr-FR' : language === 'ar' ? 'ar-MA' : 'en-US'
-  const [reservations, setReservations] = useState<ReservationRow[]>([])
-  const [payments, setPayments] = useState<PaymentRow[]>([])
+  const [summary, setSummary] = useState<BillingSummary | null>(null)
+  const [invoices, setInvoices] = useState<BillingInvoiceResponse | null>(null)
   const [search, setSearch] = useState('')
-  const [error, setError] = useState<string | null>(null)
+  const [submittedSearch, setSubmittedSearch] = useState('')
+  const [paymentStatus, setPaymentStatus] = useState<'ALL' | 'UNPAID' | 'PARTIAL' | 'PAID'>('ALL')
+  const [outstandingOnly, setOutstandingOnly] = useState(false)
+  const [page, setPage] = useState(1)
   const [loading, setLoading] = useState(true)
-  const [paymentModalRow, setPaymentModalRow] = useState<BillingRow | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [paymentInvoice, setPaymentInvoice] = useState<BillingInvoice | null>(null)
+  const [paymentType, setPaymentType] = useState<BillingPaymentType>('CHARGE')
   const [paymentMethod, setPaymentMethod] = useState<ManualPaymentMethod>('CASH')
-  const [paymentType, setPaymentType] = useState<'CHARGE' | 'DEPOSIT'>('CHARGE')
-  const paymentCurrency = 'MAD'
   const [paymentAmount, setPaymentAmount] = useState('')
+  const [receivedAt, setReceivedAt] = useState('')
+  const [reference, setReference] = useState('')
+  const [note, setNote] = useState('')
   const [submittingPayment, setSubmittingPayment] = useState(false)
   const [paymentError, setPaymentError] = useState<string | null>(null)
 
-  const copy = {
+  const copy = useMemo(() => ({
     en: {
       heading: 'Customer Billing',
-      subtitle: 'Manage customer invoices, payment status, collected amounts, and remaining balances.',
-      search: 'Search by customer, invoice, contract, vehicle, or plate…',
-      totalBilled: 'Total billed',
-      totalCollected: 'Collected',
+      subtitle: 'Customer invoices, rental payments, deposits, and balances. Subscription billing is managed separately.',
+      search: 'Search customer, invoice, contract, vehicle, or plate',
+      applySearch: 'Search',
+      allStatuses: 'All statuses',
+      outstandingOnly: 'Outstanding only',
+      totalInvoiced: 'Total invoiced',
+      collected: 'Collected',
       outstanding: 'Outstanding',
+      depositsHeld: 'Deposits held',
       openInvoices: 'Open invoices',
-      customer: 'Customer',
+      invoiceCustomer: 'Invoice and customer',
       vehicle: 'Vehicle',
-      invoice: 'Invoice',
-      rentalPeriod: 'Rental period',
-      total: 'Total',
+      period: 'Rental period',
+      invoiceTotal: 'Invoice total',
       paid: 'Paid',
       balance: 'Balance',
-      status: 'Status',
-      payment: 'Payment',
-      paymentMethod: 'Payment method',
-      actions: 'Actions',
-      contract: 'Contract',
       deposit: 'Deposit',
-      acceptPayment: 'Accept payment',
-      paymentModalTitle: 'Accept customer payment',
-      paymentModalSubtitle: 'Record a payment received for this reservation. No online provider setup is required.',
-      paymentType: 'Payment type',
-      paymentCurrency: 'Payment currency',
-      paymentAmount: 'Payment amount',
-      cancel: 'Cancel',
-      savingPayment: 'Saving payment…',
-      savePayment: 'Save payment',
-      chargeHelp: 'Charge records a payment against the reservation balance.',
-      depositHelp: 'Deposit records money received for the refundable security deposit.',
-      invalidAmount: 'Enter a valid payment amount within the remaining balance.',
-      paymentActionDisabled: 'No balance due',
-      paymentsRecorded: (count: number) => `${count} payment(s)`,
-      none: '—',
-      loading: 'Loading customer billing…',
-      noRows: 'No customer bills found.',
-      failed: 'Failed to load customer billing.',
+      status: 'Status',
+      actions: 'Actions',
+      recordPayment: 'Record payment',
+      noPaymentDue: 'No payment due',
       openContract: 'Open contract',
       openBooking: 'Open booking',
-      charge: 'Charge',
-      depositType: 'Deposit',
+      loading: 'Loading customer billing...',
+      failed: 'Failed to load customer billing.',
+      retry: 'Retry',
+      empty: 'No customer billing records found.',
+      previous: 'Previous',
+      next: 'Next',
+      pageLabel: (current: number, total: number) => `Page ${current} of ${total}`,
       unknownInvoice: 'Draft invoice',
-      paymentStatusLabels: {
-        UNPAID: 'Unpaid',
-        PAID: 'Paid',
-        PARTIAL: 'Partial',
-        PENDING: 'Pending',
-        REFUNDED: 'Refunded',
-        FAILED: 'Failed',
-        OVERDUE: 'Overdue',
-      } as Record<string, string>,
-      paymentEventLabels: {
-        PENDING: 'Pending',
-        SUCCEEDED: 'Succeeded',
-        FAILED: 'Failed',
-        REFUNDED: 'Refunded',
-        PARTIALLY_REFUNDED: 'Partially refunded',
-      } as Record<string, string>,
-      paymentProviderLabels: {
-        AMANPAY: 'AmanPay',
-        PAYPAL: 'PayPal',
-      } as Record<string, string>,
-      paymentMethodLabels: {
-        CASH: 'Cash',
-        CHECK: 'Check',
-        BANK_TRANSFER: 'Bank transfer',
-        CARD: 'Card',
-        PAYPAL: 'PayPal',
-        STRIPE: 'Card',
-        CREDIT_CARD: 'Card',
-        DEBIT_CARD: 'Card',
-      } as Record<string, string>,
+      none: '-',
+      paymentDialogTitle: 'Record manual payment',
+      paymentDialogDescription: 'Record an offline payment against the correct invoice or security-deposit balance.',
+      paymentTarget: 'Payment target',
+      charge: 'Invoice charge',
+      securityDeposit: 'Security deposit',
+      remaining: 'Remaining',
+      paymentMethod: 'Payment method',
+      amount: 'Amount',
+      currency: 'Currency',
+      receivedAt: 'Received at',
+      reference: 'Reference',
+      note: 'Internal note',
+      cancel: 'Cancel',
+      save: 'Save payment',
+      saving: 'Saving...',
+      invalidAmount: 'Enter a valid amount within the selected remaining balance.',
+      paymentStatusLabels: { ALL: 'All', UNPAID: 'Unpaid', PARTIAL: 'Partial', PAID: 'Paid' } as Record<string, string>,
+      depositStatusLabels: { NOT_REQUIRED: 'Not required', OUTSTANDING: 'Outstanding', PARTIALLY_COLLECTED: 'Partially collected', HELD: 'Held' } as Record<string, string>,
+      paymentMethodLabels: { CASH: 'Cash', CHECK: 'Check', BANK_TRANSFER: 'Bank transfer', CARD: 'Card', PAYPAL: 'PayPal', OTHER: 'Other' } as Record<string, string>,
     },
     fr: {
       heading: 'Facturation clients',
-      subtitle: 'Gérez les factures clients, le statut des paiements, les montants encaissés et les soldes restants.',
-      search: 'Rechercher par client, facture, contrat, véhicule ou plaque…',
-      totalBilled: 'Total facturé',
-      totalCollected: 'Encaissé',
+      subtitle: 'Factures clients, paiements de location, dépôts et soldes. La facturation d’abonnement est séparée.',
+      search: 'Rechercher client, facture, contrat, véhicule ou plaque',
+      applySearch: 'Rechercher',
+      allStatuses: 'Tous les statuts',
+      outstandingOnly: 'Soldes uniquement',
+      totalInvoiced: 'Total facturé',
+      collected: 'Encaissé',
       outstanding: 'Solde restant',
+      depositsHeld: 'Dépôts détenus',
       openInvoices: 'Factures ouvertes',
-      customer: 'Client',
+      invoiceCustomer: 'Facture et client',
       vehicle: 'Véhicule',
-      invoice: 'Facture',
-      rentalPeriod: 'Période',
-      total: 'Total',
+      period: 'Période',
+      invoiceTotal: 'Total facture',
       paid: 'Payé',
       balance: 'Solde',
-      status: 'Statut',
-      payment: 'Paiement',
-      paymentMethod: 'Mode de paiement',
-      actions: 'Actions',
-      contract: 'Contrat',
       deposit: 'Dépôt',
-      acceptPayment: 'Encaisser',
-      paymentModalTitle: 'Encaisser un paiement client',
-      paymentModalSubtitle: 'Enregistrez un paiement reçu pour cette réservation. Aucune configuration de fournisseur en ligne n’est requise.',
-      paymentType: 'Type de paiement',
-      paymentCurrency: 'Devise du paiement',
-      paymentAmount: 'Montant du paiement',
-      cancel: 'Annuler',
-      savingPayment: 'Enregistrement…',
-      savePayment: 'Enregistrer le paiement',
-      chargeHelp: 'Le paiement enregistre un règlement sur le solde de la réservation.',
-      depositHelp: 'Le dépôt enregistre l’encaissement du dépôt de garantie remboursable.',
-      invalidAmount: 'Saisissez un montant valide dans la limite du solde restant.',
-      paymentActionDisabled: 'Aucun solde dû',
-      paymentsRecorded: (count: number) => `${count} paiement(s)`,
-      none: '—',
-      loading: 'Chargement de la facturation client…',
-      noRows: 'Aucune facture client trouvée.',
+      status: 'Statut',
+      actions: 'Actions',
+      recordPayment: 'Encaisser',
+      noPaymentDue: 'Aucun montant dû',
+      openContract: 'Ouvrir contrat',
+      openBooking: 'Ouvrir réservation',
+      loading: 'Chargement de la facturation client...',
       failed: 'Échec du chargement de la facturation client.',
-      openContract: 'Ouvrir le contrat',
-      openBooking: 'Ouvrir la réservation',
-      charge: 'Paiement',
-      depositType: 'Dépôt',
+      retry: 'Réessayer',
+      empty: 'Aucune facture client trouvée.',
+      previous: 'Précédent',
+      next: 'Suivant',
+      pageLabel: (current: number, total: number) => `Page ${current} sur ${total}`,
       unknownInvoice: 'Facture brouillon',
-      paymentStatusLabels: {
-        UNPAID: 'Non payé',
-        PAID: 'Payé',
-        PARTIAL: 'Partiel',
-        PENDING: 'En attente',
-        REFUNDED: 'Remboursé',
-        FAILED: 'Échoué',
-        OVERDUE: 'En retard',
-      } as Record<string, string>,
-      paymentEventLabels: {
-        PENDING: 'En attente',
-        SUCCEEDED: 'Réussi',
-        FAILED: 'Échoué',
-        REFUNDED: 'Remboursé',
-        PARTIALLY_REFUNDED: 'Partiellement remboursé',
-      } as Record<string, string>,
-      paymentProviderLabels: {
-        AMANPAY: 'AmanPay',
-        PAYPAL: 'PayPal',
-      } as Record<string, string>,
-      paymentMethodLabels: {
-        CASH: 'Espèces',
-        CHECK: 'Chèque',
-        BANK_TRANSFER: 'Virement bancaire',
-        CARD: 'Carte',
-        PAYPAL: 'PayPal',
-        STRIPE: 'Carte',
-        CREDIT_CARD: 'Carte',
-        DEBIT_CARD: 'Carte',
-      } as Record<string, string>,
+      none: '-',
+      paymentDialogTitle: 'Enregistrer un paiement manuel',
+      paymentDialogDescription: 'Enregistrez un paiement hors ligne sur le bon solde de facture ou de dépôt de garantie.',
+      paymentTarget: 'Cible du paiement',
+      charge: 'Facture',
+      securityDeposit: 'Dépôt de garantie',
+      remaining: 'Restant',
+      paymentMethod: 'Mode de paiement',
+      amount: 'Montant',
+      currency: 'Devise',
+      receivedAt: 'Reçu le',
+      reference: 'Référence',
+      note: 'Note interne',
+      cancel: 'Annuler',
+      save: 'Enregistrer',
+      saving: 'Enregistrement...',
+      invalidAmount: 'Saisissez un montant valide dans la limite du solde sélectionné.',
+      paymentStatusLabels: { ALL: 'Tous', UNPAID: 'Non payé', PARTIAL: 'Partiel', PAID: 'Payé' } as Record<string, string>,
+      depositStatusLabels: { NOT_REQUIRED: 'Non requis', OUTSTANDING: 'À collecter', PARTIALLY_COLLECTED: 'Partiellement collecté', HELD: 'Détenu' } as Record<string, string>,
+      paymentMethodLabels: { CASH: 'Espèces', CHECK: 'Chèque', BANK_TRANSFER: 'Virement bancaire', CARD: 'Carte', PAYPAL: 'PayPal', OTHER: 'Autre' } as Record<string, string>,
     },
     ar: {
       heading: 'فوترة العملاء',
-      subtitle: 'إدارة فواتير العملاء وحالة الدفع والمبالغ المحصلة والأرصدة المتبقية.',
-      search: 'ابحث بالعميل أو الفاتورة أو العقد أو السيارة أو اللوحة…',
-      totalBilled: 'إجمالي الفواتير',
-      totalCollected: 'المحصّل',
+      subtitle: 'فواتير العملاء ودفعات الإيجار والضمانات والأرصدة. فوترة الاشتراك تدار بشكل منفصل.',
+      search: 'ابحث بالعميل أو الفاتورة أو العقد أو السيارة أو اللوحة',
+      applySearch: 'بحث',
+      allStatuses: 'كل الحالات',
+      outstandingOnly: 'المستحق فقط',
+      totalInvoiced: 'إجمالي الفواتير',
+      collected: 'المحصّل',
       outstanding: 'المتبقي',
+      depositsHeld: 'الضمان المحتجز',
       openInvoices: 'الفواتير المفتوحة',
-      customer: 'العميل',
+      invoiceCustomer: 'الفاتورة والعميل',
       vehicle: 'المركبة',
-      invoice: 'الفاتورة',
-      rentalPeriod: 'فترة الإيجار',
-      total: 'الإجمالي',
+      period: 'الفترة',
+      invoiceTotal: 'إجمالي الفاتورة',
       paid: 'المدفوع',
       balance: 'الرصيد',
+      deposit: 'الضمان',
       status: 'الحالة',
-      payment: 'الدفعة',
-      paymentMethod: 'طريقة الدفع',
       actions: 'الإجراءات',
-      contract: 'العقد',
-      deposit: 'العربون',
-      acceptPayment: 'تحصيل دفعة',
-      paymentModalTitle: 'تحصيل دفعة من العميل',
-      paymentModalSubtitle: 'سجّل دفعة مستلمة لهذا الحجز. لا يتطلب ذلك إعداد مزود دفع عبر الإنترنت.',
-      paymentType: 'نوع الدفع',
-      paymentCurrency: 'عملة الدفع',
-      paymentAmount: 'مبلغ الدفعة',
-      cancel: 'إلغاء',
-      savingPayment: 'جارٍ الحفظ…',
-      savePayment: 'حفظ الدفعة',
-      chargeHelp: 'تسجّل الدفعة مبلغاً مستلماً على رصيد الحجز.',
-      depositHelp: 'العربون يسجل مبلغ التأمين القابل للاسترداد المستلم.',
-      invalidAmount: 'أدخل مبلغاً صحيحاً ضمن الرصيد المتبقي.',
-      paymentActionDisabled: 'لا يوجد رصيد مستحق',
-      paymentsRecorded: (count: number) => `${count} دفعة`,
-      none: '—',
-      loading: 'جارٍ تحميل فوترة العملاء…',
-      noRows: 'لم يتم العثور على فواتير عملاء.',
-      failed: 'فشل تحميل فوترة العملاء.',
+      recordPayment: 'تسجيل دفعة',
+      noPaymentDue: 'لا يوجد مبلغ مستحق',
       openContract: 'فتح العقد',
       openBooking: 'فتح الحجز',
-      charge: 'دفعة',
-      depositType: 'عربون',
+      loading: 'جارٍ تحميل فوترة العملاء...',
+      failed: 'فشل تحميل فوترة العملاء.',
+      retry: 'إعادة المحاولة',
+      empty: 'لم يتم العثور على سجلات فوترة.',
+      previous: 'السابق',
+      next: 'التالي',
+      pageLabel: (current: number, total: number) => `الصفحة ${current} من ${total}`,
       unknownInvoice: 'فاتورة مسودة',
-      paymentStatusLabels: {
-        UNPAID: 'غير مدفوع',
-        PAID: 'مدفوع',
-        PARTIAL: 'جزئي',
-        PENDING: 'قيد الانتظار',
-        REFUNDED: 'مسترد',
-        FAILED: 'فشل',
-        OVERDUE: 'متأخر',
-      } as Record<string, string>,
-      paymentEventLabels: {
-        PENDING: 'قيد الانتظار',
-        SUCCEEDED: 'ناجح',
-        FAILED: 'فشل',
-        REFUNDED: 'مسترد',
-        PARTIALLY_REFUNDED: 'مسترد جزئياً',
-      } as Record<string, string>,
-      paymentProviderLabels: {
-        AMANPAY: 'AmanPay',
-        PAYPAL: 'PayPal',
-      } as Record<string, string>,
-      paymentMethodLabels: {
-        CASH: 'نقداً',
-        CHECK: 'شيك',
-        BANK_TRANSFER: 'تحويل بنكي',
-        CARD: 'بطاقة',
-        PAYPAL: 'PayPal',
-        STRIPE: 'بطاقة',
-        CREDIT_CARD: 'بطاقة',
-        DEBIT_CARD: 'بطاقة',
-      } as Record<string, string>,
+      none: '-',
+      paymentDialogTitle: 'تسجيل دفعة يدوية',
+      paymentDialogDescription: 'سجل دفعة خارجية على رصيد الفاتورة أو الضمان الصحيح.',
+      paymentTarget: 'هدف الدفعة',
+      charge: 'دفعة الفاتورة',
+      securityDeposit: 'ضمان التأمين',
+      remaining: 'المتبقي',
+      paymentMethod: 'طريقة الدفع',
+      amount: 'المبلغ',
+      currency: 'العملة',
+      receivedAt: 'وقت الاستلام',
+      reference: 'المرجع',
+      note: 'ملاحظة داخلية',
+      cancel: 'إلغاء',
+      save: 'حفظ الدفعة',
+      saving: 'جارٍ الحفظ...',
+      invalidAmount: 'أدخل مبلغاً صحيحاً ضمن الرصيد المحدد.',
+      paymentStatusLabels: { ALL: 'الكل', UNPAID: 'غير مدفوع', PARTIAL: 'جزئي', PAID: 'مدفوع' } as Record<string, string>,
+      depositStatusLabels: { NOT_REQUIRED: 'غير مطلوب', OUTSTANDING: 'مستحق', PARTIALLY_COLLECTED: 'محصل جزئياً', HELD: 'محتجز' } as Record<string, string>,
+      paymentMethodLabels: { CASH: 'نقداً', CHECK: 'شيك', BANK_TRANSFER: 'تحويل بنكي', CARD: 'بطاقة', PAYPAL: 'PayPal', OTHER: 'أخرى' } as Record<string, string>,
     },
-  }[language]
+  }[language]), [language])
 
-  async function loadBillingData() {
-    const [reservationRows, paymentRows] = await Promise.all([
-      apiFetch<ReservationRow[]>('/reservations?pageSize=100'),
-      apiFetch<PaymentRow[]>('/payments/company'),
+  const loadBilling = useCallback(async () => {
+    setLoading(true)
+    setError(null)
+    const params = new URLSearchParams({
+      page: String(page),
+      pageSize: '10',
+      search: submittedSearch,
+      paymentStatus,
+      outstandingOnly: String(outstandingOnly),
+    })
+    const summaryParams = new URLSearchParams({ search: submittedSearch })
+    const [summaryRows, invoiceRows] = await Promise.all([
+      apiFetch<BillingSummary>(`/billing/summary?${summaryParams.toString()}`),
+      apiFetch<BillingInvoiceResponse>(`/billing/invoices?${params.toString()}`),
     ])
-    setReservations(reservationRows ?? [])
-    setPayments(paymentRows ?? [])
-  }
+    setSummary(summaryRows)
+    setInvoices(invoiceRows)
+    setLoading(false)
+  }, [outstandingOnly, page, paymentStatus, submittedSearch])
 
   useEffect(() => {
-    loadBillingData()
-      .catch((err) => setError(err.message ?? copy.failed))
-      .finally(() => setLoading(false))
-  }, [copy.failed])
-
-  const billingRows = useMemo<BillingRow[]>(() => {
-    const paymentsByReservation = new Map<string, PaymentRow[]>()
-
-    for (const payment of payments) {
-      const existing = paymentsByReservation.get(payment.reservationId) ?? []
-      existing.push(payment)
-      paymentsByReservation.set(payment.reservationId, existing)
-    }
-
-    return reservations.map((reservation) => {
-      const reservationPayments = (paymentsByReservation.get(reservation.id) ?? []).sort((a, b) =>
-        new Date(b.paidAt ?? b.createdAt).getTime() - new Date(a.paidAt ?? a.createdAt).getTime(),
-      )
-
-      return {
-        ...reservation,
-        balanceDue: Math.max(reservation.totalAmount - reservation.paidAmount, 0),
-        paymentCount: reservationPayments.length,
-        latestPayment: reservationPayments[0] ?? null,
-      }
+    loadBilling().catch((err) => {
+      setError(err.message ?? copy.failed)
+      setLoading(false)
     })
-  }, [payments, reservations])
+  }, [copy.failed, loadBilling])
 
-  const filteredRows = useMemo(() => {
-    const q = search.trim().toLowerCase()
-    if (!q) return billingRows
-    return billingRows.filter((row) =>
-      `${row.customer.firstName} ${row.customer.lastName}`.toLowerCase().includes(q) ||
-      row.customer.email.toLowerCase().includes(q) ||
-      `${row.vehicle.make} ${row.vehicle.model}`.toLowerCase().includes(q) ||
-      row.vehicle.licensePlate.toLowerCase().includes(q) ||
-      (row.invoiceNumber ?? '').toLowerCase().includes(q) ||
-      (row.contractNumber ?? '').toLowerCase().includes(q),
-    )
-  }, [billingRows, search])
+  useEffect(() => {
+    function handleKeyDown(event: KeyboardEvent) {
+      if (event.key === 'Escape' && paymentInvoice && !submittingPayment) {
+        setPaymentInvoice(null)
+      }
+    }
+    window.addEventListener('keydown', handleKeyDown)
+    return () => window.removeEventListener('keydown', handleKeyDown)
+  }, [paymentInvoice, submittingPayment])
 
-  const totals = useMemo(() => {
-    return filteredRows.reduce(
-      (acc, row) => {
-        acc.totalBilled += row.totalAmount
-        acc.totalCollected += row.paidAmount
-        acc.outstanding += row.balanceDue
-        if (row.balanceDue > 0) acc.openInvoices += 1
-        return acc
-      },
-      { totalBilled: 0, totalCollected: 0, outstanding: 0, openInvoices: 0 },
-    )
-  }, [filteredRows])
+  const selectedRemaining = paymentInvoice
+    ? paymentType === 'DEPOSIT'
+      ? paymentInvoice.depositOutstanding
+      : paymentInvoice.invoiceBalanceDue
+    : 0
 
   function formatDate(value: string) {
     return new Date(value).toLocaleDateString(localeCode, {
@@ -376,51 +313,56 @@ export default function BillingPage() {
     })
   }
 
-  function translateStatus(status: string, labels: Record<string, string>) {
-    return labels[status] ?? status.replace(/_/g, ' ')
+  function formatMoney(amount: number, currency: SupportedCurrency = summary?.currency ?? 'MAD') {
+    return formatCurrency(amount, currency)
   }
 
-  function translatePaymentMethod(method: string | null) {
-    if (!method) return copy.none
-    return copy.paymentMethodLabels[method] ?? method.replace(/_/g, ' ')
-  }
-
-  function canAcceptPayment(row: BillingRow) {
-    return row.balanceDue > 0
-  }
-
-  function openPaymentModal(row: BillingRow) {
-    setPaymentModalRow(row)
+  function openPaymentDialog(invoice: BillingInvoice) {
+    const nextType = invoice.invoiceBalanceDue > 0 ? 'CHARGE' : 'DEPOSIT'
+    const remaining = nextType === 'DEPOSIT' ? invoice.depositOutstanding : invoice.invoiceBalanceDue
+    setPaymentInvoice(invoice)
+    setPaymentType(nextType)
     setPaymentMethod('CASH')
-    setPaymentType('CHARGE')
-    setPaymentAmount(String((row.balanceDue / 100).toFixed(2)))
+    setPaymentAmount((remaining / 100).toFixed(2))
+    setReceivedAt(new Date().toISOString().slice(0, 16))
+    setReference('')
+    setNote('')
     setPaymentError(null)
   }
 
-  async function handleAcceptPayment() {
-    if (!paymentModalRow) return
+  function updatePaymentType(type: BillingPaymentType) {
+    setPaymentType(type)
+    if (!paymentInvoice) return
+    const remaining = type === 'DEPOSIT' ? paymentInvoice.depositOutstanding : paymentInvoice.invoiceBalanceDue
+    setPaymentAmount((remaining / 100).toFixed(2))
+  }
 
-    const amount = Math.round(Number(paymentAmount) * 100)
-    if (!Number.isFinite(amount) || amount <= 0 || amount > paymentModalRow.balanceDue) {
+  async function submitPayment() {
+    if (!paymentInvoice) return
+    const amountMinor = Math.round(Number(paymentAmount) * 100)
+    if (!Number.isFinite(amountMinor) || amountMinor <= 0 || amountMinor > selectedRemaining) {
       setPaymentError(copy.invalidAmount)
       return
     }
 
     setSubmittingPayment(true)
     setPaymentError(null)
-
     try {
-      await apiFetch<PaymentRow>(`/payments/reservations/${paymentModalRow.id}/manual`, {
+      await apiFetch(`/billing/invoices/${paymentInvoice.id}/payments/manual`, {
         method: 'POST',
         body: JSON.stringify({
-          amount,
+          amountMinor,
+          currency: paymentInvoice.currency,
           type: paymentType,
-          currency: paymentCurrency,
-          paymentMethod,
+          method: paymentMethod,
+          receivedAt: receivedAt ? new Date(receivedAt).toISOString() : undefined,
+          reference: reference.trim() || undefined,
+          note: note.trim() || undefined,
+          idempotencyKey: crypto.randomUUID(),
         }),
       })
-      await loadBillingData()
-      setPaymentModalRow(null)
+      setPaymentInvoice(null)
+      await loadBilling()
     } catch (err: any) {
       setPaymentError(err.message ?? copy.failed)
     } finally {
@@ -428,203 +370,212 @@ export default function BillingPage() {
     }
   }
 
+  const rows = invoices?.items ?? []
+  const currentPage = invoices?.page ?? page
+  const totalPages = invoices?.totalPages ?? 1
+
   return (
     <div className="space-y-6">
-      <div className="flex flex-col gap-4 lg:flex-row lg:items-end lg:justify-between">
+      <div className="flex flex-col gap-4 xl:flex-row xl:items-end xl:justify-between">
         <div>
           <h2 className="text-xl font-semibold text-slate-900">{copy.heading}</h2>
-          <p className="mt-1 text-sm text-slate-500">{copy.subtitle}</p>
+          <p className="mt-1 max-w-3xl text-sm text-slate-500">{copy.subtitle}</p>
         </div>
-        <input
-          value={search}
-          onChange={(event) => setSearch(event.target.value)}
-          placeholder={copy.search}
-          className="input-field w-full lg:max-w-md"
-        />
+        <form
+          className="flex w-full flex-col gap-3 sm:flex-row xl:max-w-3xl"
+          onSubmit={(event) => {
+            event.preventDefault()
+            setPage(1)
+            setSubmittedSearch(search)
+          }}
+        >
+          <input value={search} onChange={(event) => setSearch(event.target.value)} placeholder={copy.search} className="input-field min-w-0 flex-1" />
+          <select value={paymentStatus} onChange={(event) => { setPage(1); setPaymentStatus(event.target.value as typeof paymentStatus) }} className="input-field sm:w-44">
+            {(['ALL', 'UNPAID', 'PARTIAL', 'PAID'] as const).map((status) => (
+              <option key={status} value={status}>{copy.paymentStatusLabels[status]}</option>
+            ))}
+          </select>
+          <button type="submit" className="btn-primary justify-center">{copy.applySearch}</button>
+        </form>
       </div>
 
-      <div className="grid gap-4 sm:grid-cols-2 xl:grid-cols-4">
-        <MetricCard label={copy.totalBilled} value={formatCurrency(totals.totalBilled, 'MAD')} />
-        <MetricCard label={copy.totalCollected} value={formatCurrency(totals.totalCollected, 'MAD')} />
-        <MetricCard label={copy.outstanding} value={formatCurrency(totals.outstanding, 'MAD')} />
-        <MetricCard label={copy.openInvoices} value={totals.openInvoices.toLocaleString(localeCode)} />
+      <label className="inline-flex items-center gap-2 text-sm font-medium text-slate-700">
+        <input type="checkbox" checked={outstandingOnly} onChange={(event) => { setPage(1); setOutstandingOnly(event.target.checked) }} className="h-4 w-4 rounded border-slate-300 text-blue-600" />
+        {copy.outstandingOnly}
+      </label>
+
+      <div className="grid gap-4 sm:grid-cols-2 xl:grid-cols-5">
+        <MetricCard label={copy.totalInvoiced} value={formatMoney(summary?.totalInvoiced ?? 0)} />
+        <MetricCard label={copy.collected} value={formatMoney(summary?.totalCollected ?? 0)} />
+        <MetricCard label={copy.outstanding} value={formatMoney(summary?.totalOutstanding ?? 0)} />
+        <MetricCard label={copy.depositsHeld} value={formatMoney(summary?.depositsHeld ?? 0)} />
+        <MetricCard label={copy.openInvoices} value={(summary?.openInvoiceCount ?? 0).toLocaleString(localeCode)} />
       </div>
 
-      <div className="card overflow-hidden">
-        {error ? (
-          <div className="p-6 text-sm text-red-600">{error}</div>
-        ) : (
-          <div className="overflow-x-auto">
+      {error ? (
+        <div className="card p-6">
+          <p className="text-sm font-semibold text-rose-700">{error}</p>
+          <button type="button" onClick={() => loadBilling().catch((err) => setError(err.message ?? copy.failed))} className="mt-4 rounded-full border border-slate-200 px-4 py-2 text-sm font-semibold text-slate-700 hover:bg-slate-50">
+            {copy.retry}
+          </button>
+        </div>
+      ) : (
+        <div className="card overflow-hidden">
+          <div className="hidden overflow-x-auto lg:block">
             <table className="w-full">
               <thead>
                 <tr className="border-b border-slate-200 bg-slate-50">
-                  <th className="px-6 py-3 text-left text-xs font-medium uppercase tracking-wide text-slate-500">{copy.customer}</th>
-                  <th className="px-6 py-3 text-left text-xs font-medium uppercase tracking-wide text-slate-500">{copy.vehicle}</th>
-                  <th className="px-6 py-3 text-left text-xs font-medium uppercase tracking-wide text-slate-500">{copy.invoice}</th>
-                  <th className="px-6 py-3 text-left text-xs font-medium uppercase tracking-wide text-slate-500">{copy.rentalPeriod}</th>
-                  <th className="px-6 py-3 text-right text-xs font-medium uppercase tracking-wide text-slate-500">{copy.total}</th>
-                  <th className="px-6 py-3 text-right text-xs font-medium uppercase tracking-wide text-slate-500">{copy.paid}</th>
-                  <th className="px-6 py-3 text-right text-xs font-medium uppercase tracking-wide text-slate-500">{copy.balance}</th>
-                  <th className="px-6 py-3 text-left text-xs font-medium uppercase tracking-wide text-slate-500">{copy.status}</th>
-                  <th className="px-6 py-3 text-left text-xs font-medium uppercase tracking-wide text-slate-500">{copy.payment}</th>
-                  <th className="px-6 py-3 text-left text-xs font-medium uppercase tracking-wide text-slate-500">{copy.paymentMethod}</th>
-                  <th className="px-6 py-3 text-right text-xs font-medium uppercase tracking-wide text-slate-500">{copy.actions}</th>
+                  <th className="px-5 py-3 text-start text-xs font-medium uppercase text-slate-500">{copy.invoiceCustomer}</th>
+                  <th className="px-5 py-3 text-start text-xs font-medium uppercase text-slate-500">{copy.vehicle}</th>
+                  <th className="px-5 py-3 text-start text-xs font-medium uppercase text-slate-500">{copy.period}</th>
+                  <th className="px-5 py-3 text-end text-xs font-medium uppercase text-slate-500">{copy.invoiceTotal}</th>
+                  <th className="px-5 py-3 text-end text-xs font-medium uppercase text-slate-500">{copy.paid}</th>
+                  <th className="px-5 py-3 text-end text-xs font-medium uppercase text-slate-500">{copy.balance}</th>
+                  <th className="px-5 py-3 text-start text-xs font-medium uppercase text-slate-500">{copy.deposit}</th>
+                  <th className="px-5 py-3 text-end text-xs font-medium uppercase text-slate-500">{copy.actions}</th>
                 </tr>
               </thead>
               <tbody className="divide-y divide-slate-100">
                 {loading ? (
-                  <tr>
-                    <td colSpan={11} className="px-6 py-10 text-center text-sm text-slate-400">{copy.loading}</td>
-                  </tr>
-                ) : filteredRows.length === 0 ? (
-                  <tr>
-                    <td colSpan={11} className="px-6 py-10 text-center text-sm text-slate-400">{copy.noRows}</td>
-                  </tr>
-                ) : filteredRows.map((row) => (
-                  <tr key={row.id}>
-                    <td className="px-6 py-4 text-sm">
-                      <p className="font-semibold text-slate-900">{row.customer.firstName} {row.customer.lastName}</p>
-                      <p className="text-xs text-slate-500">{row.customer.email}</p>
+                  <tr><td colSpan={8} className="px-5 py-10 text-center text-sm text-slate-400">{copy.loading}</td></tr>
+                ) : rows.length === 0 ? (
+                  <tr><td colSpan={8} className="px-5 py-10 text-center text-sm text-slate-400">{copy.empty}</td></tr>
+                ) : rows.map((invoice) => (
+                  <tr key={invoice.id}>
+                    <td className="px-5 py-4 text-sm">
+                      <p dir="ltr" className="font-semibold text-slate-900">{invoice.invoiceNumber ?? copy.unknownInvoice}</p>
+                      <p className="mt-1 font-medium text-slate-700">{invoice.customer.firstName} {invoice.customer.lastName}</p>
+                      <p dir="ltr" className="text-xs text-slate-500">{invoice.customer.email}</p>
                     </td>
-                    <td className="px-6 py-4 text-sm text-slate-700">
-                      <p>{row.vehicle.make} {row.vehicle.model}</p>
-                      <p className="text-xs text-slate-500">{row.vehicle.licensePlate}</p>
+                    <td className="px-5 py-4 text-sm text-slate-700">
+                      <p>{invoice.vehicle.make} {invoice.vehicle.model}</p>
+                      <p dir="ltr" className="text-xs text-slate-500">{invoice.vehicle.licensePlate}</p>
                     </td>
-                    <td className="px-6 py-4 text-sm text-slate-700">
-                      <p className="font-medium text-slate-900">{row.invoiceNumber ?? copy.unknownInvoice}</p>
-                      <p className="text-xs text-slate-500">{copy.contract}: {row.contractNumber ?? copy.none}</p>
+                    <td className="px-5 py-4 text-sm text-slate-600">
+                      <p>{formatDate(invoice.rentalPeriod.startDate)}</p>
+                      <p>{formatDate(invoice.rentalPeriod.endDate)}</p>
                     </td>
-                    <td className="px-6 py-4 text-sm text-slate-600">
-                      <p>{formatDate(row.startDate)}</p>
-                      <p>{formatDate(row.endDate)}</p>
+                    <td dir="ltr" className="px-5 py-4 text-end text-sm font-semibold text-slate-900">{formatMoney(invoice.invoiceTotal, invoice.currency)}</td>
+                    <td dir="ltr" className="px-5 py-4 text-end text-sm font-semibold text-emerald-700">{formatMoney(invoice.invoicePaid, invoice.currency)}</td>
+                    <td dir="ltr" className="px-5 py-4 text-end text-sm font-semibold text-orange-700">{formatMoney(invoice.invoiceBalanceDue, invoice.currency)}</td>
+                    <td className="px-5 py-4 text-sm">
+                      <StatusBadge label={copy.depositStatusLabels[invoice.depositStatus] ?? invoice.depositStatus} status={invoice.depositStatus} />
+                      <p dir="ltr" className="mt-2 text-xs text-slate-500">{formatMoney(invoice.depositOutstanding, invoice.currency)} {copy.remaining}</p>
                     </td>
-                    <td className="px-6 py-4 text-right text-sm font-semibold text-slate-900">
-                      {formatCurrency(row.totalAmount, 'MAD')}
-                      {row.depositAmount > 0 ? (
-                        <p className="text-xs font-normal text-slate-500">{copy.deposit}: {formatCurrency(row.depositAmount, 'MAD')}</p>
-                      ) : null}
-                    </td>
-                    <td className="px-6 py-4 text-right text-sm font-semibold text-emerald-700">{formatCurrency(row.paidAmount, 'MAD')}</td>
-                    <td className="px-6 py-4 text-right text-sm font-semibold text-orange-700">{formatCurrency(row.balanceDue, 'MAD')}</td>
-                    <td className="px-6 py-4 text-sm">
-                      <span className={`inline-flex rounded-full px-2.5 py-0.5 text-xs font-medium ${PAYMENT_STATUS_BADGE[row.paymentStatus] ?? 'bg-slate-100 text-slate-700'}`}>
-                        {translateStatus(row.paymentStatus, copy.paymentStatusLabels)}
-                      </span>
-                    </td>
-                    <td className="px-6 py-4 text-sm text-slate-700">
-                      {row.latestPayment ? (
-                        <div className="space-y-1">
-                          <div className="flex items-center gap-2">
-                            <span className={`inline-flex rounded-full px-2.5 py-0.5 text-xs font-medium ${PAYMENT_EVENT_BADGE[row.latestPayment.status] ?? 'bg-slate-100 text-slate-700'}`}>
-                              {translateStatus(row.latestPayment.status, copy.paymentEventLabels)}
-                            </span>
-                            <span className="text-xs text-slate-500">{copy.paymentProviderLabels[row.latestPayment.paymentProvider] ?? row.latestPayment.paymentProvider}</span>
-                          </div>
-                          <p className="text-xs text-slate-500">
-                            {row.latestPayment.type === 'DEPOSIT' ? copy.depositType : copy.charge} · {formatCurrency(row.latestPayment.amount, row.latestPayment.currency)}
-                          </p>
-                          <p className="text-xs text-slate-500">{formatDate(row.latestPayment.paidAt ?? row.latestPayment.createdAt)} · {copy.paymentsRecorded(row.paymentCount)}</p>
-                        </div>
-                      ) : (
-                        <span className="text-slate-400">{copy.none}</span>
-                      )}
-                    </td>
-                    <td className="px-6 py-4 text-sm text-slate-700">
-                      {row.latestPayment ? (
-                        <div className="space-y-1">
-                          <p className="font-medium text-slate-900">{translatePaymentMethod(row.latestPayment.paymentMethod)}</p>
-                          <p className="text-xs text-slate-500">{copy.paymentProviderLabels[row.latestPayment.paymentProvider] ?? row.latestPayment.paymentProvider}</p>
-                        </div>
-                      ) : (
-                        <span className="text-slate-400">{copy.none}</span>
-                      )}
-                    </td>
-                    <td className="px-6 py-4 text-right text-sm">
-                      <div className="flex flex-col items-end gap-2">
-                        {canAcceptPayment(row) ? (
-                          <button type="button" onClick={() => openPaymentModal(row)} className="font-semibold text-emerald-700 hover:underline">
-                            {copy.acceptPayment}
-                          </button>
-                        ) : (
-                          <span className="text-xs text-slate-400">{copy.paymentActionDisabled}</span>
-                        )}
-                        <Link href={`/contracts/${row.id}`} className="font-semibold text-blue-700 hover:underline">
-                          {copy.openContract}
-                        </Link>
-                        <Link href={`/reservations/${row.id}`} className="text-slate-600 hover:text-slate-900 hover:underline">
-                          {copy.openBooking}
-                        </Link>
-                      </div>
+                    <td className="px-5 py-4 text-end text-sm">
+                      <InvoiceActions invoice={invoice} copy={copy} onRecordPayment={openPaymentDialog} />
                     </td>
                   </tr>
                 ))}
               </tbody>
             </table>
           </div>
-        )}
-      </div>
 
-      {paymentModalRow ? (
-        <div className="fixed inset-0 z-50 flex items-center justify-center bg-blue-950/30 backdrop-blur-sm" onClick={(event) => {
-          if (event.target === event.currentTarget && !submittingPayment) setPaymentModalRow(null)
+          <div className="divide-y divide-slate-100 lg:hidden">
+            {loading ? (
+              <p className="p-6 text-center text-sm text-slate-400">{copy.loading}</p>
+            ) : rows.length === 0 ? (
+              <p className="p-6 text-center text-sm text-slate-400">{copy.empty}</p>
+            ) : rows.map((invoice) => (
+              <div key={invoice.id} className="space-y-4 p-5">
+                <div className="flex items-start justify-between gap-4">
+                  <div>
+                    <p dir="ltr" className="font-semibold text-slate-900">{invoice.invoiceNumber ?? copy.unknownInvoice}</p>
+                    <p className="mt-1 text-sm text-slate-700">{invoice.customer.firstName} {invoice.customer.lastName}</p>
+                    <p className="text-xs text-slate-500">{invoice.vehicle.make} {invoice.vehicle.model}</p>
+                  </div>
+                  <StatusBadge label={copy.paymentStatusLabels[invoice.paymentStatus]} status={invoice.paymentStatus} />
+                </div>
+                <div className="grid grid-cols-2 gap-3 text-sm">
+                  <AmountBlock label={copy.invoiceTotal} value={formatMoney(invoice.invoiceTotal, invoice.currency)} />
+                  <AmountBlock label={copy.balance} value={formatMoney(invoice.invoiceBalanceDue, invoice.currency)} />
+                  <AmountBlock label={copy.paid} value={formatMoney(invoice.invoicePaid, invoice.currency)} />
+                  <AmountBlock label={copy.deposit} value={formatMoney(invoice.depositOutstanding, invoice.currency)} />
+                </div>
+                <InvoiceActions invoice={invoice} copy={copy} onRecordPayment={openPaymentDialog} mobile />
+              </div>
+            ))}
+          </div>
+
+          <div className="flex items-center justify-between border-t border-slate-100 px-5 py-4 text-sm">
+            <button type="button" disabled={currentPage <= 1 || loading} onClick={() => setPage((value) => Math.max(value - 1, 1))} className="rounded-full border border-slate-200 px-4 py-2 font-semibold text-slate-700 disabled:cursor-not-allowed disabled:opacity-50">
+              {copy.previous}
+            </button>
+            <span className="text-slate-500">{copy.pageLabel(currentPage, totalPages)}</span>
+            <button type="button" disabled={currentPage >= totalPages || loading} onClick={() => setPage((value) => value + 1)} className="rounded-full border border-slate-200 px-4 py-2 font-semibold text-slate-700 disabled:cursor-not-allowed disabled:opacity-50">
+              {copy.next}
+            </button>
+          </div>
+        </div>
+      )}
+
+      {paymentInvoice ? (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-blue-950/30 p-4 backdrop-blur-sm" onClick={(event) => {
+          if (event.target === event.currentTarget && !submittingPayment) setPaymentInvoice(null)
         }}>
-          <div className="w-full max-w-lg rounded-3xl bg-white p-6 shadow-2xl">
+          <div role="dialog" aria-modal="true" aria-labelledby="manual-payment-title" aria-describedby="manual-payment-description" className="w-full max-w-xl rounded-2xl bg-white p-6 shadow-2xl">
             <div className="flex items-start justify-between gap-4">
               <div>
-                <h3 className="text-lg font-semibold text-slate-900">{copy.paymentModalTitle}</h3>
-                <p className="mt-1 text-sm text-slate-500">{copy.paymentModalSubtitle}</p>
+                <h3 id="manual-payment-title" className="text-lg font-semibold text-slate-900">{copy.paymentDialogTitle}</h3>
+                <p id="manual-payment-description" className="mt-1 text-sm text-slate-500">{copy.paymentDialogDescription}</p>
               </div>
-              <button type="button" onClick={() => setPaymentModalRow(null)} disabled={submittingPayment} className="text-slate-400 transition hover:text-slate-700">
+              <button type="button" aria-label={copy.cancel} onClick={() => setPaymentInvoice(null)} disabled={submittingPayment} className="rounded-full px-3 py-1 text-xl text-slate-400 hover:bg-slate-100 hover:text-slate-700">
                 ×
               </button>
             </div>
 
-            <div className="mt-5 rounded-2xl border border-slate-200 bg-slate-50 p-4 text-sm text-slate-700">
-              <p className="font-semibold text-slate-900">{paymentModalRow.customer.firstName} {paymentModalRow.customer.lastName}</p>
-              <p className="mt-1">{paymentModalRow.vehicle.make} {paymentModalRow.vehicle.model} · {paymentModalRow.vehicle.licensePlate}</p>
-              <p className="mt-1">{copy.invoice}: {paymentModalRow.invoiceNumber ?? copy.unknownInvoice}</p>
-              <p className="mt-2 font-semibold text-slate-900">{copy.balance}: {formatCurrency(paymentModalRow.balanceDue, paymentCurrency)}</p>
+            <div className="mt-5 rounded-lg border border-slate-200 bg-slate-50 p-4 text-sm">
+              <p className="font-semibold text-slate-900">{paymentInvoice.customer.firstName} {paymentInvoice.customer.lastName}</p>
+              <p dir="ltr" className="mt-1 text-slate-600">{paymentInvoice.invoiceNumber ?? copy.unknownInvoice}</p>
+              <p dir="ltr" className="mt-2 font-semibold text-slate-900">{copy.remaining}: {formatMoney(selectedRemaining, paymentInvoice.currency)}</p>
             </div>
 
-            {paymentError ? (
-              <div className="mt-5 rounded-2xl border border-rose-200 bg-rose-50 p-4 text-sm text-rose-700">
-                {paymentError}
-              </div>
-            ) : null}
+            {paymentError ? <div role="alert" className="mt-4 rounded-lg border border-rose-200 bg-rose-50 p-3 text-sm text-rose-700">{paymentError}</div> : null}
 
-            <div className="mt-5 space-y-4">
-              <div>
-                <label className="mb-1 block text-sm font-medium text-slate-700">{copy.paymentMethod}</label>
-                <select className="input-field" value={paymentMethod} onChange={(event) => setPaymentMethod(event.target.value as ManualPaymentMethod)} disabled={submittingPayment}>
-                  <option value="CASH">{copy.paymentMethodLabels.CASH}</option>
-                  <option value="CHECK">{copy.paymentMethodLabels.CHECK}</option>
-                  <option value="BANK_TRANSFER">{copy.paymentMethodLabels.BANK_TRANSFER}</option>
-                  <option value="CARD">{copy.paymentMethodLabels.CARD}</option>
-                  <option value="PAYPAL">{copy.paymentMethodLabels.PAYPAL}</option>
+            <div className="mt-5 grid gap-4 sm:grid-cols-2">
+              <label className="space-y-1 text-sm font-medium text-slate-700">
+                <span>{copy.paymentTarget}</span>
+                <select value={paymentType} onChange={(event) => updatePaymentType(event.target.value as BillingPaymentType)} disabled={submittingPayment} className="input-field">
+                  <option value="CHARGE" disabled={paymentInvoice.invoiceBalanceDue <= 0}>{copy.charge}</option>
+                  <option value="DEPOSIT" disabled={paymentInvoice.depositOutstanding <= 0}>{copy.securityDeposit}</option>
                 </select>
-              </div>
-
-              <div>
-                <label className="mb-1 block text-sm font-medium text-slate-700">{copy.paymentType}</label>
-                <select className="input-field" value={paymentType} onChange={(event) => setPaymentType(event.target.value as 'CHARGE' | 'DEPOSIT')} disabled={submittingPayment}>
-                  {paymentModalRow.depositAmount > 0 ? <option value="DEPOSIT">{copy.depositType}</option> : null}
-                  <option value="CHARGE">{copy.charge}</option>
+              </label>
+              <label className="space-y-1 text-sm font-medium text-slate-700">
+                <span>{copy.paymentMethod}</span>
+                <select value={paymentMethod} onChange={(event) => setPaymentMethod(event.target.value as ManualPaymentMethod)} disabled={submittingPayment} className="input-field">
+                  {(Object.keys(copy.paymentMethodLabels) as ManualPaymentMethod[]).map((method) => (
+                    <option key={method} value={method}>{copy.paymentMethodLabels[method]}</option>
+                  ))}
                 </select>
-                <p className="mt-2 text-xs text-slate-500">{paymentType === 'DEPOSIT' ? copy.depositHelp : copy.chargeHelp}</p>
-              </div>
-
-              <div>
-                <label className="mb-1 block text-sm font-medium text-slate-700">{copy.paymentAmount}</label>
-                <input type="number" min="0" step="0.01" className="input-field" value={paymentAmount} onChange={(event) => setPaymentAmount(event.target.value)} disabled={submittingPayment} />
-              </div>
+              </label>
+              <label className="space-y-1 text-sm font-medium text-slate-700">
+                <span>{copy.amount}</span>
+                <input type="number" min="0" step="0.01" value={paymentAmount} onChange={(event) => setPaymentAmount(event.target.value)} disabled={submittingPayment} className="input-field" />
+              </label>
+              <label className="space-y-1 text-sm font-medium text-slate-700">
+                <span>{copy.currency}</span>
+                <input value={paymentInvoice.currency} readOnly className="input-field bg-slate-50" />
+              </label>
+              <label className="space-y-1 text-sm font-medium text-slate-700">
+                <span>{copy.receivedAt}</span>
+                <input type="datetime-local" value={receivedAt} onChange={(event) => setReceivedAt(event.target.value)} disabled={submittingPayment} className="input-field" />
+              </label>
+              <label className="space-y-1 text-sm font-medium text-slate-700">
+                <span>{copy.reference}</span>
+                <input value={reference} onChange={(event) => setReference(event.target.value)} disabled={submittingPayment} className="input-field" />
+              </label>
+              <label className="space-y-1 text-sm font-medium text-slate-700 sm:col-span-2">
+                <span>{copy.note}</span>
+                <textarea value={note} onChange={(event) => setNote(event.target.value)} disabled={submittingPayment} className="input-field min-h-24" />
+              </label>
             </div>
 
-            <div className="mt-6 flex items-center gap-3">
-              <button type="button" onClick={() => setPaymentModalRow(null)} disabled={submittingPayment} className="flex-1 rounded-full border border-slate-200 px-4 py-2 text-sm font-semibold text-slate-700 transition hover:bg-slate-50">
+            <div className="mt-6 flex flex-col-reverse gap-3 sm:flex-row">
+              <button type="button" onClick={() => setPaymentInvoice(null)} disabled={submittingPayment} className="flex-1 rounded-full border border-slate-200 px-4 py-2 text-sm font-semibold text-slate-700 hover:bg-slate-50 disabled:opacity-60">
                 {copy.cancel}
               </button>
-              <button type="button" onClick={handleAcceptPayment} disabled={submittingPayment} className="btn-primary flex-1 justify-center disabled:cursor-not-allowed disabled:opacity-60">
-                {submittingPayment ? copy.savingPayment : copy.savePayment}
+              <button type="button" onClick={submitPayment} disabled={submittingPayment} className="btn-primary flex-1 justify-center disabled:cursor-not-allowed disabled:opacity-60">
+                {submittingPayment ? copy.saving : copy.save}
               </button>
             </div>
           </div>
@@ -638,7 +589,56 @@ function MetricCard({ label, value }: { label: string; value: string }) {
   return (
     <div className="card p-5">
       <p className="text-sm font-medium text-slate-500">{label}</p>
-      <p className="mt-2 text-2xl font-bold text-slate-900">{value}</p>
+      <p dir="ltr" className="mt-2 text-2xl font-semibold text-slate-900">{value}</p>
+    </div>
+  )
+}
+
+function StatusBadge({ label, status }: { label: string; status: string }) {
+  return (
+    <span className={`inline-flex rounded-full px-2.5 py-0.5 text-xs font-medium ${STATUS_BADGE[status] ?? 'bg-slate-100 text-slate-700'}`}>
+      {label}
+    </span>
+  )
+}
+
+function AmountBlock({ label, value }: { label: string; value: string }) {
+  return (
+    <div className="rounded-lg bg-slate-50 p-3">
+      <p className="text-xs font-medium uppercase text-slate-500">{label}</p>
+      <p dir="ltr" className="mt-1 font-semibold text-slate-900">{value}</p>
+    </div>
+  )
+}
+
+function InvoiceActions({
+  invoice,
+  copy,
+  onRecordPayment,
+  mobile = false,
+}: {
+  invoice: BillingInvoice
+  copy: any
+  onRecordPayment: (invoice: BillingInvoice) => void
+  mobile?: boolean
+}) {
+  const canRecord = invoice.invoiceBalanceDue > 0 || invoice.depositOutstanding > 0
+
+  return (
+    <div className={`flex ${mobile ? 'flex-row flex-wrap' : 'flex-col items-end'} gap-2`}>
+      {canRecord ? (
+        <button type="button" onClick={() => onRecordPayment(invoice)} className="font-semibold text-emerald-700 hover:underline">
+          {copy.recordPayment}
+        </button>
+      ) : (
+        <span className="text-xs text-slate-400">{copy.noPaymentDue}</span>
+      )}
+      <Link href={`/contracts/${invoice.reservationId}`} className="font-semibold text-blue-700 hover:underline">
+        {copy.openContract}
+      </Link>
+      <Link href={`/reservations/${invoice.reservationId}`} className="text-slate-600 hover:text-slate-900 hover:underline">
+        {copy.openBooking}
+      </Link>
     </div>
   )
 }
diff --git a/apps/dashboard/src/app/(dashboard)/settings/page.tsx b/apps/dashboard/src/app/(dashboard)/settings/page.tsx
index 26c87d4..d78f76f 100644
--- a/apps/dashboard/src/app/(dashboard)/settings/page.tsx
+++ b/apps/dashboard/src/app/(dashboard)/settings/page.tsx
@@ -1,8 +1,66 @@
 'use client'
 
-import { useEffect, useState } from 'react'
+import { Suspense, useEffect, useMemo, useState } from 'react'
+import type { ReactNode } from 'react'
+import { useRouter, useSearchParams } from 'next/navigation'
+import {
+  BarChart3,
+  Building2,
+  CreditCard,
+  FileText,
+  Lock,
+  Palette,
+  ShieldCheck,
+  Tags,
+} from 'lucide-react'
 import { apiFetch } from '@/lib/api'
 import { useDashboardI18n } from '@/components/I18nProvider'
+import { getMoroccanCityOptions } from '@/lib/moroccanCities'
+
+type SectionKey = 'company' | 'storefront' | 'payments' | 'rental-policies' | 'insurance' | 'pricing' | 'accounting'
+type FeatureKey =
+  | 'settings.company_profile'
+  | 'settings.public_contact'
+  | 'settings.locale_currency'
+  | 'settings.storefront_listing'
+  | 'settings.branding_basic'
+  | 'settings.branding_custom'
+  | 'settings.branding_hero'
+  | 'settings.renter_payments'
+  | 'settings.rental_policies_basic'
+  | 'settings.additional_driver_fees'
+  | 'settings.insurance_policies'
+  | 'settings.pricing_rules'
+  | 'settings.accounting_defaults'
+  | 'settings.accounting_scheduled_delivery'
+  | 'settings.accounting_advanced_formats'
+
+interface MenuItem {
+  menuKey: SectionKey
+  sectionKey: SectionKey
+  label: string
+  description: string
+  iconKey: string
+  sortOrder: number
+  state: 'ENABLED' | 'LOCKED'
+  requiredPlan: 'GROWTH' | 'PRO' | null
+}
+
+interface Entitlement {
+  available: boolean
+  editable: boolean
+  requiredPlan: 'GROWTH' | 'PRO' | null
+  reason: string | null
+}
+
+interface Entitlements {
+  plan: 'STARTER' | 'GROWTH' | 'PRO'
+  subscriptionStatus: string
+  accessLevel: 'full' | 'limited' | 'read_only' | 'none'
+  currentPeriodEnd: string | null
+  trialEndAt: string | null
+  features: Record<FeatureKey, Entitlement>
+}
 
 interface BrandSettings {
   displayName: string
@@ -22,9 +80,6 @@ interface BrandSettings {
   paypalEmail: string | null
   amanpayMerchantId: string | null
   amanpaySecretKey?: string | null
-  paypalMerchantId?: string | null
-  customDomain?: string | null
-  customDomainVerified?: boolean
   defaultLocale?: string
   defaultCurrency?: string
   isListedOnMarketplace: boolean
@@ -71,235 +126,87 @@ interface AccountingSettings {
 const emptyInsurance = { name: '', type: 'BASIC', chargeType: 'PER_DAY', chargeValue: 0, isRequired: false, isActive: true }
 const emptyRule = { name: '', type: 'SURCHARGE', condition: 'AGE_LESS_THAN', conditionValue: 25, adjustmentType: 'PERCENTAGE', adjustmentValue: 0, isActive: true }
 
-export default function SettingsPage() {
+const sectionIcons = {
+  building: Building2,
+  palette: Palette,
+  'credit-card': CreditCard,
+  'file-text': FileText,
+  shield: ShieldCheck,
+  tags: Tags,
+  'bar-chart': BarChart3,
+}
+
+function SettingsPageContent() {
+  const router = useRouter()
+  const searchParams = useSearchParams()
   const { language } = useDashboardI18n()
-  const copy = {
+  const isRtl = language === 'ar'
+  const cityOptions = useMemo(() => getMoroccanCityOptions(language), [language])
+  const copy = useMemo(() => ({
     en: {
-      title: 'Advanced settings',
-      subtitle: 'Manage insurance, additional-driver rules, pricing adjustments, and reporting defaults.',
-      save: 'Saving…',
-      saveBrand: 'Save brand',
-      brandProfile: 'Brand and public profile',
-      brandProfileDesc: 'Control how your company appears on the storefront and public booking site.',
-      payments: 'Rental payment methods',
-      paymentsDesc: 'Configure how renters pay your company on the public booking site.',
-      savePayments: 'Save payments',
-      customDomain: 'Custom domain',
-      customDomainDesc: 'Point your own domain to the branded booking site.',
-      saveDomain: 'Save domain',
-      removeDomain: 'Remove custom domain',
-      contractPolicies: 'Contract and driver policies',
-      savePolicies: 'Save policies',
-      insurancePolicies: 'Insurance policies',
-      pricingRules: 'Pricing rules',
-      accounting: 'Accounting and exports',
-      saveAccounting: 'Save accounting',
-      displayName: 'Display name',
-      tagline: 'Tagline',
-      publicEmail: 'Public email',
-      publicPhone: 'Public phone',
-      city: 'City',
-      country: 'Country',
-      websiteUrl: 'Website URL',
-      contractLanguage: 'Contract language',
-      whatsapp: 'WhatsApp number',
-      brandColor: 'Brand color',
-      listedStorefront: 'Listed on storefront',
-      logoUpload: 'Logo upload',
-      heroUpload: 'Hero image upload',
-      uploading: 'Uploading…',
-      logoUploaded: 'Logo uploaded',
-      noLogo: 'No logo uploaded yet',
-      heroUploaded: 'Hero image uploaded',
-      noHero: 'No hero image uploaded yet',
-      subdomain: 'Subdomain',
-      customDomainLabel: 'Custom domain',
-      domainPlaceholder: 'cars.example.com',
-      status: 'Status',
-      verified: 'Verified',
-      pendingDns: 'Pending DNS verification',
-      notConfigured: 'Not configured',
-      fuelPolicyType: 'Fuel policy type',
-      additionalDriverCharge: 'Additional driver charge',
-      dailyDriverRate: 'Daily driver rate',
-      flatDriverRate: 'Flat driver rate',
-      fuelPolicyNote: 'Fuel policy note',
-      damagePolicy: 'Damage policy',
-      active: 'Active',
-      inactive: 'Inactive',
-      noInsurance: 'No insurance policies configured yet.',
-      policyName: 'Policy name',
-      chargeValue: 'Charge value',
-      required: 'Required',
-      addPolicy: 'Add policy',
-      noRules: 'No pricing rules configured yet.',
-      ruleName: 'Rule name',
-      addRule: 'Add rule',
-      reportingPeriod: 'Reporting period',
-      reportFormat: 'Report format',
-      accountantName: 'Accountant name',
-      accountantEmail: 'Accountant email',
-      autoSend: 'Auto-send reports to the accountant',
-      amanpayMerchantId: 'AmanPay merchant ID',
-      amanpaySecretKey: 'AmanPay secret key',
-      paypalEmail: 'PayPal business email',
-      noPaymentConfigured: 'If no payment method is configured, renters can still submit reservation requests and pay on pickup.',
-      fuelPolicyLabels: { FULL_TO_FULL: 'Full to full', FULL_TO_EMPTY: 'Full to empty', SAME_TO_SAME: 'Same to same', PREPAID: 'Prepaid', FREE: 'Included' } as Record<string, string>,
-      driverChargeLabels: { FREE: 'Free', PER_DAY: 'Per day', FLAT: 'Flat' } as Record<string, string>,
-      reportingPeriodLabels: { WEEKLY: 'Weekly', MONTHLY: 'Monthly', QUARTERLY: 'Quarterly', ANNUAL: 'Annual' } as Record<string, string>,
-      reportFormatLabels: { CSV: 'CSV', PDF: 'PDF', BOTH: 'Both' } as Record<string, string>,
+      title: 'Settings', subtitle: 'Manage one settings area at a time. Access is resolved from your subscription and role.',
+      loading: 'Loading settings...', save: 'Saving...', saved: 'Saved.', saveSection: 'Save section', currentPlan: 'Current plan',
+      subscriptionStatus: 'Subscription status', manageSubscription: 'Manage subscription', requiredPlan: 'Requires',
+      lockedTitle: 'This settings area is not included in your current plan.', lockedBody: 'Your saved configuration is preserved and becomes editable again after upgrade.',
+      readOnly: 'This section is read-only while your subscription access is restricted.', companyHint: 'Default language affects storefront text and generated contracts when available.',
+      publicProfile: 'Public profile', storefrontBasics: 'Storefront basics', premiumBranding: 'Available on GROWTH',
+      paymentsBody: 'Configure renter payment providers. Secret values are never shown after saving.',
+      policies: 'Fuel and damage policies', additionalDriver: 'Additional-driver automation', insuranceNew: 'New insurance policy',
+      pricingNew: 'New pricing rule', accountingSchedule: 'Scheduled delivery is available on PRO.', noItems: 'No records configured yet.',
+      marketplace: 'Listed on storefront', logo: 'Logo', hero: 'Hero image', upload: 'Upload', active: 'Active', inactive: 'Inactive',
+      labels: {
+        displayName: 'Display name', tagline: 'Tagline', publicEmail: 'Public email', publicPhone: 'Public phone', whatsapp: 'WhatsApp number',
+        city: 'City', country: 'Country', websiteUrl: 'Website URL', defaultLocale: 'Default language', defaultCurrency: 'Default currency',
+        primaryColor: 'Primary color', accentColor: 'Accent color', amanpayMerchantId: 'AmanPay merchant ID', amanpaySecretKey: 'AmanPay secret key',
+        paypalEmail: 'PayPal business email', fuelPolicyType: 'Fuel policy type', fuelPolicyNote: 'Fuel policy note', damagePolicy: 'Damage policy',
+        additionalDriverCharge: 'Additional driver charge', dailyRate: 'Daily rate', flatRate: 'Flat rate', accountantName: 'Accountant name',
+        accountantEmail: 'Accountant email', reportingPeriod: 'Reporting period', reportFormat: 'Report format', autoSend: 'Auto-send reports',
+      },
     },
     fr: {
-      title: 'Paramètres avancés',
-      subtitle: 'Gérez les assurances, règles conducteurs, ajustements tarifaires et paramètres de reporting.',
-      save: 'Enregistrement…',
-      saveBrand: 'Enregistrer la marque',
-      brandProfile: 'Marque et profil public',
-      brandProfileDesc: 'Contrôlez l’affichage de votre entreprise sur la storefront et le site de réservation.',
-      payments: 'Méthodes de paiement location',
-      paymentsDesc: 'Configurez comment les clients paient votre entreprise.',
-      savePayments: 'Enregistrer les paiements',
-      customDomain: 'Domaine personnalisé',
-      customDomainDesc: 'Pointez votre propre domaine vers le site de réservation.',
-      saveDomain: 'Enregistrer le domaine',
-      removeDomain: 'Supprimer le domaine',
-      contractPolicies: 'Contrat et politiques conducteur',
-      savePolicies: 'Enregistrer les politiques',
-      insurancePolicies: 'Polices d’assurance',
-      pricingRules: 'Règles tarifaires',
-      accounting: 'Comptabilité et exports',
-      saveAccounting: 'Enregistrer la comptabilité',
-      displayName: 'Nom affiché',
-      tagline: 'Slogan',
-      publicEmail: 'E-mail public',
-      publicPhone: 'Téléphone public',
-      city: 'Ville',
-      country: 'Pays',
-      websiteUrl: 'URL du site',
-      contractLanguage: 'Langue du contrat',
-      whatsapp: 'Numéro WhatsApp',
-      brandColor: 'Couleur de marque',
-      listedStorefront: 'Publié sur la storefront',
-      logoUpload: 'Logo',
-      heroUpload: 'Image principale',
-      uploading: 'Téléversement…',
-      logoUploaded: 'Logo téléversé',
-      noLogo: 'Aucun logo téléversé',
-      heroUploaded: 'Image principale téléversée',
-      noHero: 'Aucune image principale téléversée',
-      subdomain: 'Sous-domaine',
-      customDomainLabel: 'Domaine personnalisé',
-      domainPlaceholder: 'voitures.exemple.com',
-      status: 'Statut',
-      verified: 'Vérifié',
-      pendingDns: 'Vérification DNS en attente',
-      notConfigured: 'Non configuré',
-      fuelPolicyType: 'Type de politique carburant',
-      additionalDriverCharge: 'Supplément conducteur additionnel',
-      dailyDriverRate: 'Tarif conducteur/jour',
-      flatDriverRate: 'Tarif conducteur fixe',
-      fuelPolicyNote: 'Note sur la politique carburant',
-      damagePolicy: 'Politique dommages',
-      active: 'Actif',
-      inactive: 'Inactif',
-      noInsurance: 'Aucune police d’assurance configurée.',
-      policyName: 'Nom de la police',
-      chargeValue: 'Valeur de facturation',
-      required: 'Obligatoire',
-      addPolicy: 'Ajouter la police',
-      noRules: 'Aucune règle tarifaire configurée.',
-      ruleName: 'Nom de la règle',
-      addRule: 'Ajouter la règle',
-      reportingPeriod: 'Période de reporting',
-      reportFormat: 'Format de rapport',
-      accountantName: 'Nom du comptable',
-      accountantEmail: 'E-mail du comptable',
-      autoSend: 'Envoyer automatiquement les rapports au comptable',
-      amanpayMerchantId: 'ID marchand AmanPay',
-      amanpaySecretKey: 'Clé secrète AmanPay',
-      paypalEmail: 'Email business PayPal',
-      noPaymentConfigured: 'Si aucun moyen de paiement n’est configuré, les clients peuvent envoyer une demande puis payer à la prise du véhicule.',
-      fuelPolicyLabels: { FULL_TO_FULL: 'Plein à plein', FULL_TO_EMPTY: 'Plein à vide', SAME_TO_SAME: 'Même niveau', PREPAID: 'Prépayé', FREE: 'Inclus' } as Record<string, string>,
-      driverChargeLabels: { FREE: 'Gratuit', PER_DAY: 'Par jour', FLAT: 'Forfait' } as Record<string, string>,
-      reportingPeriodLabels: { WEEKLY: 'Hebdomadaire', MONTHLY: 'Mensuel', QUARTERLY: 'Trimestriel', ANNUAL: 'Annuel' } as Record<string, string>,
-      reportFormatLabels: { CSV: 'CSV', PDF: 'PDF', BOTH: 'Les deux' } as Record<string, string>,
+      title: 'Paramètres', subtitle: 'Gérez une section à la fois. L’accès vient de votre abonnement et de votre rôle.',
+      loading: 'Chargement des paramètres...', save: 'Enregistrement...', saved: 'Enregistré.', saveSection: 'Enregistrer', currentPlan: 'Plan actuel',
+      subscriptionStatus: 'Statut abonnement', manageSubscription: 'Gérer l’abonnement', requiredPlan: 'Requiert',
+      lockedTitle: 'Cette section n’est pas incluse dans votre plan actuel.', lockedBody: 'La configuration enregistrée est conservée et redevient modifiable après mise à niveau.',
+      readOnly: 'Cette section est en lecture seule pendant la restriction d’accès.', companyHint: 'La langue par défaut affecte la vitrine et les contrats générés si disponibles.',
+      publicProfile: 'Profil public', storefrontBasics: 'Bases de la vitrine', premiumBranding: 'Disponible avec GROWTH',
+      paymentsBody: 'Configurez les prestataires de paiement. Les secrets ne sont jamais affichés après enregistrement.',
+      policies: 'Carburant et dommages', additionalDriver: 'Automatisation conducteur additionnel', insuranceNew: 'Nouvelle police',
+      pricingNew: 'Nouvelle règle', accountingSchedule: 'L’envoi planifié est disponible avec PRO.', noItems: 'Aucun enregistrement.',
+      marketplace: 'Publié sur la vitrine', logo: 'Logo', hero: 'Image principale', upload: 'Téléverser', active: 'Actif', inactive: 'Inactif',
+      labels: {
+        displayName: 'Nom affiché', tagline: 'Slogan', publicEmail: 'E-mail public', publicPhone: 'Téléphone public', whatsapp: 'Numéro WhatsApp',
+        city: 'Ville', country: 'Pays', websiteUrl: 'Site web', defaultLocale: 'Langue par défaut', defaultCurrency: 'Devise par défaut',
+        primaryColor: 'Couleur principale', accentColor: 'Couleur secondaire', amanpayMerchantId: 'ID marchand AmanPay', amanpaySecretKey: 'Clé secrète AmanPay',
+        paypalEmail: 'Email PayPal business', fuelPolicyType: 'Type de politique carburant', fuelPolicyNote: 'Note carburant', damagePolicy: 'Politique dommages',
+        additionalDriverCharge: 'Supplément conducteur', dailyRate: 'Tarif journalier', flatRate: 'Tarif fixe', accountantName: 'Nom du comptable',
+        accountantEmail: 'E-mail du comptable', reportingPeriod: 'Période', reportFormat: 'Format', autoSend: 'Envoi automatique',
+      },
     },
     ar: {
-      title: 'الإعدادات المتقدمة',
-      subtitle: 'إدارة التأمين وقواعد السائق الإضافي وتعديلات التسعير وإعدادات التقارير.',
-      save: 'جارٍ الحفظ…',
-      saveBrand: 'حفظ العلامة',
-      brandProfile: 'العلامة والملف العام',
-      brandProfileDesc: 'تحكم في ظهور شركتك في السوق وموقع الحجز العام.',
-      payments: 'طرق دفع الإيجار',
-      paymentsDesc: 'تهيئة طريقة دفع العملاء لشركتك في موقع الحجز.',
-      savePayments: 'حفظ الدفع',
-      customDomain: 'نطاق مخصص',
-      customDomainDesc: 'ربط نطاقك الخاص بموقع الحجز.',
-      saveDomain: 'حفظ النطاق',
-      removeDomain: 'إزالة النطاق المخصص',
-      contractPolicies: 'العقد وسياسات السائق',
-      savePolicies: 'حفظ السياسات',
-      insurancePolicies: 'سياسات التأمين',
-      pricingRules: 'قواعد التسعير',
-      accounting: 'المحاسبة والتصدير',
-      saveAccounting: 'حفظ المحاسبة',
-      displayName: 'اسم العرض',
-      tagline: 'الشعار',
-      publicEmail: 'البريد الإلكتروني العام',
-      publicPhone: 'الهاتف العام',
-      city: 'المدينة',
-      country: 'الدولة',
-      websiteUrl: 'رابط الموقع',
-      contractLanguage: 'لغة العقد',
-      whatsapp: 'رقم واتساب',
-      brandColor: 'لون العلامة',
-      listedStorefront: 'مدرج في السوق',
-      logoUpload: 'رفع الشعار',
-      heroUpload: 'رفع صورة الواجهة',
-      uploading: 'جارٍ الرفع…',
-      logoUploaded: 'تم رفع الشعار',
-      noLogo: 'لم يتم رفع شعار بعد',
-      heroUploaded: 'تم رفع صورة الواجهة',
-      noHero: 'لم يتم رفع صورة واجهة بعد',
-      subdomain: 'النطاق الفرعي',
-      customDomainLabel: 'النطاق المخصص',
-      domainPlaceholder: 'cars.example.com',
-      status: 'الحالة',
-      verified: 'موثق',
-      pendingDns: 'بانتظار التحقق من DNS',
-      notConfigured: 'غير مُعدّ',
-      fuelPolicyType: 'نوع سياسة الوقود',
-      additionalDriverCharge: 'رسوم السائق الإضافي',
-      dailyDriverRate: 'تعرفة السائق اليومية',
-      flatDriverRate: 'تعرفة السائق الثابتة',
-      fuelPolicyNote: 'ملاحظة سياسة الوقود',
-      damagePolicy: 'سياسة الأضرار',
-      active: 'نشط',
-      inactive: 'غير نشط',
-      noInsurance: 'لا توجد سياسات تأمين مهيأة.',
-      policyName: 'اسم السياسة',
-      chargeValue: 'قيمة الرسوم',
-      required: 'إلزامي',
-      addPolicy: 'إضافة سياسة',
-      noRules: 'لا توجد قواعد تسعير مهيأة.',
-      ruleName: 'اسم القاعدة',
-      addRule: 'إضافة قاعدة',
-      reportingPeriod: 'فترة التقرير',
-      reportFormat: 'تنسيق التقرير',
-      accountantName: 'اسم المحاسب',
-      accountantEmail: 'بريد المحاسب',
-      autoSend: 'إرسال التقارير تلقائياً إلى المحاسب',
-      amanpayMerchantId: 'معرّف التاجر AmanPay',
-      amanpaySecretKey: 'المفتاح السري AmanPay',
-      paypalEmail: 'بريد أعمال PayPal',
-      noPaymentConfigured: 'إذا لم يتم إعداد وسيلة دفع، لا يزال بإمكان العملاء إرسال طلب حجز والدفع عند الاستلام.',
-      fuelPolicyLabels: { FULL_TO_FULL: 'ممتلئ إلى ممتلئ', FULL_TO_EMPTY: 'ممتلئ إلى فارغ', SAME_TO_SAME: 'نفس المستوى', PREPAID: 'مدفوع مسبقاً', FREE: 'مشمول' } as Record<string, string>,
-      driverChargeLabels: { FREE: 'مجاني', PER_DAY: 'يومي', FLAT: 'ثابت' } as Record<string, string>,
-      reportingPeriodLabels: { WEEKLY: 'أسبوعي', MONTHLY: 'شهري', QUARTERLY: 'ربع سنوي', ANNUAL: 'سنوي' } as Record<string, string>,
-      reportFormatLabels: { CSV: 'CSV', PDF: 'PDF', BOTH: 'كلاهما' } as Record<string, string>,
+      title: 'الإعدادات', subtitle: 'إدارة قسم واحد في كل مرة. يتم تحديد الوصول من الاشتراك والدور.',
+      loading: 'جارٍ تحميل الإعدادات...', save: 'جارٍ الحفظ...', saved: 'تم الحفظ.', saveSection: 'حفظ القسم', currentPlan: 'الخطة الحالية',
+      subscriptionStatus: 'حالة الاشتراك', manageSubscription: 'إدارة الاشتراك', requiredPlan: 'يتطلب',
+      lockedTitle: 'هذا القسم غير مشمول في خطتك الحالية.', lockedBody: 'يتم الاحتفاظ بالإعدادات المحفوظة وتعود قابلة للتعديل بعد الترقية.',
+      readOnly: 'هذا القسم للقراءة فقط أثناء تقييد الوصول.', companyHint: 'تؤثر اللغة الافتراضية على الواجهة والعقود عند توفرها.',
+      publicProfile: 'الملف العام', storefrontBasics: 'أساسيات الواجهة', premiumBranding: 'متاح في GROWTH',
+      paymentsBody: 'إعداد مزودي دفع المستأجرين. لا يتم عرض المفاتيح السرية بعد الحفظ.',
+      policies: 'سياسات الوقود والأضرار', additionalDriver: 'أتمتة السائق الإضافي', insuranceNew: 'سياسة تأمين جديدة',
+      pricingNew: 'قاعدة تسعير جديدة', accountingSchedule: 'الإرسال المجدول متاح في PRO.', noItems: 'لا توجد سجلات بعد.',
+      marketplace: 'مدرج في الواجهة', logo: 'الشعار', hero: 'صورة الواجهة', upload: 'رفع', active: 'نشط', inactive: 'غير نشط',
+      labels: {
+        displayName: 'اسم العرض', tagline: 'الشعار', publicEmail: 'البريد العام', publicPhone: 'الهاتف العام', whatsapp: 'رقم واتساب',
+        city: 'المدينة', country: 'الدولة', websiteUrl: 'الموقع', defaultLocale: 'اللغة الافتراضية', defaultCurrency: 'العملة الافتراضية',
+        primaryColor: 'اللون الأساسي', accentColor: 'لون التمييز', amanpayMerchantId: 'معرف تاجر AmanPay', amanpaySecretKey: 'مفتاح AmanPay السري',
+        paypalEmail: 'بريد PayPal التجاري', fuelPolicyType: 'سياسة الوقود', fuelPolicyNote: 'ملاحظة الوقود', damagePolicy: 'سياسة الأضرار',
+        additionalDriverCharge: 'رسوم السائق الإضافي', dailyRate: 'السعر اليومي', flatRate: 'السعر الثابت', accountantName: 'اسم المحاسب',
+        accountantEmail: 'بريد المحاسب', reportingPeriod: 'فترة التقرير', reportFormat: 'تنسيق التقرير', autoSend: 'إرسال تلقائي',
+      },
     },
-  }[language]
+  }[language]), [language])
+
+  const [menu, setMenu] = useState<MenuItem[]>([])
+  const [entitlements, setEntitlements] = useState<Entitlements | null>(null)
   const [brand, setBrand] = useState<BrandSettings | null>(null)
   const [contractSettings, setContractSettings] = useState<ContractSettings | null>(null)
   const [insurancePolicies, setInsurancePolicies] = useState<InsurancePolicy[]>([])
@@ -307,75 +214,94 @@ export default function SettingsPage() {
   const [accountingSettings, setAccountingSettings] = useState<AccountingSettings | null>(null)
   const [newInsurance, setNewInsurance] = useState(emptyInsurance)
   const [newRule, setNewRule] = useState(emptyRule)
-  const [customDomain, setCustomDomain] = useState('')
-  const [showSecretKey, setShowSecretKey] = useState(false)
-  const [uploadingAsset, setUploadingAsset] = useState<'logo' | 'hero' | null>(null)
-  const [error, setError] = useState<string | null>(null)
   const [saving, setSaving] = useState(false)
+  const [uploadingAsset, setUploadingAsset] = useState<'logo' | 'hero' | null>(null)
+  const [message, setMessage] = useState<string | null>(null)
+  const [error, setError] = useState<string | null>(null)
 
-  async function load() {
-    try {
-      const [brandData, contractData, insuranceData, ruleData, accountingData] = await Promise.all([
-        apiFetch<BrandSettings | null>('/companies/me/brand'),
-        apiFetch<ContractSettings | null>('/companies/me/contract-settings'),
-        apiFetch<InsurancePolicy[]>('/companies/me/insurance-policies'),
-        apiFetch<PricingRule[]>('/companies/me/pricing-rules'),
-        apiFetch<AccountingSettings | null>('/companies/me/accounting-settings'),
-      ])
-      setBrand(brandData)
-      setCustomDomain(brandData?.customDomain ?? '')
-      setContractSettings(contractData ?? {
-        fuelPolicyType: 'FULL_TO_FULL',
-        fuelPolicyNote: '',
-        additionalDriverCharge: 'FREE',
-        additionalDriverDailyRate: 0,
-        additionalDriverFlatRate: 0,
-        damagePolicy: '',
-      })
-      setInsurancePolicies(insuranceData)
-      setPricingRules(ruleData)
-      setAccountingSettings(accountingData ?? {
-        reportingPeriod: 'MONTHLY',
-        accountantEmail: '',
-        accountantName: '',
-        autoSendReport: false,
-        reportFormat: 'CSV',
-      })
-      setError(null)
-    } catch (err: any) {
-      setError(err.message ?? 'Failed to load settings')
+  const requestedSection = searchParams.get('section') as SectionKey | null
+  const activeItem = menu.find((item) => item.sectionKey === requestedSection) ?? menu.find((item) => item.state === 'ENABLED') ?? menu[0]
+  const activeSection = activeItem?.sectionKey
+
+  const feature = (key: FeatureKey) => entitlements?.features[key] ?? { available: false, editable: false, requiredPlan: null, reason: null }
+  const canEdit = (key: FeatureKey) => feature(key).editable
+  const isAvailable = (key: FeatureKey) => feature(key).available
+
+  useEffect(() => {
+    async function loadShell() {
+      try {
+        const [menuData, entitlementData] = await Promise.all([
+          apiFetch<{ items: MenuItem[] }>(`/companies/me/settings-menu?locale=${language}`),
+          apiFetch<Entitlements>('/companies/me/settings-entitlements'),
+        ])
+        setMenu(menuData.items)
+        setEntitlements(entitlementData)
+      } catch (err: any) {
+        setError(err.message ?? 'Failed to load settings menu')
+      }
     }
-  }
+    loadShell()
+  }, [language])
 
-  async function saveBrandSettings() {
+  useEffect(() => {
+    if (!activeSection) return
+    const allowed = menu.some((item) => item.sectionKey === activeSection)
+    if (allowed && requestedSection === activeSection) return
+    router.replace(`/settings?section=${activeSection}`)
+  }, [activeSection, menu, requestedSection, router])
+
+  useEffect(() => {
+    async function loadSection() {
+      try {
+        if ((activeSection === 'company' || activeSection === 'storefront' || activeSection === 'payments') && !brand) {
+          setBrand(await apiFetch<BrandSettings | null>('/companies/me/brand'))
+        }
+        if (activeSection === 'rental-policies' && !contractSettings) {
+          setContractSettings(await apiFetch<ContractSettings | null>('/companies/me/contract-settings') ?? {
+            fuelPolicyType: 'FULL_TO_FULL', fuelPolicyNote: '', additionalDriverCharge: 'FREE',
+            additionalDriverDailyRate: 0, additionalDriverFlatRate: 0, damagePolicy: '',
+          })
+        }
+        if (activeSection === 'insurance' && isAvailable('settings.insurance_policies') && insurancePolicies.length === 0) {
+          setInsurancePolicies(await apiFetch<InsurancePolicy[]>('/companies/me/insurance-policies'))
+        }
+        if (activeSection === 'pricing' && isAvailable('settings.pricing_rules') && pricingRules.length === 0) {
+          setPricingRules(await apiFetch<PricingRule[]>('/companies/me/pricing-rules'))
+        }
+        if (activeSection === 'accounting' && isAvailable('settings.accounting_defaults') && !accountingSettings) {
+          setAccountingSettings(await apiFetch<AccountingSettings | null>('/companies/me/accounting-settings') ?? {
+            reportingPeriod: 'MONTHLY', accountantEmail: '', accountantName: '', autoSendReport: false, reportFormat: 'CSV',
+          })
+        }
+      } catch (err: any) {
+        setError(err.message ?? 'Failed to load settings')
+      }
+    }
+    loadSection()
+  }, [activeSection, accountingSettings, brand, contractSettings, insurancePolicies.length, pricingRules.length, entitlements])
+
+  async function saveBrand() {
     if (!brand) return
-    setSaving(true)
-    setError(null)
+    setSaving(true); setError(null); setMessage(null)
     try {
       const updated = await apiFetch<BrandSettings>('/companies/me/brand', {
         method: 'PATCH',
         body: JSON.stringify({
-          displayName: brand.displayName,
-          tagline: brand.tagline || undefined,
-          primaryColor: brand.primaryColor,
-          accentColor: brand.accentColor || undefined,
+          displayName: brand.displayName, tagline: brand.tagline || undefined,
+          primaryColor: canEdit('settings.branding_custom') ? brand.primaryColor : undefined,
+          accentColor: canEdit('settings.branding_custom') ? brand.accentColor || undefined : undefined,
           publicEmail: brand.publicEmail || undefined,
-          publicPhone: brand.publicPhone || undefined,
-          publicAddress: brand.publicAddress || undefined,
-          publicCity: brand.publicCity || undefined,
-          publicCountry: brand.publicCountry || undefined,
-          websiteUrl: brand.websiteUrl || undefined,
-          defaultLocale: brand.defaultLocale || undefined,
-          whatsappNumber: brand.whatsappNumber || undefined,
-          paypalEmail: brand.paypalEmail || undefined,
-          amanpayMerchantId: brand.amanpayMerchantId || undefined,
-          amanpaySecretKey: brand.amanpaySecretKey || undefined,
-          paypalMerchantId: brand.paypalMerchantId || undefined,
-          defaultCurrency: brand.defaultCurrency || undefined,
+          publicPhone: brand.publicPhone || undefined, publicAddress: brand.publicAddress || undefined,
+          publicCity: brand.publicCity || undefined, publicCountry: brand.publicCountry || undefined,
+          websiteUrl: brand.websiteUrl || undefined, defaultLocale: brand.defaultLocale || undefined,
+          whatsappNumber: brand.whatsappNumber || undefined, defaultCurrency: brand.defaultCurrency || undefined,
           isListedOnMarketplace: brand.isListedOnMarketplace,
+          amanpayMerchantId: canEdit('settings.renter_payments') ? brand.amanpayMerchantId || undefined : undefined,
+          amanpaySecretKey: canEdit('settings.renter_payments') ? brand.amanpaySecretKey || undefined : undefined,
+          paypalEmail: canEdit('settings.renter_payments') ? brand.paypalEmail || undefined : undefined,
         }),
       })
-      setBrand(updated)
+      setBrand(updated); setMessage(copy.saved)
     } catch (err: any) {
       setError(err.message ?? 'Failed to save brand settings')
     } finally {
@@ -386,15 +312,10 @@ export default function SettingsPage() {
   async function uploadBrandAsset(kind: 'logo' | 'hero', file: File | null) {
     if (!file) return
     setUploadingAsset(kind)
-    setError(null)
     try {
       const formData = new FormData()
       formData.append('file', file)
-      const updated = await apiFetch<BrandSettings>(`/companies/me/brand/${kind}`, {
-        method: 'POST',
-        body: formData,
-      })
-      setBrand(updated)
+      setBrand(await apiFetch<BrandSettings>(`/companies/me/brand/${kind}`, { method: 'POST', body: formData }))
     } catch (err: any) {
       setError(err.message ?? `Failed to upload ${kind}`)
     } finally {
@@ -402,51 +323,19 @@ export default function SettingsPage() {
     }
   }
 
-  async function saveCustomDomain() {
-    setSaving(true)
-    setError(null)
-    try {
-      await apiFetch('/companies/me/brand/custom-domain', {
-        method: 'POST',
-        body: JSON.stringify({ customDomain }),
-      })
-      await load()
-    } catch (err: any) {
-      setError(err.message ?? 'Failed to save custom domain')
-    } finally {
-      setSaving(false)
-    }
-  }
-
-  async function removeCustomDomain() {
-    setSaving(true)
-    setError(null)
-    try {
-      await apiFetch('/companies/me/brand/custom-domain', {
-        method: 'DELETE',
-      })
-      setCustomDomain('')
-      await load()
-    } catch (err: any) {
-      setError(err.message ?? 'Failed to remove custom domain')
-    } finally {
-      setSaving(false)
-    }
-  }
-
-  useEffect(() => {
-    load()
-  }, [])
-
   async function saveContractSettings() {
     if (!contractSettings) return
-    setSaving(true)
-    setError(null)
+    setSaving(true); setError(null); setMessage(null)
     try {
-      await apiFetch('/companies/me/contract-settings', {
-        method: 'PATCH',
-        body: JSON.stringify(contractSettings),
-      })
+      const body = canEdit('settings.additional_driver_fees')
+        ? contractSettings
+        : {
+          fuelPolicyType: contractSettings.fuelPolicyType,
+          fuelPolicyNote: contractSettings.fuelPolicyNote,
+          damagePolicy: contractSettings.damagePolicy,
+        }
+      await apiFetch('/companies/me/contract-settings', { method: 'PATCH', body: JSON.stringify(body) })
+      setMessage(copy.saved)
     } catch (err: any) {
       setError(err.message ?? 'Failed to save contract settings')
     } finally {
@@ -456,13 +345,19 @@ export default function SettingsPage() {
 
   async function saveAccountingSettings() {
     if (!accountingSettings) return
-    setSaving(true)
-    setError(null)
+    setSaving(true); setError(null); setMessage(null)
     try {
-      await apiFetch('/companies/me/accounting-settings', {
-        method: 'PATCH',
-        body: JSON.stringify(accountingSettings),
-      })
+      const body = {
+        reportingPeriod: accountingSettings.reportingPeriod,
+        accountantEmail: accountingSettings.accountantEmail,
+        accountantName: accountingSettings.accountantName,
+        autoSendReport: canEdit('settings.accounting_scheduled_delivery') ? accountingSettings.autoSendReport : undefined,
+        reportFormat: canEdit('settings.accounting_advanced_formats') || accountingSettings.reportFormat !== 'BOTH'
+          ? accountingSettings.reportFormat
+          : undefined,
+      }
+      await apiFetch('/companies/me/accounting-settings', { method: 'PATCH', body: JSON.stringify(body) })
+      setMessage(copy.saved)
     } catch (err: any) {
       setError(err.message ?? 'Failed to save accounting settings')
     } finally {
@@ -472,14 +367,10 @@ export default function SettingsPage() {
 
   async function createInsurance() {
     setSaving(true)
-    setError(null)
     try {
-      await apiFetch('/companies/me/insurance-policies', {
-        method: 'POST',
-        body: JSON.stringify(newInsurance),
-      })
+      await apiFetch('/companies/me/insurance-policies', { method: 'POST', body: JSON.stringify(newInsurance) })
       setNewInsurance(emptyInsurance)
-      await load()
+      setInsurancePolicies(await apiFetch<InsurancePolicy[]>('/companies/me/insurance-policies'))
     } catch (err: any) {
       setError(err.message ?? 'Failed to create insurance policy')
     } finally {
@@ -487,28 +378,12 @@ export default function SettingsPage() {
     }
   }
 
-  async function toggleInsurance(policy: InsurancePolicy) {
-    try {
-      await apiFetch(`/companies/me/insurance-policies/${policy.id}`, {
-        method: 'PATCH',
-        body: JSON.stringify({ isActive: !policy.isActive }),
-      })
-      await load()
-    } catch (err: any) {
-      setError(err.message ?? 'Failed to update insurance policy')
-    }
-  }
-
   async function createRule() {
     setSaving(true)
-    setError(null)
     try {
-      await apiFetch('/companies/me/pricing-rules', {
-        method: 'POST',
-        body: JSON.stringify(newRule),
-      })
+      await apiFetch('/companies/me/pricing-rules', { method: 'POST', body: JSON.stringify(newRule) })
       setNewRule(emptyRule)
-      await load()
+      setPricingRules(await apiFetch<PricingRule[]>('/companies/me/pricing-rules'))
     } catch (err: any) {
       setError(err.message ?? 'Failed to create pricing rule')
     } finally {
@@ -516,335 +391,200 @@ export default function SettingsPage() {
     }
   }
 
-  async function toggleRule(rule: PricingRule) {
-    try {
-      await apiFetch(`/companies/me/pricing-rules/${rule.id}`, {
-        method: 'PATCH',
-        body: JSON.stringify({ isActive: !rule.isActive }),
-      })
-      await load()
-    } catch (err: any) {
-      setError(err.message ?? 'Failed to update pricing rule')
-    }
-  }
+  if (!entitlements || !activeItem) return <div className="card p-6 text-sm text-slate-500">{copy.loading}</div>
+
+  const activeLocked = activeItem.state === 'LOCKED'
 
   return (
-    <div className="space-y-6">
-      <div>
-        <h2 className="text-xl font-semibold text-slate-900">{copy.title}</h2>
-        <p className="mt-1 text-sm text-slate-500">{copy.subtitle}</p>
+    <div className="space-y-6" dir={isRtl ? 'rtl' : 'ltr'}>
+      <div className="flex flex-col gap-4 lg:flex-row lg:items-end lg:justify-between">
+        <div>
+          <h2 className="text-xl font-semibold text-slate-900">{copy.title}</h2>
+          <p className="mt-1 text-sm text-slate-500">{copy.subtitle}</p>
+        </div>
+        <div className="flex flex-wrap items-center gap-2 text-xs">
+          <span className="rounded-full border border-slate-200 bg-white px-3 py-1.5 text-slate-600">{copy.currentPlan}: {entitlements.plan}</span>
+          <span className="rounded-full border border-slate-200 bg-white px-3 py-1.5 text-slate-600">{copy.subscriptionStatus}: {entitlements.subscriptionStatus}</span>
+          <a href="/subscription" className="btn-secondary py-1.5 text-xs">{copy.manageSubscription}</a>
+        </div>
       </div>
 
-      {error && <div className="card p-6 text-sm text-red-600">{error}</div>}
+      {error && <div className="rounded-lg border border-red-200 bg-red-50 p-4 text-sm text-red-700">{error}</div>}
+      {message && <div className="rounded-lg border border-emerald-200 bg-emerald-50 p-4 text-sm text-emerald-700" aria-live="polite">{message}</div>}
 
-      {brand && (
-        <div className="grid gap-6">
-          <div className="card p-6">
-            <div className="flex items-center justify-between gap-4">
-              <div>
-                <h3 className="text-base font-semibold text-slate-900">{copy.brandProfile}</h3>
-                <p className="mt-1 text-sm text-slate-500">{copy.brandProfileDesc}</p>
-              </div>
-              <button onClick={saveBrandSettings} disabled={saving} className="btn-primary">
-                {saving ? copy.save : copy.saveBrand}
-              </button>
-            </div>
-            <div className="mt-5 grid gap-4 lg:grid-cols-2">
-              <div>
-                <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.displayName}</label>
-                <input className="input-field" value={brand.displayName} onChange={(event) => setBrand((current) => current ? { ...current, displayName: event.target.value } : current)} />
-              </div>
-              <div>
-                <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.tagline}</label>
-                <input className="input-field" value={brand.tagline ?? ''} onChange={(event) => setBrand((current) => current ? { ...current, tagline: event.target.value } : current)} />
-              </div>
-              <div>
-                <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.publicEmail}</label>
-                <input className="input-field" type="email" value={brand.publicEmail ?? ''} onChange={(event) => setBrand((current) => current ? { ...current, publicEmail: event.target.value } : current)} />
-              </div>
-              <div>
-                <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.publicPhone}</label>
-                <input className="input-field" value={brand.publicPhone ?? ''} onChange={(event) => setBrand((current) => current ? { ...current, publicPhone: event.target.value } : current)} />
-              </div>
-              <div>
-                <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.city}</label>
-                <input className="input-field" value={brand.publicCity ?? ''} onChange={(event) => setBrand((current) => current ? { ...current, publicCity: event.target.value } : current)} />
-              </div>
-              <div>
-                <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.country}</label>
-                <input className="input-field" value={brand.publicCountry ?? ''} onChange={(event) => setBrand((current) => current ? { ...current, publicCountry: event.target.value } : current)} />
-              </div>
-              <div>
-                <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.websiteUrl}</label>
-                <input className="input-field" value={brand.websiteUrl ?? ''} onChange={(event) => setBrand((current) => current ? { ...current, websiteUrl: event.target.value } : current)} />
-              </div>
-              <div>
-                <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.contractLanguage}</label>
-                <select className="input-field" value={brand.defaultLocale ?? 'en'} onChange={(event) => setBrand((current) => current ? { ...current, defaultLocale: event.target.value } : current)}>
-                  <option value="en">EN</option>
-                  <option value="fr">FR</option>
-                  <option value="ar">AR</option>
-                </select>
-              </div>
-              <div>
-                <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.whatsapp}</label>
-                <input className="input-field" value={brand.whatsappNumber ?? ''} onChange={(event) => setBrand((current) => current ? { ...current, whatsappNumber: event.target.value } : current)} />
-              </div>
-              <div>
-                <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.brandColor}</label>
-                <input className="input-field" value={brand.primaryColor} onChange={(event) => setBrand((current) => current ? { ...current, primaryColor: event.target.value } : current)} />
-              </div>
-              <div className="flex items-center gap-4">
-                <label className="flex items-center gap-2 text-sm font-medium text-slate-700">
-                  <input type="checkbox" checked={brand.isListedOnMarketplace} onChange={(event) => setBrand((current) => current ? { ...current, isListedOnMarketplace: event.target.checked } : current)} />
-                  {copy.listedStorefront}
-                </label>
-              </div>
-            </div>
-            <div className="mt-5 grid gap-4 lg:grid-cols-2">
-              <label className="block">
-                <span className="mb-1.5 block text-sm font-medium text-slate-700">{copy.logoUpload}</span>
-                <input type="file" accept="image/*" onChange={(event) => uploadBrandAsset('logo', event.target.files?.[0] ?? null)} className="input-field" />
-                <p className="mt-2 text-xs text-slate-500">{uploadingAsset === 'logo' ? copy.uploading : brand.logoUrl ? copy.logoUploaded : copy.noLogo}</p>
-              </label>
-              <label className="block">
-                <span className="mb-1.5 block text-sm font-medium text-slate-700">{copy.heroUpload}</span>
-                <input type="file" accept="image/*" onChange={(event) => uploadBrandAsset('hero', event.target.files?.[0] ?? null)} className="input-field" />
-                <p className="mt-2 text-xs text-slate-500">{uploadingAsset === 'hero' ? copy.uploading : brand.heroImageUrl ? copy.heroUploaded : copy.noHero}</p>
-              </label>
-            </div>
+      <div className="grid gap-6 lg:grid-cols-[280px_minmax(0,1fr)]">
+        <nav className="card p-2" aria-label="Settings sections">
+          <div className="flex gap-2 overflow-x-auto lg:block lg:space-y-1">
+            {menu.map((item) => {
+              const Icon = sectionIcons[item.iconKey as keyof typeof sectionIcons] ?? FileText
+              const isActive = item.sectionKey === activeSection
+              return (
+                <button
+                  key={item.sectionKey}
+                  type="button"
+                  onClick={() => router.push(`/settings?section=${item.sectionKey}`)}
+                  aria-current={isActive ? 'page' : undefined}
+                  className={`flex min-w-56 items-start gap-3 rounded-md px-3 py-3 text-left transition lg:w-full ${isActive ? 'bg-slate-900 text-white' : 'text-slate-600 hover:bg-slate-50'}`}
+                >
+                  <Icon className="mt-0.5 h-4 w-4 shrink-0" />
+                  <span className="min-w-0 flex-1">
+                    <span className="block text-sm font-medium">{item.label}</span>
+                    <span className={`mt-0.5 block text-xs ${isActive ? 'text-slate-300' : 'text-slate-400'}`}>{item.description}</span>
+                  </span>
+                  {item.state === 'LOCKED' && <Lock className="mt-0.5 h-4 w-4 shrink-0" />}
+                </button>
+              )
+            })}
+          </div>
+        </nav>
+
+        <main className="min-w-0">
+          <div className="mb-4">
+            <h3 className="text-lg font-semibold text-slate-900">{activeItem.label}</h3>
+            <p className="text-sm text-slate-500">{activeItem.description}</p>
           </div>
 
-          <div className="grid gap-6 lg:grid-cols-2">
-            <div className="card p-6">
-              <div className="flex items-center justify-between gap-4">
-                <div>
-                  <h3 className="text-base font-semibold text-slate-900">{copy.payments}</h3>
-                  <p className="mt-1 text-sm text-slate-500">{copy.paymentsDesc}</p>
-                </div>
-                <button onClick={saveBrandSettings} disabled={saving} className="btn-primary">
-                  {saving ? copy.save : copy.savePayments}
-                </button>
-              </div>
-              <div className="mt-5 grid gap-4">
-                <div>
-                  <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.amanpayMerchantId}</label>
-                  <input className="input-field" value={brand.amanpayMerchantId ?? ''} onChange={(event) => setBrand((current) => current ? { ...current, amanpayMerchantId: event.target.value } : current)} />
-                </div>
-                <div>
-                  <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.amanpaySecretKey}</label>
-                  <div className="relative">
-                    <input className="input-field pr-10" type={showSecretKey ? 'text' : 'password'} value={brand.amanpaySecretKey ?? ''} onChange={(event) => setBrand((current) => current ? { ...current, amanpaySecretKey: event.target.value } : current)} />
-                    <button
-                      type="button"
-                      onClick={() => setShowSecretKey((v) => !v)}
-                      className="absolute inset-y-0 right-3 flex items-center text-slate-400 hover:text-slate-600"
-                      tabIndex={-1}
-                    >
-                      {showSecretKey ? (
-                        <svg xmlns="http://www.w3.org/2000/svg" className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
-                          <path strokeLinecap="round" strokeLinejoin="round" d="M13.875 18.825A10.05 10.05 0 0112 19c-4.478 0-8.268-2.943-9.543-7a9.97 9.97 0 011.563-3.029m5.858.908a3 3 0 114.243 4.243M9.878 9.878l4.242 4.242M9.88 9.88l-3.29-3.29m7.532 7.532l3.29 3.29M3 3l3.59 3.59m0 0A9.953 9.953 0 0112 5c4.478 0 8.268 2.943 9.543 7a10.025 10.025 0 01-4.132 5.411m0 0L21 21" />
-                        </svg>
-                      ) : (
-                        <svg xmlns="http://www.w3.org/2000/svg" className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
-                          <path strokeLinecap="round" strokeLinejoin="round" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z" />
-                          <path strokeLinecap="round" strokeLinejoin="round" d="M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z" />
-                        </svg>
-                      )}
-                    </button>
+          {activeLocked ? (
+            <LockedState copy={copy} item={activeItem} currentPlan={entitlements.plan} />
+          ) : (
+            <>
+              {entitlements.accessLevel !== 'full' && <div className="mb-4 rounded-lg border border-amber-200 bg-amber-50 p-4 text-sm text-amber-800">{copy.readOnly}</div>}
+              {activeSection === 'company' && brand && (
+                <SectionCard onSave={saveBrand} saving={saving} copy={copy}>
+                  <div className="grid gap-4 lg:grid-cols-2">
+                    <Input label={copy.labels.displayName} value={brand.displayName} disabled={!canEdit('settings.company_profile')} onChange={(v) => setBrand({ ...brand, displayName: v })} />
+                    <Input label={copy.labels.tagline} value={brand.tagline ?? ''} disabled={!canEdit('settings.company_profile')} onChange={(v) => setBrand({ ...brand, tagline: v })} />
+                    <Input label={copy.labels.publicEmail} type="email" value={brand.publicEmail ?? ''} disabled={!canEdit('settings.public_contact')} onChange={(v) => setBrand({ ...brand, publicEmail: v })} />
+                    <Input label={copy.labels.publicPhone} value={brand.publicPhone ?? ''} disabled={!canEdit('settings.public_contact')} onChange={(v) => setBrand({ ...brand, publicPhone: v })} />
+                    <Input label={copy.labels.whatsapp} value={brand.whatsappNumber ?? ''} disabled={!canEdit('settings.public_contact')} onChange={(v) => setBrand({ ...brand, whatsappNumber: v })} />
+                    <div>
+                      <Label text={copy.labels.city} />
+                      <input list="morocco-cities" className="input-field" value={brand.publicCity ?? ''} disabled={!canEdit('settings.public_contact')} onChange={(e) => setBrand({ ...brand, publicCity: e.target.value })} />
+                      <datalist id="morocco-cities">{cityOptions.map((city) => <option key={city} value={city} />)}</datalist>
+                    </div>
+                    <Input label={copy.labels.country} value={brand.publicCountry ?? 'Morocco'} disabled={!canEdit('settings.public_contact')} onChange={(v) => setBrand({ ...brand, publicCountry: v })} />
+                    <Input label={copy.labels.websiteUrl} value={brand.websiteUrl ?? ''} disabled={!canEdit('settings.public_contact')} onChange={(v) => setBrand({ ...brand, websiteUrl: v })} />
+                    <Select label={copy.labels.defaultLocale} value={brand.defaultLocale ?? language} disabled={!canEdit('settings.locale_currency')} options={['en', 'fr', 'ar']} onChange={(v) => setBrand({ ...brand, defaultLocale: v })} />
+                    <Select label={copy.labels.defaultCurrency} value={brand.defaultCurrency ?? 'MAD'} disabled={!canEdit('settings.locale_currency')} options={['MAD', 'EUR', 'USD']} onChange={(v) => setBrand({ ...brand, defaultCurrency: v })} />
                   </div>
-                </div>
-                <div>
-                  <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.paypalEmail}</label>
-                  <input className="input-field" type="email" value={brand.paypalEmail ?? ''} onChange={(event) => setBrand((current) => current ? { ...current, paypalEmail: event.target.value } : current)} />
-                </div>
-                <div className="rounded-2xl border border-slate-200 bg-slate-50 p-4 text-sm text-slate-600">
-                  {copy.noPaymentConfigured}
-                </div>
-              </div>
-            </div>
+                  <p className="mt-3 text-xs text-slate-500">{copy.companyHint}</p>
+                </SectionCard>
+              )}
 
-            <div className="card p-6">
-              <div className="flex items-center justify-between gap-4">
-                <div>
-                  <h3 className="text-base font-semibold text-slate-900">{copy.customDomain}</h3>
-                  <p className="mt-1 text-sm text-slate-500">{copy.customDomainDesc}</p>
-                </div>
-                <button onClick={saveCustomDomain} disabled={saving || !customDomain.trim()} className="btn-primary">
-                  {saving ? copy.save : copy.saveDomain}
-                </button>
-              </div>
-              <div className="mt-5 space-y-4">
-                <div>
-                  <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.subdomain}</label>
-                  <div className="rounded-2xl border border-slate-200 bg-slate-50 px-4 py-3 text-sm text-slate-700">{brand.subdomain}.RentalDriveGo.com</div>
-                </div>
-                <div>
-                  <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.customDomainLabel}</label>
-                  <input className="input-field" placeholder={copy.domainPlaceholder} value={customDomain} onChange={(event) => setCustomDomain(event.target.value)} />
-                </div>
-                <div className="rounded-2xl border border-slate-200 bg-slate-50 p-4 text-sm text-slate-600">
-                  {copy.status}: {brand.customDomain ? (brand.customDomainVerified ? copy.verified : copy.pendingDns) : copy.notConfigured}
-                </div>
-                {brand.customDomain ? (
-                  <button onClick={removeCustomDomain} disabled={saving} className="btn-secondary">
-                    {copy.removeDomain}
-                  </button>
-                ) : null}
-              </div>
-            </div>
-          </div>
-        </div>
-      )}
+              {activeSection === 'storefront' && brand && (
+                <SectionCard onSave={saveBrand} saving={saving} copy={copy}>
+                  <label className="flex items-center gap-2 text-sm font-medium text-slate-700">
+                    <input type="checkbox" checked={brand.isListedOnMarketplace} disabled={!canEdit('settings.storefront_listing')} onChange={(e) => setBrand({ ...brand, isListedOnMarketplace: e.target.checked })} />
+                    {copy.marketplace}
+                  </label>
+                  <div className="mt-5 grid gap-4 lg:grid-cols-2">
+                    <AssetField label={copy.logo} value={brand.logoUrl} disabled={!canEdit('settings.branding_basic')} uploading={uploadingAsset === 'logo'} copy={copy} onChange={(file) => uploadBrandAsset('logo', file)} />
+                    <AssetField label={copy.hero} value={brand.heroImageUrl} disabled={!canEdit('settings.branding_hero')} uploading={uploadingAsset === 'hero'} copy={copy} onChange={(file) => uploadBrandAsset('hero', file)} />
+                    <Input label={copy.labels.primaryColor} value={brand.primaryColor} disabled={!canEdit('settings.branding_custom')} onChange={(v) => setBrand({ ...brand, primaryColor: v })} />
+                    <Input label={copy.labels.accentColor} value={brand.accentColor ?? ''} disabled={!canEdit('settings.branding_custom')} onChange={(v) => setBrand({ ...brand, accentColor: v })} />
+                  </div>
+                  {!isAvailable('settings.branding_custom') && <UpgradePanel title={copy.premiumBranding} />}
+                </SectionCard>
+              )}
 
-      {contractSettings && (
-        <div className="card p-6">
-          <div className="flex items-center justify-between">
-            <h3 className="text-base font-semibold text-slate-900">{copy.contractPolicies}</h3>
-            <button onClick={saveContractSettings} disabled={saving} className="btn-primary">
-              {saving ? copy.save : copy.savePolicies}
-            </button>
-          </div>
-          <div className="mt-5 grid gap-4 lg:grid-cols-2">
-            <div>
-              <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.fuelPolicyType}</label>
-              <select className="input-field" value={contractSettings.fuelPolicyType} onChange={(event) => setContractSettings((current) => current ? { ...current, fuelPolicyType: event.target.value } : current)}>
-                {['FULL_TO_FULL', 'FULL_TO_EMPTY', 'SAME_TO_SAME', 'PREPAID', 'FREE'].map((option) => <option key={option} value={option}>{copy.fuelPolicyLabels[option] ?? option}</option>)}
-              </select>
-            </div>
-            <div>
-              <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.additionalDriverCharge}</label>
-              <select className="input-field" value={contractSettings.additionalDriverCharge} onChange={(event) => setContractSettings((current) => current ? { ...current, additionalDriverCharge: event.target.value as ContractSettings['additionalDriverCharge'] } : current)}>
-                {['FREE', 'PER_DAY', 'FLAT'].map((option) => <option key={option} value={option}>{copy.driverChargeLabels[option] ?? option}</option>)}
-              </select>
-            </div>
-            <div>
-              <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.dailyDriverRate}</label>
-              <input type="number" className="input-field" value={contractSettings.additionalDriverDailyRate} onChange={(event) => setContractSettings((current) => current ? { ...current, additionalDriverDailyRate: Number(event.target.value) } : current)} />
-            </div>
-            <div>
-              <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.flatDriverRate}</label>
-              <input type="number" className="input-field" value={contractSettings.additionalDriverFlatRate} onChange={(event) => setContractSettings((current) => current ? { ...current, additionalDriverFlatRate: Number(event.target.value) } : current)} />
-            </div>
-            <div className="lg:col-span-2">
-              <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.fuelPolicyNote}</label>
-              <textarea className="input-field min-h-24" value={contractSettings.fuelPolicyNote ?? ''} onChange={(event) => setContractSettings((current) => current ? { ...current, fuelPolicyNote: event.target.value } : current)} />
-            </div>
-            <div className="lg:col-span-2">
-              <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.damagePolicy}</label>
-              <textarea className="input-field min-h-24" value={contractSettings.damagePolicy ?? ''} onChange={(event) => setContractSettings((current) => current ? { ...current, damagePolicy: event.target.value } : current)} />
-            </div>
-          </div>
-        </div>
-      )}
+              {activeSection === 'payments' && brand && (
+                <SectionCard onSave={saveBrand} saving={saving} copy={copy} disabled={!canEdit('settings.renter_payments')}>
+                  <p className="mb-4 text-sm text-slate-500">{copy.paymentsBody}</p>
+                  <div className="grid gap-4 lg:grid-cols-2">
+                    <Input label={copy.labels.amanpayMerchantId} value={brand.amanpayMerchantId ?? ''} disabled={!canEdit('settings.renter_payments')} onChange={(v) => setBrand({ ...brand, amanpayMerchantId: v })} />
+                    <Input label={copy.labels.amanpaySecretKey} type="password" value={brand.amanpaySecretKey ?? ''} disabled={!canEdit('settings.renter_payments')} onChange={(v) => setBrand({ ...brand, amanpaySecretKey: v })} />
+                    <Input label={copy.labels.paypalEmail} type="email" value={brand.paypalEmail ?? ''} disabled={!canEdit('settings.renter_payments')} onChange={(v) => setBrand({ ...brand, paypalEmail: v })} />
+                  </div>
+                </SectionCard>
+              )}
 
-      <div className="grid gap-6 xl:grid-cols-2">
-        <div className="card p-6">
-          <h3 className="text-base font-semibold text-slate-900">{copy.insurancePolicies}</h3>
-          <div className="mt-5 space-y-3">
-            {insurancePolicies.map((policy) => (
-              <div key={policy.id} className="flex items-center justify-between rounded-2xl border border-slate-200 px-4 py-3 text-sm">
-                <div>
-                  <p className="font-medium text-slate-900">{policy.name}</p>
-                  <p className="text-slate-500">{policy.type} · {policy.chargeType} · {policy.chargeValue}</p>
-                </div>
-                <button onClick={() => toggleInsurance(policy)} className={policy.isActive ? 'badge-green' : 'badge-gray'}>
-                  {policy.isActive ? copy.active : copy.inactive}
-                </button>
-              </div>
-            ))}
-            {insurancePolicies.length === 0 && <div className="text-sm text-slate-400">{copy.noInsurance}</div>}
-          </div>
+              {activeSection === 'rental-policies' && contractSettings && (
+                <SectionCard onSave={saveContractSettings} saving={saving} copy={copy}>
+                  <div className="grid gap-4 lg:grid-cols-2">
+                    <Select label={copy.labels.fuelPolicyType} value={contractSettings.fuelPolicyType} disabled={!canEdit('settings.rental_policies_basic')} options={['FULL_TO_FULL', 'FULL_TO_EMPTY', 'SAME_TO_SAME', 'PREPAID', 'FREE']} onChange={(v) => setContractSettings({ ...contractSettings, fuelPolicyType: v })} />
+                    <Select label={copy.labels.additionalDriverCharge} value={contractSettings.additionalDriverCharge} disabled={!canEdit('settings.additional_driver_fees')} options={['FREE', 'PER_DAY', 'FLAT']} onChange={(v) => setContractSettings({ ...contractSettings, additionalDriverCharge: v as ContractSettings['additionalDriverCharge'] })} />
+                    {contractSettings.additionalDriverCharge === 'PER_DAY' && <Input label={copy.labels.dailyRate} type="number" value={contractSettings.additionalDriverDailyRate} disabled={!canEdit('settings.additional_driver_fees')} onChange={(v) => setContractSettings({ ...contractSettings, additionalDriverDailyRate: Math.max(0, Number(v)) })} />}
+                    {contractSettings.additionalDriverCharge === 'FLAT' && <Input label={copy.labels.flatRate} type="number" value={contractSettings.additionalDriverFlatRate} disabled={!canEdit('settings.additional_driver_fees')} onChange={(v) => setContractSettings({ ...contractSettings, additionalDriverFlatRate: Math.max(0, Number(v)) })} />}
+                    <Textarea label={copy.labels.fuelPolicyNote} value={contractSettings.fuelPolicyNote ?? ''} disabled={!canEdit('settings.rental_policies_basic')} onChange={(v) => setContractSettings({ ...contractSettings, fuelPolicyNote: v })} />
+                    <Textarea label={copy.labels.damagePolicy} value={contractSettings.damagePolicy ?? ''} disabled={!canEdit('settings.rental_policies_basic')} onChange={(v) => setContractSettings({ ...contractSettings, damagePolicy: v })} />
+                  </div>
+                  {!isAvailable('settings.additional_driver_fees') && <UpgradePanel title={copy.additionalDriver} />}
+                </SectionCard>
+              )}
 
-          <div className="mt-5 grid gap-3 sm:grid-cols-2">
-            <input className="input-field" placeholder={copy.policyName} value={newInsurance.name} onChange={(event) => setNewInsurance((current) => ({ ...current, name: event.target.value }))} />
-            <select className="input-field" value={newInsurance.type} onChange={(event) => setNewInsurance((current) => ({ ...current, type: event.target.value }))}>
-              {['BASIC', 'FULL', 'CDW', 'SCDW', 'THEFT', 'THIRD_PARTY', 'ROADSIDE', 'PERSONAL', 'CUSTOM'].map((option) => <option key={option} value={option}>{option}</option>)}
-            </select>
-            <select className="input-field" value={newInsurance.chargeType} onChange={(event) => setNewInsurance((current) => ({ ...current, chargeType: event.target.value }))}>
-              {['PER_DAY', 'PER_RENTAL', 'PERCENTAGE_OF_RENTAL'].map((option) => <option key={option} value={option}>{option}</option>)}
-            </select>
-            <input type="number" className="input-field" placeholder={copy.chargeValue} value={newInsurance.chargeValue} onChange={(event) => setNewInsurance((current) => ({ ...current, chargeValue: Number(event.target.value) }))} />
-          </div>
-          <div className="mt-3 flex items-center gap-4 text-sm">
-            <label className="flex items-center gap-2"><input type="checkbox" checked={newInsurance.isRequired} onChange={(event) => setNewInsurance((current) => ({ ...current, isRequired: event.target.checked }))} /> {copy.required}</label>
-            <button onClick={createInsurance} disabled={saving} className="btn-primary">{saving ? copy.save : copy.addPolicy}</button>
-          </div>
-        </div>
+              {activeSection === 'insurance' && <ListSection items={insurancePolicies} empty={copy.noItems} copy={copy} render={(policy) => `${policy.type} / ${policy.chargeType} / ${policy.chargeValue}`} formTitle={copy.insuranceNew} disabled={!canEdit('settings.insurance_policies')} fields={<>
+                <input className="input-field" placeholder="Name" value={newInsurance.name} onChange={(e) => setNewInsurance({ ...newInsurance, name: e.target.value })} />
+                <input className="input-field" placeholder="Charge value" type="number" value={newInsurance.chargeValue} onChange={(e) => setNewInsurance({ ...newInsurance, chargeValue: Math.max(0, Number(e.target.value)) })} />
+              </>} onCreate={createInsurance} />}
 
-        <div className="card p-6">
-          <h3 className="text-base font-semibold text-slate-900">{copy.pricingRules}</h3>
-          <div className="mt-5 space-y-3">
-            {pricingRules.map((rule) => (
-              <div key={rule.id} className="flex items-center justify-between rounded-2xl border border-slate-200 px-4 py-3 text-sm">
-                <div>
-                  <p className="font-medium text-slate-900">{rule.name}</p>
-                  <p className="text-slate-500">{rule.type} · {rule.condition} {rule.conditionValue} · {rule.adjustmentType} {rule.adjustmentValue}</p>
-                </div>
-                <button onClick={() => toggleRule(rule)} className={rule.isActive ? 'badge-green' : 'badge-gray'}>
-                  {rule.isActive ? copy.active : copy.inactive}
-                </button>
-              </div>
-            ))}
-            {pricingRules.length === 0 && <div className="text-sm text-slate-400">{copy.noRules}</div>}
-          </div>
+              {activeSection === 'pricing' && <ListSection items={pricingRules} empty={copy.noItems} copy={copy} render={(rule) => `${rule.type} when ${rule.condition} ${rule.conditionValue}: ${rule.adjustmentType} ${rule.adjustmentValue}`} formTitle={copy.pricingNew} disabled={!canEdit('settings.pricing_rules')} fields={<>
+                <input className="input-field" placeholder="Name" value={newRule.name} onChange={(e) => setNewRule({ ...newRule, name: e.target.value })} />
+                <input className="input-field" placeholder="Adjustment" type="number" value={newRule.adjustmentValue} onChange={(e) => setNewRule({ ...newRule, adjustmentValue: Math.max(0, Number(e.target.value)) })} />
+              </>} onCreate={createRule} />}
 
-          <div className="mt-5 grid gap-3 sm:grid-cols-2">
-            <input className="input-field" placeholder={copy.ruleName} value={newRule.name} onChange={(event) => setNewRule((current) => ({ ...current, name: event.target.value }))} />
-            <select className="input-field" value={newRule.type} onChange={(event) => setNewRule((current) => ({ ...current, type: event.target.value }))}>
-              {['SURCHARGE', 'DISCOUNT'].map((option) => <option key={option} value={option}>{option}</option>)}
-            </select>
-            <select className="input-field" value={newRule.condition} onChange={(event) => setNewRule((current) => ({ ...current, condition: event.target.value }))}>
-              {['AGE_LESS_THAN', 'AGE_GREATER_THAN', 'LICENSE_YEARS_LESS_THAN', 'LICENSE_YEARS_GREATER_THAN'].map((option) => <option key={option} value={option}>{option}</option>)}
-            </select>
-            <input type="number" className="input-field" value={newRule.conditionValue} onChange={(event) => setNewRule((current) => ({ ...current, conditionValue: Number(event.target.value) }))} />
-            <select className="input-field" value={newRule.adjustmentType} onChange={(event) => setNewRule((current) => ({ ...current, adjustmentType: event.target.value }))}>
-              {['PERCENTAGE', 'FLAT_PER_DAY', 'FLAT_TOTAL'].map((option) => <option key={option} value={option}>{option}</option>)}
-            </select>
-            <input type="number" className="input-field" value={newRule.adjustmentValue} onChange={(event) => setNewRule((current) => ({ ...current, adjustmentValue: Number(event.target.value) }))} />
-          </div>
-          <div className="mt-3">
-            <button onClick={createRule} disabled={saving} className="btn-primary">{saving ? copy.save : copy.addRule}</button>
-          </div>
-        </div>
+              {activeSection === 'accounting' && accountingSettings && (
+                <SectionCard onSave={saveAccountingSettings} saving={saving} copy={copy} disabled={!canEdit('settings.accounting_defaults')}>
+                  <div className="grid gap-4 lg:grid-cols-2">
+                    <Select label={copy.labels.reportingPeriod} value={accountingSettings.reportingPeriod} disabled={!canEdit('settings.accounting_defaults')} options={['WEEKLY', 'MONTHLY', 'QUARTERLY', 'ANNUAL']} onChange={(v) => setAccountingSettings({ ...accountingSettings, reportingPeriod: v })} />
+                    <Select label={copy.labels.reportFormat} value={accountingSettings.reportFormat} disabled={!canEdit('settings.accounting_defaults')} options={canEdit('settings.accounting_advanced_formats') ? ['CSV', 'PDF', 'BOTH'] : ['CSV', 'PDF']} onChange={(v) => setAccountingSettings({ ...accountingSettings, reportFormat: v })} />
+                    <Input label={copy.labels.accountantName} value={accountingSettings.accountantName ?? ''} disabled={!canEdit('settings.accounting_defaults')} onChange={(v) => setAccountingSettings({ ...accountingSettings, accountantName: v })} />
+                    <Input label={copy.labels.accountantEmail} type="email" value={accountingSettings.accountantEmail ?? ''} disabled={!canEdit('settings.accounting_defaults')} onChange={(v) => setAccountingSettings({ ...accountingSettings, accountantEmail: v })} />
+                  </div>
+                  <label className="mt-4 flex items-center gap-2 text-sm font-medium text-slate-700">
+                    <input type="checkbox" checked={accountingSettings.autoSendReport} disabled={!canEdit('settings.accounting_scheduled_delivery')} onChange={(e) => setAccountingSettings({ ...accountingSettings, autoSendReport: e.target.checked })} />
+                    {copy.labels.autoSend}
+                  </label>
+                  {!isAvailable('settings.accounting_scheduled_delivery') && <UpgradePanel title={copy.accountingSchedule} />}
+                </SectionCard>
+              )}
+            </>
+          )}
+        </main>
       </div>
-
-      {accountingSettings && (
-        <div className="card p-6">
-          <div className="flex items-center justify-between">
-            <h3 className="text-base font-semibold text-slate-900">{copy.accounting}</h3>
-            <button onClick={saveAccountingSettings} disabled={saving} className="btn-primary">
-              {saving ? copy.save : copy.saveAccounting}
-            </button>
-          </div>
-          <div className="mt-5 grid gap-4 lg:grid-cols-2">
-            <div>
-              <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.reportingPeriod}</label>
-              <select className="input-field" value={accountingSettings.reportingPeriod} onChange={(event) => setAccountingSettings((current) => current ? { ...current, reportingPeriod: event.target.value } : current)}>
-                {['WEEKLY', 'MONTHLY', 'QUARTERLY', 'ANNUAL'].map((option) => <option key={option} value={option}>{copy.reportingPeriodLabels[option] ?? option}</option>)}
-              </select>
-            </div>
-            <div>
-              <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.reportFormat}</label>
-              <select className="input-field" value={accountingSettings.reportFormat} onChange={(event) => setAccountingSettings((current) => current ? { ...current, reportFormat: event.target.value } : current)}>
-                {['CSV', 'PDF', 'BOTH'].map((option) => <option key={option} value={option}>{copy.reportFormatLabels[option] ?? option}</option>)}
-              </select>
-            </div>
-            <div>
-              <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.accountantName}</label>
-              <input className="input-field" value={accountingSettings.accountantName ?? ''} onChange={(event) => setAccountingSettings((current) => current ? { ...current, accountantName: event.target.value } : current)} />
-            </div>
-            <div>
-              <label className="mb-1.5 block text-sm font-medium text-slate-700">{copy.accountantEmail}</label>
-              <input className="input-field" value={accountingSettings.accountantEmail ?? ''} onChange={(event) => setAccountingSettings((current) => current ? { ...current, accountantEmail: event.target.value } : current)} />
-            </div>
-          </div>
-          <label className="mt-4 flex items-center gap-2 text-sm font-medium text-slate-700">
-            <input type="checkbox" checked={accountingSettings.autoSendReport} onChange={(event) => setAccountingSettings((current) => current ? { ...current, autoSendReport: event.target.checked } : current)} />
-            {copy.autoSend}
-          </label>
-        </div>
-      )}
     </div>
   )
 }
+
+function Label({ text }: { text: string }) {
+  return <label className="mb-1.5 block text-sm font-medium text-slate-700">{text}</label>
+}
+
+function Input({ label, value, onChange, disabled, type = 'text' }: { label: string; value: string | number; onChange: (value: string) => void; disabled?: boolean; type?: string }) {
+  return <div><Label text={label} /><input className="input-field" type={type} value={value} disabled={disabled} onChange={(event) => onChange(event.target.value)} /></div>
+}
+
+function Textarea({ label, value, onChange, disabled }: { label: string; value: string; onChange: (value: string) => void; disabled?: boolean }) {
+  return <div className="lg:col-span-2"><Label text={label} /><textarea className="input-field min-h-24" value={value} disabled={disabled} onChange={(event) => onChange(event.target.value)} /></div>
+}
+
+function Select({ label, value, onChange, disabled, options }: { label: string; value: string; onChange: (value: string) => void; disabled?: boolean; options: string[] }) {
+  return <div><Label text={label} /><select className="input-field" value={value} disabled={disabled} onChange={(event) => onChange(event.target.value)}>{options.map((option) => <option key={option} value={option}>{option}</option>)}</select></div>
+}
+
+function SectionCard({ children, onSave, saving, copy, disabled = false }: { children: ReactNode; onSave: () => void; saving: boolean; copy: any; disabled?: boolean }) {
+  return <div className="card p-6"><div>{children}</div><div className="mt-6 flex justify-end"><button type="button" onClick={onSave} disabled={saving || disabled} className="btn-primary">{saving ? copy.save : copy.saveSection}</button></div></div>
+}
+
+function AssetField({ label, value, disabled, uploading, copy, onChange }: { label: string; value?: string | null; disabled?: boolean; uploading: boolean; copy: any; onChange: (file: File | null) => void }) {
+  return <label className="block"><Label text={label} />{value && <img src={value} alt="" className="mb-3 h-24 w-full rounded-md object-cover" />}<input type="file" accept="image/*" disabled={disabled} className="input-field" onChange={(event) => onChange(event.target.files?.[0] ?? null)} /><p className="mt-2 text-xs text-slate-500">{uploading ? copy.save : copy.upload}</p></label>
+}
+
+function UpgradePanel({ title }: { title: string }) {
+  return <div className="mt-5 rounded-lg border border-slate-200 bg-slate-50 p-4 text-sm text-slate-600"><Lock className="mb-2 h-4 w-4" />{title}</div>
+}
+
+function LockedState({ copy, item, currentPlan }: { copy: any; item: MenuItem; currentPlan: string }) {
+  return <div className="card p-8 text-center"><Lock className="mx-auto h-8 w-8 text-slate-400" /><h4 className="mt-4 text-base font-semibold text-slate-900">{copy.lockedTitle}</h4><p className="mx-auto mt-2 max-w-lg text-sm text-slate-500">{copy.lockedBody}</p><p className="mt-4 text-sm text-slate-600">{copy.currentPlan}: {currentPlan} · {copy.requiredPlan}: {item.requiredPlan}</p><a href="/subscription" className="btn-primary mt-5 inline-flex">{copy.manageSubscription}</a></div>
+}
+
+function ListSection<T extends { id: string; name: string; isActive: boolean }>({ items, empty, copy, render, formTitle, disabled, fields, onCreate }: { items: T[]; empty: string; copy: any; render: (item: T) => string; formTitle: string; disabled?: boolean; fields: ReactNode; onCreate: () => void }) {
+  return <div className="card p-6"><div className="space-y-3">{items.map((item) => <div key={item.id} className="flex items-center justify-between rounded-lg border border-slate-200 px-4 py-3 text-sm"><div><p className="font-medium text-slate-900">{item.name}</p><p className="text-slate-500">{render(item)}</p></div><span className={item.isActive ? 'badge-green' : 'badge-gray'}>{item.isActive ? copy.active : copy.inactive}</span></div>)}{items.length === 0 && <p className="text-sm text-slate-500">{empty}</p>}</div><div className="mt-6 border-t border-slate-100 pt-5"><h4 className="mb-3 text-sm font-semibold text-slate-900">{formTitle}</h4><div className="grid gap-3 sm:grid-cols-2">{fields}</div><button type="button" disabled={disabled} onClick={onCreate} className="btn-primary mt-4">{copy.saveSection}</button></div></div>
+}
+
+export default function SettingsPage() {
+  return (
+    <Suspense fallback={<div className="card p-6 text-sm text-slate-500">Loading settings...</div>}>
+      <SettingsPageContent />
+    </Suspense>
+  )
+}
diff --git a/apps/homepage/src/lib/localization/config.ts b/apps/homepage/src/lib/localization/config.ts
index 8ff4d2b..d74650d 100644
--- a/apps/homepage/src/lib/localization/config.ts
+++ b/apps/homepage/src/lib/localization/config.ts
@@ -116,6 +116,20 @@ export function routeIdFromSlug(locale: Locale, slug: string): RouteId | null {
   return route?.id ?? null;
 }
 
+export function routeIdFromAnyLocaleSlug(slug: string): RouteId | null {
+  let decoded: string;
+  try {
+    decoded = decodeURIComponent(slug);
+  } catch {
+    return null;
+  }
+  const normalized = decoded.replace(/^\/+|\/+$/g, '');
+  const route = routeManifest.routes.find((item) =>
+    locales.some((locale) => item.slugs[locale] === normalized),
+  );
+  return route?.id ?? null;
+}
+
 export function routeIdFromPathname(pathname: string): RouteId | null {
   const [localeValue, ...segments] = pathname.split('/').filter(Boolean);
   if (!isLocale(localeValue)) return null;
diff --git a/apps/homepage/src/proxy.ts b/apps/homepage/src/proxy.ts
index 7135a81..d3ed9b8 100644
--- a/apps/homepage/src/proxy.ts
+++ b/apps/homepage/src/proxy.ts
@@ -4,11 +4,16 @@ import {
   localeCookie,
   localeCookieMaxAgeSeconds,
   localeFromAcceptLanguage,
+  localizedPath,
+  routeIdFromAnyLocaleSlug,
+  routeIdFromSlug,
 } from '@/lib/localization/config';
 import { buildContentSecurityPolicy, createNonce } from '@/lib/security/csp';
 import type { NextRequest } from 'next/server';
 import { NextResponse } from 'next/server';
 
+const dashboardLanguageCookie = 'rentaldrivego-language';
+
 function applySecurityHeaders(response: NextResponse, contentSecurityPolicy: string): NextResponse {
   response.headers.set('Content-Security-Policy', contentSecurityPolicy);
   response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
@@ -73,6 +78,40 @@ export function proxy(request: NextRequest): NextResponse {
     return applySecurityHeaders(NextResponse.redirect(destination), csp);
   }
 
+  if (isLocale(firstSegment) && request.nextUrl.pathname === `/${firstSegment}/subscription`) {
+    const destination = request.nextUrl.clone();
+    destination.pathname = '/dashboard/subscription';
+    const response = NextResponse.redirect(destination);
+    response.cookies.set(localeCookie, firstSegment, {
+      path: '/',
+      sameSite: 'lax',
+      maxAge: localeCookieMaxAgeSeconds,
+      secure: process.env.NODE_ENV === 'production',
+      httpOnly: false,
+    });
+    response.cookies.set(dashboardLanguageCookie, firstSegment, {
+      path: '/',
+      sameSite: 'lax',
+      maxAge: localeCookieMaxAgeSeconds,
+      secure: process.env.NODE_ENV === 'production',
+      httpOnly: false,
+    });
+    return applySecurityHeaders(response, csp);
+  }
+
+  if (isLocale(firstSegment)) {
+    const segments = request.nextUrl.pathname.split('/').filter(Boolean);
+    const slug = segments.slice(1).join('/');
+    if (slug && !routeIdFromSlug(firstSegment, slug)) {
+      const routeId = routeIdFromAnyLocaleSlug(slug);
+      if (routeId) {
+        const destination = request.nextUrl.clone();
+        destination.pathname = localizedPath(routeId, firstSegment);
+        return applySecurityHeaders(NextResponse.redirect(destination), csp);
+      }
+    }
+  }
+
   const response = NextResponse.next({ request: { headers: requestHeaders } });
   const explicitLocale = request.nextUrl.pathname.split('/')[1];
   if (isLocale(explicitLocale)) {
diff --git a/apps/homepage/tests/unit/localization.test.ts b/apps/homepage/tests/unit/localization.test.ts
index c5d3b8f..537491d 100644
--- a/apps/homepage/tests/unit/localization.test.ts
+++ b/apps/homepage/tests/unit/localization.test.ts
@@ -6,6 +6,7 @@ import {
   localeSwitchUrl,
   localizedPath,
   routeById,
+  routeIdFromAnyLocaleSlug,
   routeIdFromPathname,
   routeIdFromSlug,
 } from '@/lib/localization/config';
@@ -30,6 +31,10 @@ describe('localization foundations', () => {
     expect(localizedPath('privacy', 'fr')).toBe('/fr/confidentialite');
     expect(localizedPath('sign-in', 'ar')).toBe('/ar/تسجيل-الدخول');
     expect(routeIdFromSlug('fr', 'confidentialite')).toBe('privacy');
+    expect(routeIdFromSlug('fr', 'privacy')).toBeNull();
+    expect(routeIdFromAnyLocaleSlug('privacy')).toBe('privacy');
+    expect(routeIdFromAnyLocaleSlug('confidentialite')).toBe('privacy');
+    expect(routeIdFromAnyLocaleSlug('unknown')).toBeNull();
     expect(routeIdFromPathname('/ar/%D8%A7%D9%84%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9')).toBe(
       'privacy',
     );
diff --git a/docs/RentalDriveGo_Customer_Billing_Review_and_Fix_Plan_v1.md b/docs/RentalDriveGo_Customer_Billing_Review_and_Fix_Plan_v1.md
new file mode 100644
index 0000000..fa0afb9
--- /dev/null
+++ b/docs/RentalDriveGo_Customer_Billing_Review_and_Fix_Plan_v1.md
@@ -0,0 +1,1152 @@
+# RentalDriveGo Customer Billing Review and Remediation Plan
+
+## Document Status
+
+- **Purpose:** Review and implementation plan only
+- **Code changes performed:** None
+- **Primary route:** `/dashboard/billing`
+- **Primary file reviewed:** `src/app/(dashboard)/billing/page.tsx`
+- **Related areas reviewed:** dashboard navigation, route access, team-role descriptions, reservation payment fields, contract invoice payloads, API client, and existing test coverage
+- **Explicitly out of scope:** SaaS plan billing at `/dashboard/subscription`
+- **Backend limitation:** The uploaded package contains the Dashboard application but not the API and database source. Backend findings below that require confirmation are marked as verification tasks.
+
+---
+
+## 1. Objective
+
+Correct the customer billing feature so that it is financially accurate, secure, permission-aware, scalable, understandable, and usable in English, French, and Arabic.
+
+The work must prioritize:
+
+1. Financial correctness
+2. Data integrity
+3. Access control
+4. Reliable API contracts
+5. Clear billing workflows
+6. Responsive and accessible UI
+7. Automated regression coverage
+
+Visual redesign must not begin by hiding incorrect accounting behind more attractive cards. The financial model must be settled first.
+
+---
+
+## 2. Scope Definition
+
+This plan covers rental-company billing involving:
+
+- Customer invoices
+- Rental charges
+- Security deposits
+- Payments received
+- Outstanding balances
+- Payment history
+- Manual/offline payment recording
+- Invoice and payment status
+- Links to reservations and contracts
+- Billing summaries, filtering, pagination, and export
+- Menu, plan, and employee-role access
+
+This plan does not cover:
+
+- RentalDriveGo SaaS subscription checkout
+- Subscription invoices
+- Subscription renewal or cancellation
+- Payment-provider credential setup
+- Full accounting integrations
+- General ledger accounting
+- Tax filing
+- Chargeback automation
+- Bank reconciliation
+
+---
+
+## 3. Current Implementation Summary
+
+The current billing page:
+
+- Loads up to 100 reservations from `GET /reservations?pageSize=100`.
+- Loads company payments from `GET /payments/company`.
+- Joins reservations and payments in the browser.
+- Calculates balance due as `totalAmount - paidAmount`.
+- Shows four metrics:
+  - Total billed
+  - Collected
+  - Outstanding
+  - Open invoices
+- Shows one wide table with 11 columns.
+- Displays only the latest payment for each reservation.
+- Allows manual payment recording through:
+  - `POST /payments/reservations/:id/manual`
+- Allows payment types:
+  - `CHARGE`
+  - `DEPOSIT`
+- Uses a hard-coded `MAD` currency.
+- Provides English, French, and Arabic copy inside the page component.
+- Has no billing-specific automated tests.
+
+The page is approximately 644 lines and combines data fetching, financial calculations, translation data, filtering, modal state, payment submission, and presentation.
+
+---
+
+## 4. Confirmed Problems
+
+## 4.1 Critical: Deposit payments use the rental balance
+
+Current behavior:
+
+- The page enables payment only when `balanceDue > 0`.
+- The modal defaults the amount to the rental balance.
+- Both `CHARGE` and `DEPOSIT` are validated against the same rental balance.
+- A deposit option is shown only because the reservation has a nonzero required deposit.
+
+Consequences:
+
+- A security deposit cannot be collected when the rental invoice is fully paid.
+- A deposit amount may be limited by the wrong balance.
+- The UI does not know how much deposit has already been collected or refunded.
+- Rental revenue and refundable security money are treated as though they are the same liability.
+
+Required correction:
+
+Maintain separate authoritative amounts:
+
+```text
+Invoice
+- invoiceTotal
+- invoicePaid
+- invoiceRefunded
+- invoiceBalanceDue
+
+Security deposit
+- depositRequired
+- depositCollected
+- depositRefunded
+- depositHeld
+- depositOutstanding
+```
+
+`CHARGE` must be validated against `invoiceBalanceDue`.
+
+`DEPOSIT` must be validated against `depositOutstanding`.
+
+A customer with a paid invoice but an outstanding deposit must still be able to provide the deposit.
+
+---
+
+## 4.2 Critical: Financial truth is calculated in the browser
+
+The page combines two broad API responses and derives billing rows locally.
+
+Problems:
+
+- The reservation query is capped at 100 records.
+- Search, totals, and open-invoice counts only represent the loaded subset.
+- Payment and reservation responses may be generated at different moments.
+- The page assumes that `paidAmount` and payment events use compatible rules.
+- There is no server-generated billing snapshot.
+- Browser calculations can disagree with contracts, reports, or backend invoice logic.
+
+Required correction:
+
+Create a billing-specific API contract that returns authoritative invoice and deposit values from one consistent source.
+
+The browser may format and display totals. It must not invent financial truth by reconstructing it from unrelated collections.
+
+---
+
+## 4.3 Critical: Currency is hard-coded to MAD
+
+Observed behavior:
+
+- Metric totals use `MAD`.
+- Reservation totals use `MAD`.
+- Deposits use `MAD`.
+- Manual payments always submit `MAD`.
+- Payment rows technically contain a currency, but reservation rows do not.
+
+Risks:
+
+- Incorrect display when company or invoice currency differs.
+- Invalid manual payment submission.
+- Nonsensical totals if invoices can contain multiple currencies.
+- Currency is silently assumed rather than explicitly enforced.
+
+Required correction:
+
+- Add invoice currency to the billing response.
+- Use the invoice currency for manual payments.
+- If each company is restricted to one currency, enforce that rule in the API and database.
+- If multiple currencies are permitted, group summary metrics by currency and prohibit cross-currency payment application.
+- Use integer minor units consistently.
+
+---
+
+## 4.4 High: Billing role behavior is contradictory
+
+Observed behavior:
+
+- Billing is included in the Sidebar fallback for `MANAGER`.
+- Team role descriptions state that Manager has “Full ops — no billing.”
+- The route guard relies on the generated employee menu.
+- The route guard fails open during some transient menu-load failures.
+- The API source was not included, so endpoint-level role enforcement cannot yet be verified.
+
+Required correction:
+
+Freeze and document a billing permission matrix before implementation.
+
+Recommended default:
+
+| Capability | OWNER | MANAGER | AGENT |
+|---|:---:|:---:|:---:|
+| View billing summaries | Yes | No | No |
+| View invoice/payment details | Yes | No | No |
+| Record manual payment | Yes | No | No |
+| Refund or void payment | Yes | No | No |
+| Export billing data | Yes | No | No |
+
+The platform Admin may assign the Billing menu to plans, but a visible menu item must not override role permissions.
+
+If the intended product policy is that Managers may collect payments, update the role descriptions and create a granular `billing.record_payment` permission. Do not leave the current contradiction unresolved.
+
+---
+
+## 4.5 High: Admin menu control is not enough to secure billing
+
+The platform Admin controls whether Billing appears for a subscription plan. This is navigation policy, not authorization.
+
+Required checks:
+
+```text
+billing.view
+billing.record_manual_payment
+billing.refund
+billing.export
+billing.manage_adjustments
+```
+
+Effective access must require:
+
+```text
+Menu item globally enabled
+AND assigned to active subscription plan
+AND subscription status allows access
+AND employee role permits action
+AND company override does not disable it
+AND API endpoint authorizes the action
+```
+
+The Dashboard must render the Admin-resolved menu. Every billing API endpoint must independently enforce permissions.
+
+---
+
+## 4.6 High: Manual payment submission needs stronger integrity controls
+
+The current form submits:
+
+- Amount
+- Type
+- Currency
+- Payment method
+
+Missing operational fields:
+
+- Received date and time
+- External reference or check number
+- Internal note
+- Recorded-by employee
+- Idempotency key
+- Optional evidence attachment
+- Confirmation summary
+
+Risks:
+
+- Duplicate payment from retries
+- No audit trail for cash, checks, or bank transfers
+- No way to reconcile an offline payment
+- Weak investigation path when a payment is disputed
+
+Required correction:
+
+Manual payment creation must be idempotent and audited.
+
+Recommended payload:
+
+```json
+{
+  "amountMinor": 125000,
+  "currency": "MAD",
+  "type": "CHARGE",
+  "method": "BANK_TRANSFER",
+  "receivedAt": "2026-06-29T18:00:00Z",
+  "reference": "BANK-2026-00481",
+  "note": "Received before vehicle return",
+  "idempotencyKey": "client-generated-uuid"
+}
+```
+
+The API must calculate the permitted maximum again. Client validation is only convenience.
+
+---
+
+## 4.7 High: Payment-provider and payment-method concepts are mixed
+
+The local payment type only permits:
+
+- `AMANPAY`
+- `PAYPAL`
+
+The page also records manual methods:
+
+- Cash
+- Check
+- Bank transfer
+- Card
+- PayPal
+
+A manual cash payment is not an AmanPay or PayPal provider payment. The current type definition is likely incomplete or misleading.
+
+Required correction:
+
+Separate:
+
+```text
+paymentChannel
+- ONLINE
+- OFFLINE
+- TERMINAL
+
+provider
+- AMANPAY
+- PAYPAL
+- MANUAL
+- EXTERNAL_TERMINAL
+- null
+
+method
+- CASH
+- CHECK
+- BANK_TRANSFER
+- CARD
+- PAYPAL
+- OTHER
+```
+
+Use shared API types instead of local string unions.
+
+---
+
+## 4.8 High: Pagination and filtering are not production-safe
+
+Current behavior:
+
+- Only 100 reservations are loaded.
+- Search is client-side.
+- Metrics are recomputed from filtered visible rows.
+- There are no date, status, method, or balance filters.
+- There is no pagination control.
+
+Consequences:
+
+- Companies with more than 100 reservations see incomplete financial totals.
+- A search may falsely report no invoice because it is outside the loaded subset.
+- Metric meaning changes silently when search text is entered.
+- Large payment histories will become slow.
+
+Required correction:
+
+Use server-side:
+
+- Pagination
+- Search
+- Date range
+- Invoice status filter
+- Payment status filter
+- Payment method filter
+- Outstanding-only filter
+- Currency filter when required
+- Sorting
+
+Keep company-wide summary metrics separate from filtered-results metrics and label them explicitly.
+
+---
+
+## 4.9 Medium: The page shows only the latest payment
+
+The current table displays a latest-payment snapshot and a count.
+
+Missing:
+
+- Full payment ledger
+- Refund history
+- Payment references
+- Who recorded the payment
+- Notes
+- Deposit history
+- Receipt access
+- Failed-attempt details
+- Event timestamps
+
+Required correction:
+
+Use a billing list plus an invoice detail drawer or page.
+
+The detail view must show:
+
+1. Invoice summary
+2. Security deposit summary
+3. Charges and adjustments
+4. Complete payment timeline
+5. Refunds
+6. Audit information
+7. Reservation and contract links
+
+---
+
+## 4.10 Medium: Failure and refresh behavior is fragile
+
+Current behavior:
+
+- `Promise.all` fails the entire screen if either request fails.
+- The initial error is not clearly cleared before later reloads.
+- Manual-payment refresh does not show a dedicated refreshing state.
+- There is no retry button.
+- There is no empty-state distinction between:
+  - No invoices
+  - No search results
+  - Access denied
+  - API failure
+
+Required correction:
+
+- Use one billing API response where possible.
+- Add retry behavior.
+- Preserve the current filters on retry.
+- Show mutation success and failure separately from page-load errors.
+- Keep the modal open if refresh fails after payment creation, but indicate whether payment creation succeeded.
+- Prevent accidental resubmission after an uncertain network outcome by using idempotency.
+
+---
+
+## 4.11 Medium: Responsive and Arabic layouts are weak
+
+The page uses an 11-column table with horizontal scrolling.
+
+Problems:
+
+- Poor mobile usability
+- Important action is far to the right
+- Physical `text-left`, `text-right`, and `items-end` classes do not fully adapt to RTL
+- Dense payment content is difficult to scan
+- Currency values and Latin identifiers need controlled bidirectional rendering
+
+Required correction:
+
+Desktop:
+
+- Use a narrower invoice list.
+- Move payment history and secondary details into a drawer.
+- Keep key columns:
+  - Invoice/customer
+  - Rental period
+  - Invoice amount
+  - Paid
+  - Balance
+  - Status
+  - Action
+
+Mobile:
+
+- Use invoice cards.
+- Show the primary action without horizontal scrolling.
+- Open details as a full-screen sheet.
+
+Arabic:
+
+- Use logical alignment.
+- Use `dir="ltr"` for invoice numbers, references, email addresses, and currency-number groups where necessary.
+- Test modal, drawer, table, cards, and pagination in true RTL.
+
+---
+
+## 4.12 Medium: Accessibility is incomplete
+
+The manual-payment modal currently lacks a complete dialog implementation.
+
+Required correction:
+
+- Add `role="dialog"`.
+- Add `aria-modal="true"`.
+- Connect title and description IDs.
+- Trap keyboard focus.
+- Close on Escape unless submission is active.
+- Return focus to the triggering button.
+- Add an accessible label to the close button.
+- Associate every label with an input ID.
+- Announce errors and success states.
+- Move focus to the first invalid field.
+- Ensure status is not communicated by color alone.
+
+---
+
+## 4.13 Medium: Translation architecture is not maintainable
+
+The page contains a large inline three-language dictionary.
+
+Problems:
+
+- Page size and cognitive load
+- Repeated status maps
+- Raw-enum fallback may leak untranslated values
+- Count strings do not use proper plural rules
+- Payment and invoice terminology may diverge from contract pages
+
+Required correction:
+
+- Move billing copy into the shared localization architecture.
+- Centralize payment status, method, channel, and invoice-status translations.
+- Use `Intl.PluralRules` or ICU-style messages.
+- Keep immutable enum keys independent from translated labels.
+- Reuse terminology across Billing, Contracts, Reservations, and Reports.
+
+---
+
+## 4.14 Medium: The feature has no focused test coverage
+
+No billing-specific test file was found.
+
+Required correction:
+
+Add tests for:
+
+- Money calculations
+- Deposit and charge separation
+- Currency rules
+- Permission rules
+- Pagination and filters
+- Manual payment validation
+- Idempotent retries
+- Refund effects
+- Status derivation
+- RTL rendering
+- Modal accessibility
+- Admin menu visibility
+- API authorization
+
+---
+
+## 5. Target Billing Model
+
+## 5.1 Invoice model
+
+Each invoice response should include:
+
+```text
+id
+reservationId
+invoiceNumber
+contractNumber
+customer
+vehicle
+rentalPeriod
+currency
+status
+paymentStatus
+issuedAt
+dueAt
+subtotal
+taxTotal
+discountTotal
+adjustmentTotal
+invoiceTotal
+invoicePaid
+invoiceRefunded
+invoiceBalanceDue
+```
+
+## 5.2 Security deposit model
+
+```text
+depositRequired
+depositCollected
+depositRefunded
+depositHeld
+depositOutstanding
+depositStatus
+```
+
+Recommended deposit statuses:
+
+```text
+NOT_REQUIRED
+OUTSTANDING
+PARTIALLY_COLLECTED
+HELD
+PARTIALLY_REFUNDED
+REFUNDED
+FORFEITED
+```
+
+## 5.3 Payment event model
+
+```text
+id
+invoiceId
+reservationId
+amountMinor
+currency
+type
+channel
+provider
+method
+status
+reference
+note
+receivedAt
+paidAt
+createdAt
+recordedBy
+refundedAmount
+idempotencyKey
+```
+
+## 5.4 Money rules
+
+- Store money as integers in minor units.
+- Never use floating-point arithmetic for persisted financial values.
+- A payment currency must equal the invoice currency.
+- A charge payment cannot exceed invoice balance.
+- A deposit payment cannot exceed deposit outstanding.
+- A refund cannot exceed the refundable amount.
+- Historical payment and invoice snapshots must remain immutable after pricing changes.
+
+---
+
+## 6. Recommended API Plan
+
+## 6.1 Billing summary
+
+```http
+GET /billing/summary?dateFrom=&dateTo=&currency=
+```
+
+Returns authoritative totals:
+
+```json
+{
+  "currency": "MAD",
+  "totalInvoiced": 0,
+  "totalCollected": 0,
+  "totalRefunded": 0,
+  "totalOutstanding": 0,
+  "depositsHeld": 0,
+  "openInvoiceCount": 0,
+  "overdueInvoiceCount": 0
+}
+```
+
+For multi-currency companies, return one summary per currency.
+
+## 6.2 Billing invoices
+
+```http
+GET /billing/invoices?page=1&pageSize=25&search=&status=&paymentStatus=&dateFrom=&dateTo=&sort=
+```
+
+Returns:
+
+```json
+{
+  "items": [],
+  "page": 1,
+  "pageSize": 25,
+  "totalItems": 0,
+  "totalPages": 0
+}
+```
+
+## 6.3 Invoice details
+
+```http
+GET /billing/invoices/:invoiceId
+```
+
+Returns complete invoice, deposit, adjustments, and payment history.
+
+## 6.4 Record manual payment
+
+```http
+POST /billing/invoices/:invoiceId/payments/manual
+```
+
+Requirements:
+
+- Permission check
+- Subscription entitlement check
+- Idempotency
+- Database transaction
+- Server-side balance validation
+- Audit record
+- Authoritative updated invoice response
+
+## 6.5 Refund or deposit return
+
+Do not add this endpoint until refund behavior is approved.
+
+Possible future routes:
+
+```http
+POST /billing/payments/:paymentId/refund
+POST /billing/invoices/:invoiceId/deposit-return
+```
+
+Refunds must never be represented by deleting or editing the original payment.
+
+---
+
+## 7. Admin Menu and Subscription Behavior
+
+The platform Admin controls whether the Billing menu is assigned to each subscription plan.
+
+Admin controls:
+
+- Globally enable or disable Billing
+- Assign Billing to STARTER, GROWTH, and PRO
+- Choose hidden or locked behavior
+- Control menu order and translated description
+- Preview by plan, employee role, and subscription status
+
+Recommended safety rule:
+
+Billing history must remain accessible in read-only recovery mode even when a plan is downgraded or suspended. A subscription paywall must not trap a company’s financial records.
+
+Recommended capability split:
+
+```text
+billing.view
+billing.record_manual_payment
+billing.export
+billing.refund
+billing.adjust
+```
+
+The Admin may assign advanced capabilities by plan, but historical visibility and legally required records need a durable access policy.
+
+---
+
+## 8. Target Dashboard Experience
+
+## 8.1 Page header
+
+Include:
+
+- Customer Billing title
+- Clear distinction from Subscription Billing
+- Date range
+- Search
+- Filters
+- Export action when entitled
+- Refresh state
+
+## 8.2 Summary cards
+
+Recommended:
+
+- Total invoiced
+- Collected
+- Outstanding
+- Deposits held
+- Open invoices
+- Overdue invoices
+
+Each metric must identify:
+
+- Date range
+- Currency
+- Whether it represents all records or filtered records
+
+## 8.3 Invoice list
+
+Desktop columns:
+
+- Invoice and customer
+- Vehicle
+- Rental period
+- Invoice total
+- Collected
+- Balance
+- Deposit status
+- Payment status
+- Primary action
+
+Secondary details belong in a drawer, not eleven permanent columns.
+
+## 8.4 Invoice detail drawer
+
+Tabs or sections:
+
+- Overview
+- Charges
+- Payments
+- Deposit
+- Audit
+
+Actions depend on permission:
+
+- Record payment
+- Return deposit
+- Refund payment
+- Open contract
+- Open reservation
+- Download receipt or invoice
+- Export ledger
+
+## 8.5 Manual payment form
+
+Fields:
+
+- Payment target: Invoice charge or security deposit
+- Amount
+- Currency, read-only from invoice
+- Method
+- Received date/time
+- Reference
+- Note
+- Optional evidence
+- Confirmation summary
+
+Behavior:
+
+- Show the correct remaining amount for the selected target.
+- Recalculate the default amount when target changes.
+- Do not close on validation failure.
+- Prevent duplicate submission.
+- Display the resulting payment reference after success.
+
+---
+
+## 9. Component Architecture
+
+Recommended structure:
+
+```text
+src/app/(dashboard)/billing/
+  page.tsx
+  billing.types.ts
+  billing.constants.ts
+  billing.validation.ts
+  billing.i18n.ts
+  billing.permissions.ts
+
+  components/
+    BillingHeader.tsx
+    BillingFilters.tsx
+    BillingSummary.tsx
+    BillingInvoiceTable.tsx
+    BillingInvoiceCards.tsx
+    BillingInvoiceDrawer.tsx
+    InvoiceOverview.tsx
+    InvoiceCharges.tsx
+    InvoicePaymentLedger.tsx
+    InvoiceDepositSummary.tsx
+    InvoiceAuditTimeline.tsx
+    ManualPaymentDialog.tsx
+    BillingStatusBadge.tsx
+    BillingEmptyState.tsx
+    BillingErrorState.tsx
+    BillingPagination.tsx
+```
+
+Use shared API types where available. Do not duplicate backend enums in the page.
+
+---
+
+## 10. Implementation Phases
+
+## Phase 1: Freeze Financial Semantics
+
+Decide and document:
+
+- Whether `paidAmount` excludes deposits
+- Whether deposits are refundable liabilities
+- When an invoice is created
+- When an invoice becomes due
+- Overdue rules
+- Charge, deposit, refund, and forfeiture semantics
+- Company currency policy
+- Manager billing permissions
+- Subscription downgrade access
+- Refund approval requirements
+
+Exit criteria:
+
+- Signed-off invoice and deposit state model
+- Signed-off role and plan matrix
+- No ambiguous use of `paidAmount`
+
+## Phase 2: Audit the API and Database
+
+Inspect:
+
+- Reservation monetary fields
+- Invoice generation
+- Payment model
+- Payment status derivation
+- Deposit storage
+- Refund records
+- Manual payment endpoint
+- Transactions and locking
+- Idempotency
+- Currency constraints
+- Audit events
+- Authorization guards
+
+Exit criteria:
+
+- Gap report mapping current fields to target fields
+- Migration plan approved
+- No financial mutation occurs without a transaction
+
+## Phase 3: Add Authoritative Billing APIs
+
+Implement:
+
+- Billing summary endpoint
+- Paginated invoice endpoint
+- Invoice detail endpoint
+- Correct manual-payment endpoint
+- Permission and entitlement guards
+- Idempotency
+- Audit events
+
+Exit criteria:
+
+- Dashboard no longer joins broad reservation and payment collections
+- Totals are authoritative and paginated
+- Charge and deposit validation are separate
+
+## Phase 4: Correct Access Control
+
+Implement:
+
+- Admin-controlled Billing menu assignment
+- Explicit billing capabilities
+- Owner/Manager/Agent policy
+- Route-level denial
+- Endpoint-level denial
+- Recovery-mode access
+- Consistent fallback navigation
+
+Exit criteria:
+
+- Menu visibility, route access, and API access agree
+- A Manager cannot gain billing access because a fallback menu loaded
+- Direct API calls cannot bypass permissions
+
+## Phase 5: Refactor the Billing Dashboard
+
+Implement:
+
+- Billing page shell
+- Summary
+- Filters
+- Paginated invoice list
+- Responsive cards
+- Invoice detail drawer
+- Localized status components
+
+Exit criteria:
+
+- Page is no longer a 644-line monolith
+- No 11-column mobile table
+- Search covers the complete dataset
+
+## Phase 6: Rebuild Manual Payment Workflow
+
+Implement:
+
+- Separate charge and deposit targets
+- Correct remaining amounts
+- Received date
+- Reference
+- Notes
+- Idempotency
+- Confirmation
+- Success receipt
+- Accessible dialog
+
+Exit criteria:
+
+- Fully paid invoice can still receive an outstanding deposit
+- Payment cannot exceed its correct target balance
+- Retry cannot create duplicate payment
+
+## Phase 7: Add Ledger and Deposit History
+
+Implement:
+
+- Full payment timeline
+- Deposit timeline
+- Refund display
+- Recorded-by employee
+- References and notes
+- Immutable audit events
+
+Exit criteria:
+
+- Every displayed total can be explained by visible events
+- Historical events are not edited or deleted
+
+## Phase 8: Localization, RTL, Accessibility, and Responsive Review
+
+Implement:
+
+- Shared EN/FR/AR copy
+- Proper pluralization
+- True RTL
+- Focus management
+- Screen-reader status announcements
+- Mobile invoice cards
+- Bidirectional formatting for identifiers
+
+Exit criteria:
+
+- Complete keyboard workflow
+- No raw backend enum leakage
+- Arabic is usable without horizontal navigation gymnastics
+
+## Phase 9: Automated Tests and Reconciliation
+
+Implement:
+
+- Unit tests
+- API integration tests
+- Permission tests
+- Idempotency tests
+- Component tests
+- E2E billing scenarios
+- Data reconciliation checks
+
+Exit criteria:
+
+- All billing tests pass
+- Summary equals invoice ledger totals
+- Contract invoice, Billing page, and Reports use the same financial source
+
+---
+
+## 11. Required Test Scenarios
+
+## Financial correctness
+
+1. Unpaid invoice receives a partial charge.
+2. Partial invoice receives the remaining charge.
+3. Fully paid invoice rejects another charge.
+4. Fully paid invoice accepts an outstanding deposit.
+5. Deposit payment cannot exceed deposit outstanding.
+6. Charge payment cannot exceed invoice balance.
+7. Deposit refund does not reduce rental revenue.
+8. Charge refund increases invoice balance correctly.
+9. Failed and pending payments do not count as collected.
+10. Refunded payments do not remain fully counted as collected.
+11. Currency mismatch is rejected.
+12. Minor-unit rounding is stable.
+
+## Integrity and concurrency
+
+13. Duplicate request with the same idempotency key creates one payment.
+14. Two simultaneous attempts cannot overpay the invoice.
+15. Two simultaneous deposit collections cannot exceed required deposit.
+16. Network timeout followed by retry returns the original result.
+17. Payment and invoice update occur in one transaction.
+
+## Permissions
+
+18. Owner with entitlement can view and record.
+19. Manager is denied under the recommended default policy.
+20. Agent is denied.
+21. Hidden Billing menu does not authorize the endpoint.
+22. Direct API call without capability is rejected.
+23. Downgraded company can view historical records according to recovery policy.
+24. Suspended company cannot create new payments unless recovery policy explicitly permits it.
+
+## UI
+
+25. Search operates across all server records.
+26. Pagination preserves filters.
+27. Empty search result differs from no billing records.
+28. Modal traps focus and closes with Escape.
+29. Arabic list, drawer, and modal render in RTL.
+30. Mobile user can record a payment without horizontal scrolling.
+31. Payment success is announced and displayed.
+32. Failed refresh after a successful mutation does not invite duplicate payment.
+
+---
+
+## 12. Acceptance Criteria
+
+The billing remediation is complete when:
+
+1. Customer Billing and Subscription Billing are clearly separate.
+2. Invoice charges and security deposits use separate balances.
+3. Deposit collection works even when invoice balance is zero.
+4. All money uses integer minor units.
+5. Currency comes from the invoice or enforced company currency.
+6. Billing totals come from authoritative backend responses.
+7. The feature is not limited to the first 100 reservations.
+8. Search and filters run server-side.
+9. Billing history shows the complete payment ledger.
+10. Manual payments include audit and reconciliation fields.
+11. Manual payment requests are idempotent.
+12. Concurrent requests cannot overpay.
+13. The platform Admin controls menu-to-plan assignment.
+14. Role permissions remain independent from subscription-plan access.
+15. Menu visibility, route access, and API authorization are consistent.
+16. The Manager billing contradiction is resolved.
+17. Historical financial records remain visible under the approved retention policy.
+18. The page is responsive without relying on an 11-column mobile table.
+19. English, French, and Arabic are complete.
+20. Arabic uses true RTL.
+21. The manual-payment dialog meets accessibility requirements.
+22. Billing, Contracts, and Reports use the same financial source.
+23. No raw payment or status enum appears to end users.
+24. Automated financial, permission, API, UI, and E2E tests pass.
+25. No production billing migration occurs without reconciliation and rollback procedures.
+
+---
+
+## 13. Out of Scope for the First Remediation
+
+Unless separately approved, the first implementation should not add:
+
+- Full double-entry accounting
+- Bank-feed integration
+- Automated chargebacks
+- Partial tax remittance
+- Multi-entity consolidation
+- Customer credit wallets
+- Gift cards
+- Installment financing
+- Arbitrary invoice editing after issuance
+- Deleting successful payments
+- New online payment providers
+- SaaS subscription changes
+
+---
+
+## 14. Execution Gate
+
+No billing code changes should begin until these decisions are approved:
+
+1. Invoice-versus-deposit accounting semantics
+2. Money-unit convention
+3. Single-currency or multi-currency policy
+4. Owner, Manager, and Agent billing permissions
+5. Admin plan assignments
+6. Downgrade and suspension behavior
+7. Refund and deposit-return rules
+8. Overdue definition
+9. Invoice issuance lifecycle
+10. Audit retention requirements
+11. Migration and reconciliation approach
+12. Whether refunds are included in the first implementation
diff --git a/docs/RentalDriveGo_Settings_Admin_Menu_Subscription_Plan_v3.md b/docs/RentalDriveGo_Settings_Admin_Menu_Subscription_Plan_v3.md
new file mode 100644
index 0000000..3c173b8
--- /dev/null
+++ b/docs/RentalDriveGo_Settings_Admin_Menu_Subscription_Plan_v3.md
@@ -0,0 +1,1225 @@
+# RentalDriveGo Settings Reorganization, Admin Menu Control, and Subscription Entitlements Plan
+
+## Document Status
+
+- **Purpose:** Planning and review only
+- **Source code changes:** None
+- **Target areas:** Dashboard, API, Admin, Database, shared types, and localization
+- **Route:** `/dashboard/settings`
+- **Supported plans:** `STARTER`, `GROWTH`, `PRO`
+- **Supported languages:** English (`en`), French (`fr`), Arabic (`ar`)
+- **Removed from scope:** Domain and Publishing
+- **Menu ownership:** Platform Admin application
+- **Company-user menu control:** Not permitted
+
+---
+
+## 1. Objective
+
+Reorganize `/dashboard/settings` into focused sections while controlling individual settings capabilities through the company’s active subscription plan.
+
+The target design must:
+
+- Keep Settings available as a baseline route for every subscription plan.
+- Show one focused settings section at a time.
+- Grant or restrict individual capabilities through explicit subscription entitlements.
+- Preserve unavailable configuration during upgrades, downgrades, suspension, or cancellation.
+- Enforce the same rules in the Dashboard and API.
+- Support English, French, and Arabic, including true RTL behavior.
+- Avoid hard-coding authorization decisions in the frontend.
+- Keep company role permissions separate from subscription permissions.
+- Make the platform Admin application the sole authority for settings menu configuration.
+- Prevent company owners, managers, and agents from enabling, disabling, reordering, or reassigning settings menu items.
+
+---
+
+## 2. Initial Settings Menu Items
+
+The system will seed seven settings menu items:
+
+1. Company Profile
+2. Branding and Storefront
+3. Payment Methods
+4. Rental Policies
+5. Insurance Policies
+6. Pricing Rules
+7. Accounting and Reports
+
+These are the initial menu items, not frontend hard-coded subscription decisions.
+
+The platform Admin may:
+
+- Enable or disable a menu item globally.
+- Assign a menu item to one or more subscription plans.
+- Choose whether an unavailable item is hidden or displayed as locked.
+- Change its display order.
+- Change its icon from an approved icon list.
+- Edit its English, French, and Arabic label and description.
+- Mark a menu item as required so it cannot be disabled for protected plans.
+- Preview the resulting menu for a plan, company role, and subscription status.
+
+The platform Admin may not:
+
+- Change protected route keys or component keys.
+- Point an item to an arbitrary URL.
+- create a working settings capability merely by entering a new label.
+- Bypass backend entitlement enforcement.
+- Delete a protected core item while companies depend on it.
+
+Company owners, managers, and agents cannot modify the menu structure or plan assignments.
+
+Domain and Publishing is removed from this plan and must not appear in the seeded menu, components, entitlement matrix, tests, or acceptance criteria.
+
+Protected section routes:
+
+```text
+/dashboard/settings?section=company
+/dashboard/settings?section=storefront
+/dashboard/settings?section=payments
+/dashboard/settings?section=rental-policies
+/dashboard/settings?section=insurance
+/dashboard/settings?section=pricing
+/dashboard/settings?section=accounting
+```
+
+The base route `/dashboard/settings` opens the first enabled item the current user may access. Company Profile is the required fallback.
+
+---
+
+## 3. Admin-Owned Menu and Subscription Design Principle
+
+The platform Admin controls the settings menu configuration and its subscription-plan assignments.
+
+The subscription plan controls **capabilities**, not merely page visibility.
+
+The Settings route remains available to all plans because it contains required company and recovery settings. Individual sections or controls may be:
+
+- **Enabled:** The user may view and edit the capability.
+- **Read-only:** The user may view saved configuration but cannot change or use it.
+- **Locked:** The capability is unavailable and displays its required plan.
+- **Hidden for security:** Sensitive fields are not rendered when the user is not entitled.
+- **Recovery-only:** The page displays account status and a route to subscription recovery.
+
+The frontend must never decide access by checking whether the plan name is “higher” than another plan. It must consume the resolved menu and entitlement results from the API.
+
+The Admin configuration is the source of truth for:
+
+- Which settings menu items exist in the published menu.
+- Which plans receive each item.
+- Whether unavailable items are hidden or locked.
+- The order, icon, labels, and descriptions.
+- Whether an item is globally enabled.
+
+The Dashboard only renders the resolved result. It does not provide menu customization controls to company users.
+
+---
+
+## 4. Recommended Plan Positioning
+
+### STARTER
+
+Essential company setup and basic rental operations.
+
+### GROWTH
+
+Online commerce, customer-facing customization, and operational automation.
+
+### PRO
+
+Advanced reporting, scheduled delivery, governance, and the complete settings feature set.
+
+This positioning gives each upgrade a concrete operational reason. Randomly scattering premium locks across basic fields would create irritation, not a pricing strategy.
+
+---
+
+## 5. Initial Admin-Configured Feature Entitlement Matrix
+
+This matrix is the recommended initial seed. The platform Admin may modify plan assignments through the Admin application after deployment, subject to protected-core rules.
+
+Legend:
+
+- **Edit:** View and modify
+- **Basic:** Limited version of the capability
+- **Read:** View existing configuration only
+- **Locked:** Unavailable; show required plan
+- **Full:** Complete capability
+
+| Settings capability | STARTER | GROWTH | PRO |
+|---|:---:|:---:|:---:|
+| Company profile | Edit | Edit | Edit |
+| Public contact information | Edit | Edit | Edit |
+| Default language and currency | Edit | Edit | Edit |
+| Storefront listing toggle | Edit | Edit | Edit |
+| Basic logo and public identity | Edit | Edit | Edit |
+| Custom brand colors | Locked | Edit | Edit |
+| Hero image and advanced storefront branding | Locked | Edit | Edit |
+| Renter payment providers | Locked | Edit | Edit |
+| Basic fuel and damage policies | Edit | Edit | Edit |
+| Automated additional-driver fees | Locked | Edit | Edit |
+| Insurance policy management | Locked | Full | Full |
+| Pricing rules | Locked | Full | Full |
+| Basic accounting defaults | Locked | Edit | Edit |
+| Scheduled accountant report delivery | Locked | Locked | Edit |
+| Advanced report formats and delivery controls | Locked | Locked | Full |
+
+### Important boundary
+
+“Payment Methods” in this settings page means payment providers used by rental customers. It does not mean the company’s SaaS subscription payment provider.
+
+---
+
+## 6. Machine-Readable Entitlement Keys
+
+Each capability must use an immutable feature key.
+
+Recommended keys:
+
+```text
+settings.company_profile
+settings.public_contact
+settings.locale_currency
+settings.storefront_listing
+settings.branding_basic
+settings.branding_custom
+settings.branding_hero
+settings.renter_payments
+settings.rental_policies_basic
+settings.additional_driver_fees
+settings.insurance_policies
+settings.pricing_rules
+settings.accounting_defaults
+settings.accounting_scheduled_delivery
+settings.accounting_advanced_formats
+```
+
+Rules:
+
+- UI labels must never be used as entitlement identifiers.
+- Translations must never control access.
+- Plan access must be stored as explicit assignments.
+- Missing assignments mean unavailable.
+- Company overrides may disable an entitled feature.
+- Company overrides must not unlock a feature outside the active subscription plan.
+
+---
+
+## 7. Section-Level Behavior
+
+## 7.1 Company Profile
+
+### Availability
+
+- STARTER: Full
+- GROWTH: Full
+- PRO: Full
+
+### Fields
+
+- Display name
+- Tagline
+- Public email
+- Public phone
+- WhatsApp number
+- City
+- Country
+- Website URL
+- Default language
+- Default currency
+
+### Requirements
+
+- This section must never be locked by plan.
+- It remains available during subscription recovery.
+- Use the shared Moroccan city selector where applicable.
+- Validate email, phone, website, locale, and currency.
+- Explain whether the selected language affects the storefront, contracts, or both.
+
+---
+
+## 7.2 Branding and Storefront
+
+### STARTER
+
+Available:
+
+- Storefront listing
+- Company logo
+- Public identity preview
+- Basic storefront information
+
+Locked:
+
+- Custom primary and accent colors
+- Hero image
+- Advanced storefront appearance controls
+
+### GROWTH and PRO
+
+Available:
+
+- All STARTER branding capabilities
+- Custom brand colors
+- Hero image
+- Full storefront branding controls
+
+### UX behavior
+
+- Keep the section visible for all plans.
+- Group locked controls under an “Available on GROWTH” panel.
+- Do not mix enabled and locked inputs without clear boundaries.
+- Show image previews, accepted formats, dimensions, and upload limits.
+- Preserve existing premium branding assets after downgrade.
+- Do not display a retained premium asset publicly after the entitlement ends unless product policy explicitly allows a grace period.
+
+---
+
+## 7.3 Payment Methods
+
+### Availability
+
+- STARTER: Locked
+- GROWTH: Full
+- PRO: Full
+
+### Providers
+
+- AmanPay
+- PayPal
+- Future approved renter payment providers
+
+### Requirements
+
+- Show a concise locked-state explanation to STARTER.
+- Show an upgrade action without rendering credential fields.
+- Mask secret values.
+- Never return saved secrets to the browser.
+- Leaving a secret field blank must preserve the existing secret.
+- Store credentials encrypted.
+- Do not include credentials in logs, analytics, errors, or browser storage.
+- Provider configuration must also require the relevant online-reservation entitlement when that dependency exists.
+
+---
+
+## 7.4 Rental Policies
+
+### Basic policy availability
+
+- STARTER: Full
+- GROWTH: Full
+- PRO: Full
+
+Included:
+
+- Fuel policy
+- Customer-facing fuel note
+- Damage policy
+
+### Additional-driver fee automation
+
+- STARTER: Locked
+- GROWTH: Full
+- PRO: Full
+
+Included:
+
+- Free
+- Per-day fee
+- Flat fee
+- Conditional rate fields
+
+### Requirements
+
+- Hide irrelevant price fields based on charge type.
+- Reject negative values.
+- Display currency units.
+- Preserve existing additional-driver fee configuration after downgrade.
+- Stop applying premium fee automation to future reservations after entitlement loss.
+- Keep historical reservation calculations unchanged.
+
+---
+
+## 7.5 Insurance Policies
+
+### Availability
+
+- STARTER: Locked
+- GROWTH: Full
+- PRO: Full
+
+### Capabilities
+
+- List policies
+- Add policy
+- Edit policy
+- Activate or deactivate policy
+- Mark required or optional
+- Configure charge type and amount
+- Delete when safe
+
+### UX behavior
+
+- Existing policies appear as a list.
+- Creation and editing use a modal or side panel.
+- Raw enum values are replaced with translated labels.
+- STARTER sees a locked summary, not an empty form.
+- After downgrade, saved policies remain stored and become read-only.
+- Policies must not be offered on future reservations without entitlement.
+- Historical reservations and contracts retain their applied insurance records.
+
+---
+
+## 7.6 Pricing Rules
+
+### Availability
+
+- STARTER: Locked
+- GROWTH: Full
+- PRO: Full
+
+### Capabilities
+
+- List rules
+- Create rule
+- Edit rule
+- Duplicate rule
+- Activate or deactivate rule
+- Delete when safe
+- Display a readable rule summary
+
+Example:
+
+```text
+Add a 10% surcharge when the driver is younger than 25.
+```
+
+### Requirements
+
+- Define whether matching rules stack.
+- Detect conflicting rules where possible.
+- Validate percentage and monetary ranges.
+- Replace backend enum names with translated labels.
+- After downgrade, rules remain stored and become read-only.
+- Premium rules must stop applying to future pricing calculations.
+- Historical calculations remain immutable.
+
+---
+
+## 7.7 Accounting and Reports
+
+### STARTER
+
+Locked.
+
+### GROWTH
+
+Available:
+
+- Reporting period
+- Basic report format
+- Accountant name
+- Accountant email
+- Manual report defaults
+
+Locked:
+
+- Automatic scheduled delivery
+- Advanced formats
+- Multiple recipients
+- Delivery history
+
+### PRO
+
+Available:
+
+- All GROWTH accounting settings
+- Automatic scheduled delivery
+- Advanced report formats
+- Delivery timing
+- Delivery status and history, when supported
+
+### Requirements
+
+- Accountant email becomes required when automatic delivery is enabled.
+- Display the company timezone used for scheduling.
+- Do not promise delivery history unless the backend records it.
+- After downgrade from PRO to GROWTH, disable future scheduled deliveries but preserve configuration.
+- After downgrade to STARTER, accounting settings become read-only and no future automated delivery runs.
+
+---
+
+## 8. Settings Navigation Behavior
+
+### Desktop
+
+Use a persistent vertical navigation.
+
+Each item contains:
+
+- Icon
+- Section title
+- Optional status
+- Optional plan badge
+- Lock icon when unavailable
+
+### Mobile
+
+Use a compact selector or horizontally scrollable section navigation.
+
+### Locked sections
+
+Locked sections remain discoverable but must not dominate the interface.
+
+Selecting a locked section shows:
+
+- What the feature does
+- Which plan includes it
+- The company’s current plan
+- A route to manage the subscription
+- No sensitive or editable fields
+
+### Current plan indicator
+
+The page header displays:
+
+- Current plan
+- Subscription status
+- Renewal or trial information
+- A manage-subscription action
+
+The header must not turn the settings page into a pricing advertisement. Its purpose is context.
+
+---
+
+## 9. Authorization Rule
+
+A settings capability is available only when all required conditions are true:
+
+```text
+Feature is globally enabled
+AND feature is assigned to the company’s active subscription plan
+AND the company has not disabled the feature
+AND the employee role permits the action
+AND the subscription status permits the action
+```
+
+Subscription access and role access are separate checks.
+
+Examples:
+
+- A PRO plan does not grant an AGENT access to owner-only payment credentials.
+- An OWNER role does not unlock a PRO feature on STARTER.
+- Hiding a section in React does not authorize or secure the API.
+
+---
+
+## 10. Subscription-Status Behavior
+
+| Status | Settings behavior |
+|---|---|
+| `ACTIVE` | Full entitled access |
+| `TRIALING` | Access follows the trial’s assigned plan |
+| `PAST_DUE` | Core settings editable; premium settings read-only; show recovery notice |
+| `SUSPENDED` | Recovery mode; Company Profile read-only and subscription recovery available |
+| `EXPIRED` | Recovery mode |
+| `CANCELLED` | Recovery mode after the paid period ends |
+| Missing subscription | Onboarding or recovery mode |
+
+The effective access date must follow the subscription billing period. A scheduled cancellation must not remove paid access before `currentPeriodEnd`.
+
+---
+
+## 11. Upgrade and Downgrade Rules
+
+## Upgrade
+
+After a successful plan upgrade:
+
+- Refresh entitlements immediately.
+- Unlock newly available settings without requiring a new login.
+- Preserve current page and section where possible.
+- Do not auto-enable optional features without user action.
+- Existing retained configuration may become editable again.
+
+## Downgrade
+
+At the effective downgrade date:
+
+- Preserve all configuration.
+- Make unavailable configuration read-only.
+- Stop premium automation for future operations.
+- Preserve historical reservation, pricing, insurance, and report records.
+- Do not silently delete provider credentials or rules.
+- Clearly display which capabilities are no longer active.
+- Prevent API mutations for unavailable features.
+
+## Failed payment or suspension
+
+- Do not delete configuration.
+- Stop restricted operational behavior according to subscription policy.
+- Preserve access required to recover the account.
+
+---
+
+## 12. API Contract
+
+The Dashboard must receive an Admin-resolved menu response and one authoritative settings-entitlement response.
+
+Recommended menu endpoint:
+
+```http
+GET /companies/me/settings-menu
+```
+
+Example response:
+
+```json
+{
+  "version": 12,
+  "items": [
+    {
+      "menuKey": "company",
+      "sectionKey": "company",
+      "label": "Company Profile",
+      "description": "Manage public company details.",
+      "iconKey": "building",
+      "sortOrder": 10,
+      "state": "ENABLED",
+      "requiredPlan": null
+    },
+    {
+      "menuKey": "payments",
+      "sectionKey": "payments",
+      "label": "Payment Methods",
+      "description": "Configure renter payment providers.",
+      "iconKey": "credit-card",
+      "sortOrder": 30,
+      "state": "LOCKED",
+      "requiredPlan": "GROWTH"
+    }
+  ]
+}
+```
+
+The response must already reflect:
+
+- The published Admin menu configuration.
+- Active subscription plan.
+- Subscription status.
+- Company role.
+- Global feature status.
+- Hidden-versus-locked behavior.
+- Current locale.
+
+Recommended entitlement endpoint:
+
+```http
+GET /companies/me/settings-entitlements
+```
+
+Example response:
+
+```json
+{
+  "plan": "GROWTH",
+  "subscriptionStatus": "ACTIVE",
+  "accessLevel": "full",
+  "features": {
+    "settings.company_profile": {
+      "available": true,
+      "editable": true,
+      "reason": null
+    },
+    "settings.branding_custom": {
+      "available": true,
+      "editable": true,
+      "reason": null
+    },
+    "settings.accounting_scheduled_delivery": {
+      "available": false,
+      "editable": false,
+      "requiredPlan": "PRO",
+      "reason": "This feature requires the PRO plan."
+    }
+  }
+}
+```
+
+Requirements:
+
+- The response is machine-readable.
+- The reason is localized by key or mapped through shared translations.
+- Entitlement data is not derived from marketing feature labels.
+- API mutation endpoints independently enforce the same entitlement.
+- Cached entitlement data is invalidated after plan, status, or admin assignment changes.
+
+---
+
+## 13. Backend Enforcement
+
+Apply feature guards to every gated mutation and operational evaluation.
+
+Examples:
+
+```text
+requireFeature("settings.branding_custom")
+requireFeature("settings.renter_payments")
+requireFeature("settings.additional_driver_fees")
+requireFeature("settings.insurance_policies")
+requireFeature("settings.pricing_rules")
+requireFeature("settings.accounting_scheduled_delivery")
+```
+
+Enforcement must cover:
+
+- Settings create, update, and delete endpoints
+- Reservation price calculation
+- Insurance selection
+- Additional-driver fee calculation
+- Storefront branding response
+- Online payment processing
+- Scheduled report jobs
+
+Protecting only settings forms would leave the actual business behavior unlocked, which is a paywall made of decorative cardboard.
+
+---
+
+## 14. Data Model
+
+Recommended menu item catalog:
+
+```text
+SettingsMenuItem
+- id
+- menuKey
+- sectionKey
+- protectedRoute
+- componentKey
+- iconKey
+- labelKey
+- descriptionKey
+- sortOrder
+- unavailableBehavior        // HIDDEN or LOCKED
+- isGloballyEnabled
+- isRequired
+- createdAt
+- updatedAt
+```
+
+Plan assignment:
+
+```text
+SettingsMenuItemPlanAssignment
+- menuItemId
+- plan
+- enabled
+```
+
+Translation values may use the existing localization system or a protected translation table:
+
+```text
+SettingsMenuItemTranslation
+- menuItemId
+- locale                     // en, fr, ar
+- label
+- description
+```
+
+Menu-model rules:
+
+- `menuKey`, `sectionKey`, `protectedRoute`, and `componentKey` are immutable outside migrations.
+- Admin-editable icons must come from an allowlist.
+- Admin changes to labels must require all three supported languages or preserve the previous value.
+- Disabling a menu item does not remove its data or bypass API protection.
+- A disabled core recovery item must always have a safe fallback.
+- Menu order is controlled by `sortOrder`, not frontend array order.
+- Menu plan assignment and feature capability assignment must remain consistent.
+- The menu API must exclude arbitrary HTML and unsafe URLs.
+
+Recommended feature catalog:
+
+```text
+SettingsFeature
+- id
+- featureKey
+- sectionKey
+- labelKey
+- descriptionKey
+- isGloballyEnabled
+- isRequired
+- createdAt
+- updatedAt
+```
+
+Plan assignment:
+
+```text
+SettingsFeaturePlanAssignment
+- featureId
+- plan
+- enabled
+```
+
+Optional company override:
+
+```text
+CompanySettingsFeatureOverride
+- companyId
+- featureId
+- enabled
+- reason
+- expiresAt
+```
+
+Rules:
+
+- A company override may disable access.
+- A normal company override must not grant access above the active plan.
+- Exceptional support overrides require audit records and expiration.
+- Feature keys are unique and immutable.
+- Migrations and seeds must be idempotent.
+
+---
+
+## 15. Admin Management
+
+The platform Admin application is the only interface allowed to modify settings menu items and their plan availability.
+
+### Admin menu-management screen
+
+Recommended matrix:
+
+```text
+Order | Menu item | Icon | STARTER | GROWTH | PRO | Unavailable behavior | Global status
+```
+
+Supported Admin actions:
+
+- Reorder items.
+- Enable or disable items globally.
+- Assign or remove an item from STARTER, GROWTH, or PRO.
+- Choose `HIDDEN` or `LOCKED` behavior when a plan does not include it.
+- Edit English, French, and Arabic labels and descriptions.
+- Select an icon from an approved allowlist.
+- Preview the menu for a selected plan.
+- Preview the menu for a selected company role.
+- Preview past-due, suspended, trial, and recovery states.
+- View affected-company counts before publishing changes.
+- Publish or discard menu configuration changes.
+- View audit history and restore a previous published configuration.
+
+### Protected controls
+
+The Admin interface must not permit normal form editing of:
+
+- `menuKey`
+- `sectionKey`
+- `protectedRoute`
+- `componentKey`
+- Feature entitlement keys
+- Required recovery behavior
+
+These values change only through reviewed code and database migrations.
+
+### Company-user restrictions
+
+Company owners, managers, and agents may:
+
+- Open menu items granted by their plan and role.
+- Edit the business settings inside permitted sections.
+- View a locked item when Admin configured it as discoverable.
+
+They may not:
+
+- Add or remove settings menu items.
+- Reorder settings menu items.
+- Rename menu items.
+- Change icons.
+- Assign items to plans.
+- Unlock a premium item.
+- Change hidden-versus-locked behavior.
+
+### Publishing and audit
+
+Every Admin menu change must record:
+
+- Administrator identity
+- Timestamp
+- Previous value
+- New value
+- Affected menu item
+- Affected plans
+- Optional reason
+- Publish version
+
+Changes should be staged and published atomically so companies do not receive a partially updated menu.
+
+The Admin interface must warn before:
+
+- Removing an item from a plan used by active companies.
+- Globally disabling an item with saved configuration.
+- Hiding a required recovery item.
+- Publishing incomplete translations.
+- Creating menu-to-feature assignment conflicts.
+
+---
+
+## 16. Component Architecture
+
+Recommended Dashboard structure:
+
+```text
+src/app/(dashboard)/settings/
+  page.tsx
+  components/
+    SettingsLayout.tsx
+    SettingsNavigation.tsx
+    SettingsSectionHeader.tsx
+    SettingsSaveBar.tsx
+    SettingsStatusBadge.tsx
+    SettingsPlanGate.tsx
+    SettingsLockedState.tsx
+
+    CompanyProfileSection.tsx
+    BrandingSection.tsx
+    PaymentMethodsSection.tsx
+    RentalPoliciesSection.tsx
+    InsurancePoliciesSection.tsx
+    PricingRulesSection.tsx
+    AccountingSection.tsx
+
+    InsurancePolicyForm.tsx
+    PricingRuleForm.tsx
+
+  settings.types.ts
+  settings.constants.ts
+  settings.validation.ts
+  settings.entitlements.ts
+  settings.i18n.ts
+```
+
+Responsibilities:
+
+### `page.tsx`
+
+- Load the Admin-resolved settings menu.
+- Resolve the active section only from returned protected section keys.
+- Load entitlement context.
+- Render menu items in the Admin-defined order.
+- Render the settings shell.
+- Enforce route-level role access.
+- Avoid individual form markup.
+
+### `SettingsPlanGate`
+
+- Receive a feature key.
+- Render enabled, read-only, locked, or recovery states.
+- Never contain plan-specific business rules.
+
+### Section components
+
+- Own section form state.
+- Own validation.
+- Own save and error states.
+- Request only the data allowed by entitlements.
+- Avoid changing unrelated settings.
+
+---
+
+## 17. Loading and Save Strategy
+
+- Load subscription entitlements before sensitive section data.
+- Load detailed section data when its section becomes active.
+- Do not request payment credentials or premium configuration for a user who cannot access them.
+- Cache already loaded section data during the session.
+- Invalidate affected caches after a successful mutation.
+- Use independent section save states.
+- Disable save when no changes exist.
+- Warn before leaving a section with unsaved changes.
+- Keep errors local to the affected section.
+- Preserve entered values after failed saves.
+
+---
+
+## 18. Translation and RTL
+
+All new strings must exist in:
+
+- English
+- French
+- Arabic
+
+This includes:
+
+- Section names
+- Feature descriptions
+- Plan names
+- Lock messages
+- Upgrade messages
+- Subscription statuses
+- Validation errors
+- Read-only notices
+- Downgrade notices
+- Success messages
+
+Requirements:
+
+- Use immutable translation keys.
+- Do not display raw enum names.
+- Do not use translated labels in access checks.
+- Use logical CSS properties.
+- Support RTL modals, forms, navigation, icons, and status badges.
+- Keep email addresses, domains, numbers, and currencies readable in Arabic.
+- Locale switching must not change entitlements or section identifiers.
+
+---
+
+## 19. Accessibility
+
+- Section navigation supports keyboard operation.
+- The active section uses `aria-current`.
+- Locked controls are not misleadingly focusable.
+- Lock messages explain the reason in text.
+- Status is not communicated through color alone.
+- Save and validation results use appropriate live regions.
+- Modals trap focus and return it to the trigger.
+- Focus moves to the first invalid field after failed validation.
+- Upgrade actions have descriptive accessible labels.
+
+---
+
+## 20. Testing Plan
+
+## Entitlement unit tests
+
+- Every feature has explicit plan assignments.
+- Missing assignments deny access.
+- Company overrides cannot grant a higher-plan feature.
+- Role and subscription checks are both required.
+- Trial access follows its assigned plan.
+- Scheduled cancellation preserves access until period end.
+- Downgrade preserves configuration but disables future premium behavior.
+
+## API tests
+
+- STARTER cannot mutate Growth or Pro features.
+- GROWTH cannot enable Pro scheduled report delivery.
+- PRO may use all approved features.
+- Direct API calls cannot bypass the Dashboard lock.
+- Premium pricing and insurance rules do not apply after entitlement loss.
+- Historical reservation calculations remain unchanged.
+- Secret payment values are never returned.
+
+## Dashboard tests
+
+- Settings remains visible for STARTER, GROWTH, and PRO.
+- Company Profile works for every plan.
+- Locked sections show the correct required plan.
+- Sensitive forms are not rendered for unauthorized plans.
+- Plan changes refresh feature access without a new login.
+- One section saves without disabling unrelated sections.
+- Mobile navigation remains usable.
+- English, French, and Arabic render correctly.
+- Arabic remains true RTL.
+
+## Admin tests
+
+- Plan assignments save correctly.
+- Protected keys cannot be changed.
+- Preview matches the Dashboard result.
+- Global disable overrides plan assignment.
+- Unauthorized administrators cannot modify entitlements.
+- Changes create audit records.
+
+---
+
+## 21. Implementation Phases
+
+## Phase 1: Freeze Menu Governance and Initial Assignments
+
+- Approve the seven seeded settings items.
+- Approve which menu fields the platform Admin may modify.
+- Approve protected menu fields.
+- Approve the initial entitlement matrix.
+- Approve feature keys.
+- Approve hidden-versus-locked behavior.
+- Approve downgrade behavior.
+- Approve subscription-status behavior.
+- Approve owner and manager role behavior.
+
+### Exit criteria
+
+No unresolved menu ownership, protected-field, feature, downgrade, or plan-assignment decisions.
+
+## Phase 2: Add Menu and Entitlement Data Models
+
+- Create the protected settings menu catalog.
+- Create menu-to-plan assignments.
+- Create the feature catalog.
+- Create explicit feature-to-plan assignments.
+- Seed STARTER, GROWTH, and PRO access.
+- Add translation records or localization bindings.
+- Add publishing versions and audit support.
+- Make migrations and seeds idempotent.
+
+### Exit criteria
+
+Every gated capability has an explicit assignment.
+
+## Phase 3: Centralize Menu and Entitlement Resolution
+
+- Extend the canonical entitlement resolver to support settings feature keys.
+- Add the Admin-resolved settings-menu endpoint.
+- Add the settings-entitlements endpoint.
+- Resolve hidden, locked, read-only, and enabled states server-side.
+- Add cache invalidation after Admin publish.
+- Add subscription-status handling.
+
+### Exit criteria
+
+The API returns one authoritative feature-access result.
+
+## Phase 4: Enforce Gated Operations
+
+- Protect settings mutations.
+- Protect pricing, insurance, payments, branding, and reporting behavior.
+- Add consistent forbidden and upgrade-required errors.
+
+### Exit criteria
+
+No direct API call can use an unavailable capability.
+
+## Phase 5: Reorganize the Dashboard Page
+
+- Add section navigation.
+- Split the monolithic page into section components.
+- Add plan gates and locked states.
+- Preserve existing API behavior for entitled features.
+- Remove Domain and Publishing.
+
+### Exit criteria
+
+Only one focused section displays at a time, with correct plan behavior.
+
+## Phase 6: Improve Section Workflows
+
+- Add local save states.
+- Add validation.
+- Add image previews.
+- Add insurance and pricing modals or side panels.
+- Add readable summaries.
+- Add downgrade and read-only notices.
+
+### Exit criteria
+
+Each section is understandable and independently usable.
+
+## Phase 7: Admin Menu and Feature Controls
+
+- Add the settings menu-management matrix.
+- Add menu ordering, plan assignment, lock behavior, icon, and translation controls.
+- Add the settings feature matrix.
+- Add staged publishing and rollback.
+- Add plan, role, and status previews.
+- Add affected-company counts.
+- Add audit history and protected controls.
+
+### Exit criteria
+
+Platform administrators can safely manage assignments.
+
+## Phase 8: Localization, RTL, and Accessibility
+
+- Complete EN, FR, and AR strings.
+- Verify true RTL.
+- Complete keyboard and screen-reader testing.
+
+### Exit criteria
+
+No missing translations or accessibility blockers.
+
+## Phase 9: Automated Tests and Regression
+
+- Run unit, integration, component, boundary, and E2E tests.
+- Confirm existing settings data remains intact.
+- Confirm downgrade and upgrade behavior.
+- Confirm secret-handling requirements.
+
+### Exit criteria
+
+All entitlement and settings regression tests pass.
+
+---
+
+## 22. Acceptance Criteria
+
+The plan is successfully implemented when:
+
+1. Settings remains available to STARTER, GROWTH, and PRO through at least one required core item.
+2. Domain and Publishing no longer appears.
+3. Seven protected settings items are seeded initially.
+4. The platform Admin can enable, disable, reorder, rename, describe, and assign those items to plans within approved limits.
+5. Company owners, managers, and agents cannot modify the menu configuration.
+6. Protected route keys and component keys cannot be changed through the Admin UI.
+7. The Dashboard renders menu order and visibility from the published Admin configuration.
+8. Only one main section displays at a time.
+9. The active section is represented in the URL.
+10. The URL accepts only protected section keys returned by the API.
+11. Every gated capability uses an immutable feature key.
+12. Plan assignments come from the API, not frontend plan-name checks.
+13. Company Profile remains the required recovery fallback.
+14. Locked items identify the required plan when Admin selected `LOCKED`.
+15. Hidden items are absent when Admin selected `HIDDEN`.
+16. Sensitive fields are not rendered for unavailable plans.
+17. Direct API calls enforce the same entitlement rules.
+18. Menu changes are staged and published atomically.
+19. Every Admin menu change creates an audit record.
+20. Admin previews match the resulting Dashboard menu.
+21. Downgrades preserve data but stop future premium behavior.
+22. Historical reservation and financial records remain unchanged.
+23. Upgrades unlock retained configuration without a new login.
+24. Subscription status affects editing consistently.
+25. Role permissions remain separate from plan access.
+26. Each section saves independently.
+27. English, French, and Arabic menu content is complete.
+28. Arabic uses true RTL.
+29. Automated tests pass across Dashboard, API, Admin, and Database.
+30. No code implementation begins until menu governance, the initial matrix, and downgrade rules are approved.
+
+---
+
+## 23. Out of Scope
+
+This plan does not add:
+
+- Domain or DNS management
+- New payment providers
+- New insurance calculation types
+- New pricing conditions
+- New accounting integrations
+- New subscription plans
+- Runtime machine translation
+- Company-controlled menu customization
+- Company-controlled entitlement upgrades
+- Automatic deletion of downgraded configuration
+- A redesign of the global dashboard sidebar
+
+---
+
+## 24. Execution Gate
+
+Implementation must not begin until these are approved:
+
+1. Admin menu ownership and editable-field policy
+2. Initial menu-to-plan matrix
+3. Feature entitlement matrix
+4. Protected menu keys and feature keys
+5. STARTER branding limits
+6. GROWTH accounting limits
+7. PRO scheduled-report behavior
+8. Hidden-versus-locked policy
+9. Downgrade effective date
+10. Historical-record preservation rules
+11. Subscription-status behavior
+12. Role-access policy
+13. Admin override policy
+14. Admin publishing and rollback policy
diff --git a/packages/database/prisma/migrations/20260629143000_customer_billing_integrity/migration.sql b/packages/database/prisma/migrations/20260629143000_customer_billing_integrity/migration.sql
new file mode 100644
index 0000000..e01271b
--- /dev/null
+++ b/packages/database/prisma/migrations/20260629143000_customer_billing_integrity/migration.sql
@@ -0,0 +1,17 @@
+ALTER TYPE "PaymentProvider" ADD VALUE IF NOT EXISTS 'MANUAL';
+
+ALTER TABLE "rental_payments"
+  ADD COLUMN "reference" TEXT,
+  ADD COLUMN "note" TEXT,
+  ADD COLUMN "receivedAt" TIMESTAMP(3),
+  ADD COLUMN "recordedByEmployeeId" TEXT,
+  ADD COLUMN "idempotencyKey" TEXT;
+
+ALTER TABLE "rental_payments"
+  ADD CONSTRAINT "rental_payments_recordedByEmployeeId_fkey"
+  FOREIGN KEY ("recordedByEmployeeId") REFERENCES "employees"("id")
+  ON DELETE SET NULL ON UPDATE CASCADE;
+
+ALTER TABLE "rental_payments"
+  ADD CONSTRAINT "rental_payments_companyId_idempotencyKey_key"
+  UNIQUE ("companyId", "idempotencyKey");
diff --git a/packages/database/prisma/schema.prisma b/packages/database/prisma/schema.prisma
index 3959ba5..9e2bf1a 100644
--- a/packages/database/prisma/schema.prisma
+++ b/packages/database/prisma/schema.prisma
@@ -148,6 +148,7 @@ enum BillingCreditNoteStatus {
 enum PaymentProvider {
   AMANPAY
   PAYPAL
+  MANUAL
 }
 
 enum PaymentStatus {
@@ -1009,6 +1010,7 @@ model Employee {
 
   notifications           Notification[]           @relation("EmployeeNotifications")
   notificationPreferences NotificationPreference[]
+  recordedRentalPayments  RentalPayment[]          @relation("RecordedRentalPayments")
 
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
@@ -1401,6 +1403,12 @@ model RentalPayment {
   amanpayTransactionId String?         @unique
   paypalCaptureId      String?         @unique
   paymentMethod        String?
+  reference            String?
+  note                 String?
+  receivedAt           DateTime?
+  recordedByEmployeeId String?
+  recordedByEmployee   Employee?       @relation("RecordedRentalPayments", fields: [recordedByEmployeeId], references: [id])
+  idempotencyKey       String?
   paidAt               DateTime?
 
   createdAt DateTime @default(now())
@@ -1408,6 +1416,7 @@ model RentalPayment {
 
   @@index([companyId])
   @@index([reservationId])
+  @@unique([companyId, idempotencyKey])
   @@map("rental_payments")
 }