Add Access group admin surfaces, booking soft deletes, refund crash fix

Access group (Filament):
- StaffResource: manage users with an admin-tier role, gated by manage_staff
- CustomerResource: read-only view of role-less users, gated by view_customers
- RoleResource: edit permissions per role (fixed role set), gated by manage_roles
- ManageAppSettings: tabbed General/Booking settings page that reads/writes
  real .env keys via new EnvFileWriter (no parallel DB settings table, so
  BookingService/config('booking.*') stay unchanged)
- Moved Access above Catalog in the nav group order
- New permissions: manage_staff, manage_roles, view_customers, manage_settings

Booking soft deletes:
- bookings.deleted_at + SoftDeletes on the Booking model
- BookingPolicy::delete (manage_bookings, cancelled/expired only) and
  ::restore (manage_bookings)
- DeleteBookingTableAction/RestoreBookingTableAction + TrashedFilter on
  BookingsTable, using authorize() so the policy is enforced at call time,
  not just cosmetically hidden

Refund crash fix:
- ProcessRefundAction passed a nullable $payment->booking into
  RefundBookingAction's non-nullable Booking param — a soft-deleted
  booking's payment reaching the refund picker was an uncaught TypeError.
  Excluded such payments from the picker and added a defensive guard.
- Same unguarded $event->payment->booking / $event->refund->payment->booking
  pattern fixed in the MarkBookingPaid/MarkBookingRefunded queued listeners.

289 tests passing.

app-modules/booking/database/migrations/2026_08_09_213753_add_deleted_at_to_bookings_table.php

@@ -0,0 +1,33 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * Soft deletes only — a booking is never hard-removed. Admin staff may
+     * delete a cancelled/expired booking (BookingResource, gated by
+     * manage_bookings + BookingPolicy::delete), but the row stays
+     * recoverable and its Payment/Refund history stays intact.
+     */
+    public function up(): void
+    {
+        Schema::table('bookings', function (Blueprint $table) {
+            $table->softDeletes();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('bookings', function (Blueprint $table) {
+            $table->dropSoftDeletes();
+        });
+    }
+};

app-modules/booking/src/Filament/Resources/Bookings/Actions/DeleteBookingTableAction.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace Modules\Booking\Filament\Resources\Bookings\Actions;
+
+use Filament\Actions\DeleteAction;
+
+/**
+ * Soft-delete only (Booking uses SoftDeletes). `authorize('delete')` ties
+ * both the visible/hidden state AND the actual delete call itself to
+ * BookingPolicy::delete (manage_bookings + terminal status) — unlike
+ * visible()/disabled(), which are UI-only, authorize() is enforced when the
+ * action runs (Filament\Actions\Concerns\CanBeAuthorized). A booking that
+ * isn't cancelled/expired never shows this button at all, rather than a
+ * dead disabled one.
+ */
+class DeleteBookingTableAction
+{
+    public static function make(): DeleteAction
+    {
+        return DeleteAction::make()
+            ->authorize('delete');
+    }
+}

app-modules/booking/src/Filament/Resources/Bookings/Actions/RestoreBookingTableAction.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Booking\Filament\Resources\Bookings\Actions;
+
+use Filament\Actions\RestoreAction;
+
+/**
+ * Pairs with DeleteBookingTableAction — RestoreAction is already visible
+ * only for trashed records out of the box; authorize('restore') layers
+ * BookingPolicy::restore (manage_bookings) on top, enforced at call time
+ * as well as driving visibility (Filament\Actions\Concerns\CanBeAuthorized).
+ */
+class RestoreBookingTableAction
+{
+    public static function make(): RestoreAction
+    {
+        return RestoreAction::make()
+            ->authorize('restore');
+    }
+}

app-modules/booking/src/Filament/Resources/Bookings/Tables/BookingsTable.php

@@ -7,11 +7,14 @@ use Filament\Forms\Components\DatePicker;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Filters\Filter;
 use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TrashedFilter;
 use Filament\Tables\Table;
 use Illuminate\Database\Eloquent\Builder;
 use Modules\Booking\Enums\BookingStatus;
 use Modules\Booking\Filament\Resources\Bookings\Actions\AssignDriverTableAction;
 use Modules\Booking\Filament\Resources\Bookings\Actions\CancelBookingTableAction;
+use Modules\Booking\Filament\Resources\Bookings\Actions\DeleteBookingTableAction;
+use Modules\Booking\Filament\Resources\Bookings\Actions\RestoreBookingTableAction;
 use Modules\Booking\Models\Booking;
 use Modules\Catalog\Models\EvCompany;
 use Modules\Routing\Models\EvRoute;
@@ -109,11 +112,17 @@ class BookingsTable
                         $data['value'] ?? null,
                         fn (Builder $q, $companyId) => $q->whereHas('route', fn (Builder $rq) => $rq->where('ev_company_id', $companyId)),
                     )),
+                // Deleted bookings are soft-deleted, not hard-removed
+                // (domain.md; T7.x follow-up) — this is the only place they
+                // become visible again, off by default.
+                TrashedFilter::make(),
             ])
             ->recordActions([
                 ViewAction::make(),
                 AssignDriverTableAction::make(),
                 CancelBookingTableAction::make(),
+                DeleteBookingTableAction::make(),
+                RestoreBookingTableAction::make(),
             ]);
     }
 }

app-modules/booking/src/Models/Booking.php

@@ -7,6 +7,7 @@ use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\SoftDeletes;
 use Modules\Booking\Database\Factories\BookingFactory;
 use Modules\Booking\Enums\BookingChannel;
 use Modules\Booking\Enums\BookingStatus;
@@ -19,7 +20,7 @@ use Spatie\Activitylog\Support\LogOptions;
 class Booking extends Model
 {
     /** @use HasFactory<BookingFactory> */
-    use HasFactory, LogsActivity;
+    use HasFactory, LogsActivity, SoftDeletes;
 
     /**
      * Audit trail on status transitions and driver/vehicle assignment only —

app-modules/booking/src/Policies/BookingPolicy.php

@@ -63,4 +63,26 @@ class BookingPolicy
     {
         return $user->id === $booking->user_id || $user->can('manage_bookings');
     }
+
+    /**
+     * Staff-only, and only once a booking is terminal (cancelled/expired) —
+     * a pending_payment or confirmed (paid) booking must never be deleted
+     * out from under an in-flight payment/refund flow. Soft delete only
+     * (Booking uses SoftDeletes); Payment/Refund history stays intact.
+     */
+    public function delete(User $user, Booking $booking): bool
+    {
+        return in_array($booking->status, [BookingStatus::Cancelled, BookingStatus::Expired], true)
+            && $user->can('manage_bookings');
+    }
+
+    /**
+     * Staff-only. No status restriction beyond RestoreAction's own built-in
+     * "only if trashed" visibility — a booking's status doesn't change on
+     * delete, so whatever made it deletable still holds once restored.
+     */
+    public function restore(User $user, Booking $booking): bool
+    {
+        return $user->can('manage_bookings');
+    }
 }

app-modules/booking/tests/Feature/BookingPolicyTest.php

@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\User;
+use Modules\Booking\Enums\BookingStatus;
 use Modules\Booking\Models\Booking;
 use Modules\Booking\Policies\BookingPolicy;
 use Spatie\Permission\Models\Permission;
@@ -86,3 +87,53 @@ test('refund requires the process_refunds permission', function () {
     expect($policy->refund($withPermission, null))->toBeTrue()
         ->and($policy->refund($withoutPermission, null))->toBeFalse();
 });
+
+test('delete allows staff with manage_bookings on a cancelled booking', function () {
+    $policy = new BookingPolicy;
+
+    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
+    $booking = Booking::factory()->create(['status' => BookingStatus::Cancelled]);
+
+    expect($policy->delete($staff, $booking))->toBeTrue();
+});
+
+test('delete allows staff with manage_bookings on an expired booking', function () {
+    $policy = new BookingPolicy;
+
+    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
+    $booking = Booking::factory()->create(['status' => BookingStatus::Expired]);
+
+    expect($policy->delete($staff, $booking))->toBeTrue();
+});
+
+test('delete rejects a pending_payment or confirmed booking even with manage_bookings', function () {
+    $policy = new BookingPolicy;
+
+    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
+
+    $pending = Booking::factory()->create(['status' => BookingStatus::PendingPayment]);
+    $confirmed = Booking::factory()->create(['status' => BookingStatus::Confirmed]);
+
+    expect($policy->delete($staff, $pending))->toBeFalse()
+        ->and($policy->delete($staff, $confirmed))->toBeFalse();
+});
+
+test('delete rejects a cancelled booking without manage_bookings, even for the owner', function () {
+    $policy = new BookingPolicy;
+
+    $owner = User::factory()->create();
+    $booking = Booking::factory()->create(['user_id' => $owner->id, 'status' => BookingStatus::Cancelled]);
+
+    expect($policy->delete($owner, $booking))->toBeFalse();
+});
+
+test('restore requires the manage_bookings permission', function () {
+    $policy = new BookingPolicy;
+
+    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
+    $stranger = User::factory()->create();
+    $booking = Booking::factory()->create();
+
+    expect($policy->restore($staff, $booking))->toBeTrue()
+        ->and($policy->restore($stranger, $booking))->toBeFalse();
+});

app-modules/booking/tests/Feature/BookingResourceTest.php

@@ -243,3 +243,96 @@ test('the detail page\'s assign driver action is hidden for a pending_payment bo
         ->assertActionHidden('assignDriver')
         ->assertActionEnabled('cancel');
 });
+
+test('the delete action is hidden for a pending_payment or confirmed booking, even with manage_bookings', function () {
+    $pending = Booking::factory()->create(['status' => BookingStatus::PendingPayment]);
+    $confirmed = Booking::factory()->create(['status' => BookingStatus::Confirmed]);
+
+    // authorize('delete') ties visibility straight to BookingPolicy::delete
+    // (status + permission combined) — a non-terminal booking never shows
+    // this button at all, rather than a dead disabled one.
+    Livewire::test(ListBookings::class)
+        ->assertTableActionHidden('delete', $pending)
+        ->assertTableActionHidden('delete', $confirmed);
+});
+
+test('the delete action is visible and enabled for a cancelled or expired booking', function () {
+    $cancelled = Booking::factory()->create(['status' => BookingStatus::Cancelled]);
+    $expired = Booking::factory()->create(['status' => BookingStatus::Expired]);
+
+    Livewire::test(ListBookings::class)
+        ->assertTableActionVisible('delete', $cancelled)
+        ->assertTableActionEnabled('delete', $cancelled)
+        ->assertTableActionVisible('delete', $expired)
+        ->assertTableActionEnabled('delete', $expired);
+});
+
+test('the delete action is hidden from a user without manage_bookings', function () {
+    $stranger = User::factory()->create();
+    $booking = Booking::factory()->create(['status' => BookingStatus::Cancelled]);
+
+    $this->actingAs($stranger);
+
+    Livewire::test(ListBookings::class)
+        ->assertTableActionHidden('delete', $booking);
+});
+
+test('deleting a cancelled booking soft-deletes it', function () {
+    $booking = Booking::factory()->create(['status' => BookingStatus::Cancelled]);
+
+    Livewire::test(ListBookings::class)
+        ->callTableAction('delete', $booking)
+        ->assertSuccessful();
+
+    expect(Booking::find($booking->id))->toBeNull();
+    expect(Booking::withTrashed()->find($booking->id))->not->toBeNull();
+    expect(Booking::withTrashed()->find($booking->id)->trashed())->toBeTrue();
+});
+
+test('a soft-deleted booking is hidden from the default list but visible via the trashed filter', function () {
+    $active = Booking::factory()->create();
+    $deleted = Booking::factory()->create();
+    $deleted->delete();
+
+    Livewire::test(ListBookings::class)
+        ->assertCanSeeTableRecords([$active])
+        ->assertCanNotSeeTableRecords([$deleted])
+        ->filterTable('trashed', true)
+        ->assertCanSeeTableRecords([$active, $deleted]);
+});
+
+test('the restore action is only visible for a trashed booking', function () {
+    $active = Booking::factory()->create();
+    $deleted = Booking::factory()->create();
+    $deleted->delete();
+
+    Livewire::test(ListBookings::class)
+        ->filterTable('trashed', true)
+        ->assertTableActionHidden('restore', $active)
+        ->assertTableActionVisible('restore', $deleted);
+});
+
+test('restoring a deleted booking brings it back', function () {
+    $booking = Booking::factory()->create();
+    $booking->delete();
+
+    Livewire::test(ListBookings::class)
+        ->filterTable('trashed', true)
+        ->callTableAction('restore', $booking)
+        ->assertSuccessful();
+
+    expect(Booking::find($booking->id))->not->toBeNull();
+    expect(Booking::find($booking->id)->trashed())->toBeFalse();
+});
+
+test('the restore action is hidden from a user without manage_bookings', function () {
+    $stranger = User::factory()->create();
+    $booking = Booking::factory()->create();
+    $booking->delete();
+
+    $this->actingAs($stranger);
+
+    Livewire::test(ListBookings::class)
+        ->filterTable('trashed', true)
+        ->assertTableActionHidden('restore', $booking);
+});

app-modules/identity/database/seeders/RolePermissionSeeder.php

@@ -21,6 +21,10 @@ class RolePermissionSeeder extends Seeder
         'view_payments',
         'process_refunds',
         'view_audit_log',
+        'manage_staff',
+        'manage_roles',
+        'view_customers',
+        'manage_settings',
     ];
 
     /**
@@ -36,6 +40,10 @@ class RolePermissionSeeder extends Seeder
             'view_payments',
             'process_refunds',
             'view_audit_log',
+            'manage_staff',
+            'manage_roles',
+            'view_customers',
+            'manage_settings',
         ],
         'admin' => [
             'manage_catalog',
@@ -46,11 +54,14 @@ class RolePermissionSeeder extends Seeder
             'view_payments',
             'process_refunds',
             'view_audit_log',
+            'view_customers',
+            'manage_settings',
         ],
         'support' => [
             'view_bookings',
             'view_payments',
             'view_audit_log',
+            'view_customers',
         ],
     ];
 

app-modules/identity/resources/views/filament/pages/manage-app-settings.blade.php

@@ -0,0 +1,3 @@
+<x-filament-panels::page>
+    {{ $this->form }}
+</x-filament-panels::page>

app-modules/identity/src/Filament/Pages/ManageAppSettings.php

@@ -0,0 +1,151 @@
+<?php
+
+namespace Modules\Identity\Filament\Pages;
+
+use BackedEnum;
+use Filament\Actions\Action;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Notifications\Notification;
+use Filament\Pages\Page;
+use Filament\Schemas\Components\Actions;
+use Filament\Schemas\Components\Form;
+use Filament\Schemas\Components\Tabs;
+use Filament\Schemas\Components\Tabs\Tab;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Illuminate\Support\Facades\Artisan;
+use Modules\Shared\Support\EnvFileWriter;
+use UnitEnum;
+
+/**
+ * Edits real env-backed config values (config('app.*'), config('booking.*'))
+ * in place via EnvFileWriter, rather than introducing a parallel DB-backed
+ * settings table — so BookingService and everything else that already reads
+ * config('booking.*') keeps working unchanged (domain.md §2).
+ *
+ * Requires the .env file to be writable by the app process; if it isn't
+ * (e.g. some production containers ship a read-only filesystem), saving
+ * will throw and the admin needs to edit .env directly on that host instead.
+ */
+class ManageAppSettings extends Page
+{
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedCog6Tooth;
+
+    protected static string|UnitEnum|null $navigationGroup = 'Access';
+
+    protected static ?string $navigationLabel = 'App Settings';
+
+    protected static ?string $title = 'App Settings';
+
+    protected string $view = 'identity::filament.pages.manage-app-settings';
+
+    /**
+     * @var array<string, mixed>|null
+     */
+    public ?array $data = [];
+
+    public static function canAccess(): bool
+    {
+        return auth()->user()?->can('manage_settings') ?? false;
+    }
+
+    public function mount(): void
+    {
+        $this->form->fill([
+            'site_name' => config('app.name'),
+            'support_email' => config('app.support_email'),
+            'support_phone' => config('app.support_phone'),
+            'timezone' => config('app.timezone'),
+            'currency' => config('app.currency'),
+            'back_seat_enabled' => (bool) config('booking.back_seat_enabled'),
+            'whole_vehicle_enabled' => (bool) config('booking.whole_vehicle_enabled'),
+            'front_seat_max_per_booking' => config('booking.front_seat_max_per_booking'),
+        ]);
+    }
+
+    public function form(Schema $schema): Schema
+    {
+        return $schema
+            ->components([
+                Form::make([
+                    Tabs::make('Settings')
+                        ->tabs([
+                            Tab::make('General')
+                                ->schema([
+                                    TextInput::make('site_name')
+                                        ->label('Site Name')
+                                        ->required()
+                                        ->maxLength(255),
+                                    TextInput::make('support_email')
+                                        ->label('Support Email')
+                                        ->email()
+                                        ->maxLength(255),
+                                    TextInput::make('support_phone')
+                                        ->label('Support Phone')
+                                        ->tel()
+                                        ->maxLength(255),
+                                    TextInput::make('timezone')
+                                        ->label('Timezone')
+                                        ->required()
+                                        ->maxLength(64)
+                                        ->helperText('A valid PHP timezone identifier, e.g. Asia/Yangon.'),
+                                    TextInput::make('currency')
+                                        ->label('Currency Code')
+                                        ->required()
+                                        ->maxLength(3)
+                                        ->helperText('ISO 4217 currency code, e.g. MMK.'),
+                                ])
+                                ->columns(2),
+                            Tab::make('Booking')
+                                ->schema([
+                                    Toggle::make('back_seat_enabled')
+                                        ->label('Back Seat Enabled')
+                                        ->helperText('Whether customers can select Back Seat at all right now.'),
+                                    Toggle::make('whole_vehicle_enabled')
+                                        ->label('Whole Vehicle Enabled')
+                                        ->helperText('Whether customers can select Whole Vehicle at all right now.'),
+                                    TextInput::make('front_seat_max_per_booking')
+                                        ->label('Front Seat Max Per Booking')
+                                        ->numeric()
+                                        ->minValue(1)
+                                        ->required()
+                                        ->helperText('Max Front Seats a single booking may request.'),
+                                ]),
+                        ]),
+                ])
+                    ->livewireSubmitHandler('save')
+                    ->footer([
+                        Actions::make([
+                            Action::make('save')
+                                ->submit('save')
+                                ->keyBindings(['mod+s']),
+                        ]),
+                    ]),
+            ])
+            ->statePath('data');
+    }
+
+    public function save(EnvFileWriter $writer): void
+    {
+        $state = $this->form->getState();
+
+        $writer->write([
+            'APP_NAME' => $state['site_name'],
+            'SUPPORT_EMAIL' => $state['support_email'],
+            'SUPPORT_PHONE' => $state['support_phone'],
+            'APP_TIMEZONE' => $state['timezone'],
+            'APP_CURRENCY' => $state['currency'],
+            'BOOKING_BACK_SEAT_ENABLED' => (bool) $state['back_seat_enabled'],
+            'BOOKING_WHOLE_VEHICLE_ENABLED' => (bool) $state['whole_vehicle_enabled'],
+            'BOOKING_FRONT_SEAT_MAX_PER_BOOKING' => (int) $state['front_seat_max_per_booking'],
+        ]);
+
+        Artisan::call('config:clear');
+
+        Notification::make()
+            ->title('Settings saved')
+            ->success()
+            ->send();
+    }
+}

app-modules/identity/src/Filament/Resources/Customers/CustomerResource.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Customers;
+
+use App\Models\User;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Modules\Identity\Filament\Resources\Customers\Pages\ListCustomers;
+use Modules\Identity\Filament\Resources\Customers\Pages\ViewCustomer;
+use Modules\Identity\Filament\Resources\Customers\Schemas\CustomerInfolist;
+use Modules\Identity\Filament\Resources\Customers\Tables\CustomersTable;
+use UnitEnum;
+
+/**
+ * Customers are `users` rows carrying no role at all — the inverse scope of
+ * StaffResource (domain.md §4, single `users` table). Read-only by design:
+ * customer accounts are created via the mini app/mobile token flow (T1.2),
+ * never hand-entered by staff.
+ */
+class CustomerResource extends Resource
+{
+    protected static ?string $model = User::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedUsers;
+
+    protected static string|UnitEnum|null $navigationGroup = 'Access';
+
+    protected static ?string $navigationLabel = 'Customers';
+
+    protected static ?string $modelLabel = 'Customer';
+
+    public static function getEloquentQuery(): Builder
+    {
+        return parent::getEloquentQuery()->doesntHave('roles');
+    }
+
+    public static function table(Table $table): Table
+    {
+        return CustomersTable::configure($table);
+    }
+
+    public static function infolist(Schema $schema): Schema
+    {
+        return CustomerInfolist::configure($schema);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListCustomers::route('/'),
+            'view' => ViewCustomer::route('/{record}'),
+        ];
+    }
+
+    public static function canViewAny(): bool
+    {
+        return auth()->user()?->can('view_customers') ?? false;
+    }
+}

app-modules/identity/src/Filament/Resources/Customers/Pages/ListCustomers.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Customers\Pages;
+
+use Filament\Resources\Pages\ListRecords;
+use Modules\Identity\Filament\Resources\Customers\CustomerResource;
+
+class ListCustomers extends ListRecords
+{
+    protected static string $resource = CustomerResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        // No CreateAction — customer accounts are created via the mini
+        // app/mobile token flow (T1.2), never hand-entered here.
+        return [];
+    }
+}

app-modules/identity/src/Filament/Resources/Customers/Pages/ViewCustomer.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Customers\Pages;
+
+use Filament\Resources\Pages\ViewRecord;
+use Modules\Identity\Filament\Resources\Customers\CustomerResource;
+
+class ViewCustomer extends ViewRecord
+{
+    protected static string $resource = CustomerResource::class;
+}

app-modules/identity/src/Filament/Resources/Customers/Schemas/CustomerInfolist.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Customers\Schemas;
+
+use Filament\Infolists\Components\TextEntry;
+use Filament\Schemas\Components\Grid;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+
+class CustomerInfolist
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema
+            ->components([
+                Section::make('Customer')
+                    ->schema([
+                        Grid::make(3)
+                            ->schema([
+                                TextEntry::make('name'),
+                                TextEntry::make('email'),
+                                TextEntry::make('created_at')->label('Joined')->dateTime(),
+                                TextEntry::make('bookings_count')->label('Total Bookings')->state(
+                                    fn ($record) => $record->bookings()->count(),
+                                ),
+                            ]),
+                    ]),
+            ]);
+    }
+}

app-modules/identity/src/Filament/Resources/Customers/Tables/CustomersTable.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Customers\Tables;
+
+use Filament\Actions\ViewAction;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+
+class CustomersTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->modifyQueryUsing(fn (Builder $query) => $query->withCount('bookings'))
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                TextColumn::make('name')
+                    ->searchable()
+                    ->sortable(),
+                TextColumn::make('email')
+                    ->searchable()
+                    ->sortable(),
+                TextColumn::make('bookings_count')
+                    ->label('Bookings'),
+                TextColumn::make('created_at')
+                    ->label('Joined')
+                    ->dateTime()
+                    ->sortable(),
+            ])
+            ->recordActions([
+                ViewAction::make(),
+            ]);
+    }
+}

app-modules/identity/src/Filament/Resources/Roles/Pages/EditRole.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Roles\Pages;
+
+use Filament\Resources\Pages\EditRecord;
+use Modules\Identity\Filament\Resources\Roles\RoleResource;
+use Spatie\Permission\PermissionRegistrar;
+
+class EditRole extends EditRecord
+{
+    protected static string $resource = RoleResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        // No DeleteAction — the role set is fixed (see RoleResource docblock).
+        return [];
+    }
+
+    /**
+     * Spatie caches resolved permissions per-request/process — without
+     * this, a permission just toggled here wouldn't take effect until the
+     * cache naturally expires (RolePermissionSeeder does the same flush).
+     */
+    protected function afterSave(): void
+    {
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+    }
+}

app-modules/identity/src/Filament/Resources/Roles/Pages/ListRoles.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Roles\Pages;
+
+use Filament\Resources\Pages\ListRecords;
+use Modules\Identity\Filament\Resources\Roles\RoleResource;
+
+class ListRoles extends ListRecords
+{
+    protected static string $resource = RoleResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        // No CreateAction — the role set is fixed (see RoleResource docblock).
+        return [];
+    }
+}

app-modules/identity/src/Filament/Resources/Roles/RoleResource.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Roles;
+
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Modules\Identity\Filament\Resources\Roles\Pages\EditRole;
+use Modules\Identity\Filament\Resources\Roles\Pages\ListRoles;
+use Modules\Identity\Filament\Resources\Roles\Schemas\RoleForm;
+use Modules\Identity\Filament\Resources\Roles\Tables\RolesTable;
+use Spatie\Permission\Models\Role;
+use UnitEnum;
+
+/**
+ * Deliberately no create/delete — role names (super_admin/admin/support)
+ * are hardcoded across policies, User::ADMIN_TIER_ROLES, and the panel
+ * login gate (domain.md §4, §8), so the role set itself must stay fixed.
+ * Only what each role can do (its permissions) is editable here.
+ */
+class RoleResource extends Resource
+{
+    protected static ?string $model = Role::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedShieldCheck;
+
+    protected static string|UnitEnum|null $navigationGroup = 'Access';
+
+    protected static ?string $navigationLabel = 'Roles';
+
+    public static function form(Schema $schema): Schema
+    {
+        return RoleForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return RolesTable::configure($table);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListRoles::route('/'),
+            'edit' => EditRole::route('/{record}/edit'),
+        ];
+    }
+
+    public static function canViewAny(): bool
+    {
+        return auth()->user()?->can('manage_roles') ?? false;
+    }
+
+    public static function canEdit(Model $record): bool
+    {
+        return auth()->user()?->can('manage_roles') ?? false;
+    }
+
+    public static function canCreate(): bool
+    {
+        return false;
+    }
+
+    public static function canDelete(Model $record): bool
+    {
+        return false;
+    }
+}

app-modules/identity/src/Filament/Resources/Roles/Schemas/RoleForm.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Roles\Schemas;
+
+use Filament\Forms\Components\CheckboxList;
+use Filament\Forms\Components\TextInput;
+use Filament\Schemas\Schema;
+
+class RoleForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema
+            ->components([
+                TextInput::make('name')
+                    ->disabled()
+                    ->dehydrated(false),
+                CheckboxList::make('permissions')
+                    ->relationship(name: 'permissions', titleAttribute: 'name')
+                    ->columns(2)
+                    ->bulkToggleable()
+                    ->columnSpanFull(),
+            ]);
+    }
+}

app-modules/identity/src/Filament/Resources/Roles/Tables/RolesTable.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Roles\Tables;
+
+use Filament\Actions\EditAction;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+
+class RolesTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->modifyQueryUsing(fn (Builder $query) => $query->withCount(['permissions', 'users']))
+            ->columns([
+                TextColumn::make('name')
+                    ->badge()
+                    ->sortable(),
+                TextColumn::make('permissions_count')
+                    ->label('Permissions'),
+                TextColumn::make('users_count')
+                    ->label('Staff'),
+            ])
+            ->recordActions([
+                EditAction::make(),
+            ]);
+    }
+}

app-modules/identity/src/Filament/Resources/Staff/Pages/CreateStaff.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Staff\Pages;
+
+use Filament\Resources\Pages\CreateRecord;
+use Modules\Identity\Filament\Resources\Staff\StaffResource;
+
+class CreateStaff extends CreateRecord
+{
+    protected static string $resource = StaffResource::class;
+}

app-modules/identity/src/Filament/Resources/Staff/Pages/EditStaff.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Staff\Pages;
+
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+use Modules\Identity\Filament\Resources\Staff\StaffResource;
+
+class EditStaff extends EditRecord
+{
+    protected static string $resource = StaffResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app-modules/identity/src/Filament/Resources/Staff/Pages/ListStaff.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Staff\Pages;
+
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+use Modules\Identity\Filament\Resources\Staff\StaffResource;
+
+class ListStaff extends ListRecords
+{
+    protected static string $resource = StaffResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app-modules/identity/src/Filament/Resources/Staff/Schemas/StaffForm.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Staff\Schemas;
+
+use App\Models\User;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Schemas\Schema;
+use Illuminate\Support\Facades\Hash;
+
+class StaffForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema
+            ->components([
+                TextInput::make('name')
+                    ->required()
+                    ->maxLength(255),
+                TextInput::make('email')
+                    ->required()
+                    ->email()
+                    ->unique(ignoreRecord: true)
+                    ->maxLength(255),
+                TextInput::make('password')
+                    ->password()
+                    ->revealable()
+                    ->required(fn (string $operation) => $operation === 'create')
+                    ->minLength(8)
+                    ->dehydrateStateUsing(fn (?string $state) => filled($state) ? Hash::make($state) : null)
+                    ->dehydrated(fn (?string $state) => filled($state))
+                    ->helperText('Leave blank to keep the current password.'),
+                Select::make('roles')
+                    ->relationship(
+                        name: 'roles',
+                        titleAttribute: 'name',
+                        modifyQueryUsing: fn ($query) => $query->whereIn('name', User::ADMIN_TIER_ROLES),
+                    )
+                    ->multiple()
+                    ->preload()
+                    ->required()
+                    ->helperText('Determines whether this staff member can sign in here at all, and what they can do.'),
+            ]);
+    }
+}

app-modules/identity/src/Filament/Resources/Staff/StaffResource.php

@@ -0,0 +1,90 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Staff;
+
+use App\Models\User;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Modules\Identity\Filament\Resources\Staff\Pages\CreateStaff;
+use Modules\Identity\Filament\Resources\Staff\Pages\EditStaff;
+use Modules\Identity\Filament\Resources\Staff\Pages\ListStaff;
+use Modules\Identity\Filament\Resources\Staff\Schemas\StaffForm;
+use Modules\Identity\Filament\Resources\Staff\Tables\StaffTable;
+use UnitEnum;
+
+/**
+ * Staff and Customer both read from the single `users` table (domain.md §4
+ * — no separate tables, no auth-guard split); this resource scopes to users
+ * carrying an admin-tier role, the same set that can sign in to this panel
+ * at all (User::ADMIN_TIER_ROLES). Gated by manage_staff — deliberately
+ * separate from manage_roles (T7.x follow-up decision): granting someone
+ * access to the panel is a different, more sensitive action than editing
+ * what a role can do.
+ */
+class StaffResource extends Resource
+{
+    protected static ?string $model = User::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedUserGroup;
+
+    protected static string|UnitEnum|null $navigationGroup = 'Access';
+
+    protected static ?string $navigationLabel = 'Staff';
+
+    protected static ?string $modelLabel = 'Staff Member';
+
+    public static function getEloquentQuery(): Builder
+    {
+        return parent::getEloquentQuery()->role(User::ADMIN_TIER_ROLES);
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return StaffForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return StaffTable::configure($table);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListStaff::route('/'),
+            'create' => CreateStaff::route('/create'),
+            'edit' => EditStaff::route('/{record}/edit'),
+        ];
+    }
+
+    public static function canViewAny(): bool
+    {
+        return auth()->user()?->can('manage_staff') ?? false;
+    }
+
+    public static function canCreate(): bool
+    {
+        return auth()->user()?->can('manage_staff') ?? false;
+    }
+
+    public static function canEdit(Model $record): bool
+    {
+        return auth()->user()?->can('manage_staff') ?? false;
+    }
+
+    /**
+     * Blocks the one obviously destructive foot-gun (a staff member
+     * deleting their own account and locking themselves out) on top of the
+     * manage_staff permission check.
+     */
+    public static function canDelete(Model $record): bool
+    {
+        return (auth()->user()?->can('manage_staff') ?? false)
+            && auth()->id() !== $record->getKey();
+    }
+}

app-modules/identity/src/Filament/Resources/Staff/Tables/StaffTable.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Staff\Tables;
+
+use Filament\Actions\DeleteAction;
+use Filament\Actions\EditAction;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+
+class StaffTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->modifyQueryUsing(fn (Builder $query) => $query->with('roles'))
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                TextColumn::make('name')
+                    ->searchable()
+                    ->sortable(),
+                TextColumn::make('email')
+                    ->searchable()
+                    ->sortable(),
+                TextColumn::make('roles.name')
+                    ->label('Roles')
+                    ->badge(),
+                TextColumn::make('created_at')
+                    ->dateTime()
+                    ->sortable(),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ]);
+    }
+}

app-modules/identity/tests/Feature/CustomerResourceTest.php

@@ -0,0 +1,35 @@
+<?php
+
+use App\Models\User;
+use Livewire\Livewire;
+use Modules\Identity\Database\Seeders\RolePermissionSeeder;
+use Modules\Identity\Filament\Resources\Customers\Pages\ListCustomers;
+
+beforeEach(function () {
+    $this->seed(RolePermissionSeeder::class);
+
+    $this->staff = User::factory()->create();
+    $this->staff->assignRole('support');
+});
+
+test('staff with view_customers can list customers', function () {
+    $this->actingAs($this->staff)->get('/admin/customers')->assertSuccessful();
+});
+
+test('the customer resource only lists users without any role', function () {
+    $customer = User::factory()->create();
+
+    $this->actingAs($this->staff);
+
+    Livewire::test(ListCustomers::class)
+        ->assertCanSeeTableRecords([$customer])
+        ->assertCanNotSeeTableRecords([$this->staff]);
+});
+
+test('a customer view page loads for staff', function () {
+    $customer = User::factory()->create();
+
+    $this->actingAs($this->staff)
+        ->get("/admin/customers/{$customer->id}")
+        ->assertSuccessful();
+});

app-modules/identity/tests/Feature/ManageAppSettingsTest.php

@@ -0,0 +1,71 @@
+<?php
+
+use App\Models\User;
+use Livewire\Livewire;
+use Modules\Identity\Database\Seeders\RolePermissionSeeder;
+use Modules\Identity\Filament\Pages\ManageAppSettings;
+use Modules\Shared\Support\EnvFileWriter;
+
+beforeEach(function () {
+    $this->seed(RolePermissionSeeder::class);
+
+    // Never let a test write to the real project .env — bind the writer to
+    // a throwaway temp file instead.
+    $this->envPath = sys_get_temp_dir().'/manage-app-settings-test-'.uniqid().'.env';
+    file_put_contents($this->envPath, "APP_NAME=Laravel\n");
+    app()->instance(EnvFileWriter::class, new EnvFileWriter($this->envPath));
+});
+
+afterEach(function () {
+    @unlink($this->envPath);
+});
+
+test('an admin without manage_settings is forbidden from the app settings page', function () {
+    $support = User::factory()->create();
+    $support->assignRole('support');
+
+    $this->actingAs($support)->get('/admin/manage-app-settings')->assertForbidden();
+});
+
+test('a super_admin can view and save app settings, writing them to .env', function () {
+    $superAdmin = User::factory()->create();
+    $superAdmin->assignRole('super_admin');
+    $this->actingAs($superAdmin);
+
+    Livewire::test(ManageAppSettings::class)
+        ->assertOk()
+        ->fillForm([
+            'site_name' => 'EV Booking Co',
+            'support_email' => 'help@evbooking.test',
+            'support_phone' => '+95912345678',
+            'timezone' => 'Asia/Yangon',
+            'currency' => 'MMK',
+            'back_seat_enabled' => false,
+            'whole_vehicle_enabled' => true,
+            'front_seat_max_per_booking' => 2,
+        ])
+        ->call('save')
+        ->assertHasNoFormErrors();
+
+    $contents = file_get_contents($this->envPath);
+
+    expect($contents)
+        ->toContain('APP_NAME="EV Booking Co"')
+        ->toContain('SUPPORT_EMAIL=help@evbooking.test')
+        ->toContain('APP_TIMEZONE=Asia/Yangon')
+        ->toContain('APP_CURRENCY=MMK')
+        ->toContain('BOOKING_BACK_SEAT_ENABLED=false')
+        ->toContain('BOOKING_WHOLE_VEHICLE_ENABLED=true')
+        ->toContain('BOOKING_FRONT_SEAT_MAX_PER_BOOKING=2');
+});
+
+test('front seat max per booking must be at least 1', function () {
+    $superAdmin = User::factory()->create();
+    $superAdmin->assignRole('super_admin');
+    $this->actingAs($superAdmin);
+
+    Livewire::test(ManageAppSettings::class)
+        ->fillForm(['front_seat_max_per_booking' => 0])
+        ->call('save')
+        ->assertHasFormErrors(['front_seat_max_per_booking']);
+});

app-modules/identity/tests/Feature/RoleResourceTest.php

@@ -0,0 +1,36 @@
+<?php
+
+use App\Models\User;
+use Modules\Identity\Database\Seeders\RolePermissionSeeder;
+use Modules\Identity\Filament\Resources\Roles\RoleResource;
+use Spatie\Permission\Models\Role;
+
+beforeEach(function () {
+    $this->seed(RolePermissionSeeder::class);
+
+    $this->superAdmin = User::factory()->create();
+    $this->superAdmin->assignRole('super_admin');
+});
+
+test('a super_admin can list and edit roles', function () {
+    $this->actingAs($this->superAdmin)->get('/admin/roles')->assertSuccessful();
+
+    $role = Role::where('name', 'support')->firstOrFail();
+
+    $this->actingAs($this->superAdmin)->get("/admin/roles/{$role->id}/edit")->assertSuccessful();
+});
+
+test('an admin without manage_roles is forbidden from the role resource', function () {
+    $admin = User::factory()->create();
+    $admin->assignRole('admin');
+
+    $this->actingAs($admin)->get('/admin/roles')->assertForbidden();
+});
+
+test('roles cannot be created or deleted from the resource', function () {
+    expect(RoleResource::canCreate())->toBeFalse();
+
+    $role = Role::where('name', 'support')->firstOrFail();
+
+    expect(RoleResource::canDelete($role))->toBeFalse();
+});

app-modules/identity/tests/Feature/StaffResourceTest.php

@@ -0,0 +1,59 @@
+<?php
+
+use App\Models\User;
+use Livewire\Livewire;
+use Modules\Identity\Database\Seeders\RolePermissionSeeder;
+use Modules\Identity\Filament\Resources\Staff\Pages\ListStaff;
+use Modules\Identity\Filament\Resources\Staff\StaffResource;
+
+beforeEach(function () {
+    $this->seed(RolePermissionSeeder::class);
+
+    $this->superAdmin = User::factory()->create();
+    $this->superAdmin->assignRole('super_admin');
+});
+
+test('a super_admin can list, create, and edit staff', function () {
+    $this->actingAs($this->superAdmin)->get('/admin/staff')->assertSuccessful();
+    $this->actingAs($this->superAdmin)->get('/admin/staff/create')->assertSuccessful();
+
+    $other = User::factory()->create();
+    $other->assignRole('support');
+
+    $this->actingAs($this->superAdmin)->get("/admin/staff/{$other->id}/edit")->assertSuccessful();
+});
+
+test('an admin without manage_staff is forbidden from the staff resource', function () {
+    $admin = User::factory()->create();
+    $admin->assignRole('admin');
+
+    $this->actingAs($admin)->get('/admin/staff')->assertForbidden();
+});
+
+test('the staff resource only lists users carrying an admin-tier role', function () {
+    $support = User::factory()->create();
+    $support->assignRole('support');
+
+    $customer = User::factory()->create();
+
+    $this->actingAs($this->superAdmin);
+
+    Livewire::test(ListStaff::class)
+        ->assertCanSeeTableRecords([$support])
+        ->assertCanNotSeeTableRecords([$customer]);
+});
+
+test('a super_admin cannot delete their own staff account', function () {
+    $this->actingAs($this->superAdmin);
+
+    expect(StaffResource::canDelete($this->superAdmin))->toBeFalse();
+});
+
+test('a super_admin can delete another staff account', function () {
+    $other = User::factory()->create();
+    $other->assignRole('support');
+
+    $this->actingAs($this->superAdmin);
+
+    expect(StaffResource::canDelete($other))->toBeTrue();
+});

app-modules/payment/src/Filament/Resources/Refunds/Actions/ProcessRefundAction.php

@@ -33,6 +33,10 @@ class ProcessRefundAction
                     ->label('Payment')
                     ->options(fn () => Payment::query()
                         ->where('status', PaymentStatus::Completed->value)
+                        // A soft-deleted booking excludes itself from this
+                        // belongsTo by default — never offer a payment whose
+                        // booking is gone (Booking now uses SoftDeletes).
+                        ->whereHas('booking')
                         ->with('booking')
                         ->get()
                         ->mapWithKeys(fn (Payment $payment) => [
@@ -50,6 +54,20 @@ class ProcessRefundAction
             ->action(function (array $data): void {
                 $payment = Payment::with('booking')->findOrFail($data['payment_id']);
 
+                // Defense in depth against the options list going stale
+                // between render and submit (e.g. the booking gets deleted
+                // mid-form) — $payment->booking is nullable, but
+                // RefundBookingAction requires a real Booking.
+                if ($payment->booking === null) {
+                    Notification::make()
+                        ->title('Refund failed')
+                        ->body('This payment\'s booking no longer exists.')
+                        ->danger()
+                        ->send();
+
+                    return;
+                }
+
                 try {
                     app(RefundBookingAction::class)->handle(
                         $payment->booking,

app-modules/payment/src/Listeners/MarkBookingPaid.php

@@ -18,6 +18,14 @@ class MarkBookingPaid implements ShouldQueue
     {
         $booking = $event->payment->booking;
 
+        // Booking uses SoftDeletes — normally unreachable here (a
+        // pending_payment booking is never deletable, BookingPolicy::delete),
+        // but this listener is queued, so it's worth guarding against a
+        // booking that vanished between dispatch and execution regardless.
+        if ($booking === null) {
+            return;
+        }
+
         if ($booking->status === BookingStatus::PendingPayment) {
             $booking->update(['status' => BookingStatus::Confirmed]);
         }

app-modules/payment/src/Listeners/MarkBookingRefunded.php

@@ -18,6 +18,14 @@ class MarkBookingRefunded implements ShouldQueue
     {
         $booking = $event->refund->payment->booking;
 
+        // Booking uses SoftDeletes — normally unreachable here (a confirmed
+        // booking is never deletable, BookingPolicy::delete), but this
+        // listener is queued, so it's worth guarding against a booking that
+        // vanished between dispatch and execution regardless.
+        if ($booking === null) {
+            return;
+        }
+
         if ($booking->status === BookingStatus::Confirmed) {
             $booking->update(['status' => BookingStatus::Cancelled]);
         }

app-modules/payment/tests/Feature/MarkBookingPaidTest.php

@@ -24,3 +24,12 @@ test('does not touch a booking that already moved on for another reason', functi
 
     expect($booking->refresh()->status)->toBe(BookingStatus::Cancelled);
 });
+
+test('does not crash if the booking was soft-deleted before this queued listener ran', function () {
+    $booking = Booking::factory()->create(['status' => BookingStatus::PendingPayment]);
+    $payment = Payment::factory()->completed()->create(['booking_id' => $booking->id]);
+    $booking->delete();
+
+    expect(fn () => (new MarkBookingPaid)->handle(new PaymentCompleted($payment->fresh())))
+        ->not->toThrow(Throwable::class);
+});

app-modules/payment/tests/Feature/MarkBookingRefundedTest.php

@@ -0,0 +1,40 @@
+<?php
+
+use Modules\Booking\Enums\BookingStatus;
+use Modules\Booking\Models\Booking;
+use Modules\Payment\Enums\PaymentMethod;
+use Modules\Payment\Enums\RefundStatus;
+use Modules\Payment\Events\RefundProcessed;
+use Modules\Payment\Listeners\MarkBookingRefunded;
+use Modules\Payment\Models\Payment;
+use Modules\Payment\Models\Refund;
+
+test('flips a confirmed booking to cancelled', function () {
+    $booking = Booking::factory()->create(['status' => BookingStatus::Confirmed]);
+    $payment = Payment::factory()->completed()->create(['booking_id' => $booking->id, 'gateway' => PaymentMethod::KbzMiniApp]);
+    $refund = Refund::factory()->create(['payment_id' => $payment->id, 'status' => RefundStatus::Completed]);
+
+    (new MarkBookingRefunded)->handle(new RefundProcessed($refund));
+
+    expect($booking->refresh()->status)->toBe(BookingStatus::Cancelled);
+});
+
+test('does not touch a booking that already moved on for another reason', function () {
+    $booking = Booking::factory()->create(['status' => BookingStatus::Cancelled]);
+    $payment = Payment::factory()->completed()->create(['booking_id' => $booking->id, 'gateway' => PaymentMethod::KbzMiniApp]);
+    $refund = Refund::factory()->create(['payment_id' => $payment->id, 'status' => RefundStatus::Completed]);
+
+    (new MarkBookingRefunded)->handle(new RefundProcessed($refund));
+
+    expect($booking->refresh()->status)->toBe(BookingStatus::Cancelled);
+});
+
+test('does not crash if the booking was soft-deleted before this queued listener ran', function () {
+    $booking = Booking::factory()->create(['status' => BookingStatus::Confirmed]);
+    $payment = Payment::factory()->completed()->create(['booking_id' => $booking->id, 'gateway' => PaymentMethod::KbzMiniApp]);
+    $refund = Refund::factory()->create(['payment_id' => $payment->id, 'status' => RefundStatus::Completed]);
+    $booking->delete();
+
+    expect(fn () => (new MarkBookingRefunded)->handle(new RefundProcessed($refund->fresh())))
+        ->not->toThrow(Throwable::class);
+});

app-modules/payment/tests/Feature/RefundResourceTest.php

@@ -124,3 +124,30 @@ test('a non-completed payment is not offered in the process action\'s payment se
 
     expect(Refund::where('payment_id', $pendingPayment->id)->exists())->toBeFalse();
 });
+
+test('a payment whose booking has been soft-deleted is not offered in the process action\'s payment select', function () {
+    $admin = User::factory()->create()->givePermissionTo(['view_payments', 'process_refunds']);
+    $this->actingAs($admin);
+
+    $booking = Booking::factory()->create(['status' => BookingStatus::Cancelled, 'price' => 15000]);
+    $payment = Payment::factory()->completed()->create([
+        'booking_id' => $booking->id,
+        'gateway' => PaymentMethod::KbzMiniApp,
+        'amount' => 15000,
+        'gateway_transaction_id' => 'EVB-FILAMENT-DELETED-1',
+    ]);
+    $booking->delete();
+
+    // Regression: a payment whose booking is gone must never crash the
+    // refund action (RefundBookingAction requires a non-null Booking) — it
+    // simply isn't offered as an option at all.
+    Livewire::test(ListRefunds::class)
+        ->callAction('process', data: [
+            'payment_id' => $payment->id,
+            'amount' => 1000,
+            'reason' => 'reason',
+        ])
+        ->assertHasFormErrors(['payment_id']);
+
+    expect(Refund::where('payment_id', $payment->id)->exists())->toBeFalse();
+});

app-modules/shared/src/Support/EnvFileWriter.php

@@ -0,0 +1,77 @@
+<?php
+
+namespace Modules\Shared\Support;
+
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Str;
+
+/**
+ * Writes KEY=VALUE pairs directly into the .env file, preserving every
+ * other line untouched — backs the Access group's "App Settings" page
+ * (Filament), which edits real env-backed config values (config('app.*'),
+ * config('booking.*')) in place rather than introducing a parallel
+ * DB-backed settings table. Existing keys are replaced in place; missing
+ * keys are appended.
+ *
+ * Requires the .env file to be writable by the web server process — not
+ * guaranteed on every deployment target (e.g. an immutable/read-only
+ * container filesystem). Callers should surface a clear error if the write
+ * fails rather than silently losing the change.
+ */
+class EnvFileWriter
+{
+    private readonly string $path;
+
+    public function __construct(?string $path = null)
+    {
+        $this->path = $path ?? base_path('.env');
+    }
+
+    /**
+     * @param  array<string, bool|int|string|null>  $values
+     */
+    public function write(array $values): void
+    {
+        $contents = File::exists($this->path) ? File::get($this->path) : '';
+
+        foreach ($values as $key => $value) {
+            $contents = $this->setKey($contents, $key, $value);
+        }
+
+        File::put($this->path, $contents);
+    }
+
+    private function setKey(string $contents, string $key, bool|int|string|null $value): string
+    {
+        $line = $key.'='.$this->formatValue($value);
+        $pattern = '/^'.preg_quote($key, '/').'=.*$/m';
+
+        if (preg_match($pattern, $contents) === 1) {
+            return (string) preg_replace($pattern, $line, $contents, 1);
+        }
+
+        return rtrim($contents, "\n")."\n".$line."\n";
+    }
+
+    private function formatValue(bool|int|string|null $value): string
+    {
+        if (is_bool($value)) {
+            return $value ? 'true' : 'false';
+        }
+
+        if ($value === null || $value === '') {
+            return '';
+        }
+
+        if (is_int($value)) {
+            return (string) $value;
+        }
+
+        // Quote values containing whitespace or characters that would
+        // otherwise break .env parsing (matches the convention already used
+        // by hand-written entries in this project's .env.example).
+        return Str::contains($value, [' ', '#', '"'])
+            ? '"'.str_replace('"', '\\"', $value).'"'
+            : $value;
+    }
+}

app-modules/shared/tests/Unit/EnvFileWriterTest.php

@@ -0,0 +1,60 @@
+<?php
+
+use Modules\Shared\Support\EnvFileWriter;
+
+beforeEach(function () {
+    $this->path = sys_get_temp_dir().'/env-file-writer-test-'.uniqid().'.env';
+});
+
+afterEach(function () {
+    @unlink($this->path);
+});
+
+test('it replaces an existing key in place without touching other lines', function () {
+    file_put_contents($this->path, "APP_NAME=Laravel\nAPP_ENV=local\n");
+
+    (new EnvFileWriter($this->path))->write(['APP_NAME' => 'New Name']);
+
+    expect(file_get_contents($this->path))->toBe("APP_NAME=\"New Name\"\nAPP_ENV=local\n");
+});
+
+test('it appends a missing key at the end of the file', function () {
+    file_put_contents($this->path, "APP_NAME=Laravel\n");
+
+    (new EnvFileWriter($this->path))->write(['SUPPORT_EMAIL' => 'support@example.com']);
+
+    expect(file_get_contents($this->path))->toBe("APP_NAME=Laravel\nSUPPORT_EMAIL=support@example.com\n");
+});
+
+test('it formats booleans as bare true/false', function () {
+    file_put_contents($this->path, '');
+
+    (new EnvFileWriter($this->path))->write(['BOOKING_BACK_SEAT_ENABLED' => false]);
+
+    expect(file_get_contents($this->path))->toContain('BOOKING_BACK_SEAT_ENABLED=false');
+});
+
+test('it quotes values containing whitespace', function () {
+    file_put_contents($this->path, '');
+
+    (new EnvFileWriter($this->path))->write(['APP_NAME' => 'My Company']);
+
+    expect(file_get_contents($this->path))->toContain('APP_NAME="My Company"');
+});
+
+test('it writes multiple keys in one call', function () {
+    file_put_contents($this->path, "APP_NAME=Laravel\n");
+
+    (new EnvFileWriter($this->path))->write([
+        'APP_NAME' => 'Renamed',
+        'APP_CURRENCY' => 'MMK',
+        'BOOKING_FRONT_SEAT_MAX_PER_BOOKING' => 2,
+    ]);
+
+    $contents = file_get_contents($this->path);
+
+    expect($contents)
+        ->toContain('APP_NAME=Renamed')
+        ->toContain('APP_CURRENCY=MMK')
+        ->toContain('BOOKING_FRONT_SEAT_MAX_PER_BOOKING=2');
+});