chore(release): v1.0.8

Cut by rmancinas via the "Cut release" workflow. Pushing the tag triggers build.yml; deploy separately with tag=1.0.8.

.env.example

@@ -33,3 +33,20 @@ COMPANY_EMAIL=
 COMPANY_TAX_ID=
 COMPANY_WEBSITE=
 COMPANY_LOGO_PATH=
+
+# Outbound mail (Amazon SES — the channel the office already uses for bulk
+# notification, see docs/MASS_EMAIL_NOTIFICATIONS.md). Without all four
+# vars the API still boots; in dev the MailService logs sends to stdout,
+# in production every send throws ServiceUnavailableException.
+SES_REGION=
+SES_ACCESS_KEY=
+SES_SECRET_KEY=
+SES_FROM=mail@jorgecuadros.com
+SES_FROM_NAME=Information Server
+# Optional — bounce/complaint event publishing configuration set.
+SES_CONFIGURATION_SET=
+
+# Comma-separated addresses that receive the per-job admin summary email
+# (one summary per address, JSON body, sent after every sweep). Defaults to
+# the legacy pair if unset.
+NOTIFICATION_ADMIN_EMAILS=rmancinas@freakma.net,mpulido@freakma.net

.gitea/workflows/build.yml

@@ -37,6 +37,16 @@ env:
 jobs:
   build:
     name: Build ${{ matrix.image }}
+    # release.yml pushes the release commit and its tag in a single `git push`,
+    # so Gitea creates two runs for the same commit: one for master, one for the
+    # tag. Only the tag run matters — it is the one that emits the X.Y.Z / X.Y
+    # image tags, and it publishes `latest` and `sha-<short>` too, since it is
+    # the same commit. Skip the branch run rather than racing or cancelling it.
+    # Ordinary pushes to master (any message but `chore(release):`) still build.
+    if: >-
+      github.event_name != 'push' ||
+      startsWith(github.ref, 'refs/tags/') ||
+      !startsWith(github.event.head_commit.message, 'chore(release):')
     runs-on: docker
     container:
       image: docker:27-dind

.gitea/workflows/deploy-galactus.yml

@@ -40,6 +40,21 @@
 #      SESSION_SECRET_GALACTUS        64-hex (openssl rand -hex 32)
 #      MINIO_ROOT_USER / MINIO_ROOT_PASSWORD
 #      MYSQL_PASSWORD / MYSQL_ROOT_PASSWORD
+#    Optional — outbound mail. Not needed to deploy; needed for
+#    /notificaciones to send anything at all (the image sets
+#    NODE_ENV=production, which disables MailService's stdout fallback, so
+#    a blank config fails every send loudly):
+#      SES_REGION                     e.g. us-west-2
+#      SES_FROM                       a VERIFIED SES sending identity
+#      SES_FROM_NAME                  display name, optional
+#      SES_ACCESS_KEY / SES_SECRET_KEY
+#      SES_CONFIGURATION_SET          optional, for bounce/complaint events
+#      NOTIFICATION_ADMIN_EMAILS      fallback only — the summary recipients
+#                                     are edited in the UI and stored in
+#                                     app_settings; this is what a deployment
+#                                     uses until somebody saves them there
+#    These are NOT galactus-specific (no _GALACTUS suffix) — one SES identity
+#    serves every deployment.
 #  - The runner (which lives on cubex) must be able to reach BOTH
 #    galactus:9443 (Portainer) and galactus:3306 (MySQL, for migrate deploy).
 #    If it cannot reach 3306, run the migration by hand from a host that can
@@ -116,6 +131,13 @@ jobs:
           MINIO_ROOT_PASSWORD: ${{ secrets.MINIO_ROOT_PASSWORD }}
           MYSQL_PASSWORD: ${{ secrets.MYSQL_PASSWORD }}
           MYSQL_ROOT_PASSWORD: ${{ secrets.MYSQL_ROOT_PASSWORD }}
+          # Not required — the app boots fine without mail. Warned about below,
+          # because the failure mode is remote: everything looks healthy until
+          # someone clicks "Ejecutar" and every send fails.
+          SES_REGION: ${{ secrets.SES_REGION }}
+          SES_FROM: ${{ secrets.SES_FROM }}
+          SES_ACCESS_KEY: ${{ secrets.SES_ACCESS_KEY }}
+          SES_SECRET_KEY: ${{ secrets.SES_SECRET_KEY }}
           SCOPE: ${{ github.event.inputs.scope }}
         run: |
           REQUIRED="PORTAINER_URL_GALACTUS PORTAINER_API_KEY_GALACTUS
@@ -140,6 +162,20 @@ jobs:
           fi
           echo "all required secrets present for scope=$SCOPE"
 
+          # Mail is optional to deploy but not optional to work. Say so loudly
+          # rather than letting /notificaciones fail one send at a time.
+          mail_missing=""
+          for name in SES_REGION SES_FROM SES_ACCESS_KEY SES_SECRET_KEY; do
+            eval "value=\${$name}"
+            [ -z "$value" ] && mail_missing="$mail_missing $name"
+          done
+          if [ -n "$mail_missing" ]; then
+            echo "::warning::outbound mail is NOT configured, missing:$mail_missing"
+            echo "::warning::the deploy will succeed, but every notification and"
+            echo "::warning::renewal aviso will fail with 'El envío de correo no"
+            echo "::warning::está configurado.' See docs/MASS_EMAIL_NOTIFICATIONS.md"
+          fi
+
       # --- full only: database ---------------------------------------------
       - name: Deploy database stack
         if: ${{ github.event.inputs.scope == 'full' }}
@@ -260,7 +296,14 @@ jobs:
               "OPS_DB_ADMIN_USER": "root",
               "OPS_DB_ADMIN_PASSWORD": "${{ secrets.MYSQL_ROOT_PASSWORD }}",
               "MINIO_ROOT_USER": "${{ secrets.MINIO_ROOT_USER }}",
-              "MINIO_ROOT_PASSWORD": "${{ secrets.MINIO_ROOT_PASSWORD }}"
+              "MINIO_ROOT_PASSWORD": "${{ secrets.MINIO_ROOT_PASSWORD }}",
+              "SES_REGION": "${{ secrets.SES_REGION }}",
+              "SES_FROM": "${{ secrets.SES_FROM }}",
+              "SES_FROM_NAME": "${{ secrets.SES_FROM_NAME }}",
+              "SES_ACCESS_KEY": "${{ secrets.SES_ACCESS_KEY }}",
+              "SES_SECRET_KEY": "${{ secrets.SES_SECRET_KEY }}",
+              "SES_CONFIGURATION_SET": "${{ secrets.SES_CONFIGURATION_SET }}",
+              "NOTIFICATION_ADMIN_EMAILS": "${{ secrets.NOTIFICATION_ADMIN_EMAILS }}"
             }
 
       # --- prove it ----------------------------------------------------------

.gitea/workflows/deploy.yml

@@ -267,7 +267,14 @@ jobs:
               "OPS_DB_ADMIN_USER": "root",
               "OPS_DB_ADMIN_PASSWORD": "${{ secrets.MYSQL_ROOT_PASSWORD }}",
               "MINIO_ROOT_USER": "${{ secrets.MINIO_ROOT_USER }}",
-              "MINIO_ROOT_PASSWORD": "${{ secrets.MINIO_ROOT_PASSWORD }}"
+              "MINIO_ROOT_PASSWORD": "${{ secrets.MINIO_ROOT_PASSWORD }}",
+              "SES_REGION": "${{ secrets.SES_REGION }}",
+              "SES_FROM": "${{ secrets.SES_FROM }}",
+              "SES_FROM_NAME": "${{ secrets.SES_FROM_NAME }}",
+              "SES_ACCESS_KEY": "${{ secrets.SES_ACCESS_KEY }}",
+              "SES_SECRET_KEY": "${{ secrets.SES_SECRET_KEY }}",
+              "SES_CONFIGURATION_SET": "${{ secrets.SES_CONFIGURATION_SET }}",
+              "NOTIFICATION_ADMIN_EMAILS": "${{ secrets.NOTIFICATION_ADMIN_EMAILS }}"
             }
 
       # --- prove it ----------------------------------------------------------

.gitea/workflows/release.yml

@@ -191,12 +191,26 @@ jobs:
             const tag = `v${process.env.VERSION}`;
             const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
+            // The master push and the tag push carry the SAME commit, so a sha
+            // match alone is not enough: build.yml skips the master run by
+            // design, and that skipped run would satisfy a sha-only check even
+            // if the tag run were never created. When the API reports a ref for
+            // the run, require it to be the tag; when it reports none, fall back
+            // to the sha match rather than failing a release over a field name.
+            const isTagRun = (r) => {
+              const ref = r.head_branch || r.ref || "";
+              return !ref || ref === tag || ref === `refs/tags/${tag}`;
+            };
+
             const started = async () => {
               const res = await fetch(`${base}/actions/runs?limit=30`, { headers });
               if (!res.ok) throw new Error(`runs query failed: HTTP ${res.status}`);
               const body = await res.json();
               return (body.workflow_runs || []).some(
-                (r) => r.head_sha === sha && String(r.path || "").includes("build.yml"),
+                (r) =>
+                  r.head_sha === sha &&
+                  String(r.path || "").includes("build.yml") &&
+                  isTagRun(r),
               );
             };
 

PLAN.md

@@ -1,5 +1,11 @@
 # Unified Customer / Insurance / Utilities Platform — Migration & Rebuild Plan
 
+> **Looking for what is still outstanding?** → [`docs/BACKLOG.md`](docs/BACKLOG.md).
+> This document is the plan and its running status; the backlog collects every
+> open item — blocked-on-Jorge decisions, live data defects, unbuilt features
+> and deploy blockers — in one list, checked against the code rather than
+> against these notes.
+
 ## Context
 
 Jorge Cuadros & Assoc. runs two lines of business — property/utility management (`UTILITIES.accdb`) and insurance brokerage (`SEGUROS 16.mdb` + its linked backend `SEGUROS 16_be.mdb`) — out of separate, decades-old MS Access databases, plus a third file (`SCOTHIA.mdb`) that's the office's own Scotiabank checking-account register ("chequera"). The same people are customers of both business lines, but today there's no shared customer record: a person's utility account and their insurance policies live in unrelated systems with independent, inconsistent copies of their name/address/contact info. The bank register is a fourth, disconnected source of truth for the money actually moving through the office's own account.
@@ -134,16 +140,22 @@ Given the amount of near-duplicate/overlapping data across snapshot tables (mult
     - **Receipt capture module — DONE** (2026-07-27). The legacy "Editor" replacement, built on the single-movement capture from step 6. Wires up the previously-unused `Transaction.outstanding` (NOPAGO): capture flag on `POST /billing`, `?outstanding=` list filter, `POST /billing/:id/resolve-outstanding` (gated `ledger:create`, not `ledger:void` — resolving *completes* a capture), and exclusion from every balance aggregate exactly as the legacy `SALDOS ULTIMO 0`'s `HAVING NOPAGO = 0` did. Adds `POST /billing/batch` (one `$transaction`, check-level fields shared, per-line customer/amount) and `GET /billing/by-check`, plus the `cheque-count` report replacing `REPORTE CHEQUE COUNT` / `REPORTE POR CHEQUE` / `EDITA CHEQUE ALF|COUNT|NUM` — print/PDF/CSV/XLSX come free from the existing `/reportes/:slug` machinery. Web: `/estado-cuenta/lote` (the actual "Editor" screen, with live reconciliation against the physical check amount), plus an "Estado de pago" filter, a "sin fondos" row tag and a Resolver dialog on `/estado-cuenta`. No new abilities. Verified end-to-end against dev, API + browser.
       **Two pre-existing bugs found and fixed while building it:** (a) `statement()` filtered `legacySourceTable: { notIn: [...] }`, which compiles to SQL `NOT IN` — and `NULL NOT IN (…)` is NULL, so **every app-captured movement was invisible on the customer statement** (438 rows in the movement browser vs 392 on the statement) while still appearing everywhere else. This would have made the whole receipt-capture feature look broken to staff. Now NULL-safe. (b) The balances *count* query omitted the void filter its own page query applied, so the row count disagreed with the rows.
       **OCR seam:** `BillingService.createBatch(dto, opts)` is the single multi-row write path and carries three contract guarantees for the step-11 OCR module to post through — `items[i]` maps to `lines[i]` (so `StatementDocument.postedTransactionId` can be zipped back on), `opts.refs[i]` stamps `captureRef` with a duplicate-post guard that a *voided* row deliberately does not block, and `opts.source` is service-level only so an HTTP client cannot label hand-keyed rows as machine-captured. Backed by a new `TransactionCaptureSource` enum (MANUAL/BATCH/OCR) + `captureRef`, both nullable so the 40,136 migrated rows stay NULL rather than being mislabelled.
-    - **PDF/OCR auto-capture — DONE** (2026-08-01). The ingest→split→OCR→match→review pipeline for the 300+/month/service-provider statements staff key in by hand, built in `apps/api/src/statements/` and posting through §1.2's `createBatch` seam with `source: "OCR"` and a per-document `captureRef`. Web: `/recibos` + `/recibos/:id`. Abilities `statement:ingest`/`statement:review` (STAFF — the review step is what makes machine capture safe at that tier). OCR is self-hosted **Tesseract** behind a swappable `OcrProvider` interface; `tesseract-ocr`, `tesseract-ocr-data-spa` and `poppler-utils` were added to the API image.
+    - **PDF/OCR auto-capture — DONE** (2026-08-01). As-built write-up in [`docs/STATEMENT_OCR.md`](docs/STATEMENT_OCR.md); the design and the measured evidence stay in the spec's §2. The ingest→split→OCR→match→review pipeline for the 300+/month/service-provider statements staff key in by hand, built in `apps/api/src/statements/` and posting through §1.2's `createBatch` seam with `source: "OCR"` and a per-document `captureRef`. Web: `/recibos` + `/recibos/:id`. Abilities `statement:ingest`/`statement:review` (STAFF — the review step is what makes machine capture safe at that tier). OCR is self-hosted **Tesseract** behind a swappable `OcrProvider` interface; `tesseract-ocr`, `tesseract-ocr-data-spa` and `poppler-utils` were added to the API image.
       **Every decision was driven by 10 real scans (46 pages).** Shipped-parser results on them: provider 46/46, account ref 43/46, amount 42/46, due date 44/46 — and against the dev database **39/46 (85%) exact auto-match, 40/46 (87%) identified**, the rest genuine review cases. The scans are pure images (no text layer), so OCR is mandatory, and they arrive **bundled one customer per page**.
       **The three gaps are closed, and two of them were mis-stated in the spec.** (a) `TELEPHONE` now exists and is backfilled from `Property.phone1` only — coverage is 534/18/1 across phone1/2/3, so phone is one billed line per property, not three. (b) **Clave catastral ≠ predial**: `DATMEX.clave` (934 rows, `KA903009`) is what CESPT and predial bills actually print, while `predial` — what `PROPERTY_TAX.accountNumber` holds — has only 663 distinct values across 1135 rows and appears on no statement; the clave now lives on `Property.cadastralKey` as the matcher's secondary key and predial is left untouched. (c) Gas was **not** a dead end: 160 of the 334 `DATMEX.gas` values are real account numbers (the rest are `ESTACIONARIO`/`CILINDRO` descriptors), all recovered into `GAS.meterNumber`.
       **Matching is scoped per service kind and never reads the customer name** — a CESPT receipt prints `ARNAIZ ROSAS ELSA AURORA` for an account this office holds under `CATT, RANDY`, because the name on a utility bill is the registrant, not the current owner. Normalisation is per provider: CFE strips leading zeros off `NO. DE SERVICIO`, Telnor strips the 664 LADA down to the stored local 7 digits. Where a provider prints a payment barcode it is preferred over the printed label (one CFE label OCR'd a digit too many while its barcode was correct) and the two are cross-checked, with disagreement forcing review. Confirming a document whose service had no reference writes it back, so gas and any other cold start is a one-time cost.
+    - **Policy OCR capture — DONE** (2026-08-01), **unplanned — it came out of building the bullet above.** Full write-up in [`docs/POLICY_OCR.md`](docs/POLICY_OCR.md). Once the receipt pipeline existed it was obvious the same render→OCR→parse→match→review shape fits the *other* stack of paper this office keys in by hand: the carrier policy PDFs behind every `Policy` row. Built in `apps/api/src/policy-ocr/` with a GMX parser, `policy_ocr_batches`/`policy_ocr_documents`, and abilities `policy:ingest`/`policy:ocr-review` (STAFF, same trust tier and same reason). Web: `/polizas/captura` is the "automática" tab of the policy-creation screen (`/polizas/nuevo` is the manual one, both render `PolicyCaptura.tsx`) with the review queue at `/polizas/captura/[id]`. The `OcrProvider` seam was **extracted out of `StatementsModule` into its own `OcrModule`** to make this possible — that was blocking, not cosmetic; `StatementsModule` now imports it and binds nothing.
+      **The statement pipeline's core assumption inverts here.** Utility statements arrive bundled *one customer per page*, so there a page is a document; a GMX certificate is one policy across two pages (header on 1, coverage table on 2), so the pipeline concatenates the pages and runs the parser and matcher **once per file**. `PolicyOcrDocument.pageNumber` is therefore the file ordinal in the batch, and `storageKey` points at the **source PDF** (the review screen embeds the exact artifact the office received) rather than at a page image. Matching is on `Policy.policyNumber` alone and never the printed insured name — the same registrant-vs-owner drift that rules names out on the utility side. Zero hits means a new policy and confirm creates it; more than one is surfaced, never auto-picked.
+      **The GMX certificate carries no premium at all** — the figure lives on a separate `recibo` PDF — so the premium fields stay null with a note saying why, confirm never overwrites an existing premium with null, and the optional ledger write is gated on staff ticking `postPremium` *and* a premium actually parsing. 8/8 parser tests against one real document (`HC_Folio_000767_Traduccion.pdf`). GMX is the only carrier implemented; the dispatcher is a pattern table, so a second one is a parser function and two entries.
     - **Multi-bank chequera — DONE** (2026-07-27). `Bank`/`BankAccount` models so Seguros (US bank) and Utilities (Mexican bank, currently SCOTHIA) can each have their own register. `bank_transactions` gained a **required** `bankAccountId` (plus an `(bankAccountId, transactionDate)` index, since every read is now filtered by account and ordered by date), and all 22,669 existing rows were backfilled onto a seeded "Utilities — Scotiabank (MXN)" account by `migration/backfill_bank_accounts.py` — a standalone step because `prisma db push` cannot add a required column to a populated table. It is idempotent and now runs inside `run_all.py` (both normal and `--sync`) ahead of `transform_bank.py`, which fails fast if the account is missing. Every read path in `bank.service.ts` is account-scoped, including `facets()` (which had no filter at all) and *both* raw-SQL rollups in `summary()`. API: `?bankAccountId=` is required on `list`/`stats`/`facets`/`summary` — **not** optional-with-an-all-accounts-default, since summing an MXN and a USD register repeats exactly the currency-collapsing mistake the billing module exists to prevent — plus a new `bank/accounts` + `bank/banks` sub-resource under a MANAGER `bank:manage-accounts` ability. Web: `/banco` gained an account picker (remembered per browser) and reads every figure in the selected account's currency, `/banco/cuentas` manages banks and accounts, and `/inicio`'s chequera card names the account it is showing instead of implying one register. An account's `currency` is immutable after creation by design — its booked movements are denominated in it. Verified against dev + browser: a second USD account showed full read/write isolation from the MXN register, whose totals were unchanged.
     - **Customer-number recycling** — promotes the legacy `NUM id` (currently only inside `customer_legacy_refs`) into a first-class, reusable `Customer.customerNumber`, automates *finding* candidates for reuse (cancelled / 1-year-inactive), and auto-assigns the lowest free number at creation — the search is automated, the release/reuse decision stays a human action. Backfill needs care: ~140 utilities rows and all insurance-only customers have no real legacy number (synthetic `rownum_N`/`insrow_N` placeholders in `transform_customers.py`, not real `NUM id`s).
     
     Several open questions block parts of this (OCR provider/budget, the Seguros bank's identity, the clave-catastral-vs-predial mismatch, exact recycling triggers, and whether "recycling" should ever mean true data purge vs. archive-and-reuse-the-number) — see the spec's collected open-questions section.
-12. **Insurance features — NOT STARTED, spec written.** Full design in [`docs/INSURANCE_FEATURES_SPEC.md`](docs/INSURANCE_FEATURES_SPEC.md), the insurance half of the same 2026-07-25/26 meeting with Jorge that produced step 11:
+12. **Insurance features — one of four built, rest spec'd.** Full design in [`docs/INSURANCE_FEATURES_SPEC.md`](docs/INSURANCE_FEATURES_SPEC.md), the insurance half of the same 2026-07-25/26 meeting with Jorge that produced step 11:
-    - **Renewal notification emails** — a daily `@nestjs/schedule` sweep that mails the customer 30 days before expiry, 15 days before, and 7 days after, mapping onto `RenewalNotice.generation` 1/2/3 with **no schema change**. Sending is **Amazon SES** (`@aws-sdk/client-sesv2`, mirroring `StorageService`'s optional-client/degrade-don't-crash pattern) — the office already runs SES, so provider and budget are settled, not open. The letter body is the *existing* `aviso-renovacion` report (`reports.registry.ts:623-799`); `@@unique([policyId, generation])` is already-in-place idempotency, so a re-run cannot double-send. Volume ≈260 mails/month, and **815 of the 893 policyholders (91%) have an email**. Also adds the manual mark-as-sent mutation the report's own comment anticipates, so the report's permanently-zero `enviadas` total becomes real. Smallest useful piece — do first.
+    - **Renewal notification emails — DONE** (2026-08-01, extended 08-02). A sweep that mails the customer 30 days before expiry, 15 days before, and 7 days after, mapping onto `RenewalNotice.generation` 1/2/3 with **no schema change**. Sending is **Amazon SES** (`@aws-sdk/client-sesv2`, mirroring `StorageService`'s optional-client/degrade-don't-crash pattern). The letter body is the *existing* `aviso-renovacion` report; `@@unique([policyId, generation])` is already-in-place idempotency, so a re-run cannot double-send. Volume ≈260 mails/month, and **815 of the 893 policyholders (91%) have an email**.
+      **Three things came out differently from the spec.** (a) The manual mark-as-sent mutation was **dropped on purpose** — a button that marks a notice sent without sending anything lets the list claim a customer was told when they were not. `POST /renewals/send` replaced it: sending from the list *is* the marking, and the report's `enviadas` total becomes real the same way. (b) The send history is **not renewal-specific** — every attempt, including the failures and no-email skips a `RenewalNotice` row cannot represent, also writes `email_notification_log` as `RENEWAL_NOTICE`/`POLICIES`, shared with the four bulk jobs from [`docs/MASS_EMAIL_NOTIFICATIONS.md`](docs/MASS_EMAIL_NOTIFICATIONS.md). `RenewalNotice` stays *gating* state; the log is *history*. (c) The `@Cron("0 6 * * *")` literal the spec called for lasted one day: both this sweep and the servicios jobs now take their cadence from `NotificationScheduleService`, stored in `app_settings` and reinstalled on save — no redeploy. Defaults preserve the old behaviour (pólizas 06:00 daily, servicios off).
+      **Both halves live on one screen.** `/notificaciones` has Servicios and Pólizas tabs over the one log; `/renovaciones` is an alias onto the Pólizas tab. The send flags (`debug` in particular) sit in the shell above the tabs and govern both — before that there was no way to test a renewal aviso without mailing a real customer. A debug send diverts the mail, skips the `RenewalNotice` upsert **and** does not advance the sweep's `lastSuccessfulAt`; all three are needed together, or a test run silently narrows tomorrow's window and drops the letters it only pretended to send.
+      **Production status:** the `SES_*` Gitea secrets were created 2026-08-02, clearing the last blocker — but the feature has not shipped yet (master is well past the newest tag) and nothing has confirmed that `SES_FROM` is a verified SES identity or that the account is out of the sandbox. Run the first sweep with `debug` on. See [`docs/BACKLOG.md`](docs/BACKLOG.md) §0.
     - **Liquidación batch workflow** — ~70% already built (`liquidated`/`liquidationNumber`/`liquidationDate` are wired through DTOs, list filter, stats, form and detail page); only the *batch* print-and-mark step is missing, against a live pending set of 226 policies. Adds a ramo-parameterized pending report plus `POST /policies/liquidate-batch` under a new MANAGER `policy:liquidate` ability. Parameterized by ramo, not MULT-only — legacy `TABLA LIQUIDA MF` served `MULT`, `INCENDIO` and `M EMPR` alike.
     - **Certificate / "Solicitud Atlas"** — renders from the same `format: "letter"` machinery `aviso-renovacion` uses, then reaches customers as an extension of the step-8/9 replication (PDF generated here, pushed to MinIO, pointer replicated), **not** as a new public surface in this repo. Half-blocked: "Solicitud" has zero referent in the legacy system and normally means an *application form*, a different artifact from a certificate.
     - **Carrier API integration (ANA Seguros + GMX)** — shape only (`CarrierConnector` + an import-review queue rather than direct `Policy` writes, matching how step 11's OCR results are routed). Carrier research done 2026-07-27: **the two carriers are one company** — both belong to **Grupo Valore** (ANA writes autos, GMX writes daños, which is exactly this database's `AUTO`/`LICENCIAS` vs `MULT`/`INCENDIO`/`M_EMPR` split), so it is one commercial relationship, not two. **ANA has a real live SOAP service** (`server.anaseguros.com.mx/ananetws/service.asmx`, ASP.NET `.asmx`) with a published operation list — catalogs, `CalculaValor`/`CalculaMSI`, `ValidaSerie`, `RecuperaCotizacion`, `Transaccion`. **GMX publishes no machine interface at all**, only human agent portals. ⚠️ **Critical mismatch:** every ANA operation serves *new-business quoting/issuance*, not "list the policies where I am agent of record" — so if the ask is inbound portfolio sync, no evidence exists that either carrier sells it. Blocked on one phone call to Grupo Valore ((55) 5480-4000) for credentials + a direction answer, not on further research. ("GDMX" in the meeting notes was a typo for `GMX` — confirmed 2026-07-27.)
@@ -162,7 +174,13 @@ Repo scaffolded at `jorgecuadros-platform/`: npm workspaces, NestJS API with a r
 
 **Step 11 is now three-quarters built.** Receipt capture, the multi-bank chequera and PDF/OCR auto-capture are all done and verified; only customer-number recycling remains unbuilt. `docs/RECEIPT_CAPTURE_SPEC.md` carries a BUILT note per section recording what shipped and, for §2, the four things real scanned statements proved the spec had wrong or unknown.
 
-**Step 12 spec written, not built.** `docs/INSURANCE_FEATURES_SPEC.md` covers the insurance half of the same meeting (renewal emails, liquidación batch, certificate + portal delivery, carrier APIs) — see Build sequencing step 12 above. Verified the same way, plus a live query of the dev DB for the counts it quotes (email coverage, pending liquidación, installment fill rates) and of the staged Parquet for the legacy settlement-slot usage. Two of the four features are much smaller than they sound: the renewal-notice table, its idempotency key and the letter body already exist, and the per-policy liquidación fields are already wired end to end.
+Each of the two OCR intakes now has an as-built doc separate from its spec — `docs/STATEMENT_OCR.md` and `docs/POLICY_OCR.md`. The specs record what was designed and why; those record what is in the code. They share one `OcrProvider` seam (`apps/api/src/ocr/`), so the Tesseract-vs-managed-API decision is one line for both.
+
+**It also produced a feature nobody planned.** The statement OCR pipeline generalised: the same render→OCR→parse→match→review shape reads **carrier policy PDFs** into `Policy` rows, which is `docs/POLICY_OCR.md` (built 2026-08-01, GMX only so far). It belongs to step 12's subject matter but to step 11's lineage, and it is in no spec — worth knowing before reading `INSURANCE_FEATURES_SPEC.md`, which does not mention it. It also partly overlaps what §4's carrier API was wanted for, and unlike that section it is not blocked on a phone call.
+
+**Step 12 is one-quarter built.** `docs/INSURANCE_FEATURES_SPEC.md` covers the insurance half of the same meeting (renewal emails, liquidación batch, certificate + portal delivery, carrier APIs) — see Build sequencing step 12 above. Verified the same way, plus a live query of the dev DB for the counts it quotes (email coverage, pending liquidación, installment fill rates) and of the staged Parquet for the legacy settlement-slot usage. **§1 renewal emails is done** (2026-08-01/02) and carries a BUILT note recording the three places the build diverged from the spec; §2 liquidación is still the smallest remaining piece, since the per-policy fields are already wired end to end.
+
+**Notifications are one screen, not two features.** The four legacy mass-email jobs (`docs/MASS_EMAIL_NOTIFICATIONS.md`) and the insurance renewal avisos both mean "tell a customer something by email", so they are tabs of `/notificaciones` over one `email_notification_log`, with one shared flags panel and one schedule editor. `app_settings` + `SettingsService` (db → env → default) is the operator-config seam they introduced: summary recipients and both sweep cadences live there, so changing any of them is a save, not a redeploy. Credentials stay in the environment.
 
 ## Decisions (locked)
 

README.md

@@ -4,7 +4,8 @@ Internal platform for a Baja California insurance brokerage and property-service
 firm: a single expedient joining each client's **properties/services**,
 **insurance policies**, **account statement**, and the firm's **checkbook**.
 It replaces a legacy PHP/Access app (see `RESUME.md` and `PLAN.md` for the full
-history and rebuild rationale).
+history and rebuild rationale, and [`docs/BACKLOG.md`](docs/BACKLOG.md) for
+everything still outstanding).
 
 The UI is Spanish-first; the codebase and this document are in English.
 
@@ -40,8 +41,21 @@ docker-compose.yml          mysql + api + web
 ```
 
 API feature modules: `auth`, `users`, `customers`, `policies`, `properties`,
-`billing`, `bank`. Web routes: `/clientes`, `/polizas`, `/servicios`,
+`billing`, `bank`, `reports`, `notifications`, `renewals`, `mail`, `statements`,
-`/estado-cuenta`, `/banco` (chequera), `/catalogos`, `/usuarios`, `/login`.
+`policy-ocr`, `ocr`, `storage`, `settings`, `ops`.
+
+Web routes: `/inicio`, `/clientes`, `/polizas` (+ `/polizas/captura`, policy
+PDF OCR capture), `/servicios`, `/estado-cuenta`, `/banco` (chequera),
+`/recibos` (utility statement OCR capture), `/notificaciones` (mass email +
+renewal avisos; `/renovaciones` is an alias onto its Pólizas tab), `/reportes`,
+`/catalogos`, `/operaciones` (DB ingest/backup, ADMIN), `/usuarios`, `/login`.
+
+Two OCR intakes share one `OcrProvider` seam (`src/ocr/`, Tesseract today):
+utility statements → ledger rows ([`docs/STATEMENT_OCR.md`](docs/STATEMENT_OCR.md))
+and carrier policy PDFs → `Policy` rows ([`docs/POLICY_OCR.md`](docs/POLICY_OCR.md)).
+Both need `tesseract-ocr`, `tesseract-ocr-data-spa`, `poppler-utils` and object
+storage; each reports its own availability and disables only itself if either
+is missing.
 
 ---
 
@@ -195,6 +209,28 @@ python migration/run_all.py
 
 ---
 
+## Scheduled jobs
+
+The API runs two automatic email sweeps. Neither cadence is in the source:
+both are stored in `app_settings` and edited at `/notificaciones` →
+"Programación de envíos" (ADMIN, `setting:manage`), taking effect immediately
+without a restart. Shipped defaults:
+
+| Job | Default | What it does |
+| --- | ------- | ------------ |
+| Pólizas | **on**, 06:00 daily (America/Tijuana) | Renewal avisos at 30/15 days before expiry and 7 days after. |
+| Servicios | **off** | All four mass-email jobs in order, same as "Ejecutar todos". |
+
+A scheduled run never uses the UI's send flags — in particular it ignores
+`debug`, so a forgotten test toggle cannot silently stop customer mail. Full
+detail in [`docs/MASS_EMAIL_NOTIFICATIONS.md`](docs/MASS_EMAIL_NOTIFICATIONS.md).
+
+Sending needs `SES_*` in the environment. Without it the API still boots and
+logs mail to stdout in dev; in production every send fails loudly and is
+recorded as `FAILED` rather than quietly going nowhere.
+
+---
+
 ## Production notes
 
 - Use `pnpm --filter @jorgecuadros/database exec prisma migrate deploy` if/when

RESUME.md

@@ -447,6 +447,11 @@ for what's actually next.
 
 ## Statement OCR intake (`/recibos`) — DONE 2026-08-01
 
+> As-built reference: **`docs/STATEMENT_OCR.md`** (written 2026-08-02) — the
+> parsers, the matcher's scoped-field rules, confirm/learning semantics and the
+> API surface. `docs/RECEIPT_CAPTURE_SPEC.md` §2 stays the design and the
+> measured evidence. This section is the session record of building it.
+
 Plan step 11 §2 (`docs/RECEIPT_CAPTURE_SPEC.md` §2). The last big utilities
 feature: staff scan the month's utility bills and the machine proposes customer
 + amount per page, instead of keying 300+ statements per company by hand. Built
@@ -526,3 +531,167 @@ Implementation notes worth keeping:
 **Open:** whether the CFE charge should be the rounded barcode/headline figure
 (`$268`, what is paid at the window — what the parser uses today) or the exact
 breakdown total (`$268.88`). One question for Jorge.
+
+## Policy OCR capture (`/polizas/captura`) — DONE 2026-08-01, unplanned
+
+**This feature was not in any spec.** It is what the statement OCR work above
+turned into once the pipeline existed. Having built render → OCR → parse →
+match → review for CFE/CESPT/Telnor receipts, the same shape obviously fits
+the *other* stack of paper this office keys in by hand every week: the carrier
+policy PDFs behind every `Policy` row. Full write-up in `docs/POLICY_OCR.md`.
+
+The pipeline was reused rather than copied. `OcrModule` was **extracted out of
+`StatementsModule`** in the same commit so `PolicyOcrModule` could inject
+`OCR_PROVIDER` without taking on the statement pipeline — that extraction was
+blocking, not tidying; the policy module could not resolve the provider at all
+until it existed. `StatementsModule` imports it now and binds nothing itself,
+so the Tesseract-vs-managed-API decision stays one line in one file for both
+features.
+
+Screens mirror Captura exactly: `/polizas/nuevo` is the manual tab,
+`/polizas/captura` the automática one, both rendering `PolicyCaptura.tsx`, with
+the batch review queue at `/polizas/captura/[id]`. Abilities `policy:ingest` /
+`policy:ocr-review`, both STAFF — same trust tier as statement OCR, and for the
+same reason: nothing reaches the books unconfirmed.
+
+**The statement pipeline's central assumption inverts here, and that is the
+thing to remember.** Utility statements arrive bundled *one customer per page*,
+so there a page is a document and the parser runs per page. A policy PDF is the
+opposite: the GMX certificate is one policy spread across two pages (contract
+header on page 1, the per-coverage table on page 2). So every page's text is
+concatenated and the parser and matcher run **once per file**. Consequences:
+`PolicyOcrDocument.pageNumber` is repurposed as the file ordinal within the
+batch (the `(batchId, pageNumber)` unique constraint still holds), `ocrConfidence`
+is the mean across the file's pages, and a file that fails to parse yields
+exactly one `OCR_FAILED` row.
+
+`storageKey` points at the **source PDF**, not a rendered page image, so the
+review screen embeds the exact artifact the office received and gets the
+browser's native PDF scrolling, zoom and text selection for free. The page PNGs
+are still written for future re-OCR, but nothing treats them as the document's
+identity. (The statement side is the reverse, because there a page *is* the
+document.)
+
+Findings worth keeping:
+
+- **The GMX certificate has no premium on it at all.** Not intermittently
+  missing — the figure lives on GMX's separate `recibo` PDF. The parser leaves
+  the premium fields null and pushes a note saying so, confirm never overwrites
+  an existing `Policy.netPremium` with null, and the optional ledger write is
+  gated on staff ticking `postPremium` *and* a premium actually parsing.
+  Without that second gate a premium-less certificate would book a $0 charge on
+  every confirm.
+- **Match on `Policy.policyNumber`, never the printed insured name.** Same
+  registrant-vs-current-owner drift that rules names out on the utility side.
+  Zero hits means a new policy and confirm creates the row under a picked
+  customer; more than one hit is surfaced for a human, never auto-picked —
+  duplicate numbers across related parties do occur.
+- Deductible and loss participation are stored as **strings** (`"5%"`,
+  `"USD 1,000"`): they are printed as a mix of percentages, amounts and free
+  text, and normalising them would lose the distinction.
+- Carrier-portal PDFs are usually **born-digital**, so the text layer wins and
+  no OCR runs at all most of the time — same precedence rule as the statement
+  pipeline.
+- The digit-confusion map and the amount-by-separator-position parser are
+  **duplicated on purpose** rather than imported, to keep the module
+  self-contained. Fix a bug in one, check the other.
+
+8/8 parser tests, all against verbatim text from one real document
+(`HC_Folio_000767_Traduccion.pdf`).
+
+**Open:** GMX is the only carrier implemented — the dispatcher is a
+`[provider, pattern]` table plus a parser map, so a second carrier is a
+function and two entries, but no other layout has been seen. Reading the
+premium off the separate `recibo` PDF and pairing it to its certificate is the
+obvious next piece; it is what would let `postPremium` stop being a manual
+tick. And nothing versions a re-issued policy — confirm updates the existing
+row, so there is no record that this is the 2027 issue of that number.
+
+
+## Notificaciones (`/notificaciones`) — DONE 2026-08-01 → 08-02
+
+Two features that were spec'd separately turned out to be one screen. The four
+legacy mass-email jobs (`docs/MASS_EMAIL_NOTIFICATIONS.md`, ported from
+`email.notifications/send*.php`) and the insurance renewal avisos
+(`docs/INSURANCE_FEATURES_SPEC.md` §1) both mean *tell a customer something by
+email*, so they are **tabs of one screen over one log**, not two menu entries.
+`/renovaciones` is an alias that lands on the Pólizas tab, the same pattern
+Captura uses.
+
+- **Servicios tab** — the four jobs (pagos pendientes, confirmación de pago,
+  estado de cuenta, fideicomiso), individually or "Ejecutar todos". Ability
+  `notification:send` (MANAGER); STAFF sees the log read-only.
+- **Pólizas tab** — pending avisos at 30/15 days before expiry and 7 days
+  after, sent one at a time or as a sweep. Ability `renewal:send` (MANAGER).
+
+**One send log for the whole platform.** `email_notification_log` is not
+job-specific: renewals write it too (`RENEWAL_NOTICE` / `POLICIES`) through the
+same `NotificationLogService`. That is what makes "Registro de envíos" complete
+— the failures and no-email skips exist *only* there. `RenewalNotice` was not
+made redundant by it: that row is **gating** state (one per policy+generation,
+drives the pending list), the log is **history** (every attempt). `level` is
+therefore per-type and unreadable without its `notificationType` — 0/1
+yellow/red on `ACCOUNT_STATUS`, the aviso generation 1/2/3 on
+`RENEWAL_NOTICE`.
+
+**Manual mark-as-sent was dropped on purpose.** The spec called for it; a
+button that marks a notice sent without sending anything is a button that lets
+the list claim a customer was told when they were not. `POST /renewals/send`
+replaced it — sending from the list *is* the marking.
+
+**`app_settings` is the operator-config seam this work introduced.**
+`SettingsService` resolves every key **db → env → default** and reports which
+rung a value came from, so an existing deployment keeps behaving exactly as it
+did until somebody saves in the UI. Three keys today: the summary recipients
+(was `NOTIFICATION_ADMIN_EMAILS`, now a fallback) and the two sweep cadences.
+Credentials deliberately stay in the environment — SES keys, `DATABASE_URL`
+and S3 config are deployment identity, must exist before the app can reach its
+own database, and a table only widens who can read them.
+
+**The send flags are global, and that was a real bug fix (08-02).** The
+`debug` / `ignoreDayRestriction` / `useEmailLimit` panel lived inside the
+Servicios tab, so there was **no way to test a renewal aviso without mailing a
+real customer**. It now lives in the shell above the tabs and both halves read
+it. On the pólizas path `debug` does three things, and all three are required
+together: it diverts the mail, it skips the `RenewalNotice` upsert, and it does
+not advance the sweep's `lastSuccessfulAt`. Miss the third and `renewalWindow()`
+narrows back to a single day on the next real run — a test send would silently
+destroy the letters it only pretended to send. Flags are per-visit UI state and
+are **never persisted**; a stored `debug` would survive a reload and swallow
+real customer mail until somebody noticed.
+
+**Both cadences are operator-editable (08-02).** The renewal sweep's
+`@Cron("0 6 * * *")` literal lasted one day. `NotificationScheduleService` now
+owns both: the owning services register a handler in `onModuleInit`, the
+service compiles the stored `{hour, minute, weekdays}` to a cron expression and
+installs it in `SchedulerRegistry`, and saving from the UI reinstalls the job —
+no restart, which was the point. It lives in its own module for the same reason
+as `NotificationLogModule`: `NotificationsModule` and `RenewalsModule` both need
+it and neither may import the other. Defaults preserve prior behaviour exactly
+(pólizas 06:00 daily, servicios **off** — a default that starts mailing 260
+customers after a deploy is not a default, it's an incident). A scheduled run
+never inherits the UI flags: no `debug`, and no `ignoreDayRestriction`, since an
+automatic run on the operator's own cadence is precisely the case the
+Mon/Wed/Fri gate was written for.
+
+Implementation notes worth keeping:
+
+- `cron` had to become a **direct dependency of `apps/api`**. It is a
+  transitive dep of `@nestjs/schedule`, but pnpm's strict layout does not hoist
+  it, so `import { CronJob } from "cron"` does not resolve without it.
+- The pólizas sweep already had a DB lock (`scheduled_job_states`); the
+  servicios run-all does not, and relies on the deployment being
+  single-replica, which it is on galactus today.
+- Wire shapes of the four jobs are byte-for-byte the legacy PHP responses,
+  quirks included (Job 1 reports `result`, not `request`).
+
+**Open:** the `SES_*` Gitea secrets were created 2026-08-02, so the feature is
+no longer blocked — but it has not shipped (master is well past the newest tag)
+and two things nobody has checked decide whether mail leaves the building:
+`SES_FROM` must be a verified identity in `SES_REGION`, and the AWS account
+must be out of the SES sandbox, which otherwise restricts delivery to verified
+recipients and would fail a real sweep while looking correctly configured. Run
+the first sweep with `debug` on. Still open beyond that: the 78 policyholders
+with no email are logged as `SKIPPED_NO_EMAIL` but have no printable worklist,
+and the notice body is English-only (`Customer` carries no language
+preference).

apps/api/jest.config.js

@@ -0,0 +1,7 @@
+/** @type {import('jest').Config} */
+module.exports = {
+  rootDir: "src",
+  testEnvironment: "node",
+  testRegex: ".*\\.spec\\.ts$",
+  transform: { "^.+\\.ts$": "ts-jest" },
+};

apps/api/nest-cli.json

@@ -3,6 +3,7 @@
   "collection": "@nestjs/schematics",
   "sourceRoot": "src",
   "compilerOptions": {
-    "deleteOutDir": true
+    "deleteOutDir": true,
+    "tsConfigPath": "tsconfig.build.json"
   }
 }

apps/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jorgecuadros/api",
-  "version": "1.0.5",
+  "version": "1.0.8",
   "private": true,
   "scripts": {
     "build": "nest build",
@@ -12,20 +12,23 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.665.0",
+    "@aws-sdk/client-sesv2": "^3.1101.0",
     "@jorgecuadros/database": "workspace:*",
     "@nestjs/common": "^10.4.4",
     "@nestjs/config": "^3.3.0",
     "@nestjs/core": "^10.4.4",
     "@nestjs/passport": "^10.0.3",
     "@nestjs/platform-express": "^10.4.4",
+    "@nestjs/schedule": "^4.1.2",
     "argon2": "^0.41.1",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.1",
+    "cron": "^3.2.1",
     "exceljs": "^4.4.0",
     "express-session": "^1.18.0",
-    "pdfkit": "^0.15.1",
     "passport": "^0.7.0",
     "passport-local": "^1.0.0",
+    "pdfkit": "^0.15.1",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.1"
   },
@@ -34,11 +37,11 @@
     "@nestjs/testing": "^10.4.4",
     "@types/express": "^4.17.21",
     "@types/express-session": "^1.18.0",
-    "@types/pdfkit": "^0.13.5",
     "@types/jest": "^29.5.13",
     "@types/node": "^20.16.11",
     "@types/passport": "^1.0.17",
     "@types/passport-local": "^1.0.38",
+    "@types/pdfkit": "^0.13.5",
     "jest": "^29.7.0",
     "ts-jest": "^29.2.5",
     "ts-node": "^10.9.2",

apps/api/src/app.module.ts

@@ -1,8 +1,10 @@
 import { Module } from "@nestjs/common";
 import { ConfigModule } from "@nestjs/config";
+import { ScheduleModule } from "@nestjs/schedule";
 import { PrismaModule } from "./prisma/prisma.module";
 import { StorageModule } from "./storage/storage.module";
 import { CommonModule } from "./common/common.module";
+import { MailModule } from "./mail/mail.module";
 import { UsersModule } from "./users/users.module";
 import { AuthModule } from "./auth/auth.module";
 import { CustomersModule } from "./customers/customers.module";
@@ -10,17 +12,22 @@ import { PoliciesModule } from "./policies/policies.module";
 import { PropertiesModule } from "./properties/properties.module";
 import { BillingModule } from "./billing/billing.module";
 import { StatementsModule } from "./statements/statements.module";
+import { PolicyOcrModule } from "./policy-ocr/policy-ocr.module";
 import { BankModule } from "./bank/bank.module";
 import { OpsModule } from "./ops/ops.module";
 import { ReportsModule } from "./reports/reports.module";
+import { RenewalsModule } from "./renewals/renewals.module";
+import { NotificationsModule } from "./notifications/notifications.module";
 import { AppController } from "./app.controller";
 
 @Module({
   imports: [
     ConfigModule.forRoot({ isGlobal: true }),
+    ScheduleModule.forRoot(),
     PrismaModule,
     StorageModule,
     CommonModule,
+    MailModule,
     UsersModule,
     AuthModule,
     CustomersModule,
@@ -28,9 +35,12 @@ import { AppController } from "./app.controller";
     PropertiesModule,
     BillingModule,
     StatementsModule,
+    PolicyOcrModule,
     BankModule,
     OpsModule,
     ReportsModule,
+    RenewalsModule,
+    NotificationsModule,
   ],
   controllers: [AppController],
 })

apps/api/src/auth/abilities.ts

@@ -24,6 +24,9 @@ export type Ability =
   | "policy:create"
   | "policy:update"
   | "policy:delete"
+  | "policy:ingest"
+  | "policy:ocr-review"
+  | "renewal:send"
   | "property:create"
   | "property:update"
   | "property:delete"
@@ -36,7 +39,9 @@ export type Ability =
   | "statement:review"
   | "lookup:manage"
   | "user:manage"
-  | "db:manage";
+  | "db:manage"
+  | "notification:send"
+  | "setting:manage";
 
 /** Minimum role required for each ability. */
 export const ABILITY_MIN: Record<Ability, Role> = {
@@ -46,6 +51,11 @@ export const ABILITY_MIN: Record<Ability, Role> = {
   "policy:create": "STAFF",
   "policy:update": "STAFF",
   "policy:delete": "MANAGER",
+  // Insurance OCR intake is the same trust tier as statement OCR: STAFF can
+  // upload + confirm, nothing reaches the books unconfirmed.
+  "policy:ingest": "STAFF",
+  "policy:ocr-review": "STAFF",
+  "renewal:send": "MANAGER",
   "property:create": "STAFF",
   "property:update": "STAFF",
   "property:delete": "MANAGER",
@@ -65,6 +75,15 @@ export const ABILITY_MIN: Record<Ability, Role> = {
   "lookup:manage": "MANAGER",
   "user:manage": "ADMIN",
   "db:manage": "ADMIN",
+  // Mass email notifications — fires mail to customers on the office's
+  // behalf, with no per-row review. Same trust tier as `renewal:send`:
+  // a STAFF user typing one customer receipt is fine; a STAFF user firing
+  // 260 mail merges on the customer base is not.
+  "notification:send": "MANAGER",
+  // Editing operator configuration. Above `notification:send` on purpose:
+  // firing a sweep is the day job, but changing WHERE the audit summaries
+  // land is how someone would quietly stop them being read.
+  "setting:manage": "ADMIN",
 };
 
 export const ALL_ABILITIES = Object.keys(ABILITY_MIN) as Ability[];

apps/api/src/customers/create-customer.dto.ts

@@ -29,6 +29,7 @@ export class CreateCustomerDto {
   @IsOptional() @IsString() mobile?: string;
   @IsOptional() @IsString() fax?: string;
   @IsOptional() @IsEmail() email?: string;
+  @IsOptional() @IsBoolean() emailOptOut?: boolean;
   @IsOptional() @IsString() notes?: string;
   @IsOptional() @IsString() identificationType?: string;
   @IsOptional() @IsString() identificationNumber?: string;

apps/api/src/customers/update-customer.dto.ts

@@ -22,6 +22,7 @@ export class UpdateCustomerDto {
   @IsOptional() @IsString() mobile?: string;
   @IsOptional() @IsString() fax?: string;
   @IsOptional() @IsEmail() email?: string;
+  @IsOptional() @IsBoolean() emailOptOut?: boolean;
   @IsOptional() @IsString() notes?: string;
   @IsOptional() @IsString() identificationType?: string;
   @IsOptional() @IsString() identificationNumber?: string;

apps/api/src/mail/mail.module.ts

@@ -0,0 +1,13 @@
+import { Global, Module } from "@nestjs/common";
+import { MailService } from "./mail.service";
+
+/** Global so any feature module can inject MailService without re-importing.
+ *  Matches the StorageService pattern: env-driven, null when unconfigured,
+ *  and never blocks API boot. Notifications use it; renewals reuse it.
+ *  ConfigService comes from the global ConfigModule in AppModule. */
+@Global()
+@Module({
+  providers: [MailService],
+  exports: [MailService],
+})
+export class MailModule {}

apps/api/src/mail/mail.service.ts

@@ -0,0 +1,189 @@
+import {
+  Injectable,
+  Logger,
+  ServiceUnavailableException,
+} from "@nestjs/common";
+import { ConfigService } from "@nestjs/config";
+import {
+  SESv2Client,
+  SendEmailCommand,
+  SendEmailCommandInput,
+  SendEmailCommandOutput,
+} from "@aws-sdk/client-sesv2";
+
+/**
+ * Outbound mail transport. Amazon SES — the channel the office already uses
+ * for bulk notification, per docs/INSURANCE_FEATURES_SPEC.md §1.3 (the
+ * renewal-notice spec settled on SES for the same reason: established sender
+ * reputation, existing IAM, negligible incremental cost at our volume).
+ *
+ * Mirrors `StorageService` exactly: env-driven config, null client when
+ * unconfigured, `ServiceUnavailableException` on use, never blocks API boot.
+ * When the env vars are missing AND we're in dev/test we fall back to a
+ * console-logging transport so the NotificationsService can be exercised
+ * end-to-end without SES credentials — a missing mail setup in production
+ * still throws, so a real deployment can't accidentally no-op its sends.
+ *
+ * Env:
+ *   SES_REGION                — required when client is configured
+ *   SES_ACCESS_KEY / SES_SECRET_KEY — required
+ *   SES_FROM                  — verified sending identity (e.g. mail@jorgecuadros.com)
+ *   SES_FROM_NAME             — display name, optional
+ *   SES_CONFIGURATION_SET     — optional, for bounce/complaint event publishing
+ */
+
+export interface SendArgs {
+  to: string;
+  /** Optional display name; SES will not display it for "to" but we keep it on
+   *  the log row so customer-facing audit reads naturally. */
+  toName?: string;
+  subject: string;
+  /** HTML body. The four notification jobs all produce HTML. */
+  html: string;
+  /** Optional override of the configured From; rare but useful for the
+   *  trust-payment test mail to a different identity. */
+  from?: string;
+  fromName?: string;
+  /** Marker header kept on every send so a downstream mail-log search for
+   *  "X-Tracking: 1" surfaces only this app's outbound traffic. The legacy
+   *  PHP sendEmail() always set it; we keep the convention. */
+  xTracking?: string;
+}
+
+export interface SendResult {
+  /** SES MessageId (or our mock prefix in dev). Stored verbatim on the
+   *  notification log row so a SES bounce/complaint webhook can be matched
+   *  back to the exact send. */
+  messageId: string;
+  /** Truncated SES response payload (or empty in dev). 4k cap matches the
+   *  notification log column width. */
+  response: string;
+}
+
+@Injectable()
+export class MailService {
+  private readonly logger = new Logger(MailService.name);
+  private readonly client: SESv2Client | null;
+  private readonly fromAddress: string | null;
+  private readonly fromName: string;
+  private readonly configurationSet: string | undefined;
+  private readonly devMode: boolean;
+
+  constructor(config: ConfigService) {
+    const region = config.get<string>("SES_REGION");
+    const accessKeyId = config.get<string>("SES_ACCESS_KEY");
+    const secretAccessKey = config.get<string>("SES_SECRET_KEY");
+    this.fromAddress =
+      config.get<string>("SES_FROM") ??
+      config.get<string>("MAIL_FROM") ??
+      null;
+    this.fromName =
+      config.get<string>("SES_FROM_NAME") ??
+      config.get<string>("MAIL_FROM_NAME") ??
+      "Information Server";
+    this.configurationSet = config.get<string>("SES_CONFIGURATION_SET");
+    // Dev fallback: when nothing is configured, log sends to stdout instead
+    // of throwing. Lets the API boot in a fresh checkout and lets the
+    // notifications UI show "0 sent" meaningfully on `debug=1`. Production
+    // (NODE_ENV !== development) still requires real config.
+    this.devMode = process.env.NODE_ENV !== "production";
+
+    if (!region || !accessKeyId || !secretAccessKey || !this.fromAddress) {
+      if (!this.devMode) {
+        this.logger.warn(
+          "SES not configured (SES_REGION / SES_ACCESS_KEY / SES_SECRET_KEY / SES_FROM). " +
+            "Outbound mail will throw ServiceUnavailableException.",
+        );
+      }
+      this.client = null;
+      return;
+    }
+
+    this.client = new SESv2Client({
+      region,
+      credentials: { accessKeyId, secretAccessKey },
+    });
+    this.logger.log(
+      `SES mail client configured (region=${region}, from=${this.fromAddress}).`,
+    );
+  }
+
+  /** Whether the deployment has a real mail transport. Callers use this to
+   *  refuse work up front — a mass-notification job that throws on its
+   *  first send half-completes and the log is unrecoverable, so we fail
+   *  fast at the controller. */
+  get available(): boolean {
+    return this.client !== null || this.devMode;
+  }
+
+  /** True when the underlying transport is the dev console-log fallback. */
+  get isDevFallback(): boolean {
+    return this.client === null && this.devMode;
+  }
+
+  private require(): SESv2Client {
+    if (!this.client) {
+      throw new ServiceUnavailableException(
+        "El envío de correo no está configurado.",
+      );
+    }
+    return this.client;
+  }
+
+  /**
+   * Send a single HTML email. The dev fallback logs to stdout and returns a
+   * synthetic `dev-<timestamp>` message id; the real transport talks to SES
+   * and returns the SES MessageId.
+   *
+   * Throws `ServiceUnavailableException` when no transport is configured and
+   * we are not in dev — the caller (NotificationsService) catches and records
+   * it on the log row so a failed sweep produces a coherent audit trail
+   * instead of an aborted one.
+   */
+  async send(args: SendArgs): Promise<SendResult> {
+    const from = `${args.fromName ?? this.fromName} <${
+      args.from ?? this.fromAddress ?? ""
+    }>`.trim();
+
+    if (!this.client) {
+      if (!this.devMode) this.require();
+      const fakeId = `dev-${Date.now().toString(36)}-${Math.random()
+        .toString(36)
+        .slice(2, 8)}`;
+      this.logger.log(
+        `[dev-mail] to=${args.to} subject="${args.subject}" id=${fakeId} ` +
+          `len=${args.html.length}`,
+      );
+      return { messageId: fakeId, response: "" };
+    }
+
+    const input: SendEmailCommandInput = {
+      FromEmailAddress: from,
+      Destination: { ToAddresses: [args.to] },
+      Content: {
+        Simple: {
+          Subject: { Data: args.subject, Charset: "UTF-8" },
+          Body: { Html: { Data: args.html, Charset: "UTF-8" } },
+        },
+      },
+      ...(this.configurationSet
+        ? { ConfigurationSetName: this.configurationSet }
+        : {}),
+      ...(args.xTracking
+        ? {
+            EmailTags: [
+              { Name: "X-Tracking", Value: args.xTracking },
+            ],
+          }
+        : {}),
+    };
+
+    const out: SendEmailCommandOutput = await this.client.send(
+      new SendEmailCommand(input),
+    );
+    return {
+      messageId: out.MessageId ?? "",
+      response: JSON.stringify({ MessageId: out.MessageId ?? null }).slice(0, 4096),
+    };
+  }
+}

apps/api/src/notifications/notification-log.module.ts

@@ -0,0 +1,14 @@
+import { Module } from "@nestjs/common";
+import { NotificationLogService } from "./notification-log.service";
+
+/**
+ * Just the log writer, so a feature that sends mail can record it without
+ * importing `NotificationsModule` (which carries the four bulk-job pipelines
+ * and their controller). Imported by `NotificationsModule` and
+ * `RenewalsModule`.
+ */
+@Module({
+  providers: [NotificationLogService],
+  exports: [NotificationLogService],
+})
+export class NotificationLogModule {}

apps/api/src/notifications/notification-log.service.ts

@@ -0,0 +1,74 @@
+import { Injectable } from "@nestjs/common";
+import {
+  EmailNotificationServicio,
+  EmailNotificationStatus,
+  EmailNotificationType,
+} from "@jorgecuadros/database";
+import { PrismaService } from "../prisma/prisma.service";
+import { AttemptStatus } from "./notification.types";
+
+/**
+ * The single writer for `email_notification_log`.
+ *
+ * Extracted out of `NotificationsService` so the renewal sweep can write the
+ * same rows as the four bulk jobs without pulling that service (and its four
+ * job pipelines) into `RenewalsModule`. Every outbound email the platform
+ * sends goes through here, which is what makes /notificaciones' "Registro de
+ * envíos" complete rather than per-feature.
+ */
+export interface NotificationLogEntry {
+  notificationType: EmailNotificationType;
+  servicio: EmailNotificationServicio;
+  /** Defaults to now(). Pass it when the row must line up exactly with
+   *  another record of the same send (the renewal sweep pins it to
+   *  `RenewalNotice.sentAt`). */
+  sendDate?: Date;
+  /** Type-dependent discriminator — see the `level` doc on the Prisma model.
+   *  0/1 for ACCOUNT_STATUS, the generation for RENEWAL_NOTICE. */
+  level?: number | null;
+  customerId: string | null;
+  customerName: string;
+  customerEmail: string;
+  subject: string;
+  bodySnapshot: string;
+  bodyRequestUrl?: string;
+  status: AttemptStatus;
+  debug: boolean;
+  providerMessageId?: string;
+  providerResponse?: string;
+  error?: string;
+}
+
+/** `providerResponse` is a VARCHAR(191); anything longer is a provider dump
+ *  we only need the head of. Errors go to the TEXT `error` column and get
+ *  the 4k cap the schema documents. */
+const PROVIDER_RESPONSE_MAX = 180;
+const ERROR_MAX = 4096;
+
+@Injectable()
+export class NotificationLogService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async record(entry: NotificationLogEntry): Promise<void> {
+    await this.prisma.emailNotificationLog.create({
+      data: {
+        notificationType: entry.notificationType,
+        servicio: entry.servicio,
+        ...(entry.sendDate && { sendDate: entry.sendDate }),
+        level: entry.level ?? null,
+        customerId: entry.customerId,
+        customerName: entry.customerName,
+        customerEmail: entry.customerEmail,
+        subject: entry.subject,
+        bodySnapshot: entry.bodySnapshot,
+        bodyRequestUrl: entry.bodyRequestUrl ?? null,
+        debug: entry.debug,
+        providerMessageId: entry.providerMessageId ?? null,
+        providerResponse:
+          entry.providerResponse?.slice(0, PROVIDER_RESPONSE_MAX) ?? null,
+        status: entry.status as EmailNotificationStatus,
+        error: entry.error?.slice(0, ERROR_MAX) ?? null,
+      },
+    });
+  }
+}

apps/api/src/notifications/notification-schedule.module.ts

@@ -0,0 +1,15 @@
+import { Module } from "@nestjs/common";
+import { SettingsModule } from "../settings/settings.module";
+import { NotificationScheduleService } from "./notification-schedule.service";
+
+/**
+ * Just the cadence registry, split out for the same reason as
+ * `NotificationLogModule`: both `NotificationsModule` and `RenewalsModule`
+ * need it, and neither may import the other.
+ */
+@Module({
+  imports: [SettingsModule],
+  providers: [NotificationScheduleService],
+  exports: [NotificationScheduleService],
+})
+export class NotificationScheduleModule {}

apps/api/src/notifications/notification-schedule.service.ts

@@ -0,0 +1,203 @@
+import { Injectable, Logger } from "@nestjs/common";
+import { SchedulerRegistry } from "@nestjs/schedule";
+import { CronJob } from "cron";
+import { SettingsService } from "../settings/settings.service";
+import type { ResolvedSetting } from "../settings/settings.service";
+
+/**
+ * When the two automatic envíos run.
+ *
+ * Both halves of /notificaciones used to be hardcoded: pólizas swept at 06:00
+ * from a `@Cron` decorator, servicios had no automatic run at all and had to
+ * be clicked. Neither could be changed without a redeploy. This service owns
+ * the cadence for both, stores it in `app_settings`, and re-installs the job
+ * the moment an operator saves — no restart.
+ *
+ * The owning services register their handler at boot rather than this service
+ * importing them: `NotificationsService` and `RenewalsService` would otherwise
+ * have to be injected here, and this file is imported by both.
+ */
+
+export const SCHEDULE_TIME_ZONE = "America/Tijuana";
+
+export type ScheduleKind = "servicios" | "polizas";
+
+export const SCHEDULE_KINDS: ScheduleKind[] = ["servicios", "polizas"];
+
+export interface NotificationSchedule {
+  enabled: boolean;
+  /** Local hour/minute in `SCHEDULE_TIME_ZONE`, not UTC — the office thinks
+   *  in Tijuana time and DST would otherwise drift the run by an hour. */
+  hour: number;
+  minute: number;
+  /** 0 = Sunday … 6 = Saturday. Empty means every day. */
+  weekdays: number[];
+}
+
+export interface ResolvedSchedule extends ResolvedSetting<NotificationSchedule> {
+  /** The cron expression the value compiles to, shown in the UI so the
+   *  operator can see exactly what was installed. */
+  cron: string;
+  /** Next fire time, or null when disabled. */
+  nextRun: string | null;
+}
+
+/**
+ * Defaults preserve what each half did before this existed: pólizas keeps its
+ * 06:00 daily sweep, servicios stays OFF. Turning a mass send on is an
+ * operator decision — a default that starts mailing 260 customers on its own
+ * after a deploy is not a default, it's an incident.
+ */
+const DEFAULTS: Record<ScheduleKind, NotificationSchedule> = {
+  servicios: { enabled: false, hour: 7, minute: 0, weekdays: [1, 3, 5] },
+  polizas: { enabled: true, hour: 6, minute: 0, weekdays: [] },
+};
+
+/** Human label used in log lines and audit entries. */
+export const SCHEDULE_LABELS: Record<ScheduleKind, string> = {
+  servicios: "envíos de servicios",
+  polizas: "avisos de renovación",
+};
+
+export function scheduleCron(schedule: NotificationSchedule): string {
+  const dow = schedule.weekdays.length
+    ? [...new Set(schedule.weekdays)].sort((a, b) => a - b).join(",")
+    : "*";
+  return `${schedule.minute} ${schedule.hour} * * ${dow}`;
+}
+
+/** Reject anything that would compile to a cron we can't install. Returns the
+ *  normalized value, or a message naming the offending field. */
+export function parseSchedule(
+  raw: unknown,
+): { ok: true; value: NotificationSchedule } | { ok: false; error: string } {
+  const v = raw as Partial<NotificationSchedule> | null;
+  if (!v || typeof v !== "object") return { ok: false, error: "Horario inválido." };
+  const hour = Number(v.hour);
+  const minute = Number(v.minute);
+  if (!Number.isInteger(hour) || hour < 0 || hour > 23) {
+    return { ok: false, error: "La hora debe estar entre 0 y 23." };
+  }
+  if (!Number.isInteger(minute) || minute < 0 || minute > 59) {
+    return { ok: false, error: "Los minutos deben estar entre 0 y 59." };
+  }
+  const weekdays = Array.isArray(v.weekdays) ? v.weekdays.map(Number) : [];
+  if (weekdays.some((d) => !Number.isInteger(d) || d < 0 || d > 6)) {
+    return { ok: false, error: "Los días deben estar entre 0 (domingo) y 6." };
+  }
+  return {
+    ok: true,
+    value: {
+      enabled: !!v.enabled,
+      hour,
+      minute,
+      weekdays: [...new Set(weekdays)].sort((a, b) => a - b),
+    },
+  };
+}
+
+@Injectable()
+export class NotificationScheduleService {
+  private readonly logger = new Logger(NotificationScheduleService.name);
+  private readonly handlers = new Map<ScheduleKind, () => Promise<unknown>>();
+
+  constructor(
+    private readonly settings: SettingsService,
+    private readonly registry: SchedulerRegistry,
+  ) {}
+
+  /**
+   * Called once per kind at boot by the service that owns the sweep. Installs
+   * the job immediately so a freshly started process honours the stored
+   * cadence without waiting for someone to open the UI.
+   */
+  async register(kind: ScheduleKind, handler: () => Promise<unknown>) {
+    this.handlers.set(kind, handler);
+    await this.apply(kind);
+  }
+
+  async get(kind: ScheduleKind): Promise<ResolvedSchedule> {
+    const resolved = await this.settings.notificationSchedule(
+      kind,
+      DEFAULTS[kind],
+    );
+    const cron = scheduleCron(resolved.value);
+    return { ...resolved, cron, nextRun: this.nextRun(kind) };
+  }
+
+  async getAll(): Promise<Record<ScheduleKind, ResolvedSchedule>> {
+    const entries = await Promise.all(
+      SCHEDULE_KINDS.map(async (k) => [k, await this.get(k)] as const),
+    );
+    return Object.fromEntries(entries) as Record<ScheduleKind, ResolvedSchedule>;
+  }
+
+  async set(
+    kind: ScheduleKind,
+    schedule: NotificationSchedule,
+    userId: string,
+  ): Promise<ResolvedSchedule> {
+    await this.settings.setNotificationSchedule(kind, schedule, userId);
+    await this.apply(kind);
+    return this.get(kind);
+  }
+
+  /** (Re)install the cron job for one kind from whatever is stored now. */
+  private async apply(kind: ScheduleKind): Promise<void> {
+    const handler = this.handlers.get(kind);
+    if (!handler) return;
+
+    this.remove(kind);
+
+    const { value } = await this.settings.notificationSchedule(
+      kind,
+      DEFAULTS[kind],
+    );
+    if (!value.enabled) {
+      this.logger.log(`Horario de ${SCHEDULE_LABELS[kind]}: desactivado.`);
+      return;
+    }
+
+    const cron = scheduleCron(value);
+    const job = new CronJob(
+      cron,
+      () => {
+        void handler().catch((error) =>
+          this.logger.error(
+            `Falló la corrida programada de ${SCHEDULE_LABELS[kind]}: ` +
+              `${(error as Error).message}`,
+          ),
+        );
+      },
+      null,
+      false,
+      SCHEDULE_TIME_ZONE,
+    );
+    this.registry.addCronJob(this.jobName(kind), job);
+    job.start();
+    this.logger.log(
+      `Horario de ${SCHEDULE_LABELS[kind]}: ${cron} (${SCHEDULE_TIME_ZONE}).`,
+    );
+  }
+
+  private remove(kind: ScheduleKind): void {
+    const name = this.jobName(kind);
+    // `deleteCronJob` throws when the job was never installed, which is the
+    // normal case on first apply — presence check instead of try/catch so a
+    // real failure still surfaces.
+    if (!this.registry.doesExist("cron", name)) return;
+    this.registry.getCronJob(name).stop();
+    this.registry.deleteCronJob(name);
+  }
+
+  private nextRun(kind: ScheduleKind): string | null {
+    const name = this.jobName(kind);
+    if (!this.registry.doesExist("cron", name)) return null;
+    const next = this.registry.getCronJob(name).nextDate();
+    return next ? next.toJSDate().toISOString() : null;
+  }
+
+  private jobName(kind: ScheduleKind): string {
+    return `notification-schedule:${kind}`;
+  }
+}

apps/api/src/notifications/notification-schedule.spec.ts

@@ -0,0 +1,57 @@
+import { parseSchedule, scheduleCron } from "./notification-schedule.service";
+
+/**
+ * The cadence editor's only sharp edge: a stored value compiles to a cron
+ * expression that the scheduler installs verbatim. A malformed one either
+ * throws at install time (taking the sweep down) or silently installs the
+ * wrong cadence, so validation happens before anything is written.
+ */
+
+describe("scheduleCron", () => {
+  it("compiles a daily schedule with no weekday filter", () => {
+    expect(
+      scheduleCron({ enabled: true, hour: 6, minute: 0, weekdays: [] }),
+    ).toBe("0 6 * * *");
+  });
+
+  it("compiles the legacy Mon/Wed/Fri cadence, sorted and de-duplicated", () => {
+    expect(
+      scheduleCron({ enabled: true, hour: 7, minute: 30, weekdays: [5, 1, 3, 1] }),
+    ).toBe("30 7 * * 1,3,5");
+  });
+});
+
+describe("parseSchedule", () => {
+  it("normalizes weekdays and coerces enabled to a boolean", () => {
+    const parsed = parseSchedule({
+      enabled: 1,
+      hour: 6,
+      minute: 0,
+      weekdays: [3, 1, 3],
+    });
+    expect(parsed).toEqual({
+      ok: true,
+      value: { enabled: true, hour: 6, minute: 0, weekdays: [1, 3] },
+    });
+  });
+
+  it("defaults a missing weekday list to every day", () => {
+    const parsed = parseSchedule({ enabled: true, hour: 0, minute: 0 });
+    expect(parsed.ok && parsed.value.weekdays).toEqual([]);
+  });
+
+  it.each([
+    [{ enabled: true, hour: 24, minute: 0 }, "hora"],
+    [{ enabled: true, hour: 6, minute: 60 }, "minutos"],
+    [{ enabled: true, hour: 6, minute: 0, weekdays: [7] }, "días"],
+    [{ enabled: true, hour: 6.5, minute: 0 }, "hora"],
+  ])("rejects %p", (input, field) => {
+    const parsed = parseSchedule(input);
+    expect(parsed.ok).toBe(false);
+    expect(!parsed.ok && parsed.error.toLowerCase()).toContain(field);
+  });
+
+  it("rejects a non-object", () => {
+    expect(parseSchedule(null).ok).toBe(false);
+  });
+});

apps/api/src/notifications/notification.types.ts

@@ -0,0 +1,175 @@
+import {
+  EmailNotificationServicio,
+  EmailNotificationType,
+} from "@jorgecuadros/database";
+import { IsBoolean, IsEnum, IsOptional } from "class-validator";
+
+/**
+ * Where `debug` sends everything. The PHP used `rmancinas@freakma.net`;
+ * same here. Exported because the flag is platform-wide — the renewal
+ * notices honour it too, and two copies of this address would eventually
+ * disagree.
+ */
+export const DEBUG_RECIPIENT = "rmancinas@freakma.net";
+
+/**
+ * Shared flags for every notification send — the four servicios jobs and
+ * the pólizas renewal notices alike. Every endpoint takes the same shape
+ * so the UI can offer one set of switches for the whole screen; each flag
+ * is documented inline so the per-job semantics are obvious in one place.
+ *
+ * `debug`            — replace every recipient with `DEBUG_RECIPIENT` so a
+ *                      real customer never receives mail during a test run.
+ *                      Logged on every row. On the renewal side a debug send
+ *                      also does NOT write the `RenewalNotice` row, so a test
+ *                      can't gate the letter the customer is still owed.
+ * `ignoreDayRestriction` — Job 3 only: bypass the Mon/Wed/Fri (red) and
+ *                      Wed-only (yellow) day gates. Off by default so
+ *                      the on-demand sweep behaves like the legacy
+ *                      script.
+ * `useEmailLimit`    — Job 3 only: pause the sweep 1 hour after 100
+ *                      sends (a vestigial SMTP-era throttling limit).
+ *                      Off by default; SES does not need it.
+ */
+export class NotificationFlagsDto {
+  @IsOptional()
+  @IsBoolean()
+  debug?: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  ignoreDayRestriction?: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  useEmailLimit?: boolean;
+}
+
+/**
+ * What we know at job-end and put on the wire. Field names match the
+ * legacy PHP scripts' `echo json_encode(...)` so a downstream log scraper
+ * that already parses `notificationType: "sendPaymentConfirmation"`
+ * keeps working — see `~/Documents/Claude-Memory/email-notifications-spec.md`
+ * for the verbatim PHP shapes. Specifically: Job 1 reports
+ * `notificationType: "sendPaymentConfirmation"` (the legacy literal), and
+ * uses field `result` instead of `request`; the other three use
+ * `notificationType` matching the script's purpose.
+ *
+ * Every variant carries `sent/skipped/failed/debug` for the audit log;
+ * the legacy fields stay where they were so the response shape is
+ * exactly backward-compatible.
+ */
+export type NotificationJobResponse =
+  | {
+      // Job 1
+      result: "success";
+      notificationType: "sendPaymentConfirmation";
+      reason: string;
+      statusCode: 200;
+      sent: number;
+      skipped: number;
+      failed: number;
+      debug: boolean;
+      type: "OUTSTANDING_PAYMENT";
+    }
+  | {
+      // Job 2
+      request: "success";
+      notificationType: "sendPaymentConfirmation";
+      confirmationSent: string;
+      statusCode: 200;
+      sent: number;
+      skipped: number;
+      failed: number;
+      debug: boolean;
+      type: "PAYMENT_CONFIRMATION";
+    }
+  | {
+      // Job 3 — sent/skipped/failed included so the audit log can record
+      // totals without depending on (red+yellow) alone.
+      request: "success";
+      notificationType: "sendAccountStatus";
+      statusSent: string;
+      statusReport: string;
+      statusCode: 200;
+      red: number;
+      yellow: number;
+      total: number;
+      sent: number;
+      skipped: number;
+      failed: number;
+      debug: boolean;
+      type: "ACCOUNT_STATUS";
+    }
+  | {
+      // Job 4
+      request: "success";
+      notificationType: "sendTrustPaymentConfirmation";
+      confirmationSent: string;
+      statusCode: 200;
+      sent: number;
+      skipped: number;
+      failed: number;
+      debug: boolean;
+      type: "TRUST_PAYMENT_CONFIRMATION";
+    };
+
+/** The four jobs, in the order the "ejecutar todos" sweep runs them. */
+export type NotificationJobKind =
+  | "outstanding"
+  | "payment"
+  | "account"
+  | "trust";
+
+/**
+ * One entry of the run-all sweep. A job that throws does NOT abort the
+ * sweep — it is recorded with `ok: false` and the next job still runs, so a
+ * single bad query can't silently block the other three envíos.
+ */
+export interface NotificationRunAllJobResult {
+  kind: NotificationJobKind;
+  ok: boolean;
+  result?: NotificationJobResponse;
+  error?: string;
+}
+
+/**
+ * Aggregate response for `POST /notifications/run-all`. `sent/skipped/failed`
+ * are the sums across every job that completed; `jobs` keeps each job's own
+ * verbatim legacy response so the UI can still show per-job detail.
+ */
+export interface NotificationRunAllResponse {
+  request: "success";
+  notificationType: "runAllNotifications";
+  statusCode: 200;
+  debug: boolean;
+  sent: number;
+  skipped: number;
+  failed: number;
+  /** Jobs that threw — sweep continued past them. */
+  errors: number;
+  jobs: NotificationRunAllJobResult[];
+  type: "RUN_ALL";
+}
+
+/** Normalized record for a single send attempt, fed by all four jobs. */
+export interface SendAttempt {
+  notificationType: EmailNotificationType;
+  servicio: EmailNotificationServicio;
+  customerId: string | null;
+  customerName: string;
+  customerEmail: string;
+  subject: string;
+  bodySnapshot: string;
+  bodyRequestUrl?: string;
+  /** Account-status-only — 0 yellow / 1 red. Null on the other three jobs. */
+  level?: 0 | 1;
+  /** Account-status-only — DEBAJO DEL TIPO / EN ROJO. */
+  historyTipo?: string;
+  historyBalance?: string;
+  historyTCambio?: string;
+  historySolicitado?: string;
+}
+
+/** Status enum values, mirrored from `EmailNotificationStatus`. */
+export type AttemptStatus = "SENT" | "FAILED" | "SKIPPED_NO_EMAIL" | "SKIPPED_GATE";

apps/api/src/notifications/notifications.controller.ts

@@ -0,0 +1,331 @@
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Get,
+  HttpCode,
+  Param,
+  Post,
+  Put,
+  Query,
+  Req,
+  UseGuards,
+} from "@nestjs/common";
+import { Request } from "express";
+import {
+  EmailNotificationServicio,
+  EmailNotificationStatus,
+  EmailNotificationType,
+} from "@jorgecuadros/database";
+import { Transform, Type } from "class-transformer";
+import {
+  ArrayMaxSize,
+  IsArray,
+  IsBoolean,
+  IsEnum,
+  IsInt,
+  IsOptional,
+  IsString,
+  Max,
+  Min,
+} from "class-validator";
+import { AuthenticatedGuard } from "../auth/authenticated.guard";
+import { AbilityGuard } from "../auth/ability.guard";
+import { RequireAbility } from "../auth/require-ability.decorator";
+import { AuditService } from "../common/audit.service";
+import { invalidEmails, SettingsService } from "../settings/settings.service";
+import {
+  NotificationScheduleService,
+  parseSchedule,
+  SCHEDULE_KINDS,
+  ScheduleKind,
+} from "./notification-schedule.service";
+import { NotificationFlagsDto } from "./notification.types";
+import { NotificationsService } from "./notifications.service";
+
+/** Same flags for every job, query-string OR body (the PHP scripts took
+ *  both via STDIN vs HTTP-CGI — we accept either for parity). */
+class RunJobDto extends NotificationFlagsDto {}
+
+class ListLogDto {
+  @IsOptional() @Type(() => Number) @IsInt() @Min(1) page?: number;
+  @IsOptional() @Type(() => Number) @IsInt() @Min(1) @Max(200) pageSize?: number;
+  @IsOptional() @IsEnum(EmailNotificationType) type?: EmailNotificationType;
+  /** One or more servicios, comma-separated. The /notificaciones tabs each
+   *  read their own slice of the one log: Servicios passes
+   *  `CUSTOMERS,TRUST`, Pólizas passes `POLICIES`. Omitted = every servicio. */
+  @IsOptional()
+  @Transform(({ value }) =>
+    typeof value === "string"
+      ? value.split(",").map((s) => s.trim()).filter(Boolean)
+      : value,
+  )
+  @IsEnum(EmailNotificationServicio, { each: true })
+  servicio?: EmailNotificationServicio[];
+  @IsOptional() @IsEnum(EmailNotificationStatus) status?: EmailNotificationStatus;
+  @IsOptional() @IsEnum(["sent", "failed", "skipped", "all"]) view?: "sent" | "failed" | "skipped" | "all";
+}
+
+/** An empty array is valid and means "send no summaries" — the cap only
+ *  exists so a paste accident can't write an unbounded blob. */
+class AdminEmailsDto {
+  @IsArray()
+  @ArrayMaxSize(50)
+  @IsString({ each: true })
+  emails!: string[];
+}
+
+/** Cadence of one automatic envío. Ranges are re-checked by `parseSchedule`,
+ *  which is also what the scheduler itself uses — the decorators here only
+ *  reject wrong *types* so a bad payload fails at the edge. */
+class ScheduleDto {
+  @IsBoolean() enabled!: boolean;
+  @IsInt() @Min(0) @Max(23) hour!: number;
+  @IsInt() @Min(0) @Max(59) minute!: number;
+  @IsOptional() @IsArray() @IsInt({ each: true }) weekdays?: number[];
+}
+
+function actingId(req: Request): string {
+  return (req.user as { id: string }).id;
+}
+
+/**
+ * HTTP surface for the mass-notification jobs. Four trigger endpoints +
+ * two read endpoints (list log, stats). All mutations gated by the
+ * `notification:send` ability so a STAFF user can't accidentally fire a
+ * 260-mail sweep.
+ */
+@UseGuards(AuthenticatedGuard, AbilityGuard)
+@Controller("notifications")
+export class NotificationsController {
+  constructor(
+    private readonly svc: NotificationsService,
+    private readonly audit: AuditService,
+    private readonly settings: SettingsService,
+    private readonly schedule: NotificationScheduleService,
+  ) {}
+
+  /* -------------------------------------------------------------- triggers */
+
+  @Post("outstanding-payments")
+  @RequireAbility("notification:send")
+  @HttpCode(200)
+  async runOutstanding(
+    @Body() body: RunJobDto,
+    @Query() query: RunJobDto,
+    @Req() req: Request,
+  ) {
+    const flags = { ...query, ...body };
+    const result = await this.svc.runOutstandingPayments(flags);
+    void this.audit.log(actingId(req), "notification.outstanding.run", {
+      debug: !!flags.debug,
+      sent: result.sent,
+      skipped: result.skipped,
+      failed: result.failed,
+    });
+    return result;
+  }
+
+  @Post("payment-confirmation")
+  @RequireAbility("notification:send")
+  @HttpCode(200)
+  async runPaymentConfirm(
+    @Body() body: RunJobDto,
+    @Query() query: RunJobDto,
+    @Req() req: Request,
+  ) {
+    const flags = { ...query, ...body };
+    const result = await this.svc.runPaymentConfirmation(flags);
+    void this.audit.log(actingId(req), "notification.payment-confirm.run", {
+      debug: !!flags.debug,
+      sent: result.sent,
+      skipped: result.skipped,
+      failed: result.failed,
+    });
+    return result;
+  }
+
+  @Post("account-status")
+  @RequireAbility("notification:send")
+  @HttpCode(200)
+  async runAccountStatus(
+    @Body() body: RunJobDto,
+    @Query() query: RunJobDto,
+    @Req() req: Request,
+  ) {
+    const flags = { ...query, ...body };
+    const result = await this.svc.runAccountStatus(flags);
+    // Narrow the discriminated union to the ACCOUNT_STATUS variant before
+    // pulling red/yellow/total — TS can't follow this through `await` alone.
+    if (result.type === "ACCOUNT_STATUS") {
+      void this.audit.log(actingId(req), "notification.account-status.run", {
+        debug: !!flags.debug,
+        red: result.red,
+        yellow: result.yellow,
+        total: result.total,
+        sent: result.sent,
+        skipped: result.skipped,
+        failed: result.failed,
+      });
+    }
+    return result;
+  }
+
+  @Post("trust-payment-confirmation")
+  @RequireAbility("notification:send")
+  @HttpCode(200)
+  async runTrustConfirm(
+    @Body() body: RunJobDto,
+    @Query() query: RunJobDto,
+    @Req() req: Request,
+  ) {
+    const flags = { ...query, ...body };
+    const result = await this.svc.runTrustConfirmation(flags);
+    void this.audit.log(actingId(req), "notification.trust-confirm.run", {
+      debug: !!flags.debug,
+      sent: result.sent,
+      skipped: result.skipped,
+      failed: result.failed,
+    });
+    return result;
+  }
+
+  /**
+   * Run all four jobs sequentially with one set of flags. Audited as a
+   * single `notification.run-all.run` entry carrying the aggregate totals
+   * plus each job's outcome — the per-job endpoints are NOT re-audited, so
+   * the log has exactly one row per staff click.
+   */
+  @Post("run-all")
+  @RequireAbility("notification:send")
+  @HttpCode(200)
+  async runAll(
+    @Body() body: RunJobDto,
+    @Query() query: RunJobDto,
+    @Req() req: Request,
+  ) {
+    const flags = { ...query, ...body };
+    const result = await this.svc.runAll(flags);
+    void this.audit.log(actingId(req), "notification.run-all.run", {
+      debug: !!flags.debug,
+      ignoreDayRestriction: !!flags.ignoreDayRestriction,
+      useEmailLimit: !!flags.useEmailLimit,
+      sent: result.sent,
+      skipped: result.skipped,
+      failed: result.failed,
+      errors: result.errors,
+      jobs: result.jobs.map((j) => ({ kind: j.kind, ok: j.ok })),
+    });
+    return result;
+  }
+
+  /* ----------------------------------------------------------- read views */
+
+  @Get("log")
+  listLog(@Query() q: ListLogDto) {
+    const page = q.page ?? 1;
+    const pageSize = q.pageSize ?? 50;
+    return this.svc.listLog({
+      page,
+      pageSize,
+      type: q.type,
+      servicio: q.servicio,
+      status: this.mapViewStatus(q.view, q.status),
+      customerId: undefined,
+    });
+  }
+
+  @Get("stats")
+  stats(@Query() q: ListLogDto) {
+    return this.svc.stats(q.servicio);
+  }
+
+  /* -------------------------------------------------------------- settings */
+
+  /** Who receives the per-job summary email. Readable by any logged-in user
+   *  so the UI can show the current list; editing needs `setting:manage`. */
+  @Get("settings/admin-emails")
+  adminEmails() {
+    return this.settings.notificationAdminEmails();
+  }
+
+  @Put("settings/admin-emails")
+  @RequireAbility("setting:manage")
+  async setAdminEmails(@Body() dto: AdminEmailsDto, @Req() req: Request) {
+    const emails = dto.emails.map((e) => e.trim()).filter(Boolean);
+    const bad = invalidEmails(emails);
+    if (bad.length) {
+      throw new BadRequestException(
+        `Correo inválido: ${bad.join(", ")}`,
+      );
+    }
+    const result = await this.settings.setNotificationAdminEmails(
+      emails,
+      actingId(req),
+    );
+    void this.audit.log(actingId(req), "notification.settings.admin-emails", {
+      emails,
+    });
+    return result;
+  }
+
+  /* -------------------------------------------------------------- schedule */
+
+  /**
+   * Cadence of both automatic envíos. Readable by any logged-in user so the
+   * screen can show "próxima corrida" without needing edit rights; changing
+   * it needs `setting:manage`, same as the summary recipients.
+   */
+  @Get("settings/schedule")
+  schedules() {
+    return this.schedule.getAll();
+  }
+
+  @Put("settings/schedule/:kind")
+  @RequireAbility("setting:manage")
+  async setSchedule(
+    @Param("kind") kind: string,
+    @Body() dto: ScheduleDto,
+    @Req() req: Request,
+  ) {
+    if (!SCHEDULE_KINDS.includes(kind as ScheduleKind)) {
+      throw new BadRequestException(
+        `Horario desconocido: ${kind}. Use ${SCHEDULE_KINDS.join(" o ")}.`,
+      );
+    }
+    const parsed = parseSchedule({ ...dto, weekdays: dto.weekdays ?? [] });
+    if (!parsed.ok) throw new BadRequestException(parsed.error);
+
+    const result = await this.schedule.set(
+      kind as ScheduleKind,
+      parsed.value,
+      actingId(req),
+    );
+    void this.audit.log(actingId(req), "notification.settings.schedule", {
+      kind,
+      ...parsed.value,
+      cron: result.cron,
+    });
+    return result;
+  }
+
+  /** Resolve the UI's coarse view tabs to concrete statuses. An explicit
+   *  `status` wins. "Omitidos" covers both SKIPPED_* variants, which is why
+   *  this returns a list rather than a single value. */
+  private mapViewStatus(
+    view: ListLogDto["view"],
+    status: ListLogDto["status"],
+  ): EmailNotificationStatus[] | undefined {
+    if (status) return [status];
+    if (!view || view === "all") return undefined;
+    if (view === "sent") return [EmailNotificationStatus.SENT];
+    if (view === "failed") return [EmailNotificationStatus.FAILED];
+    if (view === "skipped") {
+      return [
+        EmailNotificationStatus.SKIPPED_NO_EMAIL,
+        EmailNotificationStatus.SKIPPED_GATE,
+      ];
+    }
+    return undefined;
+  }
+}

apps/api/src/notifications/notifications.module.ts

@@ -0,0 +1,22 @@
+import { Module } from "@nestjs/common";
+import { NotificationLogModule } from "./notification-log.module";
+import { NotificationScheduleModule } from "./notification-schedule.module";
+import { SettingsModule } from "../settings/settings.module";
+import { NotificationsController } from "./notifications.controller";
+import { NotificationsService } from "./notifications.service";
+
+/**
+ * Mass email notifications. MailModule is global (registered in AppModule),
+ * so this module needs no MailService import — it picks it up by injection.
+ *
+ * The automatic sweep is registered by `NotificationsService` against
+ * `NotificationScheduleService`, which owns the cadence for both halves of
+ * /notificaciones and stores it in `app_settings`.
+ */
+@Module({
+  imports: [NotificationLogModule, NotificationScheduleModule, SettingsModule],
+  controllers: [NotificationsController],
+  providers: [NotificationsService],
+  exports: [NotificationsService],
+})
+export class NotificationsModule {}

apps/api/src/notifications/render.spec.ts

@@ -0,0 +1,125 @@
+import {
+  renderAccountStatus,
+  renderOutstanding,
+  renderPaymentConfirm,
+  renderTrustConfirm,
+} from "./render";
+
+/**
+ * Render-level tests. The legacy PHP scripts fetched these bodies by URL;
+ * we render server-side and inline. The tests assert the *shape* of each
+ * body — account id, name, subject, balance/tipo, color band — because
+ * the customer base has been seeing these letters for years and a visual
+ * regression costs trust faster than any backend change does.
+ */
+
+describe("renderOutstanding", () => {
+  it("includes the customer id, name, total, and per-row table", () => {
+    const html = renderOutstanding({
+      customerId: "C-001",
+      customerName: "Acme & Co.",
+      total: "1234.50",
+      rows: [
+        {
+          date: "2026-07-01",
+          reference: "INV-1",
+          period: "Jul-26",
+          type: "CHECK",
+          amount: "-500.00",
+          balance: "-500.00",
+        },
+        {
+          date: "2026-07-15",
+          reference: "INV-2",
+          period: "Jul-26",
+          type: "CASH",
+          amount: "-734.50",
+          balance: "-1234.50",
+        },
+      ],
+      year: 2026,
+    });
+    expect(html).toContain("Acme & Co.");
+    expect(html).toContain("ACCOUNT #C-001");
+    expect(html).toContain("$ 1,234.50");
+    expect(html).toContain("INV-1");
+    expect(html).toContain("CHECK");
+    expect(html).toContain("IF YOU ALREADY SENT THE CHECK");
+  });
+
+  it("escapes HTML in the customer name", () => {
+    const html = renderOutstanding({
+      customerId: "x",
+      customerName: "<script>alert(1)</script>",
+      total: "0.00",
+      rows: [],
+      year: 2026,
+    });
+    expect(html).not.toContain("<script>alert(1)</script>");
+    expect(html).toContain("&lt;script&gt;alert(1)&lt;/script&gt;");
+  });
+});
+
+describe("renderPaymentConfirm", () => {
+  it("uses the transaction type in the heading and the amount in the body", () => {
+    const html = renderPaymentConfirm({
+      customerId: "C-002",
+      customerName: "Bob",
+      typeOfTrx: "CHECK DEPOSIT",
+      reference: "DEP-99",
+      amount: "500.00",
+      year: 2026,
+    });
+    expect(html).toContain("CHECK DEPOSIT CONFIRMATION");
+    expect(html).toContain("HI, Bob");
+    expect(html).toContain("REFER# DEP-99");
+    expect(html).toContain("$ 500.00");
+  });
+});
+
+describe("renderAccountStatus", () => {
+  it("uses the yellow band and the under-minimum phrasing for level=0", () => {
+    const html = renderAccountStatus({
+      customerId: "C-003",
+      customerName: "Carol",
+      level: 0,
+      balance: "10.00",
+      tipo: "40.00",
+      year: 2026,
+    });
+    expect(html).toContain("#88D5EE");
+    expect(html).toContain("under our minimum");
+    expect(html).toContain("Carol");
+    expect(html).toContain("$ 10.00");
+    expect(html).toContain("$ 40.00");
+  });
+
+  it("uses the red band and the rush phrasing for level=1", () => {
+    const html = renderAccountStatus({
+      customerId: "C-003",
+      customerName: "Carol",
+      level: 1,
+      balance: "-25.50",
+      tipo: "25.50",
+      year: 2026,
+    });
+    expect(html).toContain("#FF8D71");
+    expect(html).toContain("overdrawn");
+    expect(html).toContain("reactivate your payments");
+    expect(html).toContain("$ 25.50");
+  });
+});
+
+describe("renderTrustConfirm", () => {
+  it("labels the trust annual fee and quotes the amount", () => {
+    const html = renderTrustConfirm({
+      customerId: "C-004",
+      customerName: "Dan",
+      amount: "350.00",
+      year: 2026,
+    });
+    expect(html).toContain("Annual Bank Fee Payment Confirmation");
+    expect(html).toContain("$ 350.00");
+    expect(html).toContain("Most banks always request");
+  });
+});

apps/api/src/notifications/render.ts

@@ -0,0 +1,254 @@
+/**
+ * HTML body renderers for the four notification jobs. These are the modern
+ * in-process equivalent of the legacy `getXxxForEmail.php` files the PHP
+ * scripts `fetch()`ed by URL. Rendering server-side and inlining the body
+ * in the response keeps a single SES MessageId tied to one frozen HTML
+ * snapshot (vs. the legacy flow, where the URL kept re-rendering with
+ * whatever the database looked like at click time).
+ *
+ * The visual style mirrors the legacy PHP templates where it makes sense
+ * (the office's customer base has been seeing these letters for years;
+ * gratuitous redesign costs trust). The body shell, table layout and the
+ * canonical contact block are preserved verbatim. English copy because the
+ * legacy letters were English; switching to Spanish is a future decision
+ * (see INSURANCE_FEATURES_SPEC §1.6 "Spanish or English body?").
+ */
+
+const HEAD = `<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<title>{title}</title>
+</head>`;
+
+const FOOT_CONTACT = `<p>If you have any questions regarding this notice please contact us at:
+Tel. 011 52 (661) 612 - 1295 &nbsp; Fax. (661) 612 - 1285 &nbsp;
+For any type of a 24 Hrs. emergencies: please dial 52 (664) 304 - 7778 |
+<a href="mailto:jorge@jorgecuadros.com">jorge@jorgecuadros.com</a> |
+<a href="https://www.jorgecuadros.com/contactus.php">Contact Us Form</a></p>`;
+
+const SIGNED = (year: number) => `<center><span class="small">This message has been generated by the Jorge Cuadros &amp; Assoc. Information Server.<br />Copyright ${year}&nbsp;<a href="http://www.freakma.net/">Developed by FreaKmA.Net</a></span></center>`;
+
+const esc = (s: string | null | undefined): string =>
+  String(s ?? "")
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+
+const usd = (n: number | string | null | undefined): string => {
+  if (n === null || n === undefined) return "$ 0.00";
+  const v = typeof n === "string" ? Number(n) : n;
+  if (!isFinite(v)) return "$ 0.00";
+  return `$ ${v.toLocaleString("en-US", {
+    minimumFractionDigits: 2,
+    maximumFractionDigits: 2,
+  })}`;
+};
+
+/** Shared shell: a 2-column table that matches the PHP output layout. */
+function shell(opts: {
+  title: string;
+  bg: string;
+  heading: string;
+  accountId: string | number;
+  accountName: string;
+  body: string;
+  note?: string;
+  statementLink?: string;
+  year: number;
+}): string {
+  const { title, bg, heading, accountId, accountName, body, note, statementLink, year } = opts;
+  const stmt = statementLink ?? "https://my.jorgecuadros.com/";
+  return `${HEAD.replace("{title}", esc(title))}
+<body style="background-color:${bg};color:#333;font-family:'Courier New', Courier, monospace;">
+<table width="100%" border="0" cellspacing="0" cellpadding="0">
+  <tr>
+    <td width="43%" style="font-size:20px;font-weight:bold;">${esc(heading)}</td>
+    <td width="57%" style="font-size:12px;">Please do not reply to this message. For any Jorge Cuadros &amp; Assoc. customer service inquiries, visit: <a href="https://www.jorgecuadros.com/contactus.php">Customer Support</a></td>
+  </tr>
+  <tr>
+    <td><strong>${esc(accountName)}<br />ACCOUNT #${esc(String(accountId))}</strong></td>
+    <td><div align="center"><a href="${esc(stmt)}" target="_blank" style="color:#006699;font-weight:bold">Click Here to View Your Account Statement</a></div></td>
+  </tr>
+  <tr><td colspan="2">&nbsp;</td></tr>
+  <tr><td colspan="2">${body}</td></tr>
+  <tr><td colspan="2">&nbsp;</td></tr>
+  ${
+    note
+      ? `<tr><td colspan="2"><h4>${esc(note)}</h4>${FOOT_CONTACT}</td></tr>`
+      : `<tr><td colspan="2">${FOOT_CONTACT}</td></tr>`
+  }
+  <tr><td colspan="2">&nbsp;</td></tr>
+  <tr><td colspan="2">${SIGNED(year)}</td></tr>
+</table>
+</body>
+</html>`;
+}
+
+/* -------------------------------------------------------------------------- */
+/*  Outstanding payments — Job 1                                               */
+/* -------------------------------------------------------------------------- */
+
+export interface OutstandingRow {
+  date: Date | string;
+  reference: string | null;
+  period: string | null;
+  type: string | null;
+  /** Signed amount (negative for charges). */
+  amount: number | string;
+  /** Running balance in the customer's currency, after this row. */
+  balance: number | string;
+}
+
+export function renderOutstanding(args: {
+  customerId: string;
+  customerName: string;
+  total: number | string;
+  rows: OutstandingRow[];
+  year: number;
+}): string {
+  const rows = args.rows
+    .map(
+      (r) => `<tr>
+    <td>${esc(String(r.date))}</td>
+    <td>${esc(r.reference ?? "")}</td>
+    <td>${esc(r.period ?? "")}</td>
+    <td>${esc(r.type ?? "")}</td>
+    <td align="right">${esc(usd(r.amount))}</td>
+    <td align="right">${esc(usd(r.balance))}</td>
+  </tr>`,
+    )
+    .join("\n");
+
+  const body = `<p>This needs your prompt attention in order to avoid any disruption(s):</p>
+<p align="center"><strong><font color="#FF0000">TOTAL OF OUTSTANDING BILLS: ${esc(
+    usd(args.total),
+  )} PESOS.</font></strong></p>
+<table width="100%" border="0" cellpadding="0" cellspacing="0">
+  <tr><th>DATE</th><th>REFER</th><th>PERIOD</th><th>TYPEOFTRX</th><th>CHARGECREDIT</th><th>BALANCE</th></tr>
+  ${rows}
+</table>`;
+
+  return shell({
+    title: "Outstanding Payments",
+    bg: "#9CC",
+    heading: "Outstanding Payments",
+    accountId: args.customerId,
+    accountName: args.customerName,
+    body,
+    note: "NOTE : IF YOU ALREADY SENT THE CHECK, PLEASE DISREGARD THIS EMAIL",
+    year: args.year,
+  });
+}
+
+/* -------------------------------------------------------------------------- */
+/*  Payment confirmation — Job 2                                              */
+/* -------------------------------------------------------------------------- */
+
+export function renderPaymentConfirm(args: {
+  customerId: string;
+  customerName: string;
+  typeOfTrx: string;
+  reference: string | null;
+  /** The deposited amount (positive number — credits are positive in the
+   *  unified ledger). */
+  amount: number | string;
+  year: number;
+}): string {
+  const body = `<table width="100%" border="0" cellspacing="0" cellpadding="0">
+  <tr>
+    <td width="48%" style="font-size:20px;font-weight:bold;">${esc(
+      args.typeOfTrx,
+    )} CONFIRMATION</td>
+    <td width="52%" style="font-size:12px;">Please do not reply to this message. For any Jorge Cuadros &amp; Assoc. customer service inquiries, visit: <a href="https://www.jorgecuadros.com/contactus.php" target="_blank">Customer Support</a></td>
+  </tr>
+  <tr>
+    <td>
+      <strong>HI, ${esc(args.customerName)}</strong><br/>
+      <strong>ACCOUNT #${esc(args.customerId)}</strong><br/>
+      <strong>REFER# ${esc(args.reference ?? "")}</strong>
+    </td>
+    <td>
+      <div align="center" style="padding:20px;">
+        <a href="https://my.jorgecuadros.com/" target="_blank" style="color:#006699;font-weight:bold"><em>Click Here to View Your Account Statement</em></a>
+      </div>
+    </td>
+  </tr>
+  <tr><td colspan="2">&nbsp;</td></tr>
+  <tr><td colspan="2">
+    <p>Your account is now current to keep paying your future obligations. If for any reason your next bill is more than what's available; our system will email you our automatic alert requesting more funds. Thank You,</p>
+    <p align="center" style="color:#006600;font-weight:bold;">Your deposit was for ${esc(
+      usd(args.amount),
+    )} PESOS.</p>
+  </td></tr>
+  <tr><td colspan="2">&nbsp;</td></tr>
+  <tr><td colspan="2"><h4>NOTE : IF YOU ALREADY SENT THE CHECK, PLEASE DISREGARD THIS EMAIL</h4>${FOOT_CONTACT}</td></tr>
+  <tr><td colspan="2">&nbsp;</td></tr>
+  <tr><td colspan="2">${SIGNED(args.year)}</td></tr>
+</table>`;
+  return `${HEAD.replace("{title}", "Payment Confirmation")}<body>${body}</body></html>`;
+}
+
+/* -------------------------------------------------------------------------- */
+/*  Account status — Job 3 (yellow + red)                                    */
+/* -------------------------------------------------------------------------- */
+
+export function renderAccountStatus(args: {
+  customerId: string;
+  customerName: string;
+  level: 0 | 1; // 0 = yellow (DEBAJO DEL TIPO), 1 = red (EN ROJO)
+  balance: number | string;
+  /** Amount the customer needs to deposit to clear the threshold. */
+  tipo: number | string;
+  year: number;
+}): string {
+  const isYellow = args.level === 0;
+  const body = isYellow
+    ? `<p>In order to avoid any disruptions please mail or bring ${esc(
+        usd(args.tipo),
+      )} USD ASAP. As your current Balance ${esc(
+        usd(args.balance),
+      )} is under our minimum required to run this account.</p>`
+    : `<p>Sorry Account is overdrawn and all utility bills are on hold please rush ${esc(
+        usd(args.tipo),
+      )} USD these funds must be on hand ASAP to reactivate your payments.</p>`;
+  return shell({
+    title: "Account Alert",
+    bg: isYellow ? "#88D5EE" : "#FF8D71",
+    heading: "Account Alert",
+    accountId: args.customerId,
+    accountName: args.customerName,
+    body,
+    note: "NOTE : PLEASE MAKE YOUR CHECK PAYABLE TO UMC AND ASSOCIATES. IF YOU ALREADY SENT THE CHECK, PLEASE DISREGARD THIS EMAIL.",
+    year: args.year,
+  });
+}
+
+/* -------------------------------------------------------------------------- */
+/*  Trust payment confirmation — Job 4                                       */
+/* -------------------------------------------------------------------------- */
+
+export function renderTrustConfirm(args: {
+  customerId: string;
+  customerName: string;
+  /** Annual fee amount posted (positive, in MXN per the PHP). */
+  amount: number | string;
+  year: number;
+}): string {
+  const body = `<p>This automatic notice is to confirm, that your Annual Bank Fee has been paid by, and posted in your account. Thank You,</p>
+<p align="center"><strong>The annual fee was posted for the amount of <font color="#FF0000">${esc(
+    usd(args.amount),
+  )} PESOS.</font></strong></p>`;
+  return shell({
+    title: "Trust Payment Confirmation",
+    bg: "#C0BEA0",
+    heading: "Annual Bank Fee Payment Confirmation",
+    accountId: args.customerId,
+    accountName: args.customerName,
+    body,
+    note: "NOTE : Most banks always request to make such payment in advance.",
+    statementLink: "https://my.jorgecuadros.com/",
+    year: args.year,
+  });
+}

apps/api/src/ocr/ocr.module.ts

@@ -0,0 +1,18 @@
+import { Module } from "@nestjs/common";
+import { OCR_PROVIDER } from "../statements/ocr/ocr.provider";
+import { TesseractOcrProvider } from "../statements/ocr/tesseract.provider";
+
+/**
+ * Lifts the OCR seam out of StatementsModule so other modules (today:
+ * PolicyOcrModule) can inject OCR_PROVIDER without taking on the rest of
+ * the statement intake. StatementsModule itself imports this and gets the
+ * provider the same way.
+ *
+ * The concrete engine is still bound here — Tesseract today, a managed
+ * extraction API later is a one-line change in this file.
+ */
+@Module({
+  providers: [{ provide: OCR_PROVIDER, useClass: TesseractOcrProvider }],
+  exports: [OCR_PROVIDER],
+})
+export class OcrModule {}

apps/api/src/policies/policies.service.ts

@@ -358,6 +358,7 @@ export class PoliciesService {
     return this.prisma.policy.update({ where: { id }, data: { archivedAt: null } });
   }
 
+
   private async ensurePolicy(id: string) {
     const found = await this.prisma.policy.findUnique({
       where: { id },

apps/api/src/policy-ocr/parsers/policy-parser.spec.ts

@@ -0,0 +1,147 @@
+import type { OcrPage } from "../../statements/ocr/ocr.provider";
+import {
+  detectPolicyProvider,
+  parsePolicy,
+  type ParsedCoverage,
+} from "./policy-parser";
+
+/**
+ * Verbatim excerpts of what the GMX portal's translation PDF actually
+ * rendered through pdftotext — same convention as the statement parser
+ * tests, where invented-clean input would test nothing because clean input
+ * is not the failure mode.
+ */
+function page(text: string): OcrPage {
+  return { text, words: [], confidence: 0.95 };
+}
+
+describe("detectPolicyProvider", () => {
+  it("claims GMX from the brand wordmark on the letterhead", () => {
+    expect(
+      detectPolicyProvider(
+        "Grupo Mexicano de Seguros, S.A. de C.V.\nTecoyotitla 412, Edificio GMX",
+      ),
+    ).toBe("GMX");
+  });
+
+  it("claims GMX from the 'gmx.com.mx' footer URL", () => {
+    expect(detectPolicyProvider("JUNTOS EL RIESGO ES MENOR\nwww.gmx.com.mx")).toBe("GMX");
+  });
+});
+
+describe("parsePolicy / GMX", () => {
+  // Verbatim text extracted from ~/Downloads/HC_Folio_000767_Traduccion.pdf via
+  // `pdftotext -layout`. Two pages joined by "\n\n".
+  const GMX_FULL = page(
+    "Multiple Policy\nHome\n" +
+      "Policy 007-037-07005947-0000-02 in accordance with the enclosed clauses, to insurance:\n" +
+      "Insured JON ASHLEY STRABALA\n" +
+      "Additional insured VIVIAN\n" +
+      "Legal address BONAMPACK No. EXT26 No.INT 0 COL. Punta Bandera, Tijuana, Baja California, C.P. 22550\n" +
+      "ZIP 22550 Income Tax No. XEXX-010101-000\n" +
+      "Broker (1176) Jorge Humberto Cuadros\n" +
+      "Term 12 months\n" +
+      "From 19/07/2026\n" +
+      "To 19/07/2027 at twelve hours (noon) Mexico City time.\n" +
+      "Currency DOLARES Premium payment CONTADO\n" +
+      "Free translation from the Spanish Insurance contract. The English text is just copy given by courtesy. In case of a dispute, the Spanish will prevail over the English version.\n" +
+      "Agreed clauses:\n" +
+      "•The insured and GMX Hereby declared...\n" +
+      "From the above, the present contract shall not be considered under the condition mentioned within article 36-B from the Insurance Companies General Law. Therefore it shall not be required its registration before the Comision National de Seguros y Fianzas.\n" +
+      "July 23, 2026\n" +
+      "Authority sign.\n" +
+      "Grupo Mexicano de Seguros, S.A. de C.V.\n" +
+      "Tecoyotitla 412, Edificio GMX\n" +
+      "JUNTOS EL RIESGO ES MENOR\n" +
+      "www.gmx.com.mx\n\n" +
+      "Risk Insured Amount Deductible Loss Participation\n" +
+      "Building $350,000.00 Not applies Not applies\n" +
+      "Contents $60,000.00 Not applies Not applies\n" +
+      "ADDITIONAL RISK\n" +
+      "Risk Insured Amount Deductible Loss Participation\n" +
+      "Debris removal Building $35,000.00 Not applies Not applies\n" +
+      "Debris removal Contents $6,000.00 Not applies Not applies\n" +
+      "Outdoors Constructions $10,000.00 5% 10%\n" +
+      "Coverage Extention Covered Not applies Not applies\n" +
+      "All Risk Covered Not applies Not applies\n" +
+      "Earthquake and/or volcanic eruption Covered 2% of the sum insured for each damage structure 20%\n" +
+      "Extra Expenses $41,000.00 Not applies Not applies\n" +
+      "Robbery with violence $10,000.00 Not applies Not applies\n" +
+      "Jewerly $3,900.00 Not applies Not applies\n" +
+      "Electronic Equipment $10,000.00 Not applies Not applies\n" +
+      "Glasses $10,000.00 Not applies Not applies\n" +
+      "Tenant $200,000.00 Not applies Not applies\n" +
+      "Family $200,000.00 Not applies Not applies\n" +
+      "Family $200,000.00 Not applies Not applies\n" +
+      "Domestic workers $7,010.00 Not applies Not applies\n" +
+      "VALUES ADDED, HOME GMX",
+  );
+
+  it("extracts the policy number, insured name, broker, dates, and currency", () => {
+    const p = parsePolicy(GMX_FULL);
+    expect(p.provider).toBe("GMX");
+    expect(p.policyNumber).toBe("007-037-07005947-0000-02");
+    expect(p.insuredName).toBe("JON ASHLEY STRABALA");
+    expect(p.additionalInsured).toBe("VIVIAN");
+    expect(p.agentName).toBe("Jorge Humberto Cuadros");
+    expect(p.policyFrom?.toISOString().slice(0, 10)).toBe("2026-07-19");
+    expect(p.policyTo?.toISOString().slice(0, 10)).toBe("2027-07-19");
+    expect(p.policyDate?.toISOString().slice(0, 10)).toBe("2026-07-23");
+    expect(p.currency).toBe("USD");
+    expect(p.zip).toBe("22550");
+    expect(p.legalAddress).toContain("BONAMPACK");
+    expect(p.premiumPayment).toBe("CONTADO");
+  });
+
+  it("extracts every coverage row off the second page table", () => {
+    const p = parsePolicy(GMX_FULL);
+    const byName = Object.fromEntries(p.coverages.map((c) => [c.risk, c]));
+    expect(byName.Building?.insuredAmount).toBe(350000);
+    expect(byName.Contents?.insuredAmount).toBe(60000);
+    expect(byName["Debris removal Building"]?.insuredAmount).toBe(35000);
+    expect(byName["Outdoors Constructions"]?.insuredAmount).toBe(10000);
+    expect(byName["Outdoors Constructions"]?.deductible).toBe("5%");
+    expect(byName["Outdoors Constructions"]?.lossParticipation).toBe("10%");
+    // Free-text coverage cells kept verbatim (the policy form surfaces them
+    // as observations, not as numbers).
+    expect(byName["Earthquake and/or volcanic eruption"]?.insuredAmount).toBeNull();
+    expect(byName["Earthquake and/or volcanic eruption"]?.deductible).toContain("2%");
+    expect(byName["Earthquake and/or volcanic eruption"]?.lossParticipation).toBe("20%");
+    expect(byName["All Risk"]?.insuredAmount).toBeNull();
+    expect(p.coverages.length).toBeGreaterThan(10);
+  });
+
+  it("leaves premium fields null on the certificate page and notes it", () => {
+    const p = parsePolicy(GMX_FULL);
+    expect(p.netPremium).toBeNull();
+    expect(p.total).toBeNull();
+    expect(p.policyFee).toBeNull();
+    expect(p.notes.join(" ")).toMatch(/prima/i);
+  });
+
+  it("still parses when the broker parens are missing", () => {
+    const p = parsePolicy(
+      page(
+        "Insured JON ASHLEY STRABALA\nBroker Jorge Humberto Cuadros\n" +
+          "From 19/07/2026\nTo 19/07/2027\nCurrency DOLARES\n" +
+          "Grupo Mexicano de Seguros",
+      ),
+    );
+    expect(p.agentName).toBe("Jorge Humberto Cuadros");
+  });
+
+  it("rejects a page that carries no GMX signal at all", () => {
+    const p = parsePolicy(page("Random unrelated document with no policy data."));
+    expect(p.provider).toBe("");
+    expect(p.notes.join(" ")).toContain("no se reconoció el proveedor");
+  });
+
+  it("captures the deductible / loss-participation columns verbatim as strings", () => {
+    const p = parsePolicy(GMX_FULL);
+    const eq = p.coverages.find((c) => c.risk === "Earthquake and/or volcanic eruption");
+    expect(eq).toBeDefined();
+    const eqTyped = eq as ParsedCoverage;
+    expect(eqTyped.deductible).toContain("sum insured");
+    expect(eqTyped.lossParticipation).toBe("20%");
+  });
+});

apps/api/src/policy-ocr/parsers/policy-parser.ts

@@ -0,0 +1,422 @@
+import type { OcrPage } from "../../statements/ocr/ocr.provider";
+
+/**
+ * What one parsed policy page yields. All fields are nullable because each
+ * provider prints a different subset (GMX's certificate has no premium
+ * breakdown, only insured amounts; GMX's receipt page would carry the
+ * premium), and the matcher + the review queue both work better with
+ * "field was read" vs "field was not" rather than guessing.
+ */
+export interface ParsedPolicy {
+  /** "GMX" today; the dispatcher lives on `detectProvider`. */
+  provider: string;
+  policyNumber: string | null;
+  insuredName: string | null;
+  additionalInsured: string | null;
+  /** The "Broker" line on GMX — mapped onto `Policy.agentName`. */
+  agentName: string | null;
+  legalAddress: string | null;
+  zip: string | null;
+  policyFrom: Date | null;
+  policyTo: Date | null;
+  /** Signature/issue date — `Policy.policyDate`. */
+  policyDate: Date | null;
+  /** "MXN" | "USD" | …, derived from the printed currency word. */
+  currency: string | null;
+  netPremium: number | null;
+  policyFee: number | null;
+  brokerFee: number | null;
+  total: number | null;
+  /** "CONTADO" / "MENSUAL" / … — premium-payment cadence text. */
+  premiumPayment: string | null;
+  /**
+   * GMX prints per-coverage rows in a table: Building / Contents /
+   * Earthquake / … with insured amount, deductible, loss participation.
+   * Preserved verbatim so a missing premium receipt still leaves the
+   * coverages auditable on the Policy row.
+   */
+  coverages: ParsedCoverage[];
+  /** Human-readable trail of what was read, surfaced in the review queue. */
+  notes: string[];
+}
+
+export interface ParsedCoverage {
+  /** "Building", "Contents", "Debris removal Building", "Earthquake…". */
+  risk: string;
+  insuredAmount: number | null;
+  deductible: string | null;
+  lossParticipation: string | null;
+}
+
+// --- shared helpers ---------------------------------------------------------
+
+const DIGIT_CONFUSIONS: Record<string, string> = {
+  O: "0", o: "0", D: "0", I: "1", l: "1", "|": "1", S: "5", B: "8",
+};
+
+/**
+ * Tesseract confuses these glyphs inside numeric runs with some regularity.
+ * Same map and same caveat as the statement parser: ONLY apply to fields
+ * known to be digits, never to free text.
+ */
+function toDigits(s: string | null | undefined): string {
+  if (!s) return "";
+  return s
+    .split("")
+    .map((c) => DIGIT_CONFUSIONS[c] ?? c)
+    .join("")
+    .replace(/\D/g, "");
+}
+
+/**
+ * Parse a printed amount, treating `,` and `.` by position rather than by
+ * assumption. Same algorithm as the statement parser — kept here so the
+ * policy module is self-contained, since importing from `../../statements`
+ * would couple two unrelated domains through a helper.
+ */
+function money(s: string | null | undefined): number | null {
+  if (!s) return null;
+  const cleaned = s.replace(/[\s$]/g, "");
+
+  let m = cleaned.match(/^(\d{1,3}(?:[.,]\d{3})+)([.,]\d{1,2})?$/);
+  if (m) {
+    const whole = m[1].replace(/[.,]/g, "");
+    const cents = m[2] ? m[2].slice(1) : "";
+    return Number(cents ? `${whole}.${cents.padEnd(2, "0")}` : whole);
+  }
+
+  m = cleaned.match(/^(\d+)[.,](\d{2})$/);
+  if (m) return Number(`${m[1]}.${m[2]}`);
+
+  const n = Number(cleaned.replace(/[,.]/g, ""));
+  return Number.isFinite(n) ? n : null;
+}
+
+function firstMatch(text: string, patterns: RegExp[]): string | null {
+  for (const p of patterns) {
+    const m = text.match(p);
+    if (m?.[1]) return m[1].trim();
+  }
+  return null;
+}
+
+const MONTHS: Record<string, number> = {
+  ENE: 0, FEB: 1, MAR: 2, ABR: 3, MAY: 4, JUN: 5,
+  JUL: 6, AGO: 7, SEP: 8, OCT: 9, NOV: 10, DIC: 11,
+};
+
+/**
+ * DD/MM/YYYY (GMX) and the dash-separated ISO variants. Two-digit years are
+ * windowed: < 50 → 20YY, ≥ 50 → 19YY, matching what a 1950-2049 window
+ * expects from a paper document.
+ */
+function parseDate(raw: string | null | undefined): Date | null {
+  if (!raw) return null;
+  const s = raw.trim();
+
+  let m = s.match(/^(\d{1,2})\/(\d{1,2})\/(\d{4})$/);
+  if (m) return utc(+m[3], +m[2] - 1, +m[1]);
+
+  m = s.match(/^(\d{1,2})[-\s/]([A-Z]{3})[-\s/](\d{2,4})$/i);
+  if (m && MONTHS[m[2].toUpperCase()] !== undefined) {
+    const yr = +m[3];
+    const y = m[3].length === 2 ? (yr < 50 ? 2000 + yr : 1900 + yr) : yr;
+    return utc(y, MONTHS[m[2].toUpperCase()], +m[1]);
+  }
+
+  m = s.match(/^(\d{4})[-/](\d{1,2})[-/](\d{1,2})$/);
+  if (m) return utc(+m[1], +m[2] - 1, +m[3]);
+
+  // "July 23, 2026" — the signature date on the GMX certificate.
+  m = s.match(/^([A-Za-z]+)\s+(\d{1,2}),\s*(\d{4})$/);
+  if (m) {
+    const MONTH_NAMES: Record<string, number> = {
+      january: 0, february: 1, march: 2, april: 3, may: 4, june: 5,
+      july: 6, august: 7, september: 8, october: 9, november: 10, december: 11,
+    };
+    const mo = MONTH_NAMES[m[1].toLowerCase()];
+    if (mo !== undefined) return utc(+m[3], mo, +m[2]);
+  }
+
+  return null;
+}
+
+function utc(y: number, mo: number, d: number): Date | null {
+  const dt = new Date(Date.UTC(y, mo, d));
+  return Number.isNaN(dt.getTime()) ? null : dt;
+}
+
+/** Map the printed currency word onto an ISO code. */
+function currencyCode(raw: string | null | undefined): string | null {
+  if (!raw) return null;
+  const s = raw.trim().toUpperCase();
+  if (s.startsWith("PESO") || s === "MXN" || s.includes("NACIONAL")) return "MXN";
+  if (s.startsWith("DOLAR") || s === "USD" || s.includes("DOLLAR")) return "USD";
+  if (s === "EUR" || s.includes("EURO")) return "EUR";
+  return null;
+}
+
+// --- provider detection -----------------------------------------------------
+
+/**
+ * Brand first, layout as a fallback. Same ordering rule as the statement
+ * parser: a brand wordmark is the cheapest, most reliable discriminator, and
+ * a layout rule that runs first can wrongly claim a page that happens to
+ * carry the same shape string (the statement parser's lesson with CFE vs
+ * GAS on "PERIODO FACTURADO").
+ */
+const BRAND: [string, RegExp][] = [
+  ["GMX", /\bGMX\b|Grupo\s*Mexicano\s*de\s*Seguros|gmx\.com\.mx|JUNTOS\s*EL\s*RIESGO\s*ES\s*MENOR/i],
+];
+
+const LAYOUT: [string, RegExp][] = [
+  ["GMX", /Multiple\s*Policy|IMPUESTO\s*PREDIAL[\s\S]{0,80}EN\s*FECHA|Material\s*damages\s*Section/i],
+];
+
+export function detectPolicyProvider(text: string): string | null {
+  for (const group of [BRAND, LAYOUT]) {
+    for (const [name, pattern] of group) {
+      if (pattern.test(text)) return name;
+    }
+  }
+  return null;
+}
+
+// --- parsers ----------------------------------------------------------------
+
+const PARSERS: Record<string, (page: OcrPage) => ParsedPolicy> = {
+  GMX: parseGmx,
+};
+
+const EMPTY_COVERAGE: ParsedCoverage = {
+  risk: "",
+  insuredAmount: null,
+  deductible: null,
+  lossParticipation: null,
+};
+
+export function parsePolicy(page: OcrPage): ParsedPolicy {
+  const provider = detectPolicyProvider(page.text);
+  if (!provider) {
+    return {
+      provider: "",
+      policyNumber: null,
+      insuredName: null,
+      additionalInsured: null,
+      agentName: null,
+      legalAddress: null,
+      zip: null,
+      policyFrom: null,
+      policyTo: null,
+      policyDate: null,
+      currency: null,
+      netPremium: null,
+      policyFee: null,
+      brokerFee: null,
+      total: null,
+      premiumPayment: null,
+      coverages: [],
+      notes: ["no se reconoció el proveedor"],
+    };
+  }
+  return PARSERS[provider](page);
+}
+
+// --- GMX --------------------------------------------------------------------
+
+/**
+ * GMX policy certificate layout (this is the translation PDF — the Spanish
+ * version is the canonical source, but every GMX portal download is a
+ * translation so the parser can rely on these English labels).
+ *
+ * Page 1 carries the contract header in a single boxed table:
+ *   Policy | Insured | Additional insured | Legal address | ZIP | Income Tax No.
+ *   Broker | Term | From | To | Currency | Premium payment
+ * followed by an "Agreed clauses" block, the signature date, and the GMX
+ * letterhead.
+ *
+ * Page 2 carries the per-coverage table (Risk / Insured Amount / Deductible /
+ * Loss Participation) under "Material damages Section" and "ADDITIONAL RISK".
+ *
+ * Premium / total / fees are NOT on the certificate page — they live on
+ * GMX's separate "recibo" PDF. The parser leaves them null and flags the
+ * gap in `notes`; the matcher still proposes a Policy update from the
+ * certificate alone, and the staff confirm step fills premium in by hand
+ * or after a follow-up receipt upload.
+ */
+function parseGmx(page: OcrPage): ParsedPolicy {
+  const text = page.text;
+  const notes: string[] = [];
+
+  // ----- header table (page 1) --------------------------------------------
+  // The Policy row repeats the number in a long run:
+  //   "Policy 007-037-07005947-0000-02 in accordance with the enclosed clauses…"
+  // so taking the first token-shaped number is correct; the trailing prose
+  // never looks like one. The dashes are part of the printed number — keep
+  // them (don't run toDigits, which would flatten them).
+  const policyNumber = firstMatch(text, [
+    /\bPolicy\s+([0-9OIlSBD]{3,4}[-\s][0-9OIlSBD]{3}[-\s][0-9OIlSBD]{8}[-\s][0-9OIlSBD]{4}[-\s][0-9OIlSBD]{2})/i,
+    /\bPolicy\s+([0-9OIlSBD][0-9OIlSBD\s-]{9,30})/,
+  ]);
+
+  // "Insured   JON ASHLEY STRABALA" — label, then 1+ whitespace, then the name.
+  // Names can carry accents (ÁVILA) or apostrophes (O'NEILL); the label is
+  // always upper-case English on this layout, so case is reliable.
+  const insuredName = labelValue(text, /^Insured\s+([A-ZÁÉÍÓÚÑ'][A-ZÁÉÍÓÚÑ '\-.]+)$/m);
+  const additionalInsured = labelValue(text, /^Additional\s+insured\s+([A-ZÁÉÍÓÚÑ '\-.]+)$/m);
+
+  // Legal address is a single long line; the parser keeps it whole.
+  const legalAddress = labelValue(text, /^Legal\s+address\s+(.+)$/m);
+  const zip = labelValue(text, /^ZIP\s+(\d{4,6})\b/m);
+  if (!zip && legalAddress) {
+    // Last resort: zip often appears at the tail of the address run too
+    // ("…C.P. 22550"). Cheap regex, no false-positive cost on this layout.
+    const m = legalAddress.match(/\b(\d{5})\b/);
+    if (m) notes.push(`ZIP leído de la dirección (${m[1]})`);
+  }
+
+  // Broker line on GMX: "(1176) Jorge Humberto Cuadros" — the number is the
+  // agent code, the name is what lands on `Policy.agentName`. The parens
+  // are optional: a future layout or scan drop them.
+  const brokerRaw = labelValue(text, /^Broker\s+(?:\(\d+\)\s*)?(.+)$/m);
+  const agentName = brokerRaw?.trim() ?? null;
+
+  // Term: "12 months" — informational, not a free-standing date. Stored in
+  // notes; the UI can derive `coveragePeriodDays` from From/To anyway.
+  const term = firstMatch(text, [/^Term\s+(\d+\s+months?)$/m]);
+  if (term) notes.push(`vigencia: ${term}`);
+
+  const policyFrom = parseDate(
+    labelValue(text, /^From\s+(\d{1,2}\/\d{1,2}\/\d{4})\b/m),
+  );
+  const policyTo = parseDate(
+    firstMatch(text, [/^To\s+(\d{1,2}\/\d{1,2}\/\d{4})\b/m]),
+  );
+
+  // "at twelve hours (noon) Mexico City time." — kept in notes only.
+  if (/twelve\s*hours|noon/i.test(text)) notes.push("vencimiento a las 12:00 hora del centro");
+
+  // The Currency / Premium payment cells sit next to each other on one
+  // line; pull them with bounded matches so the trailing label of the
+  // adjacent cell doesn't swallow the wrong value.
+  const currency = currencyCode(labelValue(text, /^Currency\s+(\S+?)(?:\s+Premium\s+payment|$)/m));
+  const premiumPayment = labelValue(text, /Premium\s+payment\s+(\S+)$/m);
+
+  // ----- signature date (page 1) -----------------------------------------
+  // Appears above the signature line on its own: "July 23, 2026".
+  const dateMatch = text.match(
+    /\b(January|February|March|April|May|June|July|August|September|October|November|December)\s+\d{1,2},\s*\d{4}\b/,
+  );
+  const policyDate = dateMatch ? parseDate(dateMatch[0]) : null;
+  if (!policyDate) notes.push("no se pudo leer la fecha de firma");
+
+  // ----- coverages table (page 2) -----------------------------------------
+  const coverages = parseGmxCoverages(text, notes);
+
+  if (!policyNumber) notes.push("no se pudo leer el número de póliza");
+  if (!policyFrom || !policyTo) notes.push("no se pudo leer el período de vigencia");
+  // Premium fields are expected to be missing on the certificate page; flag
+  // it explicitly so the reviewer knows to look for a separate receipt.
+  if (!text.match(/Prima\s*neta|net\s*premium/i)) {
+    notes.push("esta página no trae prima; revisar el recibo de GMX por separado");
+  }
+
+  return {
+    provider: "GMX",
+    policyNumber: policyNumber ? policyNumber.replace(/\s+/g, "") : null,
+    insuredName,
+    additionalInsured,
+    agentName,
+    legalAddress,
+    zip,
+    policyFrom,
+    policyTo,
+    policyDate,
+    currency,
+    netPremium: null,
+    policyFee: null,
+    brokerFee: null,
+    total: null,
+    premiumPayment,
+    coverages,
+    notes,
+  };
+}
+
+/**
+ * Read the value that follows a `LABEL` on the same line. Used by every
+ * "Label    Value" cell on the GMX header table — matches on the line
+ * itself rather than across the page, so a label that also appears in body
+ * text can't accidentally claim a different cell.
+ */
+function labelValue(text: string, pattern: RegExp): string | null {
+  const m = text.match(pattern);
+  if (!m?.[1]) return null;
+  return m[1].replace(/\s+/g, " ").trim();
+}
+
+/**
+ * Walk the GMX per-coverage table on page 2.
+ *
+ * Real sample row (single-line representation of the table after pdftotext
+ * flattens it; the real layout uses fixed columns):
+ *   "Building                  $350,000.00   Not applies   Not applies"
+ *
+ * The four columns are:
+ *   Risk (left), Insured Amount ($ figure OR the word "Covered"),
+ *   Deductible (free text — "Not applies", "5%", "2% of the sum insured…"),
+ *   Loss Participation (same).
+ *
+ * "Covered" means the coverage is included with no dollar cap. We record
+ * the word so the review queue surfaces it instead of inventing a number.
+ *
+ * Deductible / Loss Participation are kept as printed strings, not
+ * converted to numbers — a "20%" loss participation is a different field
+ * shape from a "$5,000" deductible and the JSON column lets the UI render
+ * either verbatim.
+ *
+ * Multi-line cells (the "Earthquake" row's deductible wraps to three lines
+ * because the column is narrow) are collapsed by joining consecutive
+ * non-table-body lines onto the previous row's deductible cell before
+ * applying the column regex.
+ */
+function parseGmxCoverages(text: string, notes: string[]): ParsedCoverage[] {
+  const out: ParsedCoverage[] = [];
+
+  // Stop at "VALUES ADDED" — the trailing prose section (homeowner
+  // services, legal text) is not a coverage table. Re-enter at
+  // "ADDITIONAL RISK" for the second coverage block on page 2.
+  const segments = text.split(/VALUES\s*ADDED/i)[0].split(/ADDITIONAL\s*RISK/i);
+
+  // `[ \t]` (not `\s`) inside a cell: the deductible/loss-participation
+  // columns may wrap onto several lines in the raw `pdftotext` output, and
+  // matching across newlines silently swallows the next row.
+  const re = /^([A-Za-zÁÉÍÓÚÑ][A-Za-zÁÉÍÓÚÑ /\-.]+?)[ \t]+(\$[\d,.]+|Covered|Not[ \t]+applies)[ \t]+(\S+(?:[ \t]\S+){0,8})[ \t]+(\S+(?:[ \t]\S+){0,8})[ \t]*$/gim;
+  let m: RegExpExecArray | null;
+  for (const seg of segments) {
+    re.lastIndex = 0;
+    while ((m = re.exec(seg)) !== null) {
+      const risk = m[1].trim();
+      const amountCell = m[2].trim();
+      const deductible = m[3].trim();
+      const lossParticipation = m[4].trim();
+
+      // Skip the "Risk / Insured Amount / Deductible / Loss Participation"
+      // header row itself, which matches the same regex.
+      if (/^Risk$/i.test(risk) && /Insured\s*Amount/i.test(amountCell)) continue;
+
+      out.push({
+        risk,
+        insuredAmount:
+          amountCell === "Covered" || amountCell === "Not applies"
+            ? null
+            : money(amountCell),
+        deductible,
+        lossParticipation,
+      });
+    }
+  }
+
+  if (out.length === 0) notes.push("no se encontraron coberturas en la tabla");
+  return out;
+}

apps/api/src/policy-ocr/policy-matcher.service.ts

@@ -0,0 +1,101 @@
+import { Injectable } from "@nestjs/common";
+import { PrismaService } from "../prisma/prisma.service";
+import type { ParsedPolicy } from "./parsers/policy-parser";
+
+export interface MatchResult {
+  policyId: string | null;
+  customerId: string | null;
+  /** Why it landed here — shown in the review queue verbatim. */
+  note: string;
+  /** True only for an unambiguous hit on `Policy.policyNumber`. */
+  confident: boolean;
+  /**
+   * Every policy that carries the parsed number, with its customer. >1 means
+   * the policy number is shared across customers and a human must pick.
+   */
+  candidates: { policyId: string; customerId: string; customerName: string; policyNumber: string }[];
+}
+
+/**
+ * Resolves a parsed policy page to an existing Policy (and its customer) the
+ * office already holds.
+ *
+ * **Match on `Policy.policyNumber` alone, never on the printed insured name.**
+ * The certificate's "Insured" line is the account's registrant, which drifts
+ * from the current owner — the same problem the statement matcher cites for
+ * utility bills ("ARNAIZ ROSAS ELSA AURORA" on a CESPT receipt for a
+ * customer this office holds as "CATT, RANDY"). Names are surfaced for the
+ * reviewer to sanity-check and never feed matching.
+ *
+ * A policy number that matches zero rows means the policy is new: the
+ * review screen then offers a customer picker and the confirm step creates
+ * the row. Multiple hits are surfaced rather than auto-picked — duplicate
+ * policy numbers across customers do occur (same group policy bound by two
+ * related parties), and picking one arbitrarily would silently book the
+ * wrong coverage.
+ */
+@Injectable()
+export class PolicyMatcherService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async match(parsed: ParsedPolicy): Promise<MatchResult> {
+    if (!parsed.policyNumber) {
+      return this.unmatched("no se pudo leer el número de póliza");
+    }
+
+    const rows = await this.prisma.policy.findMany({
+      where: { policyNumber: parsed.policyNumber },
+      select: {
+        id: true,
+        policyNumber: true,
+        customerId: true,
+        customer: { select: { name: true } },
+      },
+    });
+
+    const candidates = rows.map((r) => ({
+      policyId: r.id,
+      customerId: r.customerId,
+      customerName: r.customer.name,
+      policyNumber: r.policyNumber,
+    }));
+
+    if (rows.length === 0) {
+      return {
+        policyId: null,
+        customerId: null,
+        note: `no se encontró ninguna póliza con el número ${parsed.policyNumber}`,
+        confident: false,
+        candidates: [],
+      };
+    }
+
+    if (rows.length > 1) {
+      return {
+        policyId: null,
+        customerId: null,
+        note: `${rows.length} pólizas comparten el número ${parsed.policyNumber}`,
+        confident: false,
+        candidates,
+      };
+    }
+
+    return {
+      policyId: candidates[0].policyId,
+      customerId: candidates[0].customerId,
+      note: `coincidencia exacta por número de póliza ${parsed.policyNumber}`,
+      confident: true,
+      candidates,
+    };
+  }
+
+  private unmatched(note: string): MatchResult {
+    return {
+      policyId: null,
+      customerId: null,
+      note,
+      confident: false,
+      candidates: [],
+    };
+  }
+}

apps/api/src/policy-ocr/policy-ocr.controller.ts

@@ -0,0 +1,173 @@
+import {
+  Body,
+  Controller,
+  Get,
+  Param,
+  Patch,
+  Post,
+  Query,
+  Req,
+  Res,
+  StreamableFile,
+  UploadedFiles,
+  UseGuards,
+  UseInterceptors,
+} from "@nestjs/common";
+import { FilesInterceptor } from "@nestjs/platform-express";
+import type { Request, Response } from "express";
+import { AuthenticatedGuard } from "../auth/authenticated.guard";
+import { AbilityGuard } from "../auth/ability.guard";
+import { RequireAbility } from "../auth/require-ability.decorator";
+import { AuditService } from "../common/audit.service";
+import type { UploadedFileLike } from "../storage/upload-file";
+import { PolicyOcrService } from "./policy-ocr.service";
+import {
+  ConfirmPolicyBatchDto,
+  CreatePolicyOcrBatchDto,
+  ReviewPolicyDocumentDto,
+} from "./policy-ocr.dto";
+
+/**
+ * Insurance OCR intake (policy_ocr_intake).
+ *
+ * Mirrors StatementsController shape: one batch = one upload session of
+ * policy PDFs from a provider portal (GMX today), one document per page.
+ * Confirming a batch delegates nothing to a separate billing path —
+ * everything goes through `Policy` (and optionally a Transaction for the
+ * premium), the same tables the manual `PolicyForm` writes.
+ */
+@Controller("policy-ocr")
+@UseGuards(AuthenticatedGuard, AbilityGuard)
+export class PolicyOcrController {
+  constructor(
+    private readonly policyOcr: PolicyOcrService,
+    private readonly audit: AuditService,
+  ) {}
+
+  private actingId(req: Request): string {
+    return (req.user as { id: string } | undefined)?.id ?? "";
+  }
+
+  @Get("status")
+  async status() {
+    return {
+      ocrAvailable: await this.policyOcr.ocrAvailable(),
+      storageAvailable: this.policyOcr.storageAvailable(),
+    };
+  }
+
+  @Get("batches")
+  listBatches(@Query("page") page?: string, @Query("pageSize") pageSize?: string) {
+    return this.policyOcr.listBatches(
+      Math.max(1, Number(page) || 1),
+      Math.min(100, Math.max(1, Number(pageSize) || 25)),
+    );
+  }
+
+  @Get("batches/:id")
+  getBatch(@Param("id") id: string) {
+    return this.policyOcr.getBatch(id);
+  }
+
+  @Get("batches/:id/documents")
+  listDocuments(@Param("id") id: string) {
+    return this.policyOcr.listDocuments(id);
+  }
+
+  /**
+ * The source PDF for a parsed policy document. One PDF = one parsed policy,
+ * so this returns the entire upload (typically multi-page for insurance
+ * certificates). The review screen embeds it in an iframe.
+ */
+@Get("documents/:id/page")
+async pageImage(
+  @Param("id") id: string,
+  @Res({ passthrough: true }) res: Response,
+) {
+  const { stream, contentType, contentLength } = await this.policyOcr.pageImage(id);
+  res.set({
+    // The doc row stores the source PDF, not a rendered page image.
+    "Content-Type": contentType ?? "application/pdf",
+    ...(contentLength ? { "Content-Length": String(contentLength) } : {}),
+  });
+  return new StreamableFile(stream);
+}
+
+  // --- writes ---------------------------------------------------------------
+
+  @Post("batches")
+  @RequireAbility("policy:ingest")
+  @UseInterceptors(
+    FilesInterceptor("files", 25, { limits: { fileSize: 50 * 1024 * 1024 } }),
+  )
+  async createBatch(
+    @UploadedFiles() files: UploadedFileLike[] | undefined,
+    @Body() _dto: CreatePolicyOcrBatchDto,
+    @Query("label") label: string | undefined,
+    @Req() req: Request,
+  ) {
+    const batch = await this.policyOcr.createBatch(
+      files ?? [],
+      this.actingId(req),
+      label ?? _dto.label,
+    );
+    void this.audit.log(this.actingId(req), "policyOcr.batch.create", {
+      batchId: batch.id,
+      fileCount: batch.fileCount,
+    });
+    return batch;
+  }
+
+  @Patch("documents/:id")
+  @RequireAbility("policy:ocr-review")
+  async review(
+    @Param("id") id: string,
+    @Body() dto: ReviewPolicyDocumentDto,
+    @Req() req: Request,
+  ) {
+    const doc = await this.policyOcr.review(id, dto, this.actingId(req));
+    void this.audit.log(this.actingId(req), "policyOcr.document.review", {
+      documentId: id,
+      status: doc.status,
+    });
+    return doc;
+  }
+
+  @Post("documents/:id/reject")
+  @RequireAbility("policy:ocr-review")
+  async reject(@Param("id") id: string, @Req() req: Request) {
+    const doc = await this.policyOcr.reject(id, this.actingId(req));
+    void this.audit.log(this.actingId(req), "policyOcr.document.reject", {
+      documentId: id,
+    });
+    return doc;
+  }
+
+  /** Abandon a batch pending review — rejects every unapplied page. */
+  @Post("batches/:id/discard")
+  @RequireAbility("policy:ocr-review")
+  async discard(@Param("id") id: string, @Req() req: Request) {
+    const result = await this.policyOcr.discardBatch(id, this.actingId(req));
+    void this.audit.log(this.actingId(req), "policyOcr.batch.discard", {
+      batchId: id,
+      rejected: result.rejected,
+    });
+    return result;
+  }
+
+  @Post("batches/:id/confirm")
+  @RequireAbility("policy:ocr-review")
+  async confirm(
+    @Param("id") id: string,
+    @Body() dto: ConfirmPolicyBatchDto,
+    @Req() req: Request,
+  ) {
+    const result = await this.policyOcr.confirmBatch(id, dto, this.actingId(req));
+    void this.audit.log(this.actingId(req), "policyOcr.batch.confirm", {
+      batchId: id,
+      applied: result.applied,
+      postedTransactions: result.postedTransactions,
+    });
+    return result;
+  }
+}

apps/api/src/policy-ocr/policy-ocr.dto.ts

@@ -0,0 +1,85 @@
+import { Type } from "class-transformer";
+import {
+  IsArray,
+  IsDateString,
+  IsEnum,
+  IsNumber,
+  IsObject,
+  IsOptional,
+  IsString,
+  MinLength,
+  ValidateNested,
+} from "class-validator";
+
+/** One document's confirmed-after-review state. The service reads these
+ *  fields and writes them onto either a matched Policy or a freshly created
+ *  one. Anything null here is not written. */
+export class ConfirmPolicyDocumentDto {
+  @IsString() documentId!: string;
+
+  /** Required when creating a new Policy; ignored if `policyId` is set. */
+  @IsOptional() @IsString() customerId?: string;
+  /** Set when the document matched an existing Policy. */
+  @IsOptional() @IsString() policyId?: string;
+
+  @IsOptional() @IsString() policyNumber?: string;
+  @IsOptional() @IsString() insuredName?: string;
+  @IsOptional() @IsString() additionalInsured?: string;
+  @IsOptional() @IsString() agentName?: string;
+  @IsOptional() @IsString() legalAddress?: string;
+  @IsOptional() @IsString() zip?: string;
+  @IsOptional() @IsDateString() policyFrom?: string;
+  @IsOptional() @IsDateString() policyTo?: string;
+  @IsOptional() @IsDateString() policyDate?: string;
+  @IsOptional() @IsEnum(["MXN", "USD", "EUR"]) currency?: "MXN" | "USD" | "EUR";
+  @IsOptional() @IsNumber() netPremium?: number;
+  @IsOptional() @IsNumber() policyFee?: number;
+  @IsOptional() @IsNumber() brokerFee?: number;
+  @IsOptional() @IsNumber() total?: number;
+  @IsOptional() @IsString() premiumPayment?: string;
+  /** Coverages parsed off the PDF, passed through verbatim to Policy.coveragesJson. */
+  @IsOptional() @IsObject() coveragesJson?: unknown;
+
+  /** When true, write a Transaction(domain=INSURANCE, amount=-netPremium)
+   *  in addition to creating/updating the Policy. Skipped if netPremium is
+   *  null or zero. */
+  @IsOptional() postPremium?: boolean;
+}
+
+export class ConfirmPolicyBatchDto {
+  @IsArray()
+  @ValidateNested({ each: true })
+  @Type(() => ConfirmPolicyDocumentDto)
+  documents!: ConfirmPolicyDocumentDto[];
+}
+
+/** Staff correction of one document's extracted fields or its match. */
+export class ReviewPolicyDocumentDto {
+  @IsOptional() @IsString() policyNumber?: string;
+  @IsOptional() @IsString() insuredName?: string;
+  @IsOptional() @IsString() additionalInsured?: string;
+  @IsOptional() @IsString() agentName?: string;
+  @IsOptional() @IsString() legalAddress?: string;
+  @IsOptional() @IsString() zip?: string;
+  @IsOptional() @IsDateString() policyFrom?: string;
+  @IsOptional() @IsDateString() policyTo?: string;
+  @IsOptional() @IsDateString() policyDate?: string;
+  @IsOptional() @IsString() currency?: string;
+  @IsOptional() @IsNumber() netPremium?: number;
+  @IsOptional() @IsNumber() policyFee?: number;
+  @IsOptional() @IsNumber() brokerFee?: number;
+  @IsOptional() @IsNumber() total?: number;
+  @IsOptional() @IsString() premiumPayment?: string;
+  @IsOptional() @IsObject() coveragesJson?: unknown;
+
+  /** Set by the reviewer when the document matched an existing Policy. */
+  @IsOptional() @IsString() matchedPolicyId?: string;
+  /** Set by the reviewer when creating a new Policy. */
+  @IsOptional() @IsString() matchedCustomerId?: string;
+  /** Force-confirm a doc even when the matcher left it ambiguous. */
+  @IsOptional() forceConfirm?: boolean;
+}
+
+export class CreatePolicyOcrBatchDto {
+  @IsOptional() @IsString() @MinLength(1) label?: string;
+}

apps/api/src/policy-ocr/policy-ocr.module.ts

@@ -0,0 +1,18 @@
+import { Module } from "@nestjs/common";
+import { OcrModule } from "../ocr/ocr.module";
+import { PolicyOcrController } from "./policy-ocr.controller";
+import { PolicyOcrService } from "./policy-ocr.service";
+import { PolicyMatcherService } from "./policy-matcher.service";
+
+/**
+ * Reuses the OCR seam from OcrModule unchanged: the Tesseract provider is
+ * bound there and `OcrProvider` is the only thing the parsers touch. This
+ * module registers its own controller + service + matcher; nothing about
+ * utility ingestion needs to know about it.
+ */
+@Module({
+  imports: [OcrModule],
+  controllers: [PolicyOcrController],
+  providers: [PolicyOcrService, PolicyMatcherService],
+})
+export class PolicyOcrModule {}

apps/api/src/policy-ocr/policy-ocr.service.ts

@@ -0,0 +1,767 @@
+import {
+  BadRequestException,
+  Inject,
+  Injectable,
+  Logger,
+  NotFoundException,
+} from "@nestjs/common";
+import { Currency, Prisma } from "@jorgecuadros/database";
+import { PrismaService } from "../prisma/prisma.service";
+import { StorageService } from "../storage/storage.service";
+import type { UploadedFileLike } from "../storage/upload-file";
+import { OCR_PROVIDER, type OcrPage, type OcrProvider } from "../statements/ocr/ocr.provider";
+import { parsePolicy } from "./parsers/policy-parser";
+import { PolicyMatcherService } from "./policy-matcher.service";
+import type {
+  ConfirmPolicyBatchDto,
+  ConfirmPolicyDocumentDto,
+  ReviewPolicyDocumentDto,
+} from "./policy-ocr.dto";
+
+/**
+ * Insurance OCR intake — mirrors the statement pipeline at
+ * `apps/api/src/statements/statements.service.ts`. Reuses the OCR seam and
+ * Tesseract binding unchanged; the parsers and matcher are policy-specific.
+ *
+ * Why a parallel pipeline rather than a column on StatementDocument: the
+ * matcher keys on `Policy.policyNumber`, the confirm step writes to a
+ * different table (`Policy`, not `Transaction`), and the review UI shows
+ * different fields. Sharing one queue would either bloat the row with null
+ * columns or force the review screen to branch on a discriminator — both
+ * worse than a thin second table.
+ */
+@Injectable()
+export class PolicyOcrService {
+  private readonly logger = new Logger(PolicyOcrService.name);
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly storage: StorageService,
+    private readonly matcher: PolicyMatcherService,
+    @Inject(OCR_PROVIDER) private readonly ocr: OcrProvider,
+  ) {}
+
+  ocrAvailable(): Promise<boolean> {
+    return this.ocr.available();
+  }
+
+  storageAvailable(): boolean {
+    return this.storage.available;
+  }
+
+  // --- ingest ---------------------------------------------------------------
+
+  async createBatch(
+    files: UploadedFileLike[],
+    uploadedById: string,
+    label?: string,
+  ) {
+    if (!files?.length) throw new BadRequestException("No se recibió ningún archivo.");
+    if (!(await this.ocr.available())) {
+      throw new BadRequestException(
+        "El servidor no tiene OCR instalado; no se pueden leer PDFs de pólizas.",
+      );
+    }
+    if (!this.storage.available) {
+      throw new BadRequestException(
+        "El almacenamiento de documentos no está configurado; no se pueden " +
+          "guardar los PDFs escaneados.",
+      );
+    }
+
+    const batch = await this.prisma.policyOcrBatch.create({
+      data: { provider: "GMX", uploadedById, label, fileCount: files.length },
+    });
+
+    const copies = files.map((f) => ({ buffer: f.buffer, name: f.originalname }));
+    void this.process(batch.id, copies).catch(async (err) => {
+      this.logger.error(`Policy OCR batch ${batch.id} failed: ${(err as Error).message}`);
+      await this.prisma.policyOcrBatch.update({
+        where: { id: batch.id },
+        data: { status: "FAILED", error: (err as Error).message },
+      });
+    });
+
+    return batch;
+  }
+
+  /**
+   * Render → text → parse → match, **one PolicyOcrDocument row per uploaded
+   * file**. The GMX certificate is a 2-page PDF where page 1 carries the
+   * contract header and page 2 carries the per-coverage table — both pages
+   * describe the SAME policy, so the parser concatenates them and the
+   * matcher runs once. `pageNumber` on the row is repurposed as the file
+   * ordinal within the batch (1, 2, 3…) — the unique constraint
+   * `(batchId, pageNumber)` still holds and lets a single batch carry many
+   * policies.
+   *
+   * The doc's `storageKey` is the SOURCE PDF (`policy-ocr/{batchId}/source-N.pdf`)
+   * rather than a rendered page image, so the review screen can embed the
+   * exact artifact the office received. The rendered page PNGs are still
+   * stored under `policy-ocr/{batchId}/page-M.png` for any future re-OCR or
+   * image-based audit, but they aren't used as `storageKey` for the document.
+   */
+  private async process(
+    batchId: string,
+    files: { buffer: Buffer; name?: string }[],
+  ) {
+    await this.prisma.policyOcrBatch.update({
+      where: { id: batchId },
+      data: { status: "PROCESSING" },
+    });
+
+    let fileOrdinal = 0;
+    let globalPageOrdinal = 0;
+    for (const file of files) {
+      fileOrdinal += 1;
+      const sourceKey = `policy-ocr/${batchId}/source-${fileOrdinal}.pdf`;
+      await this.storage.put(sourceKey, file.buffer, "application/pdf");
+
+      const pages = await this.ocr.renderPages(file.buffer);
+      const textLayer = await this.ocr.textPages(file.buffer).catch(() => []);
+
+      // One OcrPage per rendered page: text-layer wins when present (cheap,
+      // exact), OCR the rendered image when it isn't. Same precedence rule
+      // as the statement OCR pipeline.
+      const perPageOcr: OcrPage[] = [];
+      for (const [index, image] of pages.entries()) {
+        globalPageOrdinal += 1;
+        const pageStorageKey = `policy-ocr/${batchId}/page-${globalPageOrdinal}.png`;
+        await this.storage.put(pageStorageKey, image, "image/png");
+
+        const embedded = textLayer[index] ?? null;
+        const pageOcr = embedded ?? (await this.ocr.recognize(image));
+        perPageOcr.push(pageOcr);
+      }
+
+      // Concatenate every page's text with a blank line between pages so the
+      // parser's anchored regexes (^From$, ^Currency\s+...) still work
+      // across page boundaries — pdftotext -bbox-layout produces newline-
+      // separated text per page already, the `\n\n` just preserves a clear
+      // boundary in ocrRawText for debugging.
+      const mergedText = perPageOcr.map((p) => p.text).join("\n\n");
+      const avgConfidence =
+        perPageOcr.length === 0
+          ? 0
+          : perPageOcr.reduce((s, p) => s + p.confidence, 0) / perPageOcr.length;
+      const synthetic: OcrPage = {
+        text: mergedText,
+        words: [],
+        confidence: avgConfidence,
+      };
+
+      try {
+        const parsed = parsePolicy(synthetic);
+        if (parsed.provider === "") {
+          throw new Error("no se reconoció el proveedor");
+        }
+        const match = await this.matcher.match(parsed);
+        const notes = [...parsed.notes, match.note].filter(Boolean);
+        // Confident when exactly one Policy carries the printed number —
+        // the only unambiguous hit we trust. A new policy (no match) still
+        // needs a customer pick, so it stays in review.
+        const trusted = match.confident && parsed.policyNumber != null;
+
+        await this.prisma.policyOcrDocument.create({
+          data: {
+            batchId,
+            pageNumber: fileOrdinal,
+            storageKey: sourceKey,
+            status: trusted ? "MATCHED" : "NEEDS_REVIEW",
+            ocrRawText: mergedText,
+            ocrConfidence: new Prisma.Decimal(avgConfidence.toFixed(3)),
+            provider: parsed.provider,
+            extractedPolicyNumber: parsed.policyNumber,
+            extractedInsuredName: parsed.insuredName,
+            extractedAdditionalInsured: parsed.additionalInsured,
+            extractedAgentName: parsed.agentName,
+            extractedLegalAddress: parsed.legalAddress,
+            extractedZip: parsed.zip,
+            extractedPolicyFrom: parsed.policyFrom,
+            extractedPolicyTo: parsed.policyTo,
+            extractedPolicyDate: parsed.policyDate,
+            extractedCurrency: parsed.currency,
+            extractedNetPremium:
+              parsed.netPremium != null ? new Prisma.Decimal(parsed.netPremium) : null,
+            extractedPolicyFee:
+              parsed.policyFee != null ? new Prisma.Decimal(parsed.policyFee) : null,
+            extractedBrokerFee:
+              parsed.brokerFee != null ? new Prisma.Decimal(parsed.brokerFee) : null,
+            extractedTotal:
+              parsed.total != null ? new Prisma.Decimal(parsed.total) : null,
+            extractedCoveragesJson: parsed.coverages.length
+              ? (parsed.coverages as unknown as Prisma.InputJsonValue)
+              : Prisma.DbNull,
+            extractedPremiumPayment: parsed.premiumPayment,
+            matchedPolicyId: match.policyId,
+            matchedCustomerId: match.customerId,
+            matchCandidates: match.candidates.length
+              ? (match.candidates as unknown as Prisma.InputJsonValue)
+              : Prisma.DbNull,
+            matchNote: notes.join("; ").slice(0, 190),
+          },
+        });
+      } catch (err) {
+        // The file as a whole failed to parse (no provider, parse exception).
+        // One OCR_FAILED row per file is the right granularity — the page
+        // images are still on disk for a re-run after a parser fix.
+        await this.prisma.policyOcrDocument.create({
+          data: {
+            batchId,
+            pageNumber: fileOrdinal,
+            storageKey: sourceKey,
+            status: "OCR_FAILED",
+            matchNote: (err as Error).message.slice(0, 190),
+          },
+        });
+      }
+    }
+
+    await this.prisma.policyOcrBatch.update({
+      where: { id: batchId },
+      data: { status: "READY_FOR_REVIEW" },
+    });
+  }
+
+  // --- reads ----------------------------------------------------------------
+
+  async listBatches(page: number, pageSize: number) {
+    const [total, items] = await this.prisma.$transaction([
+      this.prisma.policyOcrBatch.count(),
+      this.prisma.policyOcrBatch.findMany({
+        orderBy: { createdAt: "desc" },
+        skip: (page - 1) * pageSize,
+        take: pageSize,
+        include: {
+          uploadedBy: { select: { name: true } },
+          _count: { select: { documents: true } },
+        },
+      }),
+    ]);
+    return { items, total, page, pageSize, pageCount: Math.ceil(total / pageSize) };
+  }
+
+  async getBatch(id: string) {
+    const batch = await this.prisma.policyOcrBatch.findUnique({
+      where: { id },
+      include: { uploadedBy: { select: { name: true } } },
+    });
+    if (!batch) throw new NotFoundException("Lote no encontrado.");
+
+    const counts = await this.prisma.policyOcrDocument.groupBy({
+      by: ["status"],
+      where: { batchId: id },
+      _count: { _all: true },
+    });
+    return {
+      ...batch,
+      byStatus: Object.fromEntries(counts.map((c) => [c.status, c._count._all])),
+    };
+  }
+
+  async listDocuments(batchId: string) {
+    return this.prisma.policyOcrDocument.findMany({
+      where: { batchId },
+      orderBy: { pageNumber: "asc" },
+      include: {
+        matchedCustomer: { select: { id: true, name: true } },
+        matchedPolicy: {
+          select: {
+            id: true,
+            policyNumber: true,
+            customerId: true,
+            customer: { select: { name: true } },
+          },
+        },
+      },
+    });
+  }
+
+  /**
+   * The source PDF for the document, so the review screen can show the
+   * exact artifact the office uploaded (the browser's PDF viewer handles
+   * scrolling, zoom, and selection natively). The rendered page PNGs
+   * remain on disk under `policy-ocr/{batchId}/page-N.png` for any
+   * future re-OCR, but the doc row points here at the source.
+   */
+  async pageImage(documentId: string) {
+    const doc = await this.prisma.policyOcrDocument.findUnique({
+      where: { id: documentId },
+      select: { storageKey: true },
+    });
+    if (!doc) throw new NotFoundException("Documento no encontrado.");
+    return this.storage.getStream(doc.storageKey);
+  }
+
+  // --- review ---------------------------------------------------------------
+
+  async review(id: string, dto: ReviewPolicyDocumentDto, reviewedById: string) {
+    const doc = await this.prisma.policyOcrDocument.findUnique({ where: { id } });
+    if (!doc) throw new NotFoundException("Documento no encontrado.");
+    if (doc.status === "POSTED") {
+      throw new BadRequestException("Este documento ya fue aplicado.");
+    }
+
+    // Trusting a customer-supplied pair (policyId, customerId) without
+    // cross-check is how a document lands on the wrong customer's ledger;
+    // pin them here from the DB.
+    let matchedPolicyId = dto.matchedPolicyId ?? doc.matchedPolicyId;
+    let matchedCustomerId = doc.matchedCustomerId;
+
+    if (matchedPolicyId) {
+      const p = await this.prisma.policy.findUnique({
+        where: { id: matchedPolicyId },
+        select: { customerId: true },
+      });
+      if (!p) throw new BadRequestException("Póliza no encontrada.");
+      matchedCustomerId = p.customerId;
+    } else if (dto.matchedCustomerId) {
+      const c = await this.prisma.customer.findUnique({
+        where: { id: dto.matchedCustomerId },
+        select: { id: true },
+      });
+      if (!c) throw new BadRequestException("Cliente no encontrado.");
+      matchedCustomerId = c.id;
+    }
+
+    return this.prisma.policyOcrDocument.update({
+      where: { id },
+      data: {
+        extractedPolicyNumber: dto.policyNumber ?? undefined,
+        extractedInsuredName: dto.insuredName ?? undefined,
+        extractedAdditionalInsured: dto.additionalInsured ?? undefined,
+        extractedAgentName: dto.agentName ?? undefined,
+        extractedLegalAddress: dto.legalAddress ?? undefined,
+        extractedZip: dto.zip ?? undefined,
+        extractedPolicyFrom: dto.policyFrom ? new Date(dto.policyFrom) : undefined,
+        extractedPolicyTo: dto.policyTo ? new Date(dto.policyTo) : undefined,
+        extractedPolicyDate: dto.policyDate ? new Date(dto.policyDate) : undefined,
+        extractedCurrency: dto.currency ?? undefined,
+        extractedNetPremium:
+          dto.netPremium != null ? new Prisma.Decimal(dto.netPremium) : undefined,
+        extractedPolicyFee:
+          dto.policyFee != null ? new Prisma.Decimal(dto.policyFee) : undefined,
+        extractedBrokerFee:
+          dto.brokerFee != null ? new Prisma.Decimal(dto.brokerFee) : undefined,
+        extractedTotal:
+          dto.total != null ? new Prisma.Decimal(dto.total) : undefined,
+        extractedCoveragesJson: dto.coveragesJson
+          ? (dto.coveragesJson as Prisma.InputJsonValue)
+          : undefined,
+        extractedPremiumPayment: dto.premiumPayment ?? undefined,
+        matchedPolicyId,
+        matchedCustomerId,
+        status: dto.forceConfirm ? "CONFIRMED" : "MATCHED",
+        reviewedById,
+        reviewedAt: new Date(),
+      },
+    });
+  }
+
+  async reject(id: string, reviewedById: string) {
+    const doc = await this.prisma.policyOcrDocument.findUnique({ where: { id } });
+    if (!doc) throw new NotFoundException("Documento no encontrado.");
+    if (doc.status === "POSTED") {
+      throw new BadRequestException("Este documento ya fue aplicado.");
+    }
+    const updated = await this.prisma.policyOcrDocument.update({
+      where: { id },
+      data: { status: "REJECTED", reviewedById, reviewedAt: new Date() },
+    });
+    // Rejecting the last open page settles the batch just as confirming it
+    // would — without this, a fully-rejected batch sat in READY_FOR_REVIEW
+    // forever because only confirmBatch() ever closed one.
+    await this.closeIfDone(doc.batchId);
+    return updated;
+  }
+
+  /**
+   * Throw away a whole batch that is pending review: every page that has not
+   * been applied is marked REJECTED and the batch itself becomes DISCARDED.
+   *
+   * Refuses once any page is POSTED — a partly-applied batch has already
+   * written Policy (and possibly Transaction) rows, and hiding the paperwork
+   * behind a "discarded" label would leave those rows unexplained. Reject the
+   * remaining pages individually instead.
+   */
+  async discardBatch(batchId: string, reviewedById: string) {
+    const batch = await this.prisma.policyOcrBatch.findUnique({
+      where: { id: batchId },
+    });
+    if (!batch) throw new NotFoundException("Lote no encontrado.");
+    if (batch.status === "DISCARDED") {
+      throw new BadRequestException("Este lote ya fue descartado.");
+    }
+
+    const posted = await this.prisma.policyOcrDocument.count({
+      where: { batchId, status: "POSTED" },
+    });
+    if (posted > 0) {
+      throw new BadRequestException(
+        `No se puede descartar: ${posted} página(s) ya se aplicaron a una póliza.`,
+      );
+    }
+
+    const { count } = await this.prisma.policyOcrDocument.updateMany({
+      where: { batchId, status: { notIn: ["POSTED", "REJECTED"] } },
+      data: { status: "REJECTED", reviewedById, reviewedAt: new Date() },
+    });
+
+    await this.prisma.policyOcrBatch.update({
+      where: { id: batchId },
+      data: { status: "DISCARDED", completedAt: new Date() },
+    });
+
+    return { batchId, rejected: count };
+  }
+
+  // --- confirm --------------------------------------------------------------
+
+  /**
+   * Apply every confirmed document: create or update the Policy, attach the
+   * source PDF as a PolicyDocument, and (when staff asked + premium parses)
+   * write a Transaction row. Each step is guarded by status checks so a
+   * double-confirm cannot re-apply a document.
+   */
+  async confirmBatch(batchId: string, dto: ConfirmPolicyBatchDto, reviewedById: string) {
+    const batch = await this.prisma.policyOcrBatch.findUnique({ where: { id: batchId } });
+    if (!batch) throw new NotFoundException("Lote no encontrado.");
+
+    const results: { documentId: string; policyId: string; postedTransactionId: string | null }[] = [];
+
+    for (const item of dto.documents) {
+      const doc = await this.prisma.policyOcrDocument.findUnique({
+        where: { id: item.documentId },
+      });
+      if (!doc) {
+        throw new BadRequestException(`Documento ${item.documentId} no encontrado.`);
+      }
+      if (doc.status === "POSTED") {
+        throw new BadRequestException(
+          `El documento página ${doc.pageNumber} ya fue aplicado.`,
+        );
+      }
+      if (!item.policyId && !item.customerId) {
+        throw new BadRequestException(
+          `Documento página ${doc.pageNumber}: falta póliza destino o cliente.`,
+        );
+      }
+
+      // 1. Resolve target Policy (create or update). Field selection: every
+      // non-null `extracted*` on the doc (post-review) is written. Null is
+      // preserved — never overwrite an existing Policy's `netPremium` with
+      // null because the certificate page didn't carry one.
+      let policyId = item.policyId ?? null;
+
+      if (policyId) {
+        const updateData = buildPolicyUpdateFromDoc(item, doc);
+        await this.prisma.policy.update({
+          where: { id: policyId },
+          data: updateData,
+        });
+      } else {
+        // Create under the picked customer. `policyNumber` is the only field
+        // that must be present.
+        if (!item.policyNumber && !doc.extractedPolicyNumber) {
+          throw new BadRequestException(
+            `Documento página ${doc.pageNumber}: falta número de póliza.`,
+          );
+        }
+        const createData = buildPolicyCreateFromDoc(item, doc, item.customerId!);
+        const created = await this.prisma.policy.create({
+          data: createData,
+        });
+        policyId = created.id;
+      }
+
+      // 2. Attach the source PDF as a PolicyDocument. `doc.storageKey`
+      // already points at the exact upload (`policy-ocr/{batchId}/source-N.pdf`)
+      // so the attach is just a stream copy into the policy's namespace —
+      // the previous per-page "which file did this page come from" walk is
+      // gone because one PDF = one doc now.
+      await this.attachSourcePdf(doc.storageKey, policyId);
+
+      // 3. Optionally post the premium to the ledger. Only when staff
+      // explicitly asked (`postPremium` true) and netPremium parses — without
+      // that gate a missing premium would silently book $0.
+      let postedTransactionId: string | null = null;
+      const premium =
+        item.netPremium != null
+          ? item.netPremium
+          : doc.extractedNetPremium != null
+          ? Number(doc.extractedNetPremium)
+          : null;
+      if (item.postPremium && premium && premium > 0) {
+        const tx = await this.prisma.transaction.create({
+          data: {
+            customerId: (await this.policyCustomerId(policyId))!,
+            domain: "INSURANCE",
+            amount: new Prisma.Decimal(-Math.abs(premium)),
+            transactionDate: doc.extractedPolicyDate ?? doc.extractedPolicyFrom ?? new Date(),
+            currency: (item.currency ??
+              doc.extractedCurrency ??
+              "MXN") as Currency,
+            reference: item.policyNumber ?? doc.extractedPolicyNumber ?? null,
+            period: null,
+            captureSource: "OCR",
+            captureRef: doc.id,
+            message: `Prima de póliza ${item.policyNumber ?? doc.extractedPolicyNumber ?? ""}`,
+          },
+        });
+        postedTransactionId = tx.id;
+      }
+
+      await this.prisma.policyOcrDocument.update({
+        where: { id: doc.id },
+        data: {
+          status: "POSTED",
+          matchedPolicyId: policyId,
+          reviewedById,
+          reviewedAt: new Date(),
+          createdPolicyId: item.policyId ? null : policyId,
+          postedTransactionId,
+        },
+      });
+
+      results.push({
+        documentId: doc.id,
+        policyId,
+        postedTransactionId,
+      });
+    }
+
+    await this.closeIfDone(batchId);
+
+    return {
+      applied: results.length,
+      policies: results.map((r) => r.policyId),
+      postedTransactions: results.filter((r) => r.postedTransactionId).length,
+    };
+  }
+
+  /**
+   * Stream the source PDF (`sourceKey`, set by `process` on the doc row)
+   * into the policy's storage namespace and create a `PolicyDocument`
+   * pointer. Trivial now that the doc row holds the exact source key —
+   * the old per-page "which file did this page come from" walk is gone.
+   */
+  private async attachSourcePdf(sourceKey: string, policyId: string): Promise<void> {
+    const got = await this.storage.getStream(sourceKey);
+    const chunks: Buffer[] = [];
+    for await (const c of got.stream) chunks.push(c as Buffer);
+    const buf = Buffer.concat(chunks);
+
+    const newKey = `policy/${policyId}/${Date.now()}-${crypto.randomUUID()}.pdf`;
+    await this.storage.put(newKey, buf, "application/pdf");
+    await this.prisma.policyDocument.create({
+      data: {
+        policyId,
+        documentType: "GMX_POLICY",
+        storageKey: newKey,
+      },
+    });
+  }
+
+  private async policyCustomerId(policyId: string): Promise<string | null> {
+    const p = await this.prisma.policy.findUnique({
+      where: { id: policyId },
+      select: { customerId: true },
+    });
+    return p?.customerId ?? null;
+  }
+
+  private async closeIfDone(batchId: string) {
+    const open = await this.prisma.policyOcrDocument.count({
+      where: {
+        batchId,
+        status: { in: ["PENDING_OCR", "NEEDS_REVIEW", "MATCHED", "CONFIRMED"] },
+      },
+    });
+    if (open === 0) {
+      await this.prisma.policyOcrBatch.updateMany({
+        // `updateMany` + a status filter so a discarded batch is never quietly
+        // relabelled COMPLETED by a late reject on one of its pages.
+        where: { id: batchId, status: { not: "DISCARDED" } },
+        data: { status: "COMPLETED", completedAt: new Date() },
+      });
+    }
+  }
+}
+
+/** Map a (post-review) doc + final confirmed fields onto a `Policy.update`
+ *  payload. Every field that is null in both inputs is omitted so we never
+ *  write null over a value the Policy already carries (the GMX certificate
+ *  has no premium — we must not blank the existing Policy.netPremium). */
+function buildPolicyUpdateFromDoc(
+  item: ConfirmPolicyDocumentDto,
+  doc: {
+    extractedPolicyNumber: string | null;
+    extractedInsuredName: string | null;
+    extractedAdditionalInsured: string | null;
+    extractedAgentName: string | null;
+    extractedLegalAddress: string | null;
+    extractedZip: string | null;
+    extractedPolicyFrom: Date | null;
+    extractedPolicyTo: Date | null;
+    extractedPolicyDate: Date | null;
+    extractedCurrency: string | null;
+    extractedNetPremium: Prisma.Decimal | null;
+    extractedPolicyFee: Prisma.Decimal | null;
+    extractedBrokerFee: Prisma.Decimal | null;
+    extractedTotal: Prisma.Decimal | null;
+    extractedCoveragesJson: Prisma.JsonValue | null;
+    extractedPremiumPayment: string | null;
+  },
+): Prisma.PolicyUpdateInput {
+  const numOrUndef = (a: number | undefined, b: Prisma.Decimal | null): Prisma.Decimal | undefined => {
+    if (a != null) return new Prisma.Decimal(a);
+    if (b != null) return b;
+    return undefined;
+  };
+  const dateOrUndef = (a: string | undefined, b: Date | null): Date | undefined => {
+    if (a) return new Date(a);
+    if (b) return b;
+    return undefined;
+  };
+  const strOrUndef = (a: string | undefined, b: string | null): string | undefined => {
+    if (a != null && a !== "") return a;
+    if (b != null && b !== "") return b;
+    return undefined;
+  };
+
+  return {
+    policyNumber: strOrUndef(item.policyNumber, doc.extractedPolicyNumber),
+    agentName: strOrUndef(item.agentName, doc.extractedAgentName),
+    policyFrom: dateOrUndef(item.policyFrom, doc.extractedPolicyFrom),
+    policyTo: dateOrUndef(item.policyTo, doc.extractedPolicyTo),
+    policyDate: dateOrUndef(item.policyDate, doc.extractedPolicyDate),
+    currency: strOrUndef(item.currency, doc.extractedCurrency) as Currency | undefined,
+    netPremium: numOrUndef(item.netPremium, doc.extractedNetPremium),
+    policyFee: numOrUndef(item.policyFee, doc.extractedPolicyFee),
+    brokerFee: numOrUndef(item.brokerFee, doc.extractedBrokerFee),
+    total: numOrUndef(item.total, doc.extractedTotal),
+    // coveragesJson / observations: freeform, keep the GMX data when present.
+    coveragesJson:
+      item.coveragesJson !== undefined
+        ? (item.coveragesJson as Prisma.InputJsonValue)
+        : doc.extractedCoveragesJson != null
+        ? (doc.extractedCoveragesJson as Prisma.InputJsonValue)
+        : undefined,
+    // Premium payment cadence ("CONTADO") and insured-name fields land in
+    // `observations` so the PolicyForm's edits stay the source of truth for
+    // structured fields. The reviewer can move them by hand if needed.
+    observations: joinObservations(
+      doc.extractedInsuredName,
+      doc.extractedAdditionalInsured,
+      doc.extractedLegalAddress,
+      doc.extractedZip,
+      doc.extractedPremiumPayment,
+      item,
+    ),
+  };
+}
+
+/** Same shape as `buildPolicyUpdateFromDoc`, but for `Policy.create`. The
+ *  `customerId` is supplied separately and `policyNumber` is required (a
+ *  Policy without a number can't be re-matched by the OCR pipeline). */
+function buildPolicyCreateFromDoc(
+  item: ConfirmPolicyDocumentDto,
+  doc: {
+    extractedPolicyNumber: string | null;
+    extractedInsuredName: string | null;
+    extractedAdditionalInsured: string | null;
+    extractedAgentName: string | null;
+    extractedLegalAddress: string | null;
+    extractedZip: string | null;
+    extractedPolicyFrom: Date | null;
+    extractedPolicyTo: Date | null;
+    extractedPolicyDate: Date | null;
+    extractedCurrency: string | null;
+    extractedNetPremium: Prisma.Decimal | null;
+    extractedPolicyFee: Prisma.Decimal | null;
+    extractedBrokerFee: Prisma.Decimal | null;
+    extractedTotal: Prisma.Decimal | null;
+    extractedCoveragesJson: Prisma.JsonValue | null;
+    extractedPremiumPayment: string | null;
+  },
+  customerId: string,
+): Prisma.PolicyUncheckedCreateInput {
+  const numOrUndef = (a: number | undefined, b: Prisma.Decimal | null): Prisma.Decimal | undefined => {
+    if (a != null) return new Prisma.Decimal(a);
+    if (b != null) return b;
+    return undefined;
+  };
+  const dateOrUndef = (a: string | undefined, b: Date | null): Date | undefined => {
+    if (a) return new Date(a);
+    if (b) return b;
+    return undefined;
+  };
+  const strOrUndef = (a: string | undefined, b: string | null): string | undefined => {
+    if (a != null && a !== "") return a;
+    if (b != null && b !== "") return b;
+    return undefined;
+  };
+
+  const policyNumber =
+    strOrUndef(item.policyNumber, doc.extractedPolicyNumber);
+  if (!policyNumber) {
+    // Caller already guards this; the throw is a type-narrowing aid.
+    throw new Error("policyNumber required for create");
+  }
+
+  return {
+    policyNumber,
+    customerId,
+    agentName: strOrUndef(item.agentName, doc.extractedAgentName),
+    policyFrom: dateOrUndef(item.policyFrom, doc.extractedPolicyFrom),
+    policyTo: dateOrUndef(item.policyTo, doc.extractedPolicyTo),
+    policyDate: dateOrUndef(item.policyDate, doc.extractedPolicyDate),
+    currency: strOrUndef(item.currency, doc.extractedCurrency) as Currency | undefined,
+    netPremium: numOrUndef(item.netPremium, doc.extractedNetPremium),
+    policyFee: numOrUndef(item.policyFee, doc.extractedPolicyFee),
+    brokerFee: numOrUndef(item.brokerFee, doc.extractedBrokerFee),
+    total: numOrUndef(item.total, doc.extractedTotal),
+    coveragesJson:
+      item.coveragesJson !== undefined
+        ? (item.coveragesJson as Prisma.InputJsonValue)
+        : doc.extractedCoveragesJson != null
+        ? (doc.extractedCoveragesJson as Prisma.InputJsonValue)
+        : undefined,
+    observations: joinObservations(
+      doc.extractedInsuredName,
+      doc.extractedAdditionalInsured,
+      doc.extractedLegalAddress,
+      doc.extractedZip,
+      doc.extractedPremiumPayment,
+      item,
+    ),
+  };
+}
+
+function joinObservations(
+  insured: string | null,
+  additional: string | null,
+  address: string | null,
+  zip: string | null,
+  premiumPayment: string | null,
+  item: ConfirmPolicyDocumentDto,
+): string | undefined {
+  const lines: string[] = [];
+  const insuredName = strOrUndefDb(item.insuredName, insured);
+  if (insuredName) lines.push(`Asegurado: ${insuredName}`);
+  const additionalInsured = strOrUndefDb(item.additionalInsured, additional);
+  if (additionalInsured) lines.push(`Asegurado adicional: ${additionalInsured}`);
+  const legalAddress = strOrUndefDb(item.legalAddress, address);
+  if (legalAddress) lines.push(`Dirección: ${legalAddress}`);
+  const zipVal = strOrUndefDb(item.zip, zip);
+  if (zipVal) lines.push(`C.P.: ${zipVal}`);
+  const cadence = strOrUndefDb(item.premiumPayment, premiumPayment);
+  if (cadence) lines.push(`Pago de prima: ${cadence}`);
+  return lines.length ? lines.join("\n") : undefined;
+}
+
+function strOrUndefDb(a: string | undefined, b: string | null): string | undefined {
+  if (a != null && a !== "") return a;
+  if (b != null && b !== "") return b;
+  return undefined;
+}

apps/api/src/renewals/renewal-email.spec.ts

@@ -0,0 +1,64 @@
+import type { RenewalLetterRow } from "../reports/renewal-letter";
+import { renderRenewalEmail } from "./renewal-email";
+
+function letter(overrides: Partial<RenewalLetterRow> = {}): RenewalLetterRow {
+  return {
+    __kind: "letter",
+    policyId: "policy-1",
+    policyNumber: "POL-123",
+    policyType: "AUTO",
+    customerName: "Ana Pérez",
+    customerEmail: "ana@example.com",
+    customerPhone: "664-111-2222",
+    customerMobile: null,
+    customerAddress: ["Calle Uno 123", "Tijuana, BC, 22000"],
+    provider: "Aseguradora Uno",
+    policyTo: "2026-09-01",
+    netPremium: "1200.00",
+    policyFee: null,
+    total: "1392.00",
+    currency: "MXN",
+    coverageDays: null,
+    cslLimit: null,
+    medicalCoverage: null,
+    propertyDamage: null,
+    perPersonLiability: null,
+    additionalService: null,
+    vehicle: null,
+    generation: 1,
+    sentAt: null,
+    ...overrides,
+  };
+}
+
+describe("renderRenewalEmail", () => {
+  it("includes policy, premium, expiration, type, and customer information", () => {
+    const result = renderRenewalEmail(letter());
+
+    expect(result.subject).toContain("POL-123");
+    expect(result.html).toContain("primer aviso");
+    expect(result.html).toContain("AUTO");
+    expect(result.html).toContain("01/09/2026");
+    expect(result.html).toContain("1,392.00");
+    expect(result.html).toContain("Ana Pérez");
+    expect(result.html).toContain("ana@example.com");
+    expect(result.html).toContain("664-111-2222");
+    expect(result.html).toContain("Calle Uno 123");
+  });
+
+  it("uses overdue wording for generation three", () => {
+    const result = renderRenewalEmail(letter({ generation: 3 }));
+
+    expect(result.subject).toContain("Póliza vencida");
+    expect(result.html).toContain("está vencida");
+  });
+
+  it("escapes customer-provided HTML", () => {
+    const result = renderRenewalEmail(
+      letter({ customerName: '<img src=x onerror="alert(1)">' }),
+    );
+
+    expect(result.html).not.toContain("<img");
+    expect(result.html).toContain("&lt;img");
+  });
+});

apps/api/src/renewals/renewal-email.ts

@@ -0,0 +1,65 @@
+import type { RenewalLetterRow } from "../reports/renewal-letter";
+
+const GENERATION_TEXT: Record<number, string> = {
+  1: "Le enviamos el primer aviso para renovar su póliza.",
+  2: "Le enviamos el segundo aviso para renovar su póliza.",
+  3: "Le informamos que su póliza está vencida.",
+};
+
+function escapeHtml(value: unknown): string {
+  return String(value ?? "")
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&#039;");
+}
+
+function displayDate(value: string): string {
+  if (value === "—") return value;
+  const [year, month, day] = value.split("-");
+  return `${day}/${month}/${year}`;
+}
+
+function money(value: string | null, currency: string): string {
+  if (!value) return "No disponible";
+  return new Intl.NumberFormat("es-MX", {
+    style: "currency",
+    currency,
+    minimumFractionDigits: 2,
+  }).format(Number(value));
+}
+
+function row(label: string, value: string): string {
+  return `<tr><th style="padding:8px 12px;text-align:left;background:#f4f4f4;border:1px solid #ddd">${escapeHtml(label)}</th><td style="padding:8px 12px;border:1px solid #ddd">${escapeHtml(value)}</td></tr>`;
+}
+
+export function renderRenewalEmail(letter: RenewalLetterRow): {
+  subject: string;
+  html: string;
+} {
+  const expired = letter.generation === 3;
+  const subject = expired
+    ? `Póliza vencida: ${letter.policyNumber}`
+    : `Aviso de renovación: póliza ${letter.policyNumber}`;
+  const phone = letter.customerMobile ?? letter.customerPhone ?? "No disponible";
+  const address = letter.customerAddress.join(", ") || "No disponible";
+  const premium = letter.total ?? letter.netPremium;
+
+  const details = [
+    row("Número de póliza", letter.policyNumber),
+    row("Tipo de póliza", letter.policyType),
+    row("Aseguradora", letter.provider),
+    row("Fecha de vencimiento", displayDate(letter.policyTo)),
+    row("Prima", money(premium, letter.currency)),
+    row("Cliente", letter.customerName),
+    row("Correo", letter.customerEmail ?? "No disponible"),
+    row("Teléfono", phone),
+    row("Dirección", address),
+  ].join("");
+
+  return {
+    subject,
+    html: `<div style="font-family:Arial,sans-serif;color:#222;line-height:1.5"><p>Estimado(a) ${escapeHtml(letter.customerName)}:</p><p>${escapeHtml(GENERATION_TEXT[letter.generation] ?? "Le enviamos un aviso sobre la renovación de su póliza.")}</p><table style="border-collapse:collapse;width:100%;max-width:680px">${details}</table><p>Por favor, comuníquese con Jorge Cuadros &amp; Asociados para revisar su renovación.</p><p>Atentamente,<br>Jorge Cuadros &amp; Asociados</p></div>`,
+  };
+}

apps/api/src/renewals/renewals-log.spec.ts

@@ -0,0 +1,197 @@
+import { RenewalsService } from "./renewals.service";
+
+/**
+ * The renewal sweep's half of the unified notification log.
+ *
+ * `RenewalNotice` only records that a policy WAS notified — it has no way to
+ * say a send failed or that a customer had no address. Those rows exist only
+ * in `email_notification_log`, so they are what these tests pin down.
+ */
+
+const POLICY_ID = "policy-1";
+const CUSTOMER_ID = "cust-1";
+
+function makePolicy(email: string | null) {
+  return {
+    id: POLICY_ID,
+    policyNumber: "700442181",
+    policyTo: new Date("2026-09-01T00:00:00.000Z"),
+    netPremium: null,
+    policyFee: null,
+    total: null,
+    currency: "MXN",
+    coveragesJson: null,
+    customer: {
+      id: CUSTOMER_ID,
+      name: "ACME SA DE CV",
+      nameMissing: false,
+      email,
+      phone: null,
+      mobile: null,
+      addressLine1: null,
+      addressLine2: null,
+      city: null,
+      state: null,
+      zipCode: null,
+      country: null,
+    },
+    policyType: { name: "AUTO" },
+    insuranceProvider: { name: "GMX" },
+    vehicles: [],
+    renewalNotices: [],
+  };
+}
+
+function build(overrides: {
+  policies?: ReturnType<typeof makePolicy>[];
+  sendImpl?: () => Promise<{ messageId: string; response: string }>;
+}) {
+  const policies = overrides.policies ?? [makePolicy("cliente@example.com")];
+
+  const record = jest.fn().mockResolvedValue(undefined);
+  const send =
+    overrides.sendImpl ??
+    jest.fn().mockResolvedValue({ messageId: "ses-1", response: "{}" });
+
+  const prisma = {
+    // Only generation 1 has a candidate; the other two cadences return none,
+    // so a sweep produces exactly one outcome to assert on.
+    policy: {
+      findMany: jest
+        .fn()
+        .mockResolvedValueOnce(policies)
+        .mockResolvedValue([]),
+      findFirst: jest.fn().mockResolvedValue(policies[0]),
+    },
+    renewalNotice: { upsert: jest.fn().mockResolvedValue({}) },
+    scheduledJobState: {
+      upsert: jest.fn().mockResolvedValue({}),
+      updateMany: jest.fn().mockResolvedValue({ count: 1 }),
+      findUniqueOrThrow: jest.fn().mockResolvedValue({ lastSuccessfulAt: null }),
+      update: jest.fn().mockResolvedValue({}),
+    },
+  };
+
+  // `register` is a no-op here: these tests drive the sweep directly, so no
+  // cron job is ever installed.
+  const schedule = { register: jest.fn().mockResolvedValue(undefined) };
+  const service = new RenewalsService(
+    prisma as never,
+    { available: true, send } as never,
+    { log: jest.fn() } as never,
+    { record } as never,
+    schedule as never,
+  );
+
+  return { service, record, send, prisma };
+}
+
+describe("renewal notices write the shared notification log", () => {
+  it("records a SENT row tagged RENEWAL_NOTICE / POLICIES", async () => {
+    const { service, record, prisma } = build({});
+
+    await service.sweep("user-1");
+
+    expect(record).toHaveBeenCalledTimes(1);
+    const row = record.mock.calls[0][0];
+    expect(row).toMatchObject({
+      notificationType: "RENEWAL_NOTICE",
+      servicio: "POLICIES",
+      status: "SENT",
+      customerId: CUSTOMER_ID,
+      customerEmail: "cliente@example.com",
+      providerMessageId: "ses-1",
+      debug: false,
+    });
+    // `level` carries the aviso generation, not an alert colour.
+    expect(row.level).toBe(1);
+    expect(row.subject).toContain("700442181");
+    expect(row.bodySnapshot).toContain("ACME SA DE CV");
+    // The gating row is still written — the log does not replace it.
+    expect(prisma.renewalNotice.upsert).toHaveBeenCalledTimes(1);
+  });
+
+  it("records a FAILED row and no gating row when the send throws", async () => {
+    const { service, record, prisma } = build({
+      sendImpl: jest.fn().mockRejectedValue(new Error("SES rejected")),
+    });
+
+    const result = await service.sweep("user-1");
+
+    expect(result.sent).toBe(0);
+    expect(result.failed).toBe(1);
+    expect(record).toHaveBeenCalledTimes(1);
+    expect(record.mock.calls[0][0]).toMatchObject({
+      status: "FAILED",
+      error: "SES rejected",
+      notificationType: "RENEWAL_NOTICE",
+    });
+    // Nothing was delivered, so nothing may gate tomorrow's retry.
+    expect(prisma.renewalNotice.upsert).not.toHaveBeenCalled();
+  });
+
+  it("records SKIPPED_NO_EMAIL for a candidate with no address", async () => {
+    const { service, record, send, prisma } = build({
+      policies: [makePolicy("   ")],
+    });
+
+    const result = await service.sweep("user-1");
+
+    expect(result.skipped).toBe(1);
+    expect(send).not.toHaveBeenCalled();
+    expect(prisma.renewalNotice.upsert).not.toHaveBeenCalled();
+    expect(record.mock.calls[0][0]).toMatchObject({
+      status: "SKIPPED_NO_EMAIL",
+      customerEmail: "",
+    });
+  });
+
+  it("diverts a debug sweep and leaves the notice pending", async () => {
+    const { service, record, send, prisma } = build({});
+
+    const result = await service.sweep("user-1", { debug: true });
+
+    expect(result.sent).toBe(1);
+    expect(result.debug).toBe(true);
+    // The customer's own address is never contacted.
+    expect(jest.mocked(send).mock.calls[0][0]).toMatchObject({
+      to: "rmancinas@freakma.net",
+      xTracking: "debug",
+    });
+    expect(record.mock.calls[0][0]).toMatchObject({
+      status: "SENT",
+      customerEmail: "rmancinas@freakma.net",
+      debug: true,
+    });
+    // The letter is still owed, so nothing may gate it: no RenewalNotice row,
+    // and `lastSuccessfulAt` must not advance past the days we only tested.
+    expect(prisma.renewalNotice.upsert).not.toHaveBeenCalled();
+    const release = prisma.scheduledJobState.update.mock.calls.at(-1)?.[0];
+    expect(release.data.lastSuccessfulAt).toBeUndefined();
+  });
+
+  it("sends one notice on demand in debug without marking it sent", async () => {
+    const { service, send, prisma } = build({});
+
+    const result = await service.sendOne(POLICY_ID, 1, "user-1", {
+      debug: true,
+    });
+
+    expect(result.debug).toBe(true);
+    expect(result.to).toBe("rmancinas@freakma.net");
+    expect(send).toHaveBeenCalledTimes(1);
+    expect(prisma.renewalNotice.upsert).not.toHaveBeenCalled();
+  });
+
+  it("does not fail a delivered notice when the log write throws", async () => {
+    const { service, record } = build({});
+    record.mockRejectedValue(new Error("log table gone"));
+
+    const result = await service.sweep("user-1");
+
+    // The mail went out and the gating row was written; a lost audit row must
+    // not report that as a failure, which would re-send tomorrow.
+    expect(result.sent).toBe(1);
+    expect(result.failed).toBe(0);
+  });
+});

apps/api/src/renewals/renewals.controller.ts

@@ -0,0 +1,72 @@
+import {
+  Body,
+  Controller,
+  Get,
+  HttpCode,
+  Post,
+  Query,
+  Req,
+  UseGuards,
+} from "@nestjs/common";
+import { Request } from "express";
+import { Type } from "class-transformer";
+import { IsBoolean, IsInt, IsOptional, IsString, Max, Min } from "class-validator";
+import { AbilityGuard } from "../auth/ability.guard";
+import { AuthenticatedGuard } from "../auth/authenticated.guard";
+import { RequireAbility } from "../auth/require-ability.decorator";
+import { RenewalsService } from "./renewals.service";
+
+/** The pólizas half of the shared "Flags del envío" panel. Only `debug`
+ *  means anything here — the day gate and the send limit are estado-de-cuenta
+ *  concepts — so the other two are simply not accepted. */
+class RenewalFlagsDto {
+  @IsOptional()
+  @IsBoolean()
+  debug?: boolean;
+}
+
+class SendRenewalDto extends RenewalFlagsDto {
+  @IsString()
+  policyId!: string;
+
+  /** 1 = 30 días antes, 2 = 15 días antes, 3 = 7 días después. */
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(3)
+  generation!: number;
+}
+
+@UseGuards(AuthenticatedGuard, AbilityGuard)
+@Controller("renewals")
+export class RenewalsController {
+  constructor(private readonly renewals: RenewalsService) {}
+
+  @Get("pending")
+  pending(@Query("days") days?: string) {
+    return this.renewals.pending(
+      Math.min(365, Math.max(1, Number(days) || 30)),
+    );
+  }
+
+  @Post("sweep")
+  @RequireAbility("renewal:send")
+  sweep(@Body() dto: RenewalFlagsDto, @Req() req: Request) {
+    return this.renewals.sweep((req.user as { id: string }).id, {
+      debug: dto?.debug,
+    });
+  }
+
+  /** Send a single pending notice from the /notificaciones list. */
+  @Post("send")
+  @RequireAbility("renewal:send")
+  @HttpCode(200)
+  send(@Body() dto: SendRenewalDto, @Req() req: Request) {
+    return this.renewals.sendOne(
+      dto.policyId,
+      dto.generation,
+      (req.user as { id: string }).id,
+      { debug: dto.debug },
+    );
+  }
+}

apps/api/src/renewals/renewals.module.ts

@@ -0,0 +1,15 @@
+import { Module } from "@nestjs/common";
+import { NotificationLogModule } from "../notifications/notification-log.module";
+import { NotificationScheduleModule } from "../notifications/notification-schedule.module";
+import { RenewalsController } from "./renewals.controller";
+import { RenewalsService } from "./renewals.service";
+
+@Module({
+  // Renewal sends write to the same `email_notification_log` the four bulk
+  // jobs write, so /notificaciones has one send history across both tabs, and
+  // take their cadence from the same operator-editable schedule.
+  imports: [NotificationLogModule, NotificationScheduleModule],
+  controllers: [RenewalsController],
+  providers: [RenewalsService],
+})
+export class RenewalsModule {}

apps/api/src/renewals/renewals.service.spec.ts

@@ -0,0 +1,42 @@
+import {
+  addUtcDays,
+  dateInTimeZone,
+  renewalWindow,
+  RENEWAL_CADENCE,
+} from "./renewals.service";
+
+describe("renewal scheduling dates", () => {
+  it("uses the America/Tijuana calendar date", () => {
+    expect(dateInTimeZone(new Date("2026-08-01T05:00:00.000Z"))).toEqual(
+      new Date("2026-07-31T00:00:00.000Z"),
+    );
+  });
+
+  it("maps generations to 30 days, 15 days, and 7 days overdue", () => {
+    const today = new Date("2026-08-01T00:00:00.000Z");
+
+    expect(
+      RENEWAL_CADENCE.map(({ generation, offsetDays }) => ({
+        generation,
+        target: addUtcDays(today, offsetDays).toISOString().slice(0, 10),
+      })),
+    ).toEqual([
+      { generation: 1, target: "2026-08-31" },
+      { generation: 2, target: "2026-08-16" },
+      { generation: 3, target: "2026-07-25" },
+    ]);
+  });
+
+  it("uses an inclusive catch-up window after a missed run", () => {
+    const window = renewalWindow(
+      new Date("2026-08-10T00:00:00.000Z"),
+      30,
+      new Date("2026-08-07T18:00:00.000Z"),
+    );
+
+    expect(window).toEqual({
+      from: new Date("2026-09-07T00:00:00.000Z"),
+      to: new Date("2026-09-09T00:00:00.000Z"),
+    });
+  });
+});

apps/api/src/renewals/renewals.service.ts

@@ -0,0 +1,449 @@
+import {
+  BadRequestException,
+  ConflictException,
+  Injectable,
+  Logger,
+  NotFoundException,
+  OnModuleInit,
+  ServiceUnavailableException,
+} from "@nestjs/common";
+import { AuditService } from "../common/audit.service";
+import { MailService } from "../mail/mail.service";
+import { NotificationLogService } from "../notifications/notification-log.service";
+import {
+  NotificationScheduleService,
+  SCHEDULE_TIME_ZONE,
+} from "../notifications/notification-schedule.service";
+import { DEBUG_RECIPIENT } from "../notifications/notification.types";
+import { PrismaService } from "../prisma/prisma.service";
+import {
+  RenewalLetterPolicy,
+  renewalLetterSelect,
+  toRenewalLetterRow,
+} from "../reports/renewal-letter";
+import { renderRenewalEmail } from "./renewal-email";
+
+export const RENEWAL_CADENCE = [
+  { generation: 1, offsetDays: 30 },
+  { generation: 2, offsetDays: 15 },
+  { generation: 3, offsetDays: -7 },
+] as const;
+
+const JOB_NAME = "renewal-email-sweep";
+/** The window maths runs in office time; the cadence itself is owned by
+ *  `NotificationScheduleService`, which uses the same zone. */
+const TIME_ZONE = SCHEDULE_TIME_ZONE;
+const DAY_MS = 86400000;
+
+export function dateInTimeZone(now: Date, timeZone = TIME_ZONE): Date {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+  }).formatToParts(now);
+  const value = (type: Intl.DateTimeFormatPartTypes) =>
+    Number(parts.find((part) => part.type === type)?.value);
+  return new Date(Date.UTC(value("year"), value("month") - 1, value("day")));
+}
+
+export function addUtcDays(date: Date, days: number): Date {
+  return new Date(date.getTime() + days * DAY_MS);
+}
+
+export function renewalWindow(
+  today: Date,
+  offsetDays: number,
+  lastSuccessfulAt?: Date | null,
+): { from: Date; to: Date } {
+  const to = addUtcDays(today, offsetDays);
+  if (!lastSuccessfulAt) return { from: to, to };
+  const previousDay = dateInTimeZone(lastSuccessfulAt);
+  if (previousDay >= today) return { from: to, to };
+  return { from: addUtcDays(previousDay, offsetDays + 1), to };
+}
+
+@Injectable()
+export class RenewalsService implements OnModuleInit {
+  private readonly logger = new Logger(RenewalsService.name);
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly mail: MailService,
+    private readonly audit: AuditService,
+    private readonly notificationLog: NotificationLogService,
+    private readonly schedule: NotificationScheduleService,
+  ) {}
+
+  /** The cadence used to be a `@Cron("0 6 * * *")` literal here; it is now
+   *  operator-editable, and the stored value defaults to that same 06:00
+   *  daily run. */
+  async onModuleInit(): Promise<void> {
+    await this.schedule.register("polizas", () => this.scheduledSweep());
+  }
+
+  /** The unattended run always sends for real: `debug` is a per-click switch
+   *  in the UI, never persisted, so the schedule cannot inherit a forgotten
+   *  test toggle and silently stop mailing customers. */
+  async scheduledSweep(): Promise<void> {
+    try {
+      await this.sweep();
+    } catch (error) {
+      this.logger.error(
+        `Falló el barrido de renovaciones: ${(error as Error).message}`,
+      );
+    }
+  }
+
+  async pending(days = 30) {
+    const today = dateInTimeZone(new Date());
+    const state = await this.prisma.scheduledJobState.findUnique({
+      where: { name: JOB_NAME },
+      select: { lastSuccessfulAt: true },
+    });
+    const cadence = RENEWAL_CADENCE.filter(
+      (item) => item.offsetDays < 0 || item.offsetDays <= days,
+    );
+    const groups = await Promise.all(
+      cadence.map(async (item) => ({
+        generation: item.generation,
+        rows: await this.findCandidates(
+          item,
+          today,
+          state?.lastSuccessfulAt ?? null,
+        ),
+      })),
+    );
+
+    return groups.flatMap(({ generation, rows }) =>
+      rows
+        .filter((policy) => Boolean(policy.customer.email?.trim()))
+        .map((policy) => toRenewalLetterRow(policy, generation)),
+    );
+  }
+
+  async sweep(userId?: string, flags: { debug?: boolean } = {}) {
+    const debug = !!flags.debug;
+    const now = new Date();
+    const state = await this.acquireLock(now);
+
+    try {
+      if (!this.mail.available) {
+        throw new ServiceUnavailableException(
+          "El servicio de correo no está configurado.",
+        );
+      }
+
+      const today = dateInTimeZone(now);
+      let eligible = 0;
+      let sent = 0;
+      let skipped = 0;
+      const failures: Array<{ policyId: string; generation: number; error: string }> = [];
+
+      for (const cadence of RENEWAL_CADENCE) {
+        const policies = await this.findCandidates(
+          cadence,
+          today,
+          state.lastSuccessfulAt,
+        );
+        eligible += policies.length;
+
+        for (const policy of policies) {
+          const to = policy.customer.email?.trim();
+          if (!to) {
+            // Logged rather than silently counted: "we had nobody to mail"
+            // is a finding the office acts on, and only the log survives the
+            // HTTP response.
+            await this.recordLog(policy, cadence.generation, "", {
+              status: "SKIPPED_NO_EMAIL",
+              debug,
+            });
+            skipped++;
+            continue;
+          }
+
+          try {
+            await this.deliver(policy, cadence.generation, to, userId, debug);
+            sent++;
+          } catch (error) {
+            failures.push({
+              policyId: policy.id,
+              generation: cadence.generation,
+              error: (error as Error).message,
+            });
+          }
+        }
+      }
+
+      const result = {
+        eligible,
+        sent,
+        skipped,
+        failed: failures.length,
+        failures,
+        debug,
+      };
+      // A debug run must not advance `lastSuccessfulAt`: it wrote no
+      // RenewalNotice rows, so the days it "covered" are still owed, and
+      // narrowing tomorrow's window back to a single day would drop them.
+      await this.releaseLock(!debug && failures.length === 0 ? now : null);
+      void this.audit.log(userId, "renewalNotice.sweep", result);
+      return result;
+    } catch (error) {
+      await this.releaseLock(null);
+      throw error;
+    }
+  }
+
+  /**
+   * Send one pending renewal notice on demand, from the /notificaciones
+   * list. Same path the sweep takes — render, send, then record the notice —
+   * so a letter sent by hand is marked exactly like a swept one and drops
+   * off the pending list. Refuses a generation already sent so a double
+   * click can't mail the customer twice.
+   *
+   * Under `debug` the notice is NOT marked as sent, so the row stays in the
+   * pending list — the customer has still not been told anything.
+   */
+  async sendOne(
+    policyId: string,
+    generation: number,
+    userId?: string,
+    flags: { debug?: boolean } = {},
+  ) {
+    const debug = !!flags.debug;
+    if (!this.mail.available) {
+      throw new ServiceUnavailableException(
+        "El servicio de correo no está configurado.",
+      );
+    }
+
+    const policy = await this.prisma.policy.findFirst({
+      where: { id: policyId, archivedAt: null },
+      select: renewalLetterSelect(generation),
+    });
+    if (!policy) {
+      throw new NotFoundException("Póliza no encontrada.");
+    }
+    if (policy.renewalNotices.some((notice) => notice.sentAt)) {
+      throw new ConflictException("Este aviso ya fue enviado.");
+    }
+    const to = policy.customer.email?.trim();
+    if (!to) {
+      throw new BadRequestException("El cliente no tiene correo registrado.");
+    }
+
+    const { sentAt, providerMessageId, addressedTo } = await this.deliver(
+      policy,
+      generation,
+      to,
+      userId,
+      debug,
+    );
+    return {
+      policyId,
+      generation,
+      // The address the mail actually went to — under debug that is the
+      // override inbox, and the UI says so rather than claiming the customer
+      // was notified.
+      to: addressedTo,
+      debug,
+      sentAt: sentAt.toISOString(),
+      providerMessageId,
+    };
+  }
+
+  /** Render + send + record one notice. Shared by the sweep and `sendOne`.
+   *
+   *  Two records come out of a send: the `RenewalNotice` row, which gates the
+   *  pending list, and an `email_notification_log` row, which is the send
+   *  history the /notificaciones "Registro de envíos" reads. A failed send
+   *  writes only the second — there is no notice to gate on — and rethrows so
+   *  the sweep counts it as a failure.
+   *
+   *  Under `debug` the mail is diverted to `DEBUG_RECIPIENT` and the
+   *  `RenewalNotice` row is deliberately skipped: the customer was not
+   *  notified, so nothing may gate the letter they are still owed. Only the
+   *  log row is written, flagged `debug`. */
+  private async deliver(
+    policy: RenewalLetterPolicy,
+    generation: number,
+    to: string,
+    userId?: string,
+    debug = false,
+  ) {
+    const letter = toRenewalLetterRow(policy, generation);
+    const message = renderRenewalEmail(letter);
+    const addressedTo = debug ? DEBUG_RECIPIENT : to;
+
+    let result: Awaited<ReturnType<MailService["send"]>>;
+    try {
+      result = await this.mail.send({
+        to: addressedTo,
+        toName: letter.customerName,
+        subject: message.subject,
+        html: message.html,
+        xTracking: debug ? "debug" : "renewals",
+      });
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      await this.recordLog(policy, generation, addressedTo, {
+        status: "FAILED",
+        error: detail,
+        debug,
+      });
+      throw error;
+    }
+
+    const sentAt = new Date();
+
+    if (!debug) {
+      await this.prisma.renewalNotice.upsert({
+        where: {
+          policyId_generation: { policyId: policy.id, generation },
+        },
+        create: {
+          policyId: policy.id,
+          generation,
+          channel: "EMAIL",
+          sentAt,
+          sentById: userId,
+          providerMessageId: result.messageId,
+        },
+        update: {
+          channel: "EMAIL",
+          sentAt,
+          sentById: userId,
+          providerMessageId: result.messageId,
+        },
+      });
+    }
+    await this.recordLog(policy, generation, addressedTo, {
+      status: "SENT",
+      providerMessageId: result.messageId || undefined,
+      providerResponse: result.response || undefined,
+      sendDate: sentAt,
+      debug,
+    });
+    void this.audit.log(userId, "renewalNotice.send", {
+      policyId: policy.id,
+      generation,
+      debug,
+      providerMessageId: result.messageId,
+    });
+    return { sentAt, providerMessageId: result.messageId, addressedTo };
+  }
+
+  /**
+   * Write one row to the shared notification log.
+   *
+   * Never throws: the mail is already gone (or already failed) by the time we
+   * get here, and losing the audit row must not turn a delivered notice into
+   * a reported failure — which on the SENT path would also strand the
+   * `RenewalNotice` we just wrote and re-send tomorrow.
+   */
+  private async recordLog(
+    policy: RenewalLetterPolicy,
+    generation: number,
+    /** Recipient as addressed. Empty on the SKIPPED_NO_EMAIL path — that
+     *  emptiness IS the reason the row exists. */
+    to: string,
+    outcome: {
+      status: "SENT" | "FAILED" | "SKIPPED_NO_EMAIL";
+      providerMessageId?: string;
+      providerResponse?: string;
+      error?: string;
+      sendDate?: Date;
+      debug?: boolean;
+    },
+  ): Promise<void> {
+    const letter = toRenewalLetterRow(policy, generation);
+    const message = renderRenewalEmail(letter);
+    try {
+      await this.notificationLog.record({
+        notificationType: "RENEWAL_NOTICE",
+        servicio: "POLICIES",
+        sendDate: outcome.sendDate,
+        // `level` carries the aviso generation for RENEWAL_NOTICE rows — see
+        // the column doc on the Prisma model.
+        level: generation,
+        customerId: policy.customer.id,
+        customerName: letter.customerName,
+        customerEmail: to,
+        subject: message.subject,
+        bodySnapshot: message.html,
+        status: outcome.status,
+        debug: !!outcome.debug,
+        providerMessageId: outcome.providerMessageId,
+        providerResponse: outcome.providerResponse,
+        error: outcome.error,
+      });
+    } catch (error) {
+      this.logger.warn(
+        `No se pudo registrar el aviso de renovación en el log ` +
+          `(póliza ${policy.id}, aviso ${generation}): ` +
+          `${(error as Error).message}`,
+      );
+    }
+  }
+
+  private findCandidates(
+    cadence: (typeof RENEWAL_CADENCE)[number],
+    today: Date,
+    lastSuccessfulAt: Date | null,
+  ) {
+    const window = renewalWindow(today, cadence.offsetDays, lastSuccessfulAt);
+    return this.prisma.policy.findMany({
+      where: {
+        archivedAt: null,
+        policyTo: { gte: window.from, lte: window.to },
+        customer: {
+          archivedAt: null,
+          emailOptOut: false,
+          email: { not: "" },
+        },
+        renewalNotices: {
+          none: { generation: cadence.generation, sentAt: { not: null } },
+        },
+      },
+      orderBy: [{ policyTo: "asc" }, { policyNumber: "asc" }],
+      select: renewalLetterSelect(cadence.generation),
+    });
+  }
+
+  private async acquireLock(now: Date) {
+    await this.prisma.scheduledJobState.upsert({
+      where: { name: JOB_NAME },
+      create: { name: JOB_NAME },
+      update: { updatedAt: now },
+    });
+
+    const acquired = await this.prisma.scheduledJobState.updateMany({
+      where: {
+        name: JOB_NAME,
+        OR: [{ lockedUntil: null }, { lockedUntil: { lte: now } }],
+      },
+      data: { lockedUntil: new Date(now.getTime() + 2 * 60 * 60 * 1000) },
+    });
+
+    if (acquired.count !== 1) {
+      throw new ConflictException(
+        "Ya hay un barrido de renovaciones en curso.",
+      );
+    }
+
+    return this.prisma.scheduledJobState.findUniqueOrThrow({
+      where: { name: JOB_NAME },
+    });
+  }
+
+  private async releaseLock(lastSuccessfulAt: Date | null): Promise<void> {
+    await this.prisma.scheduledJobState.update({
+      where: { name: JOB_NAME },
+      data: {
+        lockedUntil: null,
+        ...(lastSuccessfulAt && { lastSuccessfulAt }),
+      },
+    });
+  }
+}

apps/api/src/reports/renewal-letter.ts

@@ -0,0 +1,141 @@
+import { Prisma } from "@jorgecuadros/database";
+
+export function renewalLetterSelect(generation: number) {
+  return Prisma.validator<Prisma.PolicySelect>()({
+    id: true,
+    policyNumber: true,
+    policyTo: true,
+    netPremium: true,
+    policyFee: true,
+    total: true,
+    currency: true,
+    coveragesJson: true,
+    customer: {
+      select: {
+        // Needed by the notification log's customerId FK, not by the letter.
+        id: true,
+        name: true,
+        nameMissing: true,
+        email: true,
+        phone: true,
+        mobile: true,
+        addressLine1: true,
+        addressLine2: true,
+        city: true,
+        state: true,
+        zipCode: true,
+        country: true,
+      },
+    },
+    policyType: { select: { name: true } },
+    insuranceProvider: { select: { name: true } },
+    vehicles: {
+      take: 1,
+      select: {
+        make: true,
+        model: true,
+        modelYear: true,
+        bodyType: true,
+        engineNumber: true,
+        licensePlate: true,
+      },
+    },
+    renewalNotices: {
+      where: { generation },
+      select: { sentAt: true, channel: true },
+    },
+  });
+}
+
+export type RenewalLetterPolicy = Prisma.PolicyGetPayload<{
+  select: ReturnType<typeof renewalLetterSelect>;
+}>;
+
+export interface RenewalLetterRow extends Record<string, unknown> {
+  __kind: "letter";
+  policyId: string;
+  policyNumber: string;
+  policyType: string;
+  customerName: string;
+  customerEmail: string | null;
+  customerPhone: string | null;
+  customerMobile: string | null;
+  customerAddress: string[];
+  provider: string;
+  policyTo: string;
+  netPremium: string | null;
+  policyFee: string | null;
+  total: string | null;
+  currency: string;
+  coverageDays: unknown;
+  cslLimit: unknown;
+  medicalCoverage: unknown;
+  propertyDamage: unknown;
+  perPersonLiability: unknown;
+  additionalService: unknown;
+  vehicle: {
+    make: string | null;
+    model: string | null;
+    modelYear: string | null;
+    bodyType: string | null;
+    engineNumber: string | null;
+    licensePlate: string | null;
+  } | null;
+  generation: number;
+  sentAt: string | null;
+}
+
+export function toRenewalLetterRow(
+  policy: RenewalLetterPolicy,
+  generation: number,
+): RenewalLetterRow {
+  const notice = policy.renewalNotices[0];
+  const coverage = (policy.coveragesJson ?? {}) as Record<string, unknown>;
+  const address = [
+    policy.customer.addressLine1,
+    policy.customer.addressLine2,
+    [policy.customer.city, policy.customer.state, policy.customer.zipCode]
+      .filter(Boolean)
+      .join(", "),
+    policy.customer.country,
+  ].filter((part): part is string => Boolean(part));
+
+  return {
+    __kind: "letter",
+    policyId: policy.id,
+    policyNumber: policy.policyNumber,
+    policyType: policy.policyType?.name ?? "—",
+    customerName: policy.customer.nameMissing ? "(sin nombre)" : policy.customer.name,
+    customerEmail: policy.customer.email,
+    customerPhone: policy.customer.phone,
+    customerMobile: policy.customer.mobile,
+    customerAddress: address,
+    provider: policy.insuranceProvider?.name ?? "—",
+    policyTo: policy.policyTo ? policy.policyTo.toISOString().slice(0, 10) : "—",
+    netPremium: policy.netPremium ? policy.netPremium.toFixed(2) : null,
+    policyFee: policy.policyFee ? policy.policyFee.toFixed(2) : null,
+    total: policy.total ? policy.total.toFixed(2) : null,
+    currency: policy.currency,
+    coverageDays: coverage.cobertura ?? null,
+    cslLimit: coverage.csl_limite ?? null,
+    medicalCoverage: coverage.gastos_medico ?? null,
+    propertyDamage: coverage.propiedades ?? null,
+    perPersonLiability: coverage.personas ?? null,
+    additionalService:
+      coverage.servicio_adicional ?? coverage.servicio_adiconal ?? null,
+    vehicle: policy.vehicles[0]
+      ? {
+          make: policy.vehicles[0].make,
+          model: policy.vehicles[0].model,
+          modelYear: policy.vehicles[0].modelYear,
+          bodyType: policy.vehicles[0].bodyType,
+          engineNumber: policy.vehicles[0].engineNumber,
+          licensePlate: policy.vehicles[0].licensePlate,
+        }
+      : null,
+    generation,
+    sentAt: notice?.sentAt
+      ? notice.sentAt.toISOString().slice(0, 10)
+      : null,
+  };
+}

apps/api/src/reports/reports.registry.ts

@@ -21,6 +21,10 @@ import {
   parseDate,
   type ReportDef,
 } from "./reports.types";
+import {
+  renewalLetterSelect,
+  toRenewalLetterRow,
+} from "./renewal-letter";
 
 /* ------------------------------------------------------------------ helpers */
 
@@ -615,10 +619,7 @@ const vigente: ReportDef = {
  * covers every carrier and tier instead of a clone per combination.
  *
  * `sentStatus` is read from `RenewalNotice` (schema.prisma) — the
- * replacement for the legacy `CONTROL <ramo> RENEW[2/3] X MES` paper log
+ * replacement for the legacy `CONTROL <ramo> RENEW[2/3] X MES` paper log.
- * — but this report is read-only; marking a notice as sent is a separate
- * mutation (not yet built) that would upsert `RenewalNotice` by
- * `[policyId, generation]`.
  */
 const avisoRenovacion: ReportDef = {
   slug: "aviso-renovacion",
@@ -711,78 +712,16 @@ const avisoRenovacion: ReportDef = {
           : {}),
       },
       orderBy: { policyTo: "asc" },
-      select: {
+      select: renewalLetterSelect(generation),
-        id: true,
-        policyNumber: true,
-        policyTo: true,
-        netPremium: true,
-        policyFee: true,
-        total: true,
-        currency: true,
-        coveragesJson: true,
-        customer: { select: { name: true, nameMissing: true } },
-        insuranceProvider: { select: { name: true } },
-        vehicles: {
-          take: 1,
-          select: {
-            make: true,
-            model: true,
-            modelYear: true,
-            bodyType: true,
-            engineNumber: true,
-            licensePlate: true,
-          },
-        },
-        renewalNotices: {
-          where: { generation },
-          select: { sentAt: true, channel: true },
-        },
-      },
     });
 
     let totalPremium = new Prisma.Decimal(0);
     let sentCount = 0;
     const out = rows.map((r) => {
       if (r.netPremium) totalPremium = totalPremium.plus(r.netPremium);
-      const notice = r.renewalNotices[0];
+      const letter = toRenewalLetterRow(r, generation);
-      if (notice?.sentAt) sentCount++;
+      if (letter.sentAt) sentCount++;
-      // Legacy coverage columns not modeled as first-class Policy fields —
+      return letter;
-      // see docs/RENEWAL_NOTICES.md's column-mapping table. Keys are best-
-      // effort (derived from the source schema, not yet verified against a
-      // live migrated DB) — confirm before relying on them in production.
-      const cov = (r.coveragesJson ?? {}) as Record<string, unknown>;
-      return {
-        __kind: "letter",
-        policyId: r.id,
-        policyNumber: r.policyNumber,
-        customerName: nameOf(r.customer),
-        provider: r.insuranceProvider?.name ?? "—",
-        policyTo: r.policyTo ? r.policyTo.toISOString().slice(0, 10) : "—",
-        netPremium: r.netPremium ? r.netPremium.toFixed(2) : null,
-        policyFee: r.policyFee ? r.policyFee.toFixed(2) : null,
-        total: r.total ? r.total.toFixed(2) : null,
-        currency: r.currency,
-        coverageDays: cov.cobertura ?? null,
-        cslLimit: cov.csl_limite ?? null,
-        medicalCoverage: cov.gastos_medico ?? null,
-        propertyDamage: cov.propiedades ?? null,
-        perPersonLiability: cov.personas ?? null,
-        additionalService: cov.servicio_adicional ?? cov.servicio_adiconal ?? null,
-        vehicle: r.vehicles[0]
-          ? {
-              make: r.vehicles[0].make,
-              model: r.vehicles[0].model,
-              modelYear: r.vehicles[0].modelYear,
-              bodyType: r.vehicles[0].bodyType,
-              engineNumber: r.vehicles[0].engineNumber,
-              licensePlate: r.vehicles[0].licensePlate,
-            }
-          : null,
-        generation,
-        sentAt: notice?.sentAt
-          ? notice.sentAt.toISOString().slice(0, 10)
-          : null,
-      };
     });
 
     return {

apps/api/src/settings/settings.module.ts

@@ -0,0 +1,14 @@
+import { Module } from "@nestjs/common";
+import { SettingsService } from "./settings.service";
+
+/**
+ * Operator-editable configuration. No controller of its own — each setting is
+ * exposed by the feature that owns it (summary recipients live under
+ * /notifications), so the validation and the permission live next to the
+ * thing they protect rather than behind a generic key/value endpoint.
+ */
+@Module({
+  providers: [SettingsService],
+  exports: [SettingsService],
+})
+export class SettingsModule {}

apps/api/src/settings/settings.service.spec.ts

@@ -0,0 +1,89 @@
+import { SettingsService, invalidEmails, parseEmailList } from "./settings.service";
+
+/**
+ * The db → env → default ladder is the whole contract of this service: it is
+ * what lets the setting move out of the environment without changing how any
+ * existing deployment behaves.
+ */
+
+function build(row: { value: string } | null, env?: string) {
+  const prisma = {
+    appSetting: {
+      findUnique: jest.fn().mockResolvedValue(
+        row ? { key: "k", updatedAt: new Date("2026-08-02"), updatedById: "u1", ...row } : null,
+      ),
+      upsert: jest.fn().mockResolvedValue({}),
+    },
+  };
+  const config = { get: jest.fn().mockReturnValue(env) };
+  return {
+    service: new SettingsService(prisma as never, config as never),
+    prisma,
+  };
+}
+
+describe("notification admin emails resolve db > env > default", () => {
+  it("prefers the stored row", async () => {
+    const { service } = build({ value: "a@x.com,b@x.com" }, "env@x.com");
+
+    await expect(service.notificationAdminEmails()).resolves.toMatchObject({
+      value: ["a@x.com", "b@x.com"],
+      source: "db",
+      updatedById: "u1",
+    });
+  });
+
+  it("falls back to the environment when nothing is stored", async () => {
+    const { service } = build(null, "env@x.com, other@x.com");
+
+    await expect(service.notificationAdminEmails()).resolves.toMatchObject({
+      value: ["env@x.com", "other@x.com"],
+      source: "env",
+    });
+  });
+
+  it("falls back to the built-in defaults when neither is set", async () => {
+    const { service } = build(null, undefined);
+
+    const resolved = await service.notificationAdminEmails();
+    expect(resolved.source).toBe("default");
+    expect(resolved.value).toHaveLength(2);
+  });
+
+  it("treats a stored empty list as 'nobody', not as unset", async () => {
+    // The regression this guards: falling through to env/defaults here would
+    // keep mailing people who were deliberately removed.
+    const { service } = build({ value: "" }, "env@x.com");
+
+    await expect(service.notificationAdminEmails()).resolves.toMatchObject({
+      value: [],
+      source: "db",
+    });
+  });
+
+  it("writes the list back as CSV", async () => {
+    const { service, prisma } = build({ value: "" });
+
+    await service.setNotificationAdminEmails(["a@x.com", "b@x.com"], "user-9");
+
+    expect(prisma.appSetting.upsert).toHaveBeenCalledWith(
+      expect.objectContaining({
+        create: expect.objectContaining({ value: "a@x.com,b@x.com", updatedById: "user-9" }),
+        update: expect.objectContaining({ value: "a@x.com,b@x.com", updatedById: "user-9" }),
+      }),
+    );
+  });
+});
+
+describe("email list parsing", () => {
+  it("trims and drops blanks", () => {
+    expect(parseEmailList(" a@x.com , ,b@x.com ")).toEqual(["a@x.com", "b@x.com"]);
+  });
+
+  it("rejects entries that are not addresses at all", () => {
+    expect(invalidEmails(["ok@x.com", "nope", "also@bad"])).toEqual([
+      "nope",
+      "also@bad",
+    ]);
+  });
+});

apps/api/src/settings/settings.service.ts

@@ -0,0 +1,183 @@
+import { Injectable, Logger } from "@nestjs/common";
+import { ConfigService } from "@nestjs/config";
+import { PrismaService } from "../prisma/prisma.service";
+
+/**
+ * Reader/writer for `app_settings` — the configuration staff can change
+ * without a redeploy.
+ *
+ * Every setting resolves through the same three-step ladder: the database row
+ * if an operator has set one, else the environment variable it used to live
+ * in, else a hardcoded default. That ordering is what makes this migration
+ * safe — an existing deployment keeps behaving exactly as it did until
+ * somebody edits the value in the UI, and `source` tells the UI which of the
+ * three it is looking at so "this came from the env, editing it here will
+ * take over" is visible rather than surprising.
+ */
+
+export const SETTING_KEYS = {
+  /** Comma-separated recipients of the per-job notification summary. */
+  notificationAdminEmails: "notification.adminEmails",
+  /** JSON cadence of the automatic servicios sweep. */
+  scheduleServicios: "notification.schedule.servicios",
+  /** JSON cadence of the automatic pólizas renewal sweep. */
+  schedulePolizas: "notification.schedule.polizas",
+} as const;
+
+/** Where a resolved value came from. Shown in the UI. */
+export type SettingSource = "db" | "env" | "default";
+
+export interface ResolvedSetting<T> {
+  value: T;
+  source: SettingSource;
+  updatedAt: Date | null;
+  updatedById: string | null;
+}
+
+/** Last resort when neither the database nor the environment says otherwise.
+ *  Matches what `NotificationsService` hardcoded before this table existed. */
+const DEFAULT_ADMIN_EMAILS = ["rmancinas@freakma.net", "mpulido@freakma.net"];
+
+/** Deliberately permissive — this rejects "not an address at all", not
+ *  "not deliverable". Only SES can tell us the latter, and a validator strict
+ *  enough to argue with is a validator that blocks a legitimate address. */
+const EMAIL_RE = /^[^\s@,]+@[^\s@,]+\.[^\s@,]+$/;
+
+export function parseEmailList(raw: string): string[] {
+  return raw
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+export function invalidEmails(list: string[]): string[] {
+  return list.filter((e) => !EMAIL_RE.test(e));
+}
+
+@Injectable()
+export class SettingsService {
+  private readonly logger = new Logger(SettingsService.name);
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly config: ConfigService,
+  ) {}
+
+  /**
+   * Recipients of the per-job summary email.
+   *
+   * Read on every send rather than cached at boot: the point of moving this
+   * out of the environment was that it changes while the app is running, and
+   * a cache would reintroduce exactly the restart-to-apply behaviour we are
+   * removing. It is one indexed primary-key lookup per sweep, not per email.
+   */
+  async notificationAdminEmails(): Promise<ResolvedSetting<string[]>> {
+    const row = await this.read(SETTING_KEYS.notificationAdminEmails);
+    if (row) {
+      const parsed = parseEmailList(row.value);
+      // An empty stored value is a legitimate choice — "send no summaries" —
+      // and must not silently fall through to the env or the defaults, or an
+      // operator who cleared the field would keep receiving mail.
+      return {
+        value: parsed,
+        source: "db",
+        updatedAt: row.updatedAt,
+        updatedById: row.updatedById,
+      };
+    }
+
+    const env = this.config.get<string>("NOTIFICATION_ADMIN_EMAILS");
+    if (env && env.trim()) {
+      return {
+        value: parseEmailList(env),
+        source: "env",
+        updatedAt: null,
+        updatedById: null,
+      };
+    }
+
+    return {
+      value: [...DEFAULT_ADMIN_EMAILS],
+      source: "default",
+      updatedAt: null,
+      updatedById: null,
+    };
+  }
+
+  /** Persist the summary recipients. An empty list is stored as an empty
+   *  string and means "nobody" — see the read path above. */
+  async setNotificationAdminEmails(
+    emails: string[],
+    userId: string,
+  ): Promise<ResolvedSetting<string[]>> {
+    await this.write(
+      SETTING_KEYS.notificationAdminEmails,
+      emails.join(","),
+      userId,
+    );
+    return this.notificationAdminEmails();
+  }
+
+  /**
+   * Cadence of one automatic envío, stored as JSON.
+   *
+   * No env rung on this ladder: a schedule was never an environment variable
+   * (it was a `@Cron` literal in the source), so the only two sources are the
+   * operator's row and the caller's default — which is the previous hardcoded
+   * behaviour. A row that fails to parse is treated as absent and logged
+   * rather than thrown: a bad JSON blob must not take the scheduler down with
+   * it, and falling back to the shipped cadence is the safe reading.
+   */
+  async notificationSchedule<T>(
+    kind: "servicios" | "polizas",
+    fallback: T,
+  ): Promise<ResolvedSetting<T>> {
+    const key =
+      kind === "servicios"
+        ? SETTING_KEYS.scheduleServicios
+        : SETTING_KEYS.schedulePolizas;
+    const row = await this.read(key);
+    if (row) {
+      try {
+        return {
+          value: { ...fallback, ...(JSON.parse(row.value) as T) },
+          source: "db",
+          updatedAt: row.updatedAt,
+          updatedById: row.updatedById,
+        };
+      } catch (error) {
+        this.logger.warn(
+          `Setting ${key} is not valid JSON, using the default: ` +
+            `${(error as Error).message}`,
+        );
+      }
+    }
+    return { value: fallback, source: "default", updatedAt: null, updatedById: null };
+  }
+
+  async setNotificationSchedule(
+    kind: "servicios" | "polizas",
+    schedule: unknown,
+    userId: string,
+  ): Promise<void> {
+    await this.write(
+      kind === "servicios"
+        ? SETTING_KEYS.scheduleServicios
+        : SETTING_KEYS.schedulePolizas,
+      JSON.stringify(schedule),
+      userId,
+    );
+  }
+
+  private read(key: string) {
+    return this.prisma.appSetting.findUnique({ where: { key } });
+  }
+
+  private async write(key: string, value: string, userId: string) {
+    await this.prisma.appSetting.upsert({
+      where: { key },
+      create: { key, value, updatedById: userId },
+      update: { value, updatedById: userId },
+    });
+  }
+}

apps/api/src/statements/ocr/ocr.provider.ts

@@ -6,8 +6,10 @@
  * The shipped implementation is self-hosted Tesseract (see tesseract.provider).
  * That choice is evidence-based rather than assumed: run against 46 pages of
  * real scanned CFE, CESPT and Telnor statements, it identified the provider on
- * 46/46 and extracted a usable account reference on 43/46, which is well past
+ * 46/46 and extracted a usable account reference on 43/46, and on a later
- * the bar for a queue whose whole point is that a human confirms every row. A
+ * corpus of 19 scanned municipal predial receipts it read the provider on
+ * 19/19 and an identifier on 18/19 — well past the bar for a queue whose whole
+ * point is that a human confirms every row. A
  * managed document-extraction API (Textract, Document Intelligence, Document
  * AI) fits behind this same interface if per-page accuracy ever proves
  * insufficient, with no schema change — but at 300+ pages/month/company it
@@ -31,10 +33,10 @@ export interface OcrPage {
   /** Full page text, reading order, newline-separated. */
   text: string;
   /**
-   * Word boxes. Needed because two of the three real layouts are *tables* —
+   * Word boxes. Needed because several of the real layouts are *tables* — the
-   * the CESPT "RECIBO" prints `No. DE CUENTA` as a column header with the
+   * CESPT "RECIBO" prints `No. DE CUENTA` as a column header with the value in
-   * value in the row beneath it, which line-oriented text cannot associate.
+   * the row beneath it, which line-oriented text cannot associate. Parsers fall
-   * Parsers fall back to geometry for exactly those fields.
+   * back to geometry for exactly those fields.
    */
   words: OcrWord[];
   /** Mean word confidence across the page, 0..1. */
@@ -48,6 +50,22 @@ export interface OcrProvider {
   renderPages(pdf: Buffer): Promise<Buffer[]>;
   /** OCR a single rendered page image. */
   recognize(pageImage: Buffer): Promise<OcrPage>;
+  /**
+   * Read a PDF's own text layer, one entry per page, `null` where the page has
+   * none worth using.
+   *
+   * Not every statement is a scan. The gas company e-mails born-digital CFDI
+   * invoices whose text is already exact and already positioned — running those
+   * through a rasteriser and a character recogniser can only lose information
+   * (one sample turned `MEDIDOR: VM01014426` into `ar (LTR): 014420`) while
+   * costing about a minute of CPU per page for the privilege. Where the layer
+   * exists it is strictly better input for the same parsers, so it is tried
+   * first and OCR remains the fallback for genuine scans.
+   *
+   * Positions are reported in the same pixel space `recognize` uses, so the
+   * geometric helpers in the parsers work unchanged on either source.
+   */
+  textPages(pdf: Buffer): Promise<(OcrPage | null)[]>;
 }
 
 export const OCR_PROVIDER = Symbol("OCR_PROVIDER");

apps/api/src/statements/ocr/tesseract.provider.spec.ts

@@ -0,0 +1,67 @@
+import { parseBboxLayout } from "./tesseract.provider";
+
+/**
+ * Shaped like real `pdftotext -bbox-layout` output: the gas invoice lays its
+ * header out as two columns of independent text flows, so poppler puts a label
+ * and the value printed beside it in *different* `<line>` elements. Trusting
+ * that grouping is what left `PERIODO FACTURADO` with no value next to it and
+ * every period field empty on a batch whose text was perfectly readable.
+ */
+function word(x: number, y: number, text: string): string {
+  return `<word xMin="${x}" yMin="${y}" xMax="${x + 20}" yMax="${y + 8}">${text}</word>`;
+}
+
+function doc(...lines: string[]): string {
+  return `<doc><page width="612" height="792">${lines
+    .map((l) => `<flow><block><line>${l}</line></block></flow>`)
+    .join("")}</page></doc>`;
+}
+
+/** Enough words on the page to clear the "is this a real text layer" floor. */
+function padding(): string {
+  return Array.from({ length: 50 }, (_, i) => word(10, 400 + i * 10, `w${i}`)).join("");
+}
+
+describe("parseBboxLayout", () => {
+  it("rejoins a label with the value printed beside it in another flow", () => {
+    const [page] = parseBboxLayout(
+      doc(
+        word(20, 100, "PERIODO") + word(45, 100, "FACTURADO:"),
+        word(300, 100.4, "20260630-20260630"),
+        padding(),
+      ),
+      1,
+    );
+    expect(page).not.toBeNull();
+    expect(page!.text).toContain("PERIODO FACTURADO: 20260630-20260630");
+  });
+
+  it("keeps genuinely separate lines apart", () => {
+    const [page] = parseBboxLayout(
+      doc(word(20, 100, "Cuenta:") + word(80, 100, "0900003463"), word(20, 130, "Nombre:"), padding()),
+      1,
+    );
+    expect(page!.text.split("\n")).toContain("Cuenta: 0900003463");
+    expect(page!.text.split("\n")).toContain("Nombre:");
+  });
+
+  it("scales point coordinates into the render's pixel space", () => {
+    // Word boxes have to land in the same coordinate space tesseract reports,
+    // or the geometric helpers the parsers share silently stop finding values.
+    const [page] = parseBboxLayout(doc(word(72, 144, "X") + padding()), 300 / 72);
+    const x = page!.words.find((w) => w.text === "X")!;
+    expect(x.left).toBeCloseTo(300);
+    expect(x.top).toBeCloseTo(600);
+  });
+
+  it("reports no text layer for a scan carrying a few stray glyphs", () => {
+    expect(parseBboxLayout(doc(word(10, 10, "3") + word(40, 10, "of") + word(60, 10, "5")), 1)).toEqual([
+      null,
+    ]);
+  });
+
+  it("decodes the entities poppler escapes", () => {
+    const [page] = parseBboxLayout(doc(word(10, 10, "A&amp;B") + padding()), 1);
+    expect(page!.text).toContain("A&B");
+  });
+});

apps/api/src/statements/ocr/tesseract.provider.ts

@@ -105,6 +105,37 @@ export class TesseractOcrProvider implements OcrProvider {
     });
   }
 
+  /**
+   * `pdftotext -bbox-layout` — the same poppler package `pdftoppm` comes from,
+   * so this costs no extra dependency in the runtime image.
+   *
+   * A page is only accepted when it carries a real text layer. Scanned PDFs
+   * frequently contain a handful of stray glyphs (a scanner watermark, a page
+   * number stamped by the MFP), and treating those as the page's text would
+   * hand every parser an almost-empty string and silently take OCR out of the
+   * loop — so a floor of MIN_TEXT_WORDS words has to be present before the
+   * layer is believed.
+   */
+  async textPages(pdf: Buffer): Promise<(OcrPage | null)[]> {
+    await this.require();
+    return this.scratch(async (dir) => {
+      const src = join(dir, "in.pdf");
+      await writeFile(src, pdf);
+      const out = join(dir, "out.html");
+      try {
+        await run("pdftotext", ["-bbox-layout", src, out]);
+      } catch (err) {
+        this.logger.warn(
+          `pdftotext failed; falling back to OCR for this file: ${(err as Error).message}`,
+        );
+        return [];
+      }
+      // Points to pixels at the render DPI, so word boxes from either source
+      // land in one coordinate space and `valueUnder`'s thresholds hold.
+      return parseBboxLayout(await readFile(out, "utf8"), this.dpi / 72);
+    });
+  }
+
   async recognize(pageImage: Buffer): Promise<OcrPage> {
     await this.require();
     return this.scratch(async (dir) => {
@@ -136,6 +167,130 @@ export class TesseractOcrProvider implements OcrProvider {
   }
 }
 
+/**
+ * Below this many words a "text layer" is scanner debris, not a document.
+ * The real born-digital samples carry 400+ words a page; the scanned ones
+ * carry none at all, so the exact threshold is not delicate.
+ */
+const MIN_TEXT_WORDS = 40;
+
+const ENTITIES: Record<string, string> = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'",
+};
+
+function decodeEntities(s: string): string {
+  return s.replace(/&(#x?[0-9a-fA-F]+|[a-z]+);/g, (whole, body: string) => {
+    if (body[0] === "#") {
+      const code =
+        body[1] === "x" || body[1] === "X"
+          ? parseInt(body.slice(2), 16)
+          : parseInt(body.slice(1), 10);
+      return Number.isFinite(code) ? String.fromCodePoint(code) : whole;
+    }
+    return ENTITIES[body] ?? whole;
+  });
+}
+
+/**
+ * Turn `pdftotext -bbox-layout`'s XHTML into one OcrPage per PDF page.
+ *
+ * Parsed with regexes rather than an XML library on purpose: the output is
+ * machine-generated by poppler with a fixed element shape (`page` > `flow` >
+ * `block` > `line` > `word`), and the alternative is a parser dependency in
+ * the API for one file format read in one place. Only `page` and `word` are
+ * consulted — see below for why poppler's own `line` grouping is discarded.
+ *
+ * `confidence` is 1 for every word: these are the document's own characters,
+ * not a recognition guess.
+ */
+export function parseBboxLayout(xhtml: string, scale: number): (OcrPage | null)[] {
+  const pages: (OcrPage | null)[] = [];
+
+  for (const pageMatch of xhtml.matchAll(/<page\b[^>]*>([\s\S]*?)<\/page>/g)) {
+    const words: OcrWord[] = [];
+
+    for (const w of pageMatch[1].matchAll(
+      /<word\s+xMin="([\d.eE+-]+)"\s+yMin="([\d.eE+-]+)"\s+xMax="([\d.eE+-]+)"\s+yMax="([\d.eE+-]+)"\s*>([\s\S]*?)<\/word>/g,
+    )) {
+      const text = decodeEntities(w[5]).trim();
+      if (!text) continue;
+      const left = Number(w[1]) * scale;
+      const top = Number(w[2]) * scale;
+      words.push({
+        text,
+        left,
+        top,
+        width: Number(w[3]) * scale - left,
+        height: Number(w[4]) * scale - top,
+        confidence: 1,
+      });
+    }
+
+    pages.push(
+      words.length >= MIN_TEXT_WORDS
+        ? { text: toVisualRows(words), words, confidence: 1 }
+        : null,
+    );
+  }
+
+  return pages;
+}
+
+/**
+ * Reassemble words into the rows a reader sees, left to right.
+ *
+ * Poppler's own `<line>` grouping cannot be used for this. It groups by text
+ * flow, and these invoices lay their fields out as two columns of independent
+ * flows — so `PERIODO FACTURADO:` and the `20260630-20260630` printed beside
+ * it end up in different `<line>` elements, and every label-then-value pattern
+ * in the parsers misses a value that is plainly there on the page. Regrouping
+ * by vertical position restores the adjacency, and matches what tesseract
+ * hands back for the scanned version of the same layout.
+ *
+ * Rows are cut when a word's vertical centre leaves the band established by
+ * the row's first word, which tolerates the sub-pixel baseline differences
+ * between fonts on one line without merging two genuinely separate lines.
+ */
+function toVisualRows(words: OcrWord[]): string {
+  const centre = (w: OcrWord) => w.top + w.height / 2;
+  const sorted = [...words].sort((a, b) => centre(a) - centre(b) || a.left - b.left);
+
+  const rows: OcrWord[][] = [];
+  let current: OcrWord[] = [];
+  let band = 0;
+
+  for (const w of sorted) {
+    if (!current.length) {
+      current = [w];
+      band = centre(w);
+      continue;
+    }
+    // Half the word's own height: tall headings and body text both sit within
+    // their own line's band, and neither reaches into the next one.
+    if (Math.abs(centre(w) - band) <= Math.max(w.height, current[0].height) / 2) {
+      current.push(w);
+    } else {
+      rows.push(current);
+      current = [w];
+      band = centre(w);
+    }
+  }
+  if (current.length) rows.push(current);
+
+  return rows
+    .map((r) =>
+      [...r]
+        .sort((a, b) => a.left - b.left)
+        .map((w) => w.text)
+        .join(" "),
+    )
+    .join("\n");
+}
+
 /**
  * Turn tesseract's TSV into words plus reassembled text.
  *

apps/api/src/statements/parsers/statement-parser.spec.ts

@@ -0,0 +1,270 @@
+import type { OcrPage } from "../ocr/ocr.provider";
+import {
+  detectProvider,
+  normalizeCadastralKey,
+  normalizeZofematKey,
+  parseStatement,
+} from "./statement-parser";
+
+/**
+ * Every string in this file is a verbatim excerpt of what the OCR engine
+ * actually returned for a real receipt — misreads, dropped spaces, mangled
+ * accents and all. That is the point: these are the specific ways these five
+ * layouts have been observed to fail, and the assertions pin down what the
+ * parser is supposed to do about each one. Inventing clean input here would
+ * test nothing, because clean input was never the problem.
+ */
+function page(text: string): OcrPage {
+  return { text, words: [], confidence: 0.9 };
+}
+
+describe("detectProvider", () => {
+  it("reads a Rosarito predial receipt as predial, not as a water bill", () => {
+    // "Clave Catastral" is also a CESPT structural marker, so a predial page
+    // whose header OCR'd badly must still not be claimed by the CESPT rule.
+    expect(
+      detectProvider(
+        "e | Clave Catastral. KP-128-105 IMPUESTO PREDIAL ea rita\n" +
+          "TASA | VALOR FISCAL | BIMESTRES | INCISO. | IMPUESTO",
+      ),
+    ).toBe("PREDIAL ROSARITO");
+  });
+
+  it("keeps telling the three municipalities apart by their RFC", () => {
+    expect(detectProvider("R.F.C. ATB-541201-KK2")).toBe("PREDIAL TIJUANA");
+    expect(detectProvider("R.F.C. AMP-981201-HJ4")).toBe("PREDIAL ROSARITO");
+    expect(detectProvider("MEN-540301-9J5")).toBe("PREDIAL ENSENADA");
+  });
+
+  it("does not let the CFE rule claim a gas bill over 'PERIODO FACTURADO'", () => {
+    expect(
+      detectProvider("Orden de Facturación: 000009801640\nPERIODO FACTURADO: 20260630-20260630"),
+    ).toBe("GAS TIJUANA");
+  });
+});
+
+describe("normalizeCadastralKey", () => {
+  it("keeps a letter in the third position instead of digitising it", () => {
+    // `MMB01041` is a real key on file; mapping its B to 8 produced a key that
+    // matches no property at all.
+    expect(normalizeCadastralKey("MM-B01-041", [])).toBe("MMB01041");
+  });
+
+  it("repairs the spurious I tesseract inserts into the prefix", () => {
+    expect(normalizeCadastralKey("MIM-200-010", [])).toBe("MM200010");
+  });
+
+  it("digitises confusable glyphs from position four onward", () => {
+    expect(normalizeCadastralKey("KP-1O8-O45", [])).toBe("KP108045");
+  });
+
+  it("flags a prefix it had to truncate", () => {
+    const notes: string[] = [];
+    expect(normalizeCadastralKey("KPX-128-106", notes)).toBe("KP128106");
+    expect(notes).toHaveLength(1);
+  });
+});
+
+describe("parsePredialTijuana", () => {
+  const TIJUANA = page(
+    "Hats | AYUNTAMIENTO DE TIJUANA, BC $2,613.00 23/01/2026\n" +
+      "y) TELEFONO: 973-7000 R.F.C. ATB-541201-KK2\n" +
+      "ER AÑO VALOR FISCAL TASA IMPUESTO |CONCEPTO IMPORTE\n" +
+      "ED ca 2026 1,207,15778 246 2,969.61 1102 - IMPUESTO PREDIAL 2,969.61\n" +
+      "55164964310126000002613000054192\n" +
+      "se 0 O (54427 [a] | TOTALAPAGAR: 2,613.00\n" +
+      "Dc 1097 : FECHA VENCE : 31/ENE/2026",
+  );
+
+  it("splits the payment barcode into account, deadline and amount", () => {
+    const p = parseStatement(TIJUANA);
+    expect(p.provider).toBe("PREDIAL TIJUANA");
+    expect(p.serviceKind).toBe("PROPERTY_TAX");
+    expect(p.accountRef).toBe("55164964");
+    expect(p.amount).toBe(2613);
+    expect(p.dueDate?.toISOString().slice(0, 10)).toBe("2026-01-31");
+    expect(p.period).toBe("2026");
+  });
+
+  it("reads the printed total even when the space in the label is lost", () => {
+    // The real page OCR'd the label as "TOTALAPAGAR:", and it is that reading
+    // that cross-checks the barcode's amount.
+    expect(parseStatement(TIJUANA).crossChecked).toBe(true);
+  });
+
+  it("refuses to trust a barcode the printed total contradicts", () => {
+    const p = parseStatement(
+      page(
+        "R.F.C. ATB-541201-KK2\n" +
+          "55164964310126000002613000054192\n" +
+          "TOTAL A PAGAR: 9,613.00\nFECHA VENCE : 31/ENE/2026",
+      ),
+    );
+    expect(p.crossChecked).toBe(false);
+    expect(p.notes.join(" ")).toContain("no coincide");
+  });
+});
+
+describe("parsePredialRosarito", () => {
+  it("takes the rounded Total, not the Sub Total printed above it", () => {
+    const p = parseStatement(
+      page(
+        "AYUNTAMIENTO MUNICIPAL DE PLAYAS DE ROSARITO, B.C.\n" +
+          "Ce Clave Catastral: + JR-400-008 7 | IMPUESTO PREDIAL\n" +
+          "SUPERFICIE: 228.31 ZONA 30025 “Redondeo IT049 -$0.39 Sub Total $5,409.39\n" +
+          "¿XTEMPORANEO DESPUES DE: 31/01/2026 Elaboro: MGLG\n" +
+          "Total | $5,409.00\n" +
+          "| Periodo por Pagar: 2026/1 2026/6",
+      ),
+    );
+    expect(p.cadastralKey).toBe("JR400008");
+    expect(p.amount).toBe(5409);
+    expect(p.dueDate?.toISOString().slice(0, 10)).toBe("2026-01-31");
+    expect(p.period).toBe("2026");
+  });
+
+  it("is not fooled by the unspaced 'SubTotal' spelling", () => {
+    // This exact page read $9,624.85 off a receipt for $9,625.00 while the
+    // lookbehind still assumed a space.
+    const p = parseStatement(
+      page(
+        "AMP-981201-HJ4 IMPUESTO PREDIAL\n" +
+          "SUPERFICIE. 367.62 ZONA:30151 | Redondco 17049 $0.15 SubTotal $9,624.85\n" +
+          ": Total | $9,625.00",
+      ),
+    );
+    expect(p.amount).toBe(9625);
+  });
+});
+
+describe("parsePredialEnsenada", () => {
+  const totals = (tail: string) =>
+    page(
+      "IMPRESION MAQUINA REGISTRADORA ez | MUNICIPIO DE ENSENADA\n" +
+        "+7] DATOS. DEL.CAUSANTE alta A pe CLAVE MM-200-010 2 CUENTA\n" +
+        `ES g € S| TOTALES 12,744.47 0.00 0.00 324.56 0.00 13,069.03 ${tail} |`,
+    );
+
+  it("reads the paid total off the TOTALES row however the label OCR'd", () => {
+    expect(parseStatement(totals("TOTA LA A $5,797.00")).amount).toBe(5797);
+    expect(parseStatement(totals("orAL: M7 z] $14,414.00")).amount).toBe(14414);
+    expect(parseStatement(totals("| TOTAL: = $6 246.00")).amount).toBe(6246);
+  });
+
+  it("reports no amount rather than one whose $ was misread as an 8", () => {
+    // `TOTAL: A 82,203.00` is a $2,203.00 receipt. Posting $82,203 would look
+    // entirely ordinary in the ledger, so this page must go to review instead.
+    const p = parseStatement(totals("TOTAL: A 82,203.00"));
+    expect(p.amount).toBeNull();
+    expect(p.notes.join(" ")).toContain("capturarlo a mano");
+  });
+
+  it("never falls back to the assessed total on the same row", () => {
+    expect(parseStatement(totals("yo: se TE= 58/4690]")).amount).toBeNull();
+  });
+});
+
+describe("parseGas", () => {
+  const gas = (...cuentas: string[]) =>
+    page(
+      "GTI4608032K2 COMPAÑIA DE GAS DE TIJUANA\n" +
+        "Fecha de Vencimiento: 2026/08/08\n" +
+        cuentas.map((c) => `Cuenta: ${c}`).join("\n") +
+        "\nPERIODO FACTURADO: 20260630-20260630\nTOTAL A PAGAR: $275.82",
+    );
+
+  it("strips the printed leading zero to the stored account number", () => {
+    const p = parseStatement(gas("0900003463", "0900003463", "0900003463"));
+    expect(p.serviceKind).toBe("GAS");
+    expect(p.accountRef).toBe("900003463");
+    expect(p.amount).toBe(275.82);
+    expect(p.dueDate?.toISOString().slice(0, 10)).toBe("2026-08-08");
+    expect(p.period).toBe("2026-06");
+    expect(p.crossChecked).toBe(true);
+  });
+
+  it("takes the majority reading but still sends a disagreement to review", () => {
+    const p = parseStatement(gas("0900003463", "0900003463", "0900003468"));
+    expect(p.accountRef).toBe("900003463");
+    expect(p.crossChecked).toBe(false);
+  });
+
+  it("claims no cross-check from a single printing", () => {
+    expect(parseStatement(gas("0900003463")).crossChecked).toBeNull();
+  });
+});
+
+describe("parseZonaFederal", () => {
+  /**
+   * The Tijuana zona federal receipt, trimmed to the rows the parser reads.
+   * Verbatim from page 7 of the August 2026 batch, including the two ways the
+   * heading OCR'd: the clave line is struck through by the office's own
+   * highlighter, which is what cost two of eight pages their concession clave.
+   */
+  const zf = (clave: string, body = "") =>
+    page(
+      "ESIZ <pYl Av. Independencia y Esq. Paseo del CentenaxiaiiArlhnto de Tijuana, B.C.\n" +
+        "Teléfono: 9737000 R.F.C. ATB-541201-BK2 0070000146 12:54 PM\n" +
+        "Zona Federal Marítimo Terrestre\n" +
+        `${clave} Nombre: DENNIS JOHN SEIN Concesión:\n` +
+        "Periodo Construcción Tasa  Ornato Tasa Impuesto Actualiza. Recargo Multa Importe\n" +
+        "2026-2 / 2026-2 316.40 35.00 0.00 12.11 1,845.66 0.00 27.13 1,000.00 2,872.79\n" +
+        "SubTotal 1,845.66 0.00 27.13 1,000.00 2,872.79\n" +
+        "Concepto: Derechos de ocupación de Zona Federal Marítimo Terrestre\n" +
+        body,
+    );
+
+  it("is not claimed by the predial parser that shares its RFC and header", () => {
+    // Tijuana bills predial and zona federal from the same treasury, so
+    // "Ayuntamiento de Tijuana" and ATB-541201 identify neither on their own.
+    expect(detectProvider("R.F.C. ATB-541201-BK2\nZona Federal Marítimo Terrestre")).toBe(
+      "ZONA FEDERAL TIJUANA",
+    );
+    expect(parseStatement(zf("Clave: 14-D -014")).serviceKind).toBe("FEDERAL_ZONE");
+  });
+
+  it("still recognises the layout when the heading itself did not survive OCR", () => {
+    // Real: page 1 came back as "Zona Ledera) Maritimo Terrestre".
+    expect(
+      detectProvider("Zona Ledera) Maritimo Terrestre\nClave EJ -012% Nombre: STEFAN"),
+    ).toBe("ZONA FEDERAL TIJUANA");
+  });
+
+  it("reads the clave through the loose spacing the receipt prints", () => {
+    expect(parseStatement(zf("Clave: 14-D -014")).accountRef).toBe("14D014");
+    expect(parseStatement(zf("Clave: 14-A-119")).accountRef).toBe("14A119");
+  });
+
+  it("keeps the letter instead of digitising it", () => {
+    // toDigits maps D to 0 and B to 8; a real 14-D -014 must not become 140014.
+    expect(normalizeZofematKey("14-D -014")).toBe("14D014");
+    expect(normalizeZofematKey("12-B -013")).toBe("12B013");
+  });
+
+  it("takes the payable amount from the SubTotal row, rounded to whole pesos", () => {
+    // The municipality rounds and prints the difference as "Ajuste Ley Hacienda
+    // Mpal"; 2,872.79 is charged as $2,873.00.
+    expect(parseStatement(zf("Clave: 14-D -014")).amount).toBe(2873);
+  });
+
+  it("prefers the printed total and cross-checks it against the subtotal", () => {
+    const p = parseStatement(zf("Clave: 14-D -014", "Total a pagar $2,873.00"));
+    expect(p.amount).toBe(2873);
+    expect(p.crossChecked).toBe(true);
+  });
+
+  it("sends a printed total that contradicts the subtotal to review", () => {
+    const p = parseStatement(zf("Clave: 14-D -014", "Total a pagar $2,973.00"));
+    expect(p.crossChecked).toBe(false);
+  });
+
+  it("translates the printed bimester into the ledger's own vocabulary", () => {
+    expect(parseStatement(zf("Clave: 14-D -014")).period).toBe("MAR/APR");
+  });
+
+  it("leaves the clave blank rather than guessing when the marker ate it", () => {
+    const p = parseStatement(zf("Clave EJ -012%"));
+    expect(p.accountRef).toBeNull();
+    expect(p.notes.join(" ")).toContain("clave");
+  });
+});

apps/api/src/statements/parsers/statement-parser.ts

@@ -7,7 +7,11 @@ import type { OcrPage, OcrWord } from "../ocr/ocr.provider";
  * like with like and never has to know about provider-specific formatting.
  */
 export interface ParsedStatement {
-  /** "CFE" | "CESPT" | "TELNOR", or null when no parser claimed the page. */
+  /**
+   * "CFE" | "CESPT" | "TELNOR" | "GAS TIJUANA" | "PREDIAL TIJUANA" |
+   * "PREDIAL ROSARITO" | "PREDIAL ENSENADA" | "ZONA FEDERAL TIJUANA", or null
+   * when no parser claimed the page.
+   */
   provider: string | null;
   serviceKind: ServiceKind | null;
   accountRef: string | null;
@@ -90,6 +94,16 @@ function firstMatch(text: string, patterns: RegExp[]): string | null {
   return null;
 }
 
+/** Every capture of `pattern` across the page, in order. */
+function allMatches(text: string, pattern: RegExp): string[] {
+  const out: string[] = [];
+  const re = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+  for (const m of text.matchAll(re)) {
+    if (m[1]) out.push(m[1].trim());
+  }
+  return out;
+}
+
 const MONTHS: Record<string, number> = {
   ENE: 0, FEB: 1, MAR: 2, ABR: 3, MAY: 4, JUN: 5,
   JUL: 6, AGO: 7, SEP: 8, OCT: 9, NOV: 10, DIC: 11,
@@ -104,15 +118,16 @@ export function parseDate(raw: string | null | undefined): Date | null {
   let m = s.match(/^(\d{1,2})\/(\d{1,2})\/(\d{4})$/);
   if (m) return utc(+m[3], +m[2] - 1, +m[1]);
 
-  // 22-JUL-2026  /  22 JUN 26
+  // 22-JUL-2026  /  22 JUN 26  /  31/ENE/2026 (Tijuana predial)
-  m = s.match(/^(\d{1,2})[-\s]([A-Z]{3})[A-Z]*[-\s](\d{2,4})$/);
+  m = s.match(/^(\d{1,2})[-\s/]([A-Z]{3})[A-Z]*[-\s/](\d{2,4})$/);
   if (m && MONTHS[m[2]] !== undefined) {
     const y = m[3].length === 2 ? 2000 + +m[3] : +m[3];
     return utc(y, MONTHS[m[2]], +m[1]);
   }
 
-  // 2026-07-22 (already normalised, e.g. decoded from a barcode)
+  // 2026-07-22 (already normalised, e.g. decoded from a barcode) and the
-  m = s.match(/^(\d{4})-(\d{2})-(\d{2})$/);
+  // 2026/08/08 the gas bill prints — same field order, different separator.
+  m = s.match(/^(\d{4})[-/](\d{2})[-/](\d{2})$/);
   if (m) return utc(+m[1], +m[2] - 1, +m[3]);
 
   return null;
@@ -174,9 +189,44 @@ const BRAND: [string, RegExp][] = [
   ["CFE", /comisi[oó]n federal de electricidad|CFE.?contigo|Suministrador de Servicios/i],
   ["CESPT", /CESPT|COMISI[OÓ]N ESTATAL DE SERVICIOS/i],
   ["TELNOR", /TELNOR|TELEFONOS DEL NOROESTE/i],
+  ["GAS TIJUANA", /COMPA[ÑN][IÍ]?A\s*DE\s*GAS\s*DE\s*TIJUANA|bajagas/i],
+  // Ahead of the predial rules on purpose. Tijuana's zona federal receipt is
+  // issued by the same treasury and carries the same header — "Ayuntamiento de
+  // Tijuana", the same address, the same `ATB-541201` RFC — so every predial
+  // discriminator matches it too, and whichever rule is asked first wins the
+  // page. What only the zona federal layout says is "Marítimo Terrestre", which
+  // survived OCR on all eight sample pages even where the heading above it came
+  // back as "Zona Ledera) Maritimo Terrestre" and the printed concession clave
+  // was lost under a highlighter mark.
+  ["ZONA FEDERAL TIJUANA", /ZOFEMAT|Mar[ií]timo\s*Terrestre|ocupaci[oó]n\s*de\s*Zona\s*Federal/i],
+  // The municipal RFCs are the single most reliable discriminator on a predial
+  // receipt: they are printed in a clean monospaced run on every layout, they
+  // never change, and they say which of the three city treasuries issued the
+  // page — which the wordmarks alone do not, since a Tijuana receipt also
+  // carries "PLAYAS DE TIJUANA" and a Rosarito one "TIJUANA ENSENADA".
+  ["PREDIAL TIJUANA", /AYUNTAMIENTO\s*DE\s*TIJUANA|ATB.?541201/i],
+  ["PREDIAL ROSARITO", /AYUNTAMIENTO\s*MUNICIPAL\s*DE\s*PLAYAS\s*DE\s*ROSARITO|AMP.?981201|rosarito\.gob/i],
+  ["PREDIAL ENSENADA", /MUNICIPIO\s*DE\s*ENSENADA|MEN.?540301/i],
 ];
 
+/**
+ * The predial rules come first because a Rosarito receipt prints "Clave
+ * Catastral" as a boxed label — the very string the CESPT structural rule
+ * looks for — so a page whose municipal header failed to OCR would otherwise
+ * be claimed as a water bill and matched against the wrong column entirely.
+ * "IMPUESTO PREDIAL" appears on all three municipal layouts and on none of the
+ * utility ones, so it is the safe first question to ask.
+ */
 const LAYOUT: [string, RegExp][] = [
+  // Same reasoning as the brand pass, one rule earlier: the concept line
+  // "Derechos de ocupación de Zona Federal Marítimo Terrestre" is printed on
+  // the stub of every zona federal page and on no other layout, and it read
+  // cleanly on 8 of 8 samples — including the two whose heading did not.
+  ["ZONA FEDERAL TIJUANA", /Derechos\s*de\s*ocupaci[oó]n/i],
+  ["PREDIAL TIJUANA", /IMPUESTO\s*PREDIAL[\s\S]*?(?:CERTIFICACION\s*DE\s*CAJA|PASEO\s*DEL\s*CENTENARIO|PAGA\s*TU\s*PREDIAL)/i],
+  ["PREDIAL ENSENADA", /(?:IMPUESTO\s*PREDIAL[\s\S]*?TRANSPENINSULAR)|(?:IMPRESION\s*MAQUINA\s*REGISTRADORA)/i],
+  ["PREDIAL ROSARITO", /IMPUESTO\s*PREDIAL/i],
+  ["GAS TIJUANA", /Orden\s*de\s*Facturaci[oó]n|FACTOR\s*DE\s*PRESI[OÓ]N|GAS\s*LP/i],
   ["CFE", /NO\.?\s*DE\s*SERVICIO|L[IÍ]MITE\s*DE\s*PAGO|PERIODO\s*FACTURADO/i],
   ["CESPT", /SALDO\s+CORRIENTE|CLAVE\s*CATASTRAL|No\.?\s*DE\s*CUENTA/i],
   ["TELNOR", /Mes\s*de\s*Facturaci[oó]n|Pagar\s*antes\s*de/i],
@@ -364,10 +414,442 @@ function parseTelnor(page: OcrPage): ParsedStatement {
   };
 }
 
+// --- GAS (Compañía de Gas de Tijuana / bajagas) ------------------------------
+
+/**
+ * These arrive as born-digital CFDI PDFs rather than scans, so the text layer
+ * (see `TesseractOcrProvider.textPages`) usually reads them exactly and the
+ * patterns below only have to be tolerant enough for the scanned case.
+ *
+ * The account number is printed three times — supply address, fiscal data, and
+ * the payment stub at the foot — which is a free cross-check: three readings
+ * that agree are near-certainly right, and any disagreement means one of them
+ * was misread and the page deserves a human glance.
+ *
+ * `Cuenta` is what the matcher compares, not `Contrato`. The migration
+ * recovered gas references out of `PropertyService.notes` into `meterNumber`
+ * and what sat there is the 9-digit account (`900003463`), printed here with a
+ * leading zero as `0900003463`.
+ */
+function parseGas(page: OcrPage): ParsedStatement {
+  const text = page.text;
+  const notes: string[] = [];
+
+  const seen = allMatches(text, /Cuenta\s*[:;.]?\s*([0-9OIlSBD]{6,12})/i).map((s) =>
+    toDigits(s).replace(/^0+/, ""),
+  );
+  const distinct = [...new Set(seen.filter(Boolean))];
+
+  let accountRef: string | null = null;
+  let crossChecked: boolean | null = null;
+  if (distinct.length === 1) {
+    accountRef = distinct[0];
+    if (seen.length > 1) crossChecked = true;
+  } else if (distinct.length > 1) {
+    // Majority wins — the stub and the two address blocks print the same
+    // number, so a single divergent reading is the misread one. It still goes
+    // to review: `crossChecked: false` is what keeps the batch from
+    // auto-matching a number one of three readings disagreed with.
+    const tally = new Map<string, number>();
+    for (const s of seen) tally.set(s, (tally.get(s) ?? 0) + 1);
+    accountRef = [...tally.entries()].sort((a, b) => b[1] - a[1])[0][0];
+    crossChecked = false;
+    notes.push(`el número de cuenta se leyó de ${distinct.length} formas distintas (${distinct.join(", ")})`);
+  }
+
+  const amount = money(
+    firstMatch(text, [
+      /TOTAL\s*A\s*PAGAR\s*[:;.]?\s*\$\s*([\d,]+\.\d{2})/i,
+      /Total\s*a\s*pagar\s*[:;.]?\s*\$\s*([\d,]+\.\d{2})/i,
+    ]),
+  );
+
+  // `20260630-20260630` — the range the bill was cut for. Both ends are the
+  // same reading date on every sample, so the period is reported as the ISO
+  // month rather than a range no ledger row would ever be searched by.
+  const facturado = firstMatch(text, [/PERIODO\s*FACTURADO\s*[:;.]?\s*(\d{8})\s*-\s*\d{8}/i]);
+  const period = facturado ? `${facturado.slice(0, 4)}-${facturado.slice(4, 6)}` : null;
+
+  return {
+    provider: "GAS TIJUANA",
+    serviceKind: "GAS",
+    accountRef: accountRef || null,
+    cadastralKey: null,
+    amount,
+    dueDate: parseDate(
+      firstMatch(text, [/Fecha\s*de\s*Vencimiento\s*[:;.]?\s*(\d{4}\s*\/\s*\d{2}\s*\/\s*\d{2})/i])?.replace(
+        /\s/g,
+        "",
+      ),
+    ),
+    period,
+    crossChecked,
+    notes,
+  };
+}
+
+// --- PREDIAL (municipal property tax) ---------------------------------------
+
+/**
+ * Normalise a printed clave catastral to the eight-character form
+ * `Property.cadastralKey` holds. The municipalities print it grouped
+ * (`KP-128-106`, `MM-B01-041`); the stored value drops the separators
+ * (`KP128106`, `MMB01041`).
+ *
+ * The shape is *not* two letters and six digits, which is the assumption that
+ * has to be resisted here. Across the 932 distinct claves on file, characters
+ * four through eight are digits without exception, but the third is a digit in
+ * 917 of them and one of `A`, `B`, `H`, `T` in the other fifteen. Running the
+ * whole tail through `toDigits` — which maps `B` to `8` — is what turned a real
+ * `MMB01041` into a nonexistent `MM801041`, so only positions four onward get
+ * that treatment and a letter in the third position is kept as printed.
+ *
+ * That leaves a genuine ambiguity at that one position: a `B` there might be a
+ * misread `8`, and 34 stored claves do carry an `8` there against six with a
+ * `B`. It is left as read rather than guessed, because a page that fails to
+ * match lands in the review queue where a human fixes it in seconds, while a
+ * page that matches the wrong property posts a charge to the wrong customer.
+ *
+ * The two-letter prefix is the other fragile part. Tesseract inserts a spurious
+ * `I` into letter pairs with some regularity — a real `MM-200-010` came back as
+ * `MIM-200-010` — so a run longer than two letters has its `I`/`L` dropped
+ * first, which recovers exactly that case. Anything still not two letters is
+ * truncated and flagged, because a wrong prefix silently matches the wrong
+ * property or, more often, nothing at all.
+ */
+export function normalizeCadastralKey(
+  raw: string,
+  notes: string[],
+): string | null {
+  const m = raw.match(/^([A-Za-z|]{2,5})[-\s]?([A-Za-z0-9|]{3})[-\s]?([0-9OIlSBD]{3})$/);
+  if (!m) return null;
+
+  let letters = m[1].toUpperCase().replace(/[^A-Z]/g, "");
+  if (letters.length > 2) {
+    const stripped = letters.replace(/[IL]/g, "");
+    if (stripped.length === 2) {
+      letters = stripped;
+    } else {
+      letters = letters.slice(0, 2);
+      notes.push(`la clave catastral se leyó como "${m[1]}"; se tomó "${letters}"`);
+    }
+  }
+  if (letters.length !== 2) return null;
+
+  const third = m[2][0].toUpperCase();
+  const tail =
+    (/[A-Z]/.test(third) ? third : toDigits(third)) +
+    toDigits(m[2].slice(1)) +
+    toDigits(m[3]);
+
+  return tail.length === 6 ? letters + tail : null;
+}
+
+/** The grouped clave as printed, anchored to its label when one survived OCR. */
+const GROUPED_CLAVE = "[A-Z|]{2,5}-[A-Z0-9OIlSBD]{3}-[0-9OIlSBD]{3}";
+
+function findCadastralKey(text: string, notes: string[]): string | null {
+  const labelled = firstMatch(text, [
+    new RegExp(`Clave\\s*Catastral\\s*[^A-Z0-9]{0,8}(${GROUPED_CLAVE})`, "i"),
+    new RegExp(`CLAVE\\s*[^A-Z0-9]{0,8}(${GROUPED_CLAVE})`, "i"),
+  ]);
+  if (labelled) return normalizeCadastralKey(labelled, notes);
+
+  // Ensenada's label ("CLAVE") lands inside a table header that OCRs into
+  // noise more often than not, so the bare grouped shape is accepted as a
+  // fallback. It is distinctive enough — two letters and two three-character
+  // groups joined by hyphens appears nowhere else on these pages.
+  const bare = firstMatch(text, [new RegExp(`\\b(${GROUPED_CLAVE})\\b`)]);
+  return bare ? normalizeCadastralKey(bare, notes) : null;
+}
+
+/**
+ * Tijuana: a "CERTIFICACIÓN DE CAJA" whose payment barcode is one 32-digit run
+ * of `account(8) + due date(DDMMYY) + amount(9) + folio(9)`, verified against
+ * all five sample pages. Municipal totals are whole pesos (the receipt itself
+ * carries a "Redondeo" line), so the barcode amount needs no decimal point.
+ *
+ * No clave catastral is printed anywhere on this layout — the 8-digit
+ * municipal account is the only identifier, and it is not a number the legacy
+ * database ever held. Until a reviewer confirms one, every Tijuana page lands
+ * in review; confirming teaches the matcher (see `learnAccountRefs`) so the
+ * same property matches itself next year.
+ */
+function parsePredialTijuana(page: OcrPage): ParsedStatement {
+  const text = page.text;
+  const notes: string[] = [];
+
+  const barcode = text.match(/(?<![0-9OIlSBD])([0-9OIlSBD]{32})(?![0-9OIlSBD])/);
+  const printedTotal = money(
+    firstMatch(text, [/TOTAL\s*A?\s*PAGAR\s*[:;.]?\s*\$?\s*([\d,]+\.?\d{0,2})/i]),
+  );
+
+  let accountRef: string | null = null;
+  let amount: number | null = printedTotal;
+  let dueDate: Date | null = null;
+  let crossChecked: boolean | null = null;
+
+  if (barcode) {
+    const run = toDigits(barcode[1]);
+    const d = run.slice(8, 14);
+    const fromBarcode = Number(run.slice(14, 23));
+    accountRef = run.slice(0, 8);
+    dueDate = parseDate(`20${d.slice(4, 6)}-${d.slice(2, 4)}-${d.slice(0, 2)}`);
+    notes.push("cuenta, importe y vencimiento leídos del código de barras");
+
+    if (printedTotal != null) {
+      // Guarding the money, not the account number: the printed total is the
+      // figure a human would key, so when the two disagree one of them is a
+      // misread peso amount and nothing should post unreviewed.
+      crossChecked = Math.abs(printedTotal - fromBarcode) < 0.5;
+      if (!crossChecked) {
+        notes.push(
+          `el total impreso (${printedTotal}) no coincide con el código de barras (${fromBarcode})`,
+        );
+      }
+    }
+    if (amount == null) amount = fromBarcode;
+  }
+
+  if (!dueDate) {
+    dueDate = parseDate(
+      firstMatch(text, [/FECHA\s*VENCE\s*[:;.]?\s*(\d{1,2}\/\w{3}\/\d{4})/i]),
+    );
+  }
+
+  return {
+    provider: "PREDIAL TIJUANA",
+    serviceKind: "PROPERTY_TAX",
+    accountRef: accountRef || null,
+    cadastralKey: null,
+    amount,
+    dueDate,
+    // The fiscal year, which is what the legacy ledger's `period` holds for
+    // predial ("2026" is its single most common value). It is read from the
+    // assessment table's year column, and failing that from the deadline: a
+    // predial bill for year N falls due on 31 January of year N.
+    period:
+      firstMatch(text, [/VALOR\s*FISCAL[\s\S]{0,160}?\b(20\d{2})\b/i]) ??
+      (dueDate ? String(dueDate.getUTCFullYear()) : null),
+    crossChecked,
+    notes,
+  };
+}
+
+/**
+ * Rosarito: a wide "CERTIFICACIÓN DE CAJA" keyed by clave catastral, with no
+ * account number of its own — the clave is the identifier, which is exactly
+ * what `Property.cadastralKey` holds, so these match on the first pass.
+ *
+ * The total is read with a negative lookbehind on "Sub": the receipt prints
+ * `Sub Total $5,409.39` (before the peso rounding) directly above
+ * `Total $5,409.00`, and taking the first "Total" on the page books 39 cents
+ * that the municipality did not charge. The lookbehind allows zero spaces
+ * because the label prints both ways — `Sub Total` on one sample and
+ * `SubTotal` on the next, and the tight one is what slipped past a fixed
+ * `Sub\s` and read $9,624.85 off a receipt for $9,625.00.
+ */
+function parsePredialRosarito(page: OcrPage): ParsedStatement {
+  const notes: string[] = [];
+  const text = page.text;
+
+  return {
+    provider: "PREDIAL ROSARITO",
+    serviceKind: "PROPERTY_TAX",
+    accountRef: null,
+    cadastralKey: findCadastralKey(text, notes),
+    amount: money(firstMatch(text, [/(?<!Sub\s{0,3})Total\s*[|:;.]?\s*\$\s*([\d,]+\.\d{2})/i])),
+    // "EXTEMPORANEO DESPUES DE: 31/01/2026" — the leading E is regularly eaten
+    // by the box rule printed over it, so the anchor starts at "XTEMPORANEO".
+    dueDate: parseDate(
+      firstMatch(text, [/XTEMPOR[AÁ]NEO\s*DESPU[EÉ]S\s*DE\s*[:;.]?\s*(\d{2}\/\d{2}\/\d{4})/i]),
+    ),
+    period: firstMatch(text, [/Periodo\s*por\s*Pagar\s*[:;.]?\s*(20\d{2})/i]),
+    crossChecked: null,
+    notes,
+  };
+}
+
+/**
+ * Ensenada: a dot-matrix "IMPRESION MAQUINA REGISTRADORA" statement, by some
+ * distance the worst-scanning of the three. Matching is by clave catastral.
+ *
+ * The amount is read positionally rather than by label, because the label does
+ * not survive: across five real pages the same word came back as `TOTAL:`,
+ * `TOTA LA A` and `orAL:`. What is stable is the row — the summary line that
+ * starts `TOTALES` carries the assessed figures across it and the amount
+ * actually paid last, at the right margin.
+ *
+ * That last figure must carry a literal `$`. On a real sample the paid total
+ * printed as `TOTAL: A $2,203.00` and OCR'd as `TOTAL: A 82,203.00` — the
+ * dollar sign read as an 8, a mistake that would post a $2,203 charge as
+ * $82,203 and look entirely ordinary in the ledger. Requiring the `$` costs
+ * that page its amount and sends it to review, which is the only acceptable
+ * failure here. The unprefixed figures earlier on the row are deliberately not
+ * a fallback: they are the tax assessed before the early-payment discount, not
+ * what was paid.
+ */
+function parsePredialEnsenada(page: OcrPage): ParsedStatement {
+  const notes: string[] = [];
+  const text = page.text;
+
+  const totalsRow = text.split("\n").find((l) => /TOTALES/i.test(l)) ?? "";
+  const figures = allMatches(totalsRow, /\$\s*(\d[\d,.\s]*\.\d{2})/);
+  const amount = figures.length ? money(figures[figures.length - 1]) : null;
+  if (amount == null) {
+    notes.push("no se pudo leer el importe con certeza; capturarlo a mano");
+  }
+
+  return {
+    provider: "PREDIAL ENSENADA",
+    serviceKind: "PROPERTY_TAX",
+    accountRef: null,
+    cadastralKey: findCadastralKey(text, notes),
+    amount,
+    // This layout prints no payment deadline at all — it is a receipt for a
+    // payment already made at the municipal window.
+    dueDate: null,
+    period: firstMatch(text, [/A[ÑN]O\s*[\s\S]{0,60}?\b(20\d{2})\b/i]),
+    crossChecked: null,
+    notes,
+  };
+}
+
+// --- ZONA FEDERAL (ZOFEMAT, Tijuana) ----------------------------------------
+
+/**
+ * Normalise the concession clave the zona federal receipt is keyed by.
+ *
+ * It is printed grouped and loosely spaced — `12-T -012`, `14-A-119`,
+ * `14-K -031` — and is a different shape from the cadastral key entirely: two
+ * digits, one letter, three digits. The letter is kept as printed rather than
+ * digitised, for the same reason `normalizeCadastralKey` keeps its third
+ * character: `toDigits` maps `B` to `8` and `D` to `0`, and a real `14-D -014`
+ * run through it becomes `140014`, which is not a clave at all.
+ *
+ * Stored without separators, because nothing on file holds this value yet (see
+ * `parseZonaFederal`) so the canonical form is ours to pick, and a bare run
+ * cannot be broken by the hyphen the scan renders as a dash, a minus or
+ * nothing.
+ */
+export function normalizeZofematKey(raw: string): string | null {
+  const m = raw.match(/^([0-9OIlSBD]{2})\s*-\s*([A-Za-z])\s*-?\s*([0-9OIlSBD]{3})$/);
+  if (!m) return null;
+  const zone = toDigits(m[1]);
+  const lot = toDigits(m[3]);
+  if (zone.length !== 2 || lot.length !== 3) return null;
+  return `${zone}${m[2].toUpperCase()}${lot}`;
+}
+
+/**
+ * The bimester the receipt prints as `2026-2 / 2026-2`, rendered in the
+ * vocabulary the ledger already speaks.
+ *
+ * All 258 legacy FEDERAL ZONE transactions carry a period of `JAN/FEB`,
+ * `MAR/APR`, `MAY/JUN` or `NOV/DEC`, and their payment dates confirm the
+ * ordering — JAN/FEB was paid in March, MAR/APR in May, MAY/JUN in July,
+ * NOV/DEC in January, i.e. always the month after the bimester closes. The
+ * receipts agree: the two `2026-3` samples fall due 17/07/2026 with no
+ * surcharge, which is bimester three, May and June. Writing `2026-3` instead
+ * would leave the OCR-posted rows unsearchable alongside every hand-keyed one.
+ */
+const BIMESTERS = ["JAN/FEB", "MAR/APR", "MAY/JUN", "JUL/AUG", "SEP/OCT", "NOV/DEC"];
+
+/**
+ * Tijuana's "Zona Federal Marítimo Terrestre" — the federal maritime-zone
+ * occupancy fee, billed by the municipality for beachfront lots.
+ *
+ * Nothing on file identifies these. `PropertyService.accountNumber` for
+ * FEDERAL_ZONE holds DATMEX.zfed, which is not a reference at all but an
+ * amount: its 77 values include `246.06`, `2369.09`, `22653.94` and a negative
+ * `-1679`, and the concession claves these receipts are keyed by appear nowhere
+ * in the database. So the clave goes to `meterNumber` (see `scopedRefField`),
+ * every page starts cold, and the first confirm teaches the match — the same
+ * arrangement Tijuana predial needed, for the same reason.
+ *
+ * The amount is taken from the SubTotal row rather than the "Total a pagar"
+ * box, which is printed on a grey fill and OCR'd on only 1 of 8 sample pages
+ * while the SubTotal row read on 8 of 8. The two differ by design: the
+ * municipality rounds to whole pesos and prints the difference on its own
+ * "Ajuste Ley Hacienda Mpal" line — `-$0.05` against a 591.05 subtotal, `$0.21`
+ * against 2,872.79 — so the payable figure is the rounded subtotal, and where
+ * the printed box did read, it agreed.
+ */
+function parseZonaFederal(page: OcrPage): ParsedStatement {
+  const text = page.text;
+  const notes: string[] = [];
+
+  // Printed twice, once on the receipt and once on the stub below it, which is
+  // a free second reading: on one sample the heading was struck through by the
+  // office's own highlighter and only the stub survived.
+  const claves = [
+    ...new Set(
+      allMatches(text, /Clave\s*[:;.]?\s*([0-9OIlSBD]{2}\s*-\s*[A-Za-z]\s*-?\s*[0-9OIlSBD]{3})/i)
+        .map(normalizeZofematKey)
+        .filter((k): k is string => k != null),
+    ),
+  ];
+
+  const accountRef = claves[0] ?? null;
+  let crossChecked: boolean | null = null;
+
+  const subtotalRow = text.split("\n").find((l) => /SubTotal/i.test(l)) ?? "";
+  const figures = allMatches(subtotalRow, /(\d[\d,]*\.\d{2})/);
+  // Impuesto, Actualización, Recargo, Multa, Importe — the payable one is last.
+  const importe = figures.length ? money(figures[figures.length - 1]) : null;
+  const rounded = importe != null ? Math.round(importe) : null;
+  const printed = money(
+    firstMatch(text, [/Total\s*a\s*pagar\s*[:;.]?\s*\$?\s*([\d,]+\.\d{2})/i]),
+  );
+
+  if (printed != null && rounded != null) {
+    crossChecked = Math.abs(printed - rounded) < 0.5;
+    if (!crossChecked) {
+      notes.push(
+        `el total impreso (${printed}) no coincide con el subtotal redondeado (${rounded})`,
+      );
+    }
+  } else if (rounded != null) {
+    notes.push("importe tomado del subtotal, redondeado al peso");
+  } else if (printed == null) {
+    notes.push("no se pudo leer el importe con certeza; capturarlo a mano");
+  }
+
+  // A clave read two different ways means one of the two readings is wrong and
+  // there is no third to break the tie, so the page goes to a human even if the
+  // money cross-checked.
+  if (claves.length > 1) {
+    crossChecked = false;
+    notes.push(`la clave se leyó de ${claves.length} formas distintas (${claves.join(", ")})`);
+  }
+  if (!accountRef) notes.push("no se pudo leer la clave de la concesión");
+
+  const bimester = text.match(/\b(20\d{2})\s*-\s*([1-6])\s*\/\s*20\d{2}\s*-\s*[1-6]/);
+
+  return {
+    provider: "ZONA FEDERAL TIJUANA",
+    serviceKind: "FEDERAL_ZONE",
+    accountRef,
+    cadastralKey: null,
+    amount: printed ?? rounded,
+    dueDate: parseDate(
+      firstMatch(text, [/Vencimiento\s*[:;.]?\s*(\d{2}\/\d{2}\/\d{4})/i]),
+    ),
+    period: bimester ? BIMESTERS[+bimester[2] - 1] : null,
+    crossChecked,
+    notes,
+  };
+}
+
 const PARSERS: Record<string, (page: OcrPage) => ParsedStatement> = {
   CFE: parseCfe,
   CESPT: parseCespt,
   TELNOR: parseTelnor,
+  "GAS TIJUANA": parseGas,
+  "PREDIAL TIJUANA": parsePredialTijuana,
+  "PREDIAL ROSARITO": parsePredialRosarito,
+  "PREDIAL ENSENADA": parsePredialEnsenada,
+  "ZONA FEDERAL TIJUANA": parseZonaFederal,
 };
 
 const EMPTY: ParsedStatement = {

apps/api/src/statements/statement-matcher.service.ts

@@ -32,29 +32,52 @@ export interface MatchResult {
  * person. Names are displayed for the reviewer to sanity-check, and are never
  * an input to matching.
  */
-@Injectable()
+/**
-export class StatementMatcherService {
+ * Which `PropertyService` column a given kind's statements actually print.
-  constructor(private readonly prisma: PrismaService) {}
+ *
-
+ * Exported because the same answer governs three places that must agree: the
-  /** Which PropertyService column a given kind's statements actually print. */
+ * lookup here, the blank-service fill on review, and the write-back on confirm.
-  private fieldFor(kind: ServiceKind): "accountNumber" | "meterNumber" | null {
+ * When they disagree, a reference gets learned into a column nothing searches,
+ * and the same page returns to the review queue every month forever.
+ *
+ * `meterNumber` is doing double duty for the three kinds whose printed
+ * reference DATMEX never held in `accountNumber`:
+ *   - GAS, where the number lived in free-text notes,
+ *   - PROPERTY_TAX, where `accountNumber` holds DATMEX.predial — a 3-4 digit
+ *     office file number that is neither unique nor printed on any statement.
+ *     The Tijuana municipal receipt prints an 8-digit account and no clave
+ *     catastral at all, so it needs a column of its own; overwriting the legacy
+ *     predial numbers to make room would destroy the only link back to the
+ *     original records, and
+ *   - FEDERAL_ZONE, where `accountNumber` holds DATMEX.zfed, which is not a
+ *     reference of any kind but a peso amount: 3 of its 77 values carry cents
+ *     (`246.06`, `2369.09`, `22653.94`) and one is negative. Searching it for
+ *     the concession clave the receipt prints would never hit, and — worse —
+ *     because every row already has a value, the `[field]: null` guards in
+ *     `learnAccountRefs` and the blank-service fill would never fire either, so
+ *     the same page would return to the review queue every bimester forever.
+ */
+export function scopedRefField(
+  kind: ServiceKind,
+): "accountNumber" | "meterNumber" | null {
   switch (kind) {
     case "ELECTRIC": // CFE "NO. DE SERVICIO" -> DATMEX.rpu
     case "WATER": // CESPT "Cuenta" / "No. DE CUENTA" -> DATMEX.agua
     case "TELEPHONE": // Telnor "Teléfono" (LADA stripped) -> DATMEX.telefono
-      case "FEDERAL_ZONE":
     case "CABLE":
       return "accountNumber";
-      case "GAS": // no account column in DATMEX; the number lived in notes
+    case "GAS": // bajagas "Cuenta" -> recovered from notes into meterNumber
+    case "PROPERTY_TAX": // Tijuana's 8-digit municipal account
+    case "FEDERAL_ZONE": // ZOFEMAT concession clave, e.g. `12T012`
       return "meterNumber";
-      // PROPERTY_TAX deliberately has no scoped column: what its
-      // accountNumber holds is DATMEX.predial, which is neither unique nor
-      // printed on any statement. Predial bills match on the clave catastral
-      // alone — see matchByCadastralKey.
     default:
       return null;
   }
-  }
+}
+
+@Injectable()
+export class StatementMatcherService {
+  constructor(private readonly prisma: PrismaService) {}
 
   async match(parsed: ParsedStatement, expectedKind: ServiceKind): Promise<MatchResult> {
     const kind = parsed.serviceKind ?? expectedKind;
@@ -68,33 +91,39 @@ export class StatementMatcherService {
       );
     }
 
-    const field = this.fieldFor(kind);
+    const field = scopedRefField(kind);
 
     if (field && parsed.accountRef) {
       const hit = await this.byServiceField(kind, field, parsed.accountRef);
       if (hit) return hit;
     }
 
-    // Secondary key. The clave catastral is printed on CESPT bills as well as
+    // The clave catastral is printed on CESPT bills as well as predial ones, so
-    // predial ones, so it rescues a page whose account number did not OCR —
+    // it rescues a page whose account number did not OCR — which happened on
-    // which happened on real samples, where the clave read cleanly and the
+    // real samples, where the clave read cleanly and the account number did
-    // account number did not.
+    // not. On the Rosarito and Ensenada predial layouts it is not a rescue at
+    // all but the only identifier the receipt carries, so a unique hit there is
+    // as good as any account-number match and is treated as one.
     if (parsed.cadastralKey) {
-      const hit = await this.byCadastralKey(kind, parsed.cadastralKey);
+      const primary = kind === "PROPERTY_TAX" && !parsed.accountRef;
+      const hit = await this.byCadastralKey(kind, parsed.cadastralKey, primary);
       if (hit) return hit;
     }
 
     if (!field && !parsed.cadastralKey) {
+      return this.unmatched(`no hay campo de búsqueda definido para ${kind}`);
+    }
+    if (!parsed.accountRef && !parsed.cadastralKey) {
       return this.unmatched(
         kind === "PROPERTY_TAX"
-          ? "el predial sólo se puede identificar por clave catastral y no se leyó ninguna"
+          ? "no se leyó ni la clave catastral ni la cuenta municipal"
-          : `no hay campo de búsqueda definido para ${kind}`,
+          : "no se pudo leer la referencia de la cuenta",
       );
     }
     return this.unmatched(
       parsed.accountRef
         ? `no se encontró ningún servicio de ${kind} con la referencia ${parsed.accountRef}`
-        : "no se pudo leer la referencia de la cuenta",
+        : `no se encontró ninguna propiedad con la clave catastral ${parsed.cadastralKey}`,
     );
   }
 
@@ -145,6 +174,8 @@ export class StatementMatcherService {
   private async byCadastralKey(
     kind: ServiceKind,
     key: string,
+    /** True when the clave is the identifier the statement was issued against. */
+    primary: boolean,
   ): Promise<MatchResult | null> {
     const props = await this.prisma.property.findMany({
       where: { cadastralKey: key },
@@ -174,15 +205,21 @@ export class StatementMatcherService {
       };
     }
 
-    // The clave identifies the property with certainty, but it is a *secondary*
+    // When the clave is the *secondary* key — a utility bill that also happens
-    // key: it was not the number the statement was issued against. Left for
+    // to print it — the page is left for review, because the clave was not the
-    // review so the confirm also teaches the matcher the account number, rather
+    // number the statement was issued against and confirming is what teaches
-    // than the same page needing the fallback again next month.
+    // the matcher the account number for next month. When it is the primary key
+    // (Rosarito and Ensenada predial, which print nothing else), a unique hit
+    // is a real match and there is no second number to learn.
     return {
       propertyServiceId: candidates[0].propertyServiceId ?? null,
       customerId: candidates[0].customerId,
-      note: `identificado por clave catastral ${key}; confirme para registrar también el número de cuenta`,
+      note: primary
-      confident: false,
+        ? `coincidencia exacta por clave catastral ${key}`
+        : `identificado por clave catastral ${key}; confirme para registrar también el número de cuenta`,
+      // A clave with no service row of the right kind behind it still needs a
+      // human: there is nothing to attach the posting to.
+      confident: primary && candidates[0].propertyServiceId != null,
       candidates,
     };
   }

apps/api/src/statements/statements.controller.ts

@@ -142,6 +142,18 @@ export class StatementsController {
     return doc;
   }
 
+  /** Abandon a batch pending review — rejects every unposted page. */
+  @Post("batches/:id/discard")
+  @RequireAbility("statement:review")
+  async discard(@Param("id") id: string, @Req() req: Request) {
+    const result = await this.statements.discardBatch(id, this.actingId(req));
+    void this.audit.log(this.actingId(req), "statement.batch.discard", {
+      batchId: id,
+      rejected: result.rejected,
+    });
+    return result;
+  }
+
   /** Post every matched document in the batch, against one check. */
   @Post("batches/:id/confirm")
   @RequireAbility("statement:review")

apps/api/src/statements/statements.module.ts

@@ -1,23 +1,18 @@
 import { Module } from "@nestjs/common";
 import { BillingModule } from "../billing/billing.module";
+import { OcrModule } from "../ocr/ocr.module";
 import { StatementsController } from "./statements.controller";
 import { StatementsService } from "./statements.service";
 import { StatementMatcherService } from "./statement-matcher.service";
-import { OCR_PROVIDER } from "./ocr/ocr.provider";
-import { TesseractOcrProvider } from "./ocr/tesseract.provider";
 
 /**
- * The concrete OCR engine is bound here and nowhere else — everything
+ * The concrete OCR engine is bound in OcrModule (see apps/api/src/ocr/) —
- * downstream depends on the OcrProvider interface, so swapping Tesseract for a
+ * everything downstream depends on the OcrProvider interface, so swapping
- * managed extraction API is a one-line change in this file.
+ * Tesseract for a managed extraction API is a one-line change there.
  */
 @Module({
-  imports: [BillingModule],
+  imports: [BillingModule, OcrModule],
   controllers: [StatementsController],
-  providers: [
+  providers: [StatementsService, StatementMatcherService],
-    StatementsService,
-    StatementMatcherService,
-    { provide: OCR_PROVIDER, useClass: TesseractOcrProvider },
-  ],
 })
 export class StatementsModule {}

apps/api/src/statements/statements.service.ts

@@ -16,7 +16,7 @@ import { BillingService } from "../billing/billing.service";
 import type { UploadedFileLike } from "../storage/upload-file";
 import { OCR_PROVIDER, type OcrProvider } from "./ocr/ocr.provider";
 import { parseStatement } from "./parsers/statement-parser";
-import { StatementMatcherService } from "./statement-matcher.service";
+import { StatementMatcherService, scopedRefField } from "./statement-matcher.service";
 import type { ConfirmBatchDto, ReviewDocumentDto } from "./statement.dto";
 
 /**
@@ -127,14 +127,23 @@ export class StatementsService {
       await this.storage.put(sourceKey, file.buffer, "application/pdf");
 
       const pages = await this.ocr.renderPages(file.buffer);
-      for (const image of pages) {
+      // Page images are still rendered and stored for every file, text layer or
+      // not: the review screen shows the reviewer the page, and "what the
+      // parser read" is only checkable against a picture of the paper.
+      const textLayer = await this.ocr.textPages(file.buffer).catch(() => []);
+
+      for (const [index, image] of pages.entries()) {
         pageNumber += 1;
         const storageKey = `statement/${batchId}/page-${pageNumber}.png`;
         await this.storage.put(storageKey, image, "image/png");
 
         try {
-          const ocr = await this.ocr.recognize(image);
+          const embedded = textLayer[index] ?? null;
+          const ocr = embedded ?? (await this.ocr.recognize(image));
           const parsed = parseStatement(ocr);
+          if (embedded) {
+            parsed.notes.unshift("texto leído del PDF original, sin OCR");
+          }
           const match = await this.matcher.match(parsed, serviceKind);
 
           const notes = [...parsed.notes, match.note].filter(Boolean);
@@ -295,8 +304,8 @@ export class StatementsService {
         where: { id: doc.batchId },
         select: { serviceKind: true },
       });
-      if (batch) {
+      const field = batch && scopedRefField(batch.serviceKind);
-        const field = batch.serviceKind === "GAS" ? "meterNumber" : "accountNumber";
+      if (batch && field) {
         const blank = await this.prisma.propertyService.findMany({
           where: {
             kind: batch.serviceKind,
@@ -333,10 +342,54 @@ export class StatementsService {
     if (doc.status === "POSTED") {
       throw new BadRequestException("Este documento ya fue registrado.");
     }
-    return this.prisma.statementDocument.update({
+    const updated = await this.prisma.statementDocument.update({
       where: { id },
       data: { status: "REJECTED", reviewedById, reviewedAt: new Date() },
     });
+    // Rejecting the last open page settles the batch just as posting it would
+    // — without this, a fully-rejected batch sat in READY_FOR_REVIEW forever
+    // because only confirmBatch() ever closed one.
+    await this.closeIfDone(doc.batchId);
+    return updated;
+  }
+
+  /**
+   * Throw away a whole batch that is pending review: every page that has not
+   * been posted is marked REJECTED and the batch itself becomes DISCARDED.
+   *
+   * Refuses once any page is POSTED — those pages already wrote ledger rows
+   * against a check, and a "discarded" label on the batch would leave those
+   * charges unexplained. Reject the remaining pages individually instead.
+   */
+  async discardBatch(batchId: string, reviewedById: string) {
+    const batch = await this.prisma.statementBatch.findUnique({
+      where: { id: batchId },
+    });
+    if (!batch) throw new NotFoundException("Lote no encontrado.");
+    if (batch.status === "DISCARDED") {
+      throw new BadRequestException("Este lote ya fue descartado.");
+    }
+
+    const posted = await this.prisma.statementDocument.count({
+      where: { batchId, status: "POSTED" },
+    });
+    if (posted > 0) {
+      throw new BadRequestException(
+        `No se puede descartar: ${posted} página(s) ya se registraron en el estado de cuenta.`,
+      );
+    }
+
+    const { count } = await this.prisma.statementDocument.updateMany({
+      where: { batchId, status: { notIn: ["POSTED", "REJECTED"] } },
+      data: { status: "REJECTED", reviewedById, reviewedAt: new Date() },
+    });
+
+    await this.prisma.statementBatch.update({
+      where: { id: batchId },
+      data: { status: "DISCARDED", completedAt: new Date() },
+    });
+
+    return { batchId, rejected: count };
   }
 
   // --- posting --------------------------------------------------------------
@@ -434,7 +487,8 @@ export class StatementsService {
     docs: { matchedPropertyServiceId: string | null; extractedAccountRef: string | null }[],
     kind: ServiceKind,
   ) {
-    const field = kind === "GAS" ? "meterNumber" : "accountNumber";
+    const field = scopedRefField(kind);
+    if (!field) return;
     for (const d of docs) {
       if (!d.matchedPropertyServiceId || !d.extractedAccountRef) continue;
       await this.prisma.propertyService.updateMany({
@@ -451,8 +505,10 @@ export class StatementsService {
       where: { batchId, status: { in: OPEN } },
     });
     if (open === 0) {
-      await this.prisma.statementBatch.update({
+      await this.prisma.statementBatch.updateMany({
-        where: { id: batchId },
+        // `updateMany` + a status filter so a discarded batch is never quietly
+        // relabelled COMPLETED by a late reject on one of its pages.
+        where: { id: batchId, status: { not: "DISCARDED" } },
         data: { status: "COMPLETED", completedAt: new Date() },
       });
     }

apps/api/tsconfig.build.json

@@ -0,0 +1,4 @@
+{
+  "extends": "./tsconfig.json",
+  "exclude": ["node_modules", "dist", "**/*.spec.ts"]
+}

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jorgecuadros/web",
-  "version": "1.0.5",
+  "version": "1.0.8",
   "private": true,
   "scripts": {
     "dev": "next dev -p 4500",

apps/web/src/app/globals.css

@@ -212,6 +212,11 @@ button {
   color: var(--muted);
 }
 
+/* Secondary line inside a row or card — used alongside .muted throughout. */
+.small {
+  font-size: 0.8125rem;
+}
+
 /* ============================================================================
    App shell / top nav
    ========================================================================== */

apps/web/src/app/notificaciones/page.tsx

@@ -0,0 +1,12 @@
+"use client";
+
+import { AppShell } from "@/components/AppShell";
+import { Notificaciones } from "@/components/Notificaciones";
+
+export default function NotificacionesPage() {
+  return (
+    <AppShell>
+      <Notificaciones initialTab="servicios" />
+    </AppShell>
+  );
+}

apps/web/src/app/polizas/captura/[id]/page.tsx

@@ -0,0 +1,16 @@
+"use client";
+
+import { AppShell } from "@/components/AppShell";
+import { PolicyOcrReview } from "@/components/PolicyOcrReview";
+
+export default function PolicyOcrBatchPage({
+  params,
+}: {
+  params: { id: string };
+}) {
+  return (
+    <AppShell>
+      <PolicyOcrReview id={params.id} />
+    </AppShell>
+  );
+}

apps/web/src/app/polizas/captura/page.tsx

@@ -0,0 +1,21 @@
+"use client";
+
+import { AppShell } from "@/components/AppShell";
+import { PolicyCaptura } from "@/components/PolicyCaptura";
+
+/**
+ * OCR mode of the policy intake screen. Drops the GMX PDF, walks through
+ * per-page review, confirms. Same wrapper as `/polizas/nuevo` (manual)
+ * with `initialMode="auto"`, so the tab strip is identical and swapping
+ * modes doesn't drop state.
+ *
+ * Sister route `/polizas/captura/[id]` is the batch review screen once a
+ * batch is uploaded.
+ */
+export default function CapturaOcrPage() {
+  return (
+    <AppShell>
+      <PolicyCaptura initialMode="auto" />
+    </AppShell>
+  );
+}

apps/web/src/app/polizas/nuevo/page.tsx

@@ -1,41 +1,22 @@
 "use client";
 
 import { Suspense } from "react";
-import Link from "next/link";
-import { useSearchParams } from "next/navigation";
 import { AppShell } from "@/components/AppShell";
-import { PolicyForm } from "@/components/PolicyForm";
+import { PolicyCaptura } from "@/components/PolicyCaptura";
-import { useCan } from "@/lib/abilities";
 
+/**
+ * Manual mode of the policy intake screen. Shares the tab wrapper with
+ * `/polizas/captura` (OCR mode) so staff can swap between the two without
+ * losing their place. Customer picker comes from the `?customerId=`
+ * / `?customerName=` query string — used by `/clientes/[id]` when staff
+ * creates a policy from a customer detail page.
+ */
 export default function NuevaPolizaPage() {
   return (
     <AppShell>
       <Suspense fallback={null}>
-        <NuevaPoliza />
+        <PolicyCaptura initialMode="manual" />
       </Suspense>
     </AppShell>
   );
 }
-
-function NuevaPoliza() {
-  const allowed = useCan("policy:create");
-  const params = useSearchParams();
-  const customerId = params.get("customerId") ?? undefined;
-  const customerName = params.get("customerName") ?? undefined;
-
-  return (
-    <>
-      <div className="page-head">
-        <Link href="/polizas" className="back-link">← Pólizas</Link>
-        <h1 className="page-title">Nueva póliza</h1>
-      </div>
-      {allowed ? (
-        <PolicyForm fixedCustomerId={customerId} fixedCustomerName={customerName} />
-      ) : (
-        <div className="state-box state-error">
-          No tiene permisos para crear pólizas.
-        </div>
-      )}
-    </>
-  );
-}

apps/web/src/app/polizas/page.tsx

@@ -57,6 +57,7 @@ export default function PolizasPage() {
 
 function PolizasBrowser() {
   const canCreate = useCan("policy:create");
+  const canIngest = useCan("policy:ingest");
   const [stats, setStats] = useState<PolicyStats | null>(null);
   const [facets, setFacets] = useState<PolicyFacets | null>(null);
 
@@ -135,6 +136,11 @@ function PolizasBrowser() {
               { slug: "vigente", label: "Por vencer (Incen.)", params: { typeName: "INCEN" } },
             ]}
           />
+          {canIngest && (
+            <Link href="/polizas/captura" className="btn btn-outline">
+              + Captura OCR
+            </Link>
+          )}
           {canCreate && (
             <Link href="/polizas/nuevo" className="btn btn-primary">+ Nueva póliza</Link>
           )}

apps/web/src/app/recibos/[id]/page.tsx

@@ -4,8 +4,10 @@ import { useCallback, useEffect, useMemo, useState } from "react";
 import Link from "next/link";
 import { AppShell } from "@/components/AppShell";
 import { CustomerPicker } from "@/components/CustomerPicker";
+import { DiscardBatchCard } from "@/components/DiscardBatchCard";
 import {
   confirmStatementBatch,
+  discardStatementBatch,
   getStatementBatch,
   listStatementDocuments,
   rejectStatementDocument,
@@ -66,6 +68,7 @@ function BatchReview({ id }: { id: string }) {
   const [docs, setDocs] = useState<StatementDocument[]>([]);
   const [error, setError] = useState<string | null>(null);
   const [loading, setLoading] = useState(true);
+  const [discarding, setDiscarding] = useState(false);
 
   const load = useCallback(async () => {
     try {
@@ -108,9 +111,31 @@ function BatchReview({ id }: { id: string }) {
     (d) => d.status === "MATCHED" && d.matchedCustomer,
   ).length;
 
+  async function discard() {
+    setDiscarding(true);
+    setError(null);
+    try {
+      await discardStatementBatch(id);
+      await load();
+    } catch (e) {
+      setError((e as Error)?.message ?? "No se pudo descartar el lote.");
+    } finally {
+      setDiscarding(false);
+    }
+  }
+
   if (loading) return <div className="state-box">Cargando…</div>;
   if (!batch) return <div className="state-box state-error">{error ?? "No encontrado."}</div>;
 
+  const postedCount = batch.byStatus.POSTED ?? 0;
+  // Discarding is only offered while the batch can still be abandoned whole:
+  // nothing posted to the ledger yet, and not already settled.
+  const canDiscard =
+    canReview &&
+    batch.status !== "DISCARDED" &&
+    batch.status !== "COMPLETED" &&
+    postedCount === 0;
+
   return (
     <div className="stack">
       <header className="page-head">
@@ -132,9 +157,7 @@ function BatchReview({ id }: { id: string }) {
       {error && <div className="state-box state-error">{error}</div>}
 
       {processing && (
-        <div className="state-box">
+        <ProcessingBanner docsLength={docs.length} pendingOcr={batch.byStatus.PENDING_OCR ?? 0} />
-          Leyendo los recibos… esta pantalla se actualiza sola.
-        </div>
       )}
 
       <SummaryCard batch={batch} readyCount={readyCount} />
@@ -148,6 +171,15 @@ function BatchReview({ id }: { id: string }) {
         />
       )}
 
+      {canDiscard && (
+        <DiscardBatchCard
+          busy={discarding}
+          onDiscard={discard}
+          pageCount={docs.length}
+          what="recibo"
+        />
+      )}
+
       <section className="stack">
         {sorted.map((doc) => (
           <DocumentRow
@@ -168,8 +200,58 @@ const STATUS_LABEL_BATCH: Record<string, string> = {
   READY_FOR_REVIEW: "Listo para revisar",
   COMPLETED: "Registrado",
   FAILED: "Falló",
+  DISCARDED: "Descartado",
 };
 
+/**
+ * Live readout while OCR is running. The backend tells us how many pages are
+ * still PENDING_OCR, so we can show real progress instead of "loading…". When
+ * the docs list hasn't caught up to the upload yet (total === 0) we fall back
+ * to the indeterminate bar.
+ */
+function ProcessingBanner({
+  docsLength,
+  pendingOcr,
+}: {
+  docsLength: number;
+  pendingOcr: number;
+}) {
+  const done = Math.max(docsLength - pendingOcr, 0);
+  const pct =
+    docsLength > 0 ? Math.min(100, Math.round((done / docsLength) * 100)) : null;
+  return (
+    <div className="card" style={{ padding: 16 }}>
+      <div className="upload-progress" style={{ padding: 0 }}>
+        <div
+          className={`progress-track${pct === null ? " progress-indeterminate" : ""}`}
+          role="progressbar"
+          aria-valuemin={0}
+          aria-valuemax={100}
+          aria-valuenow={pct ?? undefined}
+        >
+          <div className="progress-fill" style={{ width: `${pct ?? 100}%` }} />
+        </div>
+        <div className="upload-progress-stats">
+          {pct === null ? (
+            <span>Leyendo los recibos…</span>
+          ) : (
+            <>
+              <strong>{pct}%</strong>
+              <span>
+                {done} de {docsLength} página(s) leídas
+              </span>
+              {pendingOcr > 0 && <span>{pendingOcr} en cola</span>}
+            </>
+          )}
+          <span style={{ marginLeft: "auto" }}>
+            Esta pantalla se actualiza sola.
+          </span>
+        </div>
+      </div>
+    </div>
+  );
+}
+
 function SummaryCard({
   batch,
   readyCount,

apps/web/src/app/renovaciones/page.tsx

@@ -0,0 +1,14 @@
+"use client";
+
+import { AppShell } from "@/components/AppShell";
+import { Notificaciones } from "@/components/Notificaciones";
+
+/** Renewal notices moved into /notificaciones as its "Pólizas" tab. This route
+ *  stays so old bookmarks and links land on that tab instead of a 404. */
+export default function RenovacionesPage() {
+  return (
+    <AppShell>
+      <Notificaciones initialTab="polizas" />
+    </AppShell>
+  );
+}

apps/web/src/components/AdminEmailsSetting.tsx

@@ -0,0 +1,196 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import { useCan } from "@/lib/abilities";
+import {
+  getNotificationAdminEmails,
+  setNotificationAdminEmails,
+  type NotificationAdminEmails,
+} from "@/lib/api";
+import { formatDateTime } from "@/lib/labels";
+
+/**
+ * Who receives the per-job summary email.
+ *
+ * This used to be NOTIFICATION_ADMIN_EMAILS in the deployment environment,
+ * which made "add Beto to the summaries" a redeploy. It is now a stored
+ * setting; the env var still acts as the fallback until someone saves here,
+ * so nothing changes for a deployment that never touches this screen.
+ */
+
+const SOURCE_NOTE: Record<NotificationAdminEmails["source"], string> = {
+  db: "Guardado desde esta pantalla.",
+  env: "Viene de la configuración del despliegue (NOTIFICATION_ADMIN_EMAILS). Al guardar aquí, este valor toma precedencia.",
+  default: "Nadie lo ha configurado; se están usando los valores por omisión.",
+};
+
+export function AdminEmailsSetting() {
+  const canEdit = useCan("setting:manage");
+
+  const [setting, setSetting] = useState<NotificationAdminEmails | null>(null);
+  const [draft, setDraft] = useState("");
+  const [editing, setEditing] = useState(false);
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [saved, setSaved] = useState(false);
+
+  const load = useCallback(async () => {
+    try {
+      const data = await getNotificationAdminEmails();
+      setSetting(data);
+      setDraft(data.value.join(", "));
+      setError(null);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    }
+  }, []);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  async function save() {
+    setSaving(true);
+    setError(null);
+    setSaved(false);
+    try {
+      const emails = draft
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+      const data = await setNotificationAdminEmails(emails);
+      setSetting(data);
+      setDraft(data.value.join(", "));
+      setEditing(false);
+      setSaved(true);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  function cancel() {
+    setDraft(setting?.value.join(", ") ?? "");
+    setEditing(false);
+    setError(null);
+  }
+
+  if (!setting) {
+    return (
+      <section className="card" style={{ padding: 20 }}>
+        <h2 className="section-title">Destinatarios del resumen</h2>
+        {error ? (
+          <div className="state-box state-error" style={{ marginTop: 12 }}>
+            {error}
+          </div>
+        ) : (
+          <p className="muted small" style={{ marginTop: 8, marginBottom: 0 }}>
+            Cargando…
+          </p>
+        )}
+      </section>
+    );
+  }
+
+  return (
+    <section className="card" style={{ padding: 20 }}>
+      <div
+        style={{
+          display: "flex",
+          justifyContent: "space-between",
+          alignItems: "flex-start",
+          gap: 12,
+          flexWrap: "wrap",
+        }}
+      >
+        <div>
+          <h2 className="section-title">Destinatarios del resumen</h2>
+          <p className="muted small" style={{ marginTop: 4, marginBottom: 0, maxWidth: 620 }}>
+            Después de cada envío se manda un correo interno con el resultado
+            (enviados, omitidos, fallidos). Estas son las direcciones que lo
+            reciben. No afecta a los correos que reciben los clientes.
+          </p>
+        </div>
+        {canEdit && !editing && (
+          <button
+            type="button"
+            className="btn btn-outline btn-sm"
+            onClick={() => setEditing(true)}
+          >
+            Editar
+          </button>
+        )}
+      </div>
+
+      {error && (
+        <div className="state-box state-error" style={{ marginTop: 12 }}>
+          {error}
+        </div>
+      )}
+
+      {editing ? (
+        <div style={{ marginTop: 14 }}>
+          <label className="field" style={{ marginBottom: 8 }}>
+            <span className="field-label">
+              Correos separados por coma (vacío = no enviar resumen a nadie)
+            </span>
+            <input
+              className="input"
+              type="text"
+              value={draft}
+              disabled={saving}
+              placeholder="alguien@ejemplo.com, otro@ejemplo.com"
+              onChange={(e) => setDraft(e.target.value)}
+            />
+          </label>
+          <div className="row-actions">
+            <button
+              type="button"
+              className="btn btn-primary btn-sm"
+              disabled={saving}
+              onClick={() => void save()}
+            >
+              {saving ? "Guardando…" : "Guardar"}
+            </button>
+            <button
+              type="button"
+              className="btn btn-outline btn-sm"
+              disabled={saving}
+              onClick={cancel}
+            >
+              Cancelar
+            </button>
+          </div>
+        </div>
+      ) : (
+        <div style={{ marginTop: 14 }}>
+          {setting.value.length === 0 ? (
+            <span className="empty-inline">
+              Nadie recibe el resumen de los envíos.
+            </span>
+          ) : (
+            <ul className="small" style={{ margin: 0, paddingLeft: 18 }}>
+              {setting.value.map((email) => (
+                <li key={email} className="mono">
+                  {email}
+                </li>
+              ))}
+            </ul>
+          )}
+          <p className="section-note" style={{ marginTop: 10, marginBottom: 0 }}>
+            {SOURCE_NOTE[setting.source]}
+            {setting.updatedAt &&
+              ` Última edición: ${formatDateTime(setting.updatedAt)}.`}
+            {saved && " Guardado."}
+          </p>
+          {!canEdit && (
+            <p className="section-note" style={{ marginTop: 6, marginBottom: 0 }}>
+              Solo un ADMIN puede cambiar esta lista.
+            </p>
+          )}
+        </div>
+      )}
+    </section>
+  );
+}

apps/web/src/components/AppShell.tsx

@@ -28,6 +28,9 @@ type NavLink = {
   href: string;
   label: string;
   ability?: Ability;
+  /** Shown when the user holds *any* of these — for a screen that merges two
+   *  separately-gated jobs (Notificaciones: servicios + pólizas). */
+  anyAbility?: Ability[];
   exact?: boolean;
   /** Extra path prefixes that belong to this entry (e.g. a second route into
    *  the same screen), so they highlight it instead of nothing. */
@@ -78,6 +81,14 @@ const NAV: NavEntry[] = [
         label: "Cuentas de chequera",
         ability: "bank:manage-accounts",
       },
+      // Mass email (servicios) and renewal notices (pólizas) are two tabs of
+      // one screen; `/renovaciones` opens the same page on its pólizas tab.
+      {
+        href: "/notificaciones",
+        label: "Notificaciones",
+        anyAbility: ["notification:send", "renewal:send"],
+        aliases: ["/renovaciones"],
+      },
       { href: "/usuarios", label: "Usuarios", ability: "user:manage" },
       { href: "/operaciones", label: "Operaciones", ability: "db:manage" },
     ],
@@ -91,7 +102,9 @@ const NAV_LINKS: NavLink[] = NAV.flatMap((entry) =>
 
 /** The nav the given user may see, with empty groups dropped. */
 function visibleNav(user: AuthUser | null): NavEntry[] {
-  const allowed = (item: NavLink) => !item.ability || can(user, item.ability);
+  const allowed = (item: NavLink) =>
+    (!item.ability || can(user, item.ability)) &&
+    (!item.anyAbility || item.anyAbility.some((a) => can(user, a)));
   const out: NavEntry[] = [];
   for (const entry of NAV) {
     if (entry.kind === "link") {

apps/web/src/components/CustomerForm.tsx

@@ -30,6 +30,7 @@ type Values = {
   mobile: string;
   fax: string;
   email: string;
+  emailOptOut: boolean;
   identificationType: string;
   identificationNumber: string;
   identificationExpiration: string;
@@ -54,6 +55,7 @@ function initial(c?: CustomerDetail): Values {
     mobile: c?.mobile ?? "",
     fax: c?.fax ?? "",
     email: c?.email ?? "",
+    emailOptOut: c?.emailOptOut ?? false,
     identificationType: c?.identificationType ?? "",
     identificationNumber: c?.identificationNumber ?? "",
     identificationExpiration: toDateInput(c?.identificationExpiration),
@@ -103,6 +105,7 @@ export function CustomerForm({ customer }: { customer?: CustomerDetail }) {
       mobile: s(v.mobile),
       fax: s(v.fax),
       email: s(v.email),
+      emailOptOut: v.emailOptOut,
       identificationType: s(v.identificationType),
       identificationNumber: s(v.identificationNumber),
       identificationExpiration: s(v.identificationExpiration),
@@ -139,6 +142,13 @@ export function CustomerForm({ customer }: { customer?: CustomerDetail }) {
             <input className="input" type="email" value={v.email}
               onChange={(e) => set("email", e.target.value)} />
           </Field>
+          <Field label="Notificaciones de renovación">
+            <label>
+              <input type="checkbox" checked={v.emailOptOut}
+                onChange={(e) => set("emailOptOut", e.target.checked)} />
+              {" "}No enviar correos
+            </label>
+          </Field>
           <Field label="Teléfono">
             <input className="input" value={v.phone}
               onChange={(e) => set("phone", e.target.value)} />

apps/web/src/components/DiscardBatchCard.tsx

@@ -0,0 +1,80 @@
+"use client";
+
+import { useState } from "react";
+
+/**
+ * "Throw this batch away" control, shared by both OCR review queues
+ * (recibos and pólizas).
+ *
+ * Confirmation is a two-step inline swap rather than `window.confirm`: the
+ * dialog would block the page, and an accidental discard is not undoable from
+ * the UI — the reviewer should read what they are about to lose, not dismiss
+ * a modal reflexively.
+ *
+ * The card is only rendered when the batch is still discardable; the API
+ * refuses again on its own (a page posted between render and click).
+ */
+export function DiscardBatchCard({
+  busy,
+  onDiscard,
+  pageCount,
+  what,
+}: {
+  busy: boolean;
+  onDiscard: () => void;
+  pageCount: number;
+  /** Singular noun for what a page becomes — "recibo" / "póliza". */
+  what: string;
+}) {
+  const [armed, setArmed] = useState(false);
+
+  return (
+    <section className="card" style={{ padding: 16 }}>
+      <h2 className="section-title" style={{ marginTop: 0 }}>
+        Descartar lote
+      </h2>
+      {armed ? (
+        <>
+          <p className="page-sub" style={{ marginBottom: 12 }}>
+            Se descartarán las {pageCount} página(s) de este lote y no se
+            creará ninguna {what}. Esto no se puede deshacer desde aquí; para
+            volver a intentarlo hay que subir los PDFs otra vez.
+          </p>
+          <div className="inline-form" style={{ gap: 8 }}>
+            <button
+              type="button"
+              className="btn btn-danger"
+              disabled={busy}
+              onClick={onDiscard}
+            >
+              {busy ? "Descartando…" : "Sí, descartar el lote"}
+            </button>
+            <button
+              type="button"
+              className="btn btn-ghost"
+              disabled={busy}
+              onClick={() => setArmed(false)}
+            >
+              Cancelar
+            </button>
+          </div>
+        </>
+      ) : (
+        <>
+          <p className="page-sub" style={{ marginBottom: 12 }}>
+            Si el lote quedó mal (escaneo ilegible, PDFs equivocados, subida
+            duplicada), descártelo para sacarlo de la cola de revisión.
+          </p>
+          <button
+            type="button"
+            className="btn btn-ghost"
+            disabled={busy}
+            onClick={() => setArmed(true)}
+          >
+            Descartar lote
+          </button>
+        </>
+      )}
+    </section>
+  );
+}

apps/web/src/components/Notificaciones.tsx

@@ -0,0 +1,111 @@
+"use client";
+
+import { useState } from "react";
+import { useCan } from "@/lib/abilities";
+import { NotificacionesServicios } from "@/components/NotificacionesServicios";
+import { NotificacionesPolizas } from "@/components/NotificacionesPolizas";
+import { NotificationFlagsCard } from "@/components/NotificationFlagsCard";
+import { NotificationScheduleCard } from "@/components/NotificationScheduleCard";
+import type { NotificationFlags } from "@/lib/api";
+
+/**
+ * Notificaciones — one screen, two subsections:
+ *
+ * - **servicios** — the four mass-email jobs against customer ledgers
+ *   (pagos pendientes, confirmación de pago, estado de cuenta, fideicomiso).
+ * - **polizas** — renewal notices, 30/15 days before and 7 days after a
+ *   policy expires.
+ *
+ * Both are "tell a customer something by email", so they are modes of one
+ * screen rather than two menu entries. `/renovaciones` still resolves here on
+ * the pólizas tab so old bookmarks keep working (same pattern as Captura).
+ *
+ * Two things are owned by this shell rather than by a tab, because they are
+ * true of every notification: the send flags (`debug` in particular, which the
+ * pólizas half honours exactly like the servicios half) and the automatic
+ * cadence of both sweeps. Keeping the flags here also means switching tabs
+ * cannot silently drop a `debug` the operator just ticked.
+ */
+
+export type NotificacionesTab = "servicios" | "polizas";
+
+const TAB_HINT: Record<NotificacionesTab, string> = {
+  servicios:
+    "Envíos masivos de cobranza y estado de cuenta a los clientes de servicios.",
+  polizas: "Avisos de renovación de pólizas: 30 y 15 días antes, 7 días después.",
+};
+
+export function Notificaciones({
+  initialTab = "servicios",
+}: {
+  initialTab?: NotificacionesTab;
+}) {
+  const canNotify = useCan("notification:send");
+  const canRenew = useCan("renewal:send");
+
+  // Gating is cosmetic (the API enforces every send), but a user who only has
+  // one of the two abilities should land on the tab they can actually use.
+  // Servicios stays visible read-only for STAFF, who can browse the log.
+  const tabs: { key: NotificacionesTab; label: string }[] = [
+    { key: "servicios", label: "Servicios" },
+    ...(canRenew ? [{ key: "polizas" as const, label: "Pólizas" }] : []),
+  ];
+
+  const [tab, setTab] = useState<NotificacionesTab>(
+    tabs.some((t) => t.key === initialTab) ? initialTab : "servicios",
+  );
+  // Defaults to debug ON: the safe end of the switch is the one you land on.
+  const [flags, setFlags] = useState<NotificationFlags>({ debug: true });
+
+  if (!canNotify && !canRenew) {
+    return (
+      <div className="state-box state-error">
+        No tienes permiso para enviar notificaciones.
+      </div>
+    );
+  }
+
+  return (
+    <>
+      <div className="page-head">
+        <p className="eyebrow">Notificaciones</p>
+        <h1 className="page-title">Notificaciones</h1>
+        <p className="muted" style={{ marginTop: 6, maxWidth: 720 }}>
+          {TAB_HINT[tab]}
+        </p>
+      </div>
+
+      <div style={{ display: "grid", gap: 16, marginBottom: 20 }}>
+        <NotificationFlagsCard
+          flags={flags}
+          onChange={setFlags}
+          disabled={!canNotify && !canRenew}
+        />
+        <NotificationScheduleCard />
+      </div>
+
+      {tabs.length > 1 && (
+        <div className="seg" role="tablist" style={{ marginBottom: 20 }}>
+          {tabs.map((t) => (
+            <button
+              key={t.key}
+              type="button"
+              role="tab"
+              aria-selected={tab === t.key}
+              className={`seg-btn ${tab === t.key ? "active" : ""}`}
+              onClick={() => setTab(t.key)}
+            >
+              {t.label}
+            </button>
+          ))}
+        </div>
+      )}
+
+      {tab === "servicios" ? (
+        <NotificacionesServicios flags={flags} />
+      ) : (
+        <NotificacionesPolizas flags={flags} />
+      )}
+    </>
+  );
+}

apps/web/src/components/NotificacionesPolizas.tsx

@@ -0,0 +1,305 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import { useCan } from "@/lib/abilities";
+import { formatDate, formatMoney } from "@/lib/labels";
+import { NotificationLogPanel } from "@/components/NotificationLogPanel";
+import { apiFetch, POLIZAS_LOG_SCOPE, type NotificationFlags } from "@/lib/api";
+
+/**
+ * Renewal notices — the "Pólizas" half of /notificaciones. Shows which
+ * renewal letters are pending in a window and lets staff send them, either
+ * one row at a time or as a whole sweep. Sending is what marks a notice as
+ * delivered — there is no manual "mark as sent", so the list can never claim
+ * a letter went out when no mail was ever sent. Gated on `renewal:send`.
+ *
+ * Sends are recorded in the same `email_notification_log` the Servicios tab
+ * reads, so "Registro de envíos" below is the same component with the
+ * POLICIES slice — failures and no-email skips included, which the pending
+ * list alone cannot show.
+ *
+ * `debug` comes from the shared flags card above the tabs and means the same
+ * thing here as it does for servicios: the mail is diverted to the override
+ * inbox. It additionally does NOT mark the notice as sent, so a test send
+ * leaves the row exactly where it was — pending.
+ */
+
+export interface RenewalLetter {
+  policyId: string;
+  policyNumber: string;
+  policyType: string;
+  customerName: string;
+  customerEmail: string | null;
+  provider: string;
+  policyTo: string;
+  netPremium: string | null;
+  total: string | null;
+  currency: string;
+  generation: number;
+  sentAt: string | null;
+}
+
+export interface RenewalSweepResult {
+  eligible: number;
+  sent: number;
+  skipped: number;
+  failed: number;
+  failures: { policyId: string; generation: number; error: string }[];
+  debug: boolean;
+}
+
+export interface RenewalSendResult {
+  policyId: string;
+  generation: number;
+  /** Where the mail actually went — the override inbox under debug. */
+  to: string;
+  debug: boolean;
+  sentAt: string;
+  providerMessageId?: string;
+}
+
+const GENERATION_LABEL: Record<number, string> = {
+  1: "Primer aviso (30 días antes)",
+  2: "Segundo aviso (15 días antes)",
+  3: "Tercer aviso (7 días después)",
+};
+
+export function NotificacionesPolizas({ flags }: { flags: NotificationFlags }) {
+  const allowed = useCan("renewal:send");
+  const debug = !!flags.debug;
+  const [days, setDays] = useState(30);
+  const [pending, setPending] = useState<RenewalLetter[] | null>(null);
+  const [pendingError, setPendingError] = useState<string | null>(null);
+  const [actionError, setActionError] = useState<string | null>(null);
+  const [notice, setNotice] = useState<string | null>(null);
+  const [sweeping, setSweeping] = useState(false);
+  /** `policyId-generation` of the row currently being sent, if any. */
+  const [sendingKey, setSendingKey] = useState<string | null>(null);
+  /** Raised after every send so the log panel reloads. */
+  const [logToken, setLogToken] = useState(0);
+
+  const refresh = useCallback(async () => {
+    setPendingError(null);
+    try {
+      const data = await apiFetch<RenewalLetter[]>(
+        `/renewals/pending?days=${days}`,
+      );
+      setPending(data);
+    } catch (e) {
+      setPendingError(
+        (e as Error)?.message ?? "No se pudo cargar la lista de avisos.",
+      );
+      setPending([]);
+    }
+  }, [days]);
+
+  useEffect(() => {
+    if (allowed) refresh();
+  }, [allowed, refresh]);
+
+  async function handleSweep() {
+    // Only worth confirming when debug is off — that is the case where real
+    // customers receive mail. Mirrors "Ejecutar todos" on the servicios tab.
+    if (!debug) {
+      const ok = window.confirm(
+        "debug está desactivado: los avisos irán a los correos reales de los clientes. ¿Ejecutar el barrido?",
+      );
+      if (!ok) return;
+    }
+    setActionError(null);
+    setNotice(null);
+    setSweeping(true);
+    try {
+      const result = await apiFetch<RenewalSweepResult>("/renewals/sweep", {
+        method: "POST",
+        body: JSON.stringify({ debug }),
+      });
+      setNotice(
+        `Enviados ${result.sent} avisos (${result.failed} con error).` +
+          (result.debug
+            ? " Modo debug: fueron al buzón de pruebas y siguen pendientes."
+            : ""),
+      );
+      setLogToken((t) => t + 1);
+      await refresh();
+    } catch (e) {
+      setActionError((e as Error)?.message ?? "No se pudo ejecutar el barrido.");
+      setLogToken((t) => t + 1);
+    } finally {
+      setSweeping(false);
+    }
+  }
+
+  /**
+   * Send this one notice now. The API records it as sent on success, so the
+   * row leaves the pending list — that disappearance IS the "sent" signal,
+   * backed by the confirmation line above the table.
+   */
+  async function handleSend(letter: RenewalLetter) {
+    setActionError(null);
+    setNotice(null);
+    setSendingKey(`${letter.policyId}-${letter.generation}`);
+    try {
+      const result = await apiFetch<RenewalSendResult>("/renewals/send", {
+        method: "POST",
+        body: JSON.stringify({
+          policyId: letter.policyId,
+          generation: letter.generation,
+          debug,
+        }),
+      });
+      setNotice(
+        result.debug
+          ? `Prueba enviada a ${result.to}. El aviso sigue pendiente: el cliente no ha recibido nada.`
+          : `Aviso enviado a ${result.to}.`,
+      );
+      setLogToken((t) => t + 1);
+      await refresh();
+    } catch (e) {
+      setActionError((e as Error)?.message ?? "No se pudo enviar el aviso.");
+      // A rejected send may still have written a FAILED row; reload either way.
+      setLogToken((t) => t + 1);
+    } finally {
+      setSendingKey(null);
+    }
+  }
+
+  if (!allowed) {
+    return (
+      <div className="empty-inline">
+        No tiene permisos para enviar avisos de renovación.
+      </div>
+    );
+  }
+
+  const counts = (pending ?? []).reduce<Record<number, number>>(
+    (acc, item) => ({
+      ...acc,
+      [item.generation]: (acc[item.generation] ?? 0) + 1,
+    }),
+    {},
+  );
+  const grouped = [1, 2, 3].filter((gen) => (counts[gen] ?? 0) > 0);
+
+  return (
+    <div style={{ display: "grid", gap: 20 }}>
+      <p className="muted" style={{ maxWidth: 760, margin: 0 }}>
+        El sistema ejecuta un barrido automático (ver «Programación de envíos»
+        arriba) que notifica a los clientes a 30, 15 y 7 días antes o después
+        del vencimiento de su póliza. Esta sección muestra qué avisos están
+        pendientes y permite ejecutarlo manualmente.
+      </p>
+
+      {actionError && <div className="state-box state-error">{actionError}</div>}
+      {notice && <div className="empty-inline">{notice}</div>}
+
+      <section className="card" style={{ padding: 20 }}>
+        <div className="row-actions" style={{ justifyContent: "space-between" }}>
+          <div>
+            <h2 className="section-title">Barrido manual</h2>
+            <p className="muted small" style={{ marginTop: 4 }}>
+              Usa la fecha actual del servidor como referencia para seleccionar
+              avisos vencidos a 30 y 15 días, y vencidos hace 7 días.
+            </p>
+          </div>
+          <button
+            type="button"
+            className="btn btn-primary"
+            disabled={sweeping}
+            onClick={handleSweep}
+          >
+            {sweeping ? "Enviando…" : "Ejecutar barrido"}
+          </button>
+        </div>
+        <div className="field" style={{ maxWidth: 180, marginTop: 12, marginBottom: 0 }}>
+          <span className="field-label">Ventana (días)</span>
+          <input
+            className="input"
+            type="number"
+            min={1}
+            max={365}
+            value={days}
+            onChange={(e) =>
+              setDays(Math.min(365, Math.max(1, Number(e.target.value) || 30)))
+            }
+          />
+        </div>
+      </section>
+
+      {pendingError && <div className="state-box state-error">{pendingError}</div>}
+
+      {!pendingError && grouped.length === 0 && (
+        <div className="empty-inline">
+          No hay avisos pendientes en esta ventana.
+        </div>
+      )}
+
+      {grouped.map((generation) => (
+        <section className="card" key={generation} style={{ padding: 20 }}>
+          <h2 className="section-title">{GENERATION_LABEL[generation]}</h2>
+          <div className="tx-scroll" style={{ marginTop: 12 }}>
+            <table className="tx-table">
+              <thead>
+                <tr>
+                  <th>Cliente</th>
+                  <th>Póliza</th>
+                  <th>Tipo</th>
+                  <th>Aseguradora</th>
+                  <th>Vence</th>
+                  <th className="num">Prima</th>
+                  <th>Acciones</th>
+                </tr>
+              </thead>
+              <tbody>
+                {(pending ?? [])
+                  .filter((item) => item.generation === generation)
+                  .map((item) => (
+                    <tr key={`${item.policyId}-${item.generation}`}>
+                      <td>
+                        <div>{item.customerName}</div>
+                        <div className="muted small">
+                          {item.customerEmail ?? "Sin correo"}
+                        </div>
+                      </td>
+                      <td className="mono">{item.policyNumber}</td>
+                      <td>{item.policyType}</td>
+                      <td>{item.provider}</td>
+                      <td>{formatDate(item.policyTo)}</td>
+                      <td className="num">
+                        {formatMoney(item.total ?? item.netPremium, item.currency)}
+                      </td>
+                      <td>
+                        <div className="row-actions">
+                          <button
+                            type="button"
+                            className="btn btn-outline btn-sm"
+                            onClick={() => handleSend(item)}
+                            disabled={
+                              !item.customerEmail ||
+                              sweeping ||
+                              sendingKey !== null
+                            }
+                          >
+                            {sendingKey ===
+                            `${item.policyId}-${item.generation}`
+                              ? "Enviando…"
+                              : "Enviar aviso"}
+                          </button>
+                        </div>
+                      </td>
+                    </tr>
+                  ))}
+              </tbody>
+            </table>
+          </div>
+        </section>
+      ))}
+
+      <NotificationLogPanel
+        servicio={POLIZAS_LOG_SCOPE}
+        reloadToken={logToken}
+        emptyHint="Todavía no se ha enviado ningún aviso de renovación con este filtro."
+      />
+    </div>
+  );
+}

apps/web/src/components/NotificacionesServicios.tsx

@@ -0,0 +1,353 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import { useCan } from "@/lib/abilities";
+import {
+  formatDateTime,
+  NOTIFICATION_STATUS_LABELS,
+  NOTIFICATION_TYPE_LABELS,
+} from "@/lib/labels";
+import { NotificationLogPanel } from "@/components/NotificationLogPanel";
+import { AdminEmailsSetting } from "@/components/AdminEmailsSetting";
+import {
+  getNotificationStats,
+  runAccountStatus,
+  runAllNotifications,
+  runOutstandingPayments,
+  runPaymentConfirmation,
+  runTrustConfirmation,
+  SERVICIOS_LOG_SCOPE,
+} from "@/lib/api";
+import type {
+  NotificationFlags,
+  NotificationJobResponse,
+  NotificationRunAllResponse,
+  NotificationStats,
+} from "@/lib/api";
+
+/**
+ * Mass email notifications — the "Servicios" half of /notificaciones. Manual
+ * triggers for the four jobs plus a paged log browser. Gated on
+ * `notification:send`; a STAFF viewer sees the read-only log table but not the
+ * trigger buttons.
+ *
+ * The send flags come from the shell above the tabs — they are shared with the
+ * pólizas half — so this component only consumes them.
+ */
+
+type JobKind = "outstanding" | "payment" | "account" | "trust";
+
+interface JobDef {
+  kind: JobKind;
+  title: string;
+  endpoint: string;
+  description: string;
+  servicio: "Clientes" | "Fideicomiso";
+  flagsHint?: string;
+}
+
+const JOBS: JobDef[] = [
+  {
+    kind: "outstanding",
+    title: "Pagos pendientes",
+    endpoint: "sendOutstandingPaymentAlerts",
+    servicio: "Clientes",
+    description:
+      "Clientes con al menos un movimiento marcado como pendiente (outstanding). Equivale a la columna NOPAGO=1 del antiguo datosfreak.",
+  },
+  {
+    kind: "payment",
+    title: "Confirmación de pago",
+    endpoint: "sendPaymentConfirmation",
+    servicio: "Clientes",
+    description:
+      "Clientes con un crédito (abono) en las últimas 24 horas. Un correo por cliente con el pago más reciente.",
+  },
+  {
+    kind: "account",
+    title: "Estado de cuenta",
+    endpoint: "sendAccountStatus",
+    servicio: "Clientes",
+    description:
+      "Alerta amarilla (DEBAJO DEL TIPO) los miércoles y roja (EN ROJO) lunes/miércoles/viernes. El flag ignoreDayRestriction salta los gates.",
+    flagsHint: "Solo este job respeta ignoreDayRestriction y useEmailLimit.",
+  },
+  {
+    kind: "trust",
+    title: "Confirmación fideicomiso",
+    endpoint: "sendConfirmTrustPayment",
+    servicio: "Fideicomiso",
+    description:
+      "Clientes con TrustAccount que recibieron un crédito en el dominio TRUST en las últimas 24 horas.",
+  },
+];
+
+/** Job title by kind — used by the run-all summary, which only carries kinds. */
+const JOB_TITLES: Record<JobKind, string> = JOBS.reduce(
+  (acc, j) => ({ ...acc, [j.kind]: j.title }),
+  {} as Record<JobKind, string>,
+);
+
+export function NotificacionesServicios({ flags }: { flags: NotificationFlags }) {
+  const allowed = useCan("notification:send");
+
+  const [stats, setStats] = useState<NotificationStats | null>(null);
+  /** Raised after every run so the shared log panel reloads. */
+  const [logToken, setLogToken] = useState(0);
+  const [busy, setBusy] = useState<JobKind | "all" | null>(null);
+  const [lastResult, setLastResult] = useState<
+    NotificationJobResponse | NotificationRunAllResponse | null
+  >(null);
+  const [error, setError] = useState<string | null>(null);
+
+  const refresh = useCallback(async () => {
+    try {
+      setStats(await getNotificationStats(SERVICIOS_LOG_SCOPE));
+      setLogToken((t) => t + 1);
+      setError(null);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    }
+  }, []);
+
+  useEffect(() => {
+    void refresh();
+  }, [refresh]);
+
+  const run = useCallback(
+    async (job: JobDef) => {
+      if (!allowed) return;
+      setBusy(job.kind);
+      setError(null);
+      try {
+        let res: NotificationJobResponse;
+        if (job.kind === "outstanding") res = await runOutstandingPayments(flags);
+        else if (job.kind === "payment") res = await runPaymentConfirmation(flags);
+        else if (job.kind === "account") res = await runAccountStatus(flags);
+        else res = await runTrustConfirmation(flags);
+        setLastResult(res);
+        await refresh();
+      } catch (e) {
+        setError(e instanceof Error ? e.message : String(e));
+      } finally {
+        setBusy(null);
+      }
+    },
+    [allowed, flags, refresh],
+  );
+
+  // "Ejecutar todos" — one POST, the API runs the four jobs sequentially with
+  // the same flags. Confirmation only matters when debug is off, since that
+  // is the case where real customers receive mail.
+  const runAll = useCallback(async () => {
+    if (!allowed) return;
+    if (!flags.debug) {
+      const ok = window.confirm(
+        "debug está desactivado: los cuatro envíos irán a los correos reales de los clientes. ¿Ejecutar todos?",
+      );
+      if (!ok) return;
+    }
+    setBusy("all");
+    setError(null);
+    try {
+      const res = await runAllNotifications(flags);
+      setLastResult(res);
+      await refresh();
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setBusy(null);
+    }
+  }, [allowed, flags, refresh]);
+
+  return (
+    <div style={{ display: "grid", gap: 20 }}>
+      <p className="muted" style={{ maxWidth: 760, margin: 0 }}>
+        Disparo manual de los cuatro envíos equivalentes a los scripts PHP de{" "}
+        <code>email.notifications/</code>. Cada ejecución registra todas las filas
+        (enviado, fallido, omitido) en <code>email_notification_log</code>.
+      </p>
+
+      {!allowed && (
+        <div className="empty-inline">
+          Tu rol no incluye <code>notification:send</code>. Solo puedes ver el
+          registro. Para disparar envíos pide a un MANAGER/ADMIN.
+        </div>
+      )}
+
+      {error && <div className="state-box state-error">{error}</div>}
+
+      <section className="card" style={{ padding: 20 }}>
+        <h2 className="section-title">Ejecutar ahora</h2>
+        <div
+          style={{
+            display: "flex",
+            alignItems: "center",
+            gap: 12,
+            flexWrap: "wrap",
+            marginTop: 12,
+          }}
+        >
+          <button
+            type="button"
+            className="btn btn-primary btn-sm"
+            disabled={!allowed || busy !== null}
+            onClick={() => void runAll()}
+          >
+            {busy === "all" ? "Ejecutando todos…" : "Ejecutar todos"}
+          </button>
+          <span className="muted small">
+            Dispara los cuatro envíos en orden (pagos pendientes, confirmación
+            de pago, estado de cuenta, fideicomiso) con los flags de arriba. Si
+            uno falla, los demás continúan. Es lo mismo que ejecuta la corrida
+            programada de Servicios.
+          </span>
+        </div>
+      </section>
+
+      <section
+        style={{
+          display: "grid",
+          gridTemplateColumns: "repeat(auto-fit, minmax(280px, 1fr))",
+          gap: 12,
+        }}
+      >
+        {JOBS.map((j) => (
+          <article
+            key={j.kind}
+            className="card"
+            style={{ padding: 18, display: "grid", gap: 8, alignContent: "start" }}
+          >
+            <header
+              style={{
+                display: "flex",
+                justifyContent: "space-between",
+                alignItems: "center",
+                gap: 8,
+              }}
+            >
+              <strong>{j.title}</strong>
+              <span
+                className={
+                  j.servicio === "Fideicomiso"
+                    ? "badge badge-fideicomiso"
+                    : "badge badge-servicios"
+                }
+              >
+                <span className="dot" />
+                {j.servicio}
+              </span>
+            </header>
+            <p className="muted small" style={{ margin: 0 }}>
+              {j.description}
+            </p>
+            {j.flagsHint && (
+              <p className="section-note" style={{ margin: 0, fontStyle: "italic" }}>
+                {j.flagsHint}
+              </p>
+            )}
+            <div className="row-actions" style={{ marginTop: 4 }}>
+              <button
+                type="button"
+                className="btn btn-primary btn-sm"
+                disabled={!allowed || busy !== null}
+                onClick={() => void run(j)}
+              >
+                {busy === j.kind ? "Ejecutando…" : "Ejecutar"}
+              </button>
+            </div>
+          </article>
+        ))}
+      </section>
+
+      {stats && (
+        <section className="card" style={{ padding: 20 }}>
+          <h2 className="section-title">Estado del transporte</h2>
+          <ul className="small" style={{ marginTop: 10, marginBottom: 0, paddingLeft: 18 }}>
+            <li>
+              SES configurado:{" "}
+              <strong
+                style={{
+                  color: stats.transport.available
+                    ? "var(--positive)"
+                    : "var(--negative)",
+                }}
+              >
+                {stats.transport.available ? "sí" : "no"}
+              </strong>
+              {stats.transport.devFallback && " (fallback dev: stdout)"}
+            </li>
+            <li>
+              Último envío registrado:{" "}
+              {stats.lastRun
+                ? `${NOTIFICATION_TYPE_LABELS[stats.lastRun.notificationType]} — ${formatDateTime(stats.lastRun.sendDate)}`
+                : "—"}
+            </li>
+            <li>
+              Totales:{" "}
+              {stats.byStatus.map((s) => (
+                <span key={s.status} style={{ marginRight: 12 }}>
+                  {NOTIFICATION_STATUS_LABELS[s.status]}: {s._count._all}
+                </span>
+              ))}
+            </li>
+          </ul>
+        </section>
+      )}
+
+      <AdminEmailsSetting />
+
+      {lastResult && (
+        <section className="card" style={{ padding: 20 }}>
+          <h2 className="section-title">Última respuesta</h2>
+          {lastResult.type === "RUN_ALL" && (
+            <ul
+              className="small"
+              style={{ marginTop: 10, marginBottom: 0, paddingLeft: 18 }}
+            >
+              <li>
+                Totales: enviados {lastResult.sent} · omitidos{" "}
+                {lastResult.skipped} · fallidos {lastResult.failed}
+                {lastResult.errors > 0 && ` · jobs con error ${lastResult.errors}`}
+              </li>
+              {lastResult.jobs.map((j) => (
+                <li key={j.kind}>
+                  {JOB_TITLES[j.kind]}:{" "}
+                  {j.ok && j.result ? (
+                    <>
+                      enviados {j.result.sent} · omitidos {j.result.skipped} ·
+                      fallidos {j.result.failed}
+                    </>
+                  ) : (
+                    <span style={{ color: "var(--negative)" }}>
+                      error — {j.error}
+                    </span>
+                  )}
+                </li>
+              ))}
+            </ul>
+          )}
+          <pre
+            className="mono"
+            style={{
+              margin: "10px 0 0",
+              fontSize: 12,
+              overflow: "auto",
+              background: "var(--surface-2)",
+              border: "1px solid var(--line)",
+              borderRadius: "var(--radius-sm)",
+              padding: 12,
+            }}
+          >
+            {JSON.stringify(lastResult, null, 2)}
+          </pre>
+        </section>
+      )}
+
+      <NotificationLogPanel
+        servicio={SERVICIOS_LOG_SCOPE}
+        reloadToken={logToken}
+      />
+    </div>
+  );
+}

apps/web/src/components/NotificationFlagsCard.tsx

@@ -0,0 +1,92 @@
+"use client";
+
+import type { NotificationFlags } from "@/lib/api";
+
+/**
+ * The "Flags del envío" panel. It lives in the /notificaciones shell above the
+ * tabs, not inside one of them, because the flags are platform-wide: `debug`
+ * governs the pólizas avisos exactly as it governs the four servicios jobs,
+ * and a switch that only protected half the screen was the bug this fixes.
+ *
+ * State is per-visit, never persisted — see the note on the schedule card. A
+ * stored `debug` would survive a reload and silently swallow real customer
+ * mail; the automatic corridas therefore always send for real.
+ */
+
+export function NotificationFlagsCard({
+  flags,
+  onChange,
+  disabled = false,
+}: {
+  flags: NotificationFlags;
+  onChange: (next: NotificationFlags) => void;
+  disabled?: boolean;
+}) {
+  const set = (patch: Partial<NotificationFlags>) =>
+    onChange({ ...flags, ...patch });
+
+  return (
+    <section className="card" style={{ padding: 20 }}>
+      <h2 className="section-title">Flags del envío</h2>
+      <p className="muted small" style={{ marginTop: 4, marginBottom: 0, maxWidth: 620 }}>
+        Se aplican a todo lo que se envía desde esta pantalla — servicios y
+        pólizas — y solo a los envíos manuales. Las corridas automáticas siempre
+        mandan de verdad.
+      </p>
+      <div style={{ display: "grid", gap: 4, marginTop: 14 }}>
+        <label
+          className="field"
+          style={{ display: "flex", gap: 8, alignItems: "flex-start", marginBottom: 8 }}
+        >
+          <input
+            type="checkbox"
+            checked={!!flags.debug}
+            disabled={disabled}
+            onChange={(e) => set({ debug: e.target.checked })}
+            style={{ marginTop: 2 }}
+          />
+          <span className="small">
+            <strong>debug</strong> — reescribe todos los destinatarios a{" "}
+            <code>rmancinas@freakma.net</code>. Ningún cliente real recibe el
+            correo mientras esté activo. Un aviso de renovación enviado en debug
+            NO se marca como enviado: sigue pendiente en la lista.
+          </span>
+        </label>
+        <label
+          className="field"
+          style={{ display: "flex", gap: 8, alignItems: "flex-start", marginBottom: 8 }}
+        >
+          <input
+            type="checkbox"
+            checked={!!flags.ignoreDayRestriction}
+            disabled={disabled}
+            onChange={(e) => set({ ignoreDayRestriction: e.target.checked })}
+            style={{ marginTop: 2 }}
+          />
+          <span className="small">
+            <strong>ignoreDayRestriction</strong> — salta los gates de
+            Mon/Wed/Fri del estado de cuenta. Útil para disparar en cualquier
+            día sin esperar a la próxima corrida. Solo aplica a servicios.
+          </span>
+        </label>
+        <label
+          className="field"
+          style={{ display: "flex", gap: 8, alignItems: "flex-start", marginBottom: 0 }}
+        >
+          <input
+            type="checkbox"
+            checked={!!flags.useEmailLimit}
+            disabled={disabled}
+            onChange={(e) => set({ useEmailLimit: e.target.checked })}
+            style={{ marginTop: 2 }}
+          />
+          <span className="small">
+            <strong>useEmailLimit</strong> — pausa el estado de cuenta cada 100
+            correos durante 1 hora. Vestigio de la era SMTP; SES no lo necesita.
+            Solo aplica a servicios.
+          </span>
+        </label>
+      </div>
+    </section>
+  );
+}

apps/web/src/components/NotificationLogPanel.tsx

@@ -0,0 +1,186 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import {
+  listNotificationLog,
+  type NotificationLogPage,
+  type NotificationServicio,
+} from "@/lib/api";
+import {
+  formatDateTime,
+  NOTIFICATION_SERVICIO_LABELS,
+  NOTIFICATION_STATUS_COLORS,
+  NOTIFICATION_STATUS_LABELS,
+  NOTIFICATION_TYPE_LABELS,
+  notificationLevelLabel,
+} from "@/lib/labels";
+
+/**
+ * "Registro de envíos" — the send history over `email_notification_log`.
+ *
+ * Every outbound email the platform sends writes to that one table (the four
+ * bulk jobs and the renewal avisos alike), so this component is shared by
+ * both /notificaciones tabs; each passes the `servicio` slice it owns. Rows
+ * cover failures and skips too, which is the whole point: a notice that never
+ * left is invisible everywhere else.
+ */
+
+const LOG_VIEWS = [
+  { key: "all", label: "Todos" },
+  { key: "sent", label: "Enviados" },
+  { key: "failed", label: "Fallidos" },
+  { key: "skipped", label: "Omitidos" },
+] as const;
+
+export type LogView = (typeof LOG_VIEWS)[number]["key"];
+
+export function NotificationLogPanel({
+  servicio,
+  emptyHint = "Sin envíos con el filtro actual.",
+  /** Bump to force a reload — the parent raises it after a send. */
+  reloadToken = 0,
+}: {
+  servicio: NotificationServicio[];
+  emptyHint?: string;
+  reloadToken?: number;
+}) {
+  const [log, setLog] = useState<NotificationLogPage | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [view, setView] = useState<LogView>("all");
+  const [page, setPage] = useState(1);
+
+  // `servicio` is a literal array at every call site, so a new identity each
+  // render would re-fetch forever. Key the effect on its contents instead.
+  const servicioKey = servicio.join(",");
+
+  const refresh = useCallback(async () => {
+    try {
+      const data = await listNotificationLog({
+        page,
+        pageSize: 50,
+        servicio: servicioKey.split(",") as NotificationServicio[],
+        view: view === "all" ? undefined : view,
+      });
+      setLog(data);
+      setError(null);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    }
+  }, [page, view, servicioKey]);
+
+  useEffect(() => {
+    void refresh();
+  }, [refresh, reloadToken]);
+
+  return (
+    <section className="card" style={{ padding: 20 }}>
+      <div
+        style={{
+          display: "flex",
+          justifyContent: "space-between",
+          alignItems: "center",
+          gap: 12,
+          flexWrap: "wrap",
+        }}
+      >
+        <h2 className="section-title">Registro de envíos</h2>
+        <div className="seg" role="tablist">
+          {LOG_VIEWS.map((v) => (
+            <button
+              key={v.key}
+              type="button"
+              role="tab"
+              aria-selected={view === v.key}
+              className={`seg-btn ${view === v.key ? "active" : ""}`}
+              onClick={() => {
+                setView(v.key);
+                setPage(1);
+              }}
+            >
+              {v.label}
+            </button>
+          ))}
+        </div>
+      </div>
+
+      {error && (
+        <div className="state-box state-error" style={{ marginTop: 12 }}>
+          {error}
+        </div>
+      )}
+
+      <div className="tx-scroll" style={{ marginTop: 12 }}>
+        <table className="tx-table">
+          <thead>
+            <tr>
+              <th>Fecha</th>
+              <th>Tipo</th>
+              <th>Servicio</th>
+              <th>Cliente</th>
+              <th>Email</th>
+              <th>Estado</th>
+              <th>Asunto</th>
+              <th>Provider</th>
+            </tr>
+          </thead>
+          <tbody>
+            {log?.items.map((row) => (
+              <tr key={row.id}>
+                <td>{formatDateTime(row.sendDate)}</td>
+                <td>
+                  {NOTIFICATION_TYPE_LABELS[row.notificationType]}
+                  {notificationLevelLabel(row.notificationType, row.level)}
+                </td>
+                <td>{NOTIFICATION_SERVICIO_LABELS[row.servicio]}</td>
+                <td>
+                  {row.customerName}
+                  {row.debug ? " · debug" : ""}
+                </td>
+                <td>{row.customerEmail || "—"}</td>
+                <td style={{ color: NOTIFICATION_STATUS_COLORS[row.status] }}>
+                  {NOTIFICATION_STATUS_LABELS[row.status]}
+                </td>
+                <td>{row.subject}</td>
+                <td className="muted small">
+                  {row.providerMessageId ?? row.error ?? "—"}
+                </td>
+              </tr>
+            ))}
+            {log && log.items.length === 0 && (
+              <tr>
+                <td colSpan={8}>
+                  <span className="empty-inline">{emptyHint}</span>
+                </td>
+              </tr>
+            )}
+          </tbody>
+        </table>
+      </div>
+
+      {log && log.pageCount > 1 && (
+        <div className="pager" style={{ marginTop: 14 }}>
+          <button
+            type="button"
+            className="btn btn-outline btn-sm"
+            disabled={log.page <= 1}
+            onClick={() => setPage((p) => Math.max(1, p - 1))}
+          >
+            ← Anterior
+          </button>
+          <span className="pager-info">
+            {log.total} fila{log.total === 1 ? "" : "s"} · página {log.page} de{" "}
+            {log.pageCount}
+          </span>
+          <button
+            type="button"
+            className="btn btn-outline btn-sm"
+            disabled={log.page >= log.pageCount}
+            onClick={() => setPage((p) => Math.min(log.pageCount, p + 1))}
+          >
+            Siguiente →
+          </button>
+        </div>
+      )}
+    </section>
+  );
+}

apps/web/src/components/NotificationScheduleCard.tsx

@@ -0,0 +1,309 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import { useCan } from "@/lib/abilities";
+import {
+  getNotificationSchedules,
+  setNotificationSchedule,
+  type NotificationSchedule,
+  type NotificationSchedules,
+  type ScheduleKind,
+} from "@/lib/api";
+import { formatDateTime } from "@/lib/labels";
+
+/**
+ * When the two automatic envíos run.
+ *
+ * Both cadences used to be source code: pólizas barría a las 06:00 desde un
+ * `@Cron` en el servidor y servicios no corría solo en absoluto. Cambiar
+ * cualquiera de los dos era un redeploy. Ahora se guardan en `app_settings` y
+ * el servidor reinstala el job al guardar — sin reinicio.
+ *
+ * Los flags de la tarjeta de arriba NO se aplican aquí: una corrida
+ * automática siempre manda de verdad.
+ */
+
+const KIND_LABEL: Record<ScheduleKind, string> = {
+  servicios: "Servicios",
+  polizas: "Pólizas",
+};
+
+const KIND_HINT: Record<ScheduleKind, string> = {
+  servicios:
+    "Ejecuta los cuatro envíos en orden, igual que el botón «Ejecutar todos». El estado de cuenta sigue respetando sus gates de lunes/miércoles/viernes.",
+  polizas:
+    "Barrido de avisos de renovación: 30 y 15 días antes del vencimiento, y 7 días después.",
+};
+
+const DAYS = [
+  { value: 0, label: "Dom" },
+  { value: 1, label: "Lun" },
+  { value: 2, label: "Mar" },
+  { value: 3, label: "Mié" },
+  { value: 4, label: "Jue" },
+  { value: 5, label: "Vie" },
+  { value: 6, label: "Sáb" },
+];
+
+function timeValue(s: NotificationSchedule): string {
+  return `${String(s.hour).padStart(2, "0")}:${String(s.minute).padStart(2, "0")}`;
+}
+
+function describe(s: NotificationSchedule): string {
+  if (!s.enabled) return "Desactivado — solo se envía manualmente.";
+  const days = s.weekdays.length
+    ? s.weekdays
+        .map((d) => DAYS.find((x) => x.value === d)?.label ?? d)
+        .join(", ")
+    : "todos los días";
+  return `${days} a las ${timeValue(s)} (hora de Tijuana).`;
+}
+
+export function NotificationScheduleCard() {
+  const canEdit = useCan("setting:manage");
+
+  const [schedules, setSchedules] = useState<NotificationSchedules | null>(null);
+  const [drafts, setDrafts] = useState<Partial<Record<ScheduleKind, NotificationSchedule>>>({});
+  const [editing, setEditing] = useState<ScheduleKind | null>(null);
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [saved, setSaved] = useState<ScheduleKind | null>(null);
+
+  const load = useCallback(async () => {
+    try {
+      setSchedules(await getNotificationSchedules());
+      setError(null);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    }
+  }, []);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  function startEdit(kind: ScheduleKind) {
+    if (!schedules) return;
+    setDrafts((d) => ({ ...d, [kind]: { ...schedules[kind].value } }));
+    setEditing(kind);
+    setSaved(null);
+    setError(null);
+  }
+
+  async function save(kind: ScheduleKind) {
+    const draft = drafts[kind];
+    if (!draft) return;
+    setSaving(true);
+    setError(null);
+    try {
+      const result = await setNotificationSchedule(kind, draft);
+      setSchedules((prev) => (prev ? { ...prev, [kind]: result } : prev));
+      setEditing(null);
+      setSaved(kind);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  if (!schedules) {
+    return (
+      <section className="card" style={{ padding: 20 }}>
+        <h2 className="section-title">Programación de envíos</h2>
+        {error ? (
+          <div className="state-box state-error" style={{ marginTop: 12 }}>
+            {error}
+          </div>
+        ) : (
+          <p className="muted small" style={{ marginTop: 8, marginBottom: 0 }}>
+            Cargando…
+          </p>
+        )}
+      </section>
+    );
+  }
+
+  return (
+    <section className="card" style={{ padding: 20 }}>
+      <h2 className="section-title">Programación de envíos</h2>
+      <p className="muted small" style={{ marginTop: 4, marginBottom: 0, maxWidth: 660 }}>
+        Cuándo corre solo cada envío. Los cambios aplican de inmediato, sin
+        reiniciar el servidor. Una corrida automática nunca usa los flags de
+        arriba: siempre manda a los clientes reales.
+      </p>
+
+      {error && (
+        <div className="state-box state-error" style={{ marginTop: 12 }}>
+          {error}
+        </div>
+      )}
+
+      <div style={{ display: "grid", gap: 12, marginTop: 14 }}>
+        {(Object.keys(KIND_LABEL) as ScheduleKind[]).map((kind) => {
+          const current = schedules[kind];
+          const draft = drafts[kind];
+          const isEditing = editing === kind && draft;
+
+          return (
+            <article
+              key={kind}
+              style={{
+                border: "1px solid var(--line)",
+                borderRadius: "var(--radius-sm)",
+                padding: 14,
+              }}
+            >
+              <div
+                style={{
+                  display: "flex",
+                  justifyContent: "space-between",
+                  alignItems: "flex-start",
+                  gap: 12,
+                  flexWrap: "wrap",
+                }}
+              >
+                <div>
+                  <strong>{KIND_LABEL[kind]}</strong>
+                  <p className="muted small" style={{ margin: "4px 0 0", maxWidth: 560 }}>
+                    {KIND_HINT[kind]}
+                  </p>
+                </div>
+                {canEdit && !isEditing && (
+                  <button
+                    type="button"
+                    className="btn btn-outline btn-sm"
+                    onClick={() => startEdit(kind)}
+                  >
+                    Editar
+                  </button>
+                )}
+              </div>
+
+              {isEditing ? (
+                <div style={{ marginTop: 12 }}>
+                  <label
+                    className="field"
+                    style={{ display: "flex", gap: 8, alignItems: "center", marginBottom: 10 }}
+                  >
+                    <input
+                      type="checkbox"
+                      checked={draft.enabled}
+                      disabled={saving}
+                      onChange={(e) =>
+                        setDrafts((d) => ({
+                          ...d,
+                          [kind]: { ...draft, enabled: e.target.checked },
+                        }))
+                      }
+                    />
+                    <span className="small">
+                      <strong>Corrida automática activada</strong>
+                    </span>
+                  </label>
+
+                  <label className="field" style={{ maxWidth: 160, marginBottom: 10 }}>
+                    <span className="field-label">Hora (Tijuana)</span>
+                    <input
+                      className="input"
+                      type="time"
+                      value={timeValue(draft)}
+                      disabled={saving || !draft.enabled}
+                      onChange={(e) => {
+                        const [h, m] = e.target.value.split(":").map(Number);
+                        setDrafts((d) => ({
+                          ...d,
+                          [kind]: {
+                            ...draft,
+                            hour: Number.isFinite(h) ? h : draft.hour,
+                            minute: Number.isFinite(m) ? m : draft.minute,
+                          },
+                        }));
+                      }}
+                    />
+                  </label>
+
+                  <div className="field" style={{ marginBottom: 10 }}>
+                    <span className="field-label">
+                      Días (ninguno seleccionado = todos los días)
+                    </span>
+                    <div style={{ display: "flex", gap: 6, flexWrap: "wrap", marginTop: 4 }}>
+                      {DAYS.map((d) => {
+                        const on = draft.weekdays.includes(d.value);
+                        return (
+                          <button
+                            key={d.value}
+                            type="button"
+                            className={`btn btn-sm ${on ? "btn-primary" : "btn-outline"}`}
+                            disabled={saving || !draft.enabled}
+                            onClick={() =>
+                              setDrafts((prev) => ({
+                                ...prev,
+                                [kind]: {
+                                  ...draft,
+                                  weekdays: on
+                                    ? draft.weekdays.filter((x) => x !== d.value)
+                                    : [...draft.weekdays, d.value].sort(),
+                                },
+                              }))
+                            }
+                          >
+                            {d.label}
+                          </button>
+                        );
+                      })}
+                    </div>
+                  </div>
+
+                  <div className="row-actions">
+                    <button
+                      type="button"
+                      className="btn btn-primary btn-sm"
+                      disabled={saving}
+                      onClick={() => void save(kind)}
+                    >
+                      {saving ? "Guardando…" : "Guardar"}
+                    </button>
+                    <button
+                      type="button"
+                      className="btn btn-outline btn-sm"
+                      disabled={saving}
+                      onClick={() => {
+                        setEditing(null);
+                        setError(null);
+                      }}
+                    >
+                      Cancelar
+                    </button>
+                  </div>
+                </div>
+              ) : (
+                <div style={{ marginTop: 10 }}>
+                  <p className="small" style={{ margin: 0 }}>
+                    {describe(current.value)}
+                  </p>
+                  <p className="section-note" style={{ marginTop: 6, marginBottom: 0 }}>
+                    <code>{current.cron}</code>
+                    {current.nextRun &&
+                      ` · próxima corrida: ${formatDateTime(current.nextRun)}`}
+                    {current.source === "default" &&
+                      " · valor por omisión, nadie lo ha cambiado"}
+                    {current.updatedAt &&
+                      ` · última edición: ${formatDateTime(current.updatedAt)}`}
+                    {saved === kind && " · guardado"}
+                  </p>
+                </div>
+              )}
+            </article>
+          );
+        })}
+      </div>
+
+      {!canEdit && (
+        <p className="section-note" style={{ marginTop: 12, marginBottom: 0 }}>
+          Solo un ADMIN puede cambiar la programación.
+        </p>
+      )}
+    </section>
+  );
+}

apps/web/src/components/PolicyCaptura.tsx

@@ -0,0 +1,124 @@
+"use client";
+
+import { useState } from "react";
+import Link from "next/link";
+import { useSearchParams } from "next/navigation";
+import { PolicyForm } from "@/components/PolicyForm";
+import { PolicyOcrIntake } from "@/components/PolicyOcrIntake";
+import { useCan } from "@/lib/abilities";
+
+/**
+ * Policy intake — mirror of `Captura.tsx` (statement OCR side): one screen,
+ * two ways in:
+ *
+ * - **manual** — `PolicyForm` keys every field by hand.
+ * - **auto** — `PolicyOcrIntake` uploads a GMX PDF, OCR proposes the
+ *   policy, a human still confirms.
+ *
+ * Both end at the same place (a `Policy` row on a customer's file) so they
+ * live as two modes of one screen rather than two menu entries — exactly the
+ * same shape Captura uses for `ManualCheckCapture` vs `StatementIntake`.
+ *
+ * `/polizas/nuevo` opens manual, `/polizas/captura` opens auto; both render
+ * this component so the tab toggle works either way and an old bookmark
+ * still lands on the right tab.
+ */
+export type PolicyCaptureMode = "manual" | "auto";
+
+const MODE_HINT: Record<PolicyCaptureMode, string> = {
+  manual:
+    "Captura cada campo a mano. Use esta opción cuando la póliza llega en papel, en un correo sin PDF legible, o cuando hay que revisar cada dato.",
+  auto: "Suelte el PDF descargado del portal de GMX y el sistema propondrá los campos. Nada se registra sin tu confirmación.",
+};
+
+export function PolicyCaptura({ initialMode = "manual" }: { initialMode?: PolicyCaptureMode }) {
+  const canCreate = useCan("policy:create");
+  const canIngest = useCan("policy:ingest");
+
+  // `/clientes/[id]` deep-links into /polizas/nuevo with the customer
+  // pre-picked so staff can fill the rest without retyping. The OCR pane
+  // ignores these — there's no customer to lock in until the batch is
+  // confirmed.
+  const params = useSearchParams();
+  const fixedCustomerId = params.get("customerId") ?? undefined;
+  const fixedCustomerName = params.get("customerName") ?? undefined;
+
+  // One user can land on either mode. The tab strip only renders when both
+  // abilities are held — a STAFF with only policy:ingest (no create) still
+  // sees the screen but only the OCR tab is offered.
+  const modes: { key: PolicyCaptureMode; label: string }[] = [
+    ...(canCreate ? [{ key: "manual" as const, label: "Captura manual" }] : []),
+    ...(canIngest ? [{ key: "auto" as const, label: "Captura automática (OCR)" }] : []),
+  ];
+
+  const [mode, setMode] = useState<PolicyCaptureMode>(
+    modes.some((m) => m.key === initialMode) ? initialMode : (modes[0]?.key ?? "manual"),
+  );
+
+  if (modes.length === 0) {
+    return (
+      <div className="state-box state-error">
+        No tienes permiso para crear ni capturar pólizas.
+      </div>
+    );
+  }
+
+  return (
+    <>
+      <div className="page-head">
+        <Link href="/polizas" className="back-link">← Pólizas</Link>
+        <h1 className="page-title">Nueva póliza</h1>
+        <p className="eyebrow">{MODE_HINT[mode]}</p>
+      </div>
+
+      {modes.length > 1 && (
+        <div className="seg" role="tablist" style={{ marginBottom: 16 }}>
+          {modes.map((m) => (
+            <button
+              key={m.key}
+              type="button"
+              role="tab"
+              aria-selected={mode === m.key}
+              className={`seg-btn ${mode === m.key ? "active" : ""}`}
+              onClick={() => setMode(m.key)}
+            >
+              {m.label}
+            </button>
+          ))}
+        </div>
+      )}
+
+      {mode === "manual" ? (
+        <ManualPane
+          fixedCustomerId={fixedCustomerId}
+          fixedCustomerName={fixedCustomerName}
+        />
+      ) : (
+        <PolicyOcrIntake />
+      )}
+    </>
+  );
+}
+
+function ManualPane({
+  fixedCustomerId,
+  fixedCustomerName,
+}: {
+  fixedCustomerId?: string;
+  fixedCustomerName?: string;
+}) {
+  const allowed = useCan("policy:create");
+  if (!allowed) {
+    return (
+      <div className="state-box state-error">
+        No tiene permisos para crear pólizas.
+      </div>
+    );
+  }
+  return (
+    <PolicyForm
+      fixedCustomerId={fixedCustomerId}
+      fixedCustomerName={fixedCustomerName}
+    />
+  );
+}

apps/web/src/components/PolicyOcrIntake.tsx

@@ -0,0 +1,233 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import Link from "next/link";
+import {
+  getPolicyOcrStatus,
+  listPolicyOcrBatches,
+  uploadPolicyOcrBatch,
+} from "@/lib/api";
+import { useCan } from "@/lib/abilities";
+import { formatDate } from "@/lib/labels";
+import type { PolicyOcrBatch, PolicyOcrBatchStatus } from "@/lib/types";
+
+/**
+ * Insurance OCR intake — mirror of StatementIntake, scoped to the insurance
+ * side. Today the only provider is GMX; the parser dispatches on a brand
+ * wordmark (`Grupo Mexicano de Seguros` / `gmx.com.mx` / the GMX letterhead)
+ * and a new portal only needs a new BRAND entry plus a parser file.
+ *
+ * Lives inside the `Pólizas` page rather than a top-level route because it
+ * is one mode of one job (staff uploading whatever PDFs the office has on
+ * hand that day, mixed service vs insurance), and the matching/review queue
+ * already keys on the policyNumber → existing Policy transition that the
+ * rest of /polizas owns.
+ */
+
+const STATUS_LABEL: Record<PolicyOcrBatchStatus, string> = {
+  UPLOADED: "Recibido",
+  PROCESSING: "Procesando…",
+  READY_FOR_REVIEW: "Listo para revisar",
+  COMPLETED: "Aplicado",
+  FAILED: "Falló",
+  DISCARDED: "Descartado",
+};
+
+export function PolicyOcrIntake() {
+  const canIngest = useCan("policy:ingest");
+  const [batches, setBatches] = useState<PolicyOcrBatch[]>([]);
+  const [ocrAvailable, setOcrAvailable] = useState<boolean | null>(null);
+  const [storageAvailable, setStorageAvailable] = useState<boolean | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  const load = useCallback(async () => {
+    try {
+      const [list, status] = await Promise.all([
+        listPolicyOcrBatches(),
+        getPolicyOcrStatus(),
+      ]);
+      setBatches(list.items);
+      setOcrAvailable(status.ocrAvailable);
+      setStorageAvailable(status.storageAvailable);
+      setError(null);
+    } catch (e) {
+      setError((e as Error)?.message ?? "No se pudieron cargar los lotes.");
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  const working = batches.some(
+    (b) => b.status === "PROCESSING" || b.status === "UPLOADED",
+  );
+  useEffect(() => {
+    if (!working) return;
+    const t = setInterval(() => void load(), 4000);
+    return () => clearInterval(t);
+  }, [working, load]);
+
+  const ready = ocrAvailable === true && storageAvailable === true;
+
+  return (
+    <div className="stack">
+      {ocrAvailable === false && (
+        <div className="state-box state-error">
+          Este servidor no tiene OCR instalado, así que no se pueden leer PDFs
+          de pólizas escaneados. La captura manual sigue funcionando.
+        </div>
+      )}
+
+      {storageAvailable === false && (
+        <div className="state-box state-error">
+          Este servidor no tiene configurado el almacenamiento de documentos, así
+          que no hay dónde guardar los PDFs. Mientras tanto, capture las
+          pólizas a mano.
+        </div>
+      )}
+
+      {canIngest && ready && <UploadCard onDone={load} />}
+
+      {error && <div className="state-box state-error">{error}</div>}
+
+      <section className="card" style={{ padding: 16 }}>
+        <h2 className="section-title" style={{ marginTop: 0 }}>
+          Lotes
+        </h2>
+        {loading ? (
+          <div className="state-box">Cargando…</div>
+        ) : batches.length === 0 ? (
+          <div className="state-box">
+            Todavía no hay lotes de pólizas. Descargue el certificado del portal
+            de GMX y suéltelo arriba.
+          </div>
+        ) : (
+          <div className="tx-scroll">
+            <table className="tx-table">
+              <thead>
+                <tr>
+                  <th>Fecha</th>
+                  <th>Aseguradora</th>
+                  <th>Referencia</th>
+                  <th>Estado</th>
+                  <th className="num">Páginas</th>
+                  <th>Subido por</th>
+                  <th />
+                </tr>
+              </thead>
+              <tbody>
+                {batches.map((b) => (
+                  <tr key={b.id}>
+                    <td style={{ whiteSpace: "nowrap" }}>{formatDate(b.createdAt)}</td>
+                    <td>{b.provider}</td>
+                    <td>{b.label || "—"}</td>
+                    <td>
+                      <StatusTag status={b.status} />
+                      {b.error && (
+                        <div className="page-sub" style={{ marginTop: 4 }}>
+                          {b.error}
+                        </div>
+                      )}
+                    </td>
+                    <td className="num">{b._count?.documents ?? 0}</td>
+                    <td>{b.uploadedBy?.name ?? "—"}</td>
+                    <td>
+                      <Link
+                        className="btn btn-ghost"
+                        href={`/polizas/captura/${b.id}`}
+                      >
+                        Revisar
+                      </Link>
+                    </td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          </div>
+        )}
+      </section>
+    </div>
+  );
+}
+
+function StatusTag({ status }: { status: PolicyOcrBatchStatus }) {
+  return <span className="tag">{STATUS_LABEL[status] ?? status}</span>;
+}
+
+function UploadCard({ onDone }: { onDone: () => void }) {
+  const [files, setFiles] = useState<File[]>([]);
+  const [label, setLabel] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  async function submit() {
+    if (!files.length) return;
+    setBusy(true);
+    setError(null);
+    try {
+      await uploadPolicyOcrBatch(files, label.trim() || undefined);
+      setFiles([]);
+      setLabel("");
+      onDone();
+    } catch (e) {
+      setError((e as Error)?.message ?? "No se pudo subir el lote.");
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  return (
+    <section className="card" style={{ padding: 16 }}>
+      <h2 className="section-title" style={{ marginTop: 0 }}>
+        Subir PDFs de pólizas (GMX)
+      </h2>
+      <div className="inline-form" style={{ flexWrap: "wrap", gap: 12 }}>
+        <label>
+          <span className="page-sub">Referencia (opcional)</span>
+          <input
+            className="input"
+            placeholder="ej. GMX julio 2026"
+            value={label}
+            onChange={(e) => setLabel(e.target.value)}
+          />
+        </label>
+
+        <label>
+          <span className="page-sub">Archivos PDF</span>
+          <input
+            type="file"
+            className="input"
+            accept="application/pdf"
+            multiple
+            onChange={(e) => setFiles(Array.from(e.target.files ?? []))}
+          />
+        </label>
+
+        <button
+          type="button"
+          className="btn btn-primary"
+          disabled={!files.length || busy}
+          onClick={submit}
+        >
+          {busy ? "Subiendo…" : `Procesar ${files.length || ""}`.trim()}
+        </button>
+      </div>
+
+      {error && (
+        <div className="state-box state-error" style={{ marginTop: 12 }}>
+          {error}
+        </div>
+      )}
+
+      <p className="page-sub" style={{ marginTop: 12 }}>
+        Un lote puede traer varios PDFs. Cada página se procesa por separado; el
+        sistema busca una póliza existente por número y, si no la encuentra,
+        propone crear una nueva bajo el cliente que se elija en la revisión.
+      </p>
+    </section>
+  );
+}

apps/web/src/components/PolicyOcrReview.tsx

@@ -0,0 +1,622 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import Link from "next/link";
+import { CustomerPicker } from "@/components/CustomerPicker";
+import { DiscardBatchCard } from "@/components/DiscardBatchCard";
+import {
+  confirmPolicyOcrBatch,
+  discardPolicyOcrBatch,
+  getPolicyOcrBatch,
+  listCustomers,
+  listPolicyOcrDocuments,
+  policyOcrDocumentUrl,
+  rejectPolicyOcrDocument,
+  reviewPolicyOcrDocument,
+} from "@/lib/api";
+import { useCan } from "@/lib/abilities";
+import { formatDate, formatMoney } from "@/lib/labels";
+import type {
+  CustomerListItem,
+  PolicyOcrBatchDetail,
+  PolicyOcrConfirmDocument,
+  PolicyOcrCoverage,
+  PolicyOcrDocument,
+  PolicyOcrReviewInput,
+} from "@/lib/types";
+
+/** Document and batch statuses share this map — the two enums have no
+ *  overlapping members, and the header renders a batch status through it. */
+const STATUS_LABEL: Record<string, string> = {
+  PENDING_OCR: "Pendiente",
+  OCR_FAILED: "Falló OCR",
+  NEEDS_REVIEW: "Para revisar",
+  MATCHED: "Listo",
+  CONFIRMED: "Confirmado",
+  POSTED: "Aplicado",
+  REJECTED: "Rechazado",
+  UPLOADED: "Recibido",
+  PROCESSING: "Procesando…",
+  READY_FOR_REVIEW: "Listo para revisar",
+  COMPLETED: "Aplicado",
+  FAILED: "Falló",
+  DISCARDED: "Descartado",
+};
+
+const OPEN_FIRST = [
+  "NEEDS_REVIEW",
+  "MATCHED",
+  "CONFIRMED",
+  "PENDING_OCR",
+  "OCR_FAILED",
+  "REJECTED",
+  "POSTED",
+];
+
+type EditMap = Record<string, PolicyOcrConfirmDocument | undefined>;
+
+export function PolicyOcrReview({ id }: { id: string }) {
+  const canReview = useCan("policy:ocr-review");
+  const [batch, setBatch] = useState<PolicyOcrBatchDetail | null>(null);
+  const [docs, setDocs] = useState<PolicyOcrDocument[]>([]);
+  const [edits, setEdits] = useState<EditMap>({});
+  const [customerIndex, setCustomerIndex] = useState<Record<string, CustomerListItem>>({});
+  const [error, setError] = useState<string | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [submitting, setSubmitting] = useState(false);
+  const [discarding, setDiscarding] = useState(false);
+
+  const load = useCallback(async () => {
+    try {
+      const [b, d, c] = await Promise.all([
+        getPolicyOcrBatch(id),
+        listPolicyOcrDocuments(id),
+        canReview ? listCustomers({ pageSize: 200 }).then((r) => r.items) : Promise.resolve([]),
+      ]);
+      setBatch(b);
+      setDocs(d);
+      setCustomerIndex(Object.fromEntries(c.map((x) => [x.id, x])));
+      setError(null);
+    } catch (e) {
+      setError((e as Error)?.message ?? "No se pudo cargar el lote.");
+    } finally {
+      setLoading(false);
+    }
+  }, [id, canReview]);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  const processing = batch?.status === "PROCESSING" || batch?.status === "UPLOADED";
+  useEffect(() => {
+    if (!processing) return;
+    const t = setInterval(() => void load(), 4000);
+    return () => clearInterval(t);
+  }, [processing, load]);
+
+  const sorted = useMemo(
+    () =>
+      [...docs].sort(
+        (a, b) =>
+          OPEN_FIRST.indexOf(a.status) - OPEN_FIRST.indexOf(b.status) ||
+          a.pageNumber - b.pageNumber,
+      ),
+    [docs],
+  );
+
+  const readyCount = Object.values(edits).filter(Boolean).length;
+
+  function setEdit(docId: string, edit: PolicyOcrConfirmDocument) {
+    setEdits((prev) => ({ ...prev, [docId]: edit }));
+  }
+
+  async function onConfirm() {
+    if (!batch) return;
+    const payload: PolicyOcrConfirmDocument[] = [];
+    for (const d of docs) {
+      const edit = edits[d.id];
+      if (!edit) continue;
+      if (!edit.policyId && !edit.customerId) {
+        setError(`Página ${d.pageNumber}: falta cliente o póliza destino.`);
+        return;
+      }
+      payload.push(edit);
+    }
+    if (!payload.length) {
+      setError("No hay documentos revisados. Guarde cada página antes de aplicar.");
+      return;
+    }
+    setSubmitting(true);
+    setError(null);
+    try {
+      await confirmPolicyOcrBatch(batch.id, { documents: payload });
+      setEdits({});
+      await load();
+    } catch (e) {
+      setError((e as Error)?.message ?? "No se pudo aplicar el lote.");
+    } finally {
+      setSubmitting(false);
+    }
+  }
+
+  async function onDiscard() {
+    if (!batch) return;
+    setDiscarding(true);
+    setError(null);
+    try {
+      await discardPolicyOcrBatch(batch.id);
+      setEdits({});
+      await load();
+    } catch (e) {
+      setError((e as Error)?.message ?? "No se pudo descartar el lote.");
+    } finally {
+      setDiscarding(false);
+    }
+  }
+
+  if (loading) return <div className="state-box">Cargando…</div>;
+  if (!batch) return <div className="state-box state-error">{error ?? "No encontrado."}</div>;
+
+  const appliedCount = docs.filter((d) => d.status === "POSTED").length;
+  // Discarding is only offered while the batch can still be abandoned whole:
+  // nothing applied yet, and not already discarded.
+  const canDiscard =
+    canReview &&
+    batch.status !== "DISCARDED" &&
+    batch.status !== "COMPLETED" &&
+    appliedCount === 0;
+
+  return (
+    <div className="stack">
+      <header className="page-head">
+        <div>
+          <h1 className="page-title">
+            Pólizas — {batch.provider}
+            {batch.label ? ` · ${batch.label}` : ""}
+          </h1>
+          <p className="page-sub">
+            {formatDate(batch.createdAt)} · {docs.length} página(s) ·{" "}
+            {STATUS_LABEL[batch.status] ?? batch.status}
+          </p>
+        </div>
+        <Link className="btn btn-ghost" href="/polizas">
+          Volver a pólizas
+        </Link>
+      </header>
+
+      {processing && <div className="state-box">Procesando…</div>}
+
+      {error && <div className="state-box state-error">{error}</div>}
+
+      {canReview && readyCount > 0 && (
+        <section className="card" style={{ padding: 16 }}>
+          <h2 className="section-title" style={{ marginTop: 0 }}>
+            Aplicar lote
+          </h2>
+          <p className="page-sub" style={{ marginBottom: 12 }}>
+            {readyCount} página(s) revisada(s). Se creará o actualizará la póliza
+            y, si marcó la casilla, se registrará la prima en el estado de
+            cuenta.
+          </p>
+          <button
+            type="button"
+            className="btn btn-primary"
+            disabled={submitting}
+            onClick={onConfirm}
+          >
+            {submitting ? "Aplicando…" : "Aplicar"}
+          </button>
+        </section>
+      )}
+
+      {canDiscard && (
+        <DiscardBatchCard
+          busy={discarding}
+          onDiscard={onDiscard}
+          pageCount={docs.length}
+          what="póliza"
+        />
+      )}
+
+      <section className="stack">
+        {sorted.map((doc) => (
+          <DocumentRow
+            key={doc.id}
+            doc={doc}
+            customerIndex={customerIndex}
+            canReview={canReview}
+            onSave={async (edit) => {
+              await reviewPolicyOcrDocument(doc.id, edit.reviewInput);
+              setEdit(doc.id, edit.confirmInput);
+              await load();
+            }}
+            onReject={async () => {
+              await rejectPolicyOcrDocument(doc.id);
+              setEdits((prev) => {
+                const { [doc.id]: _, ...rest } = prev;
+                return rest;
+              });
+              await load();
+            }}
+          />
+        ))}
+      </section>
+    </div>
+  );
+}
+
+interface RowSaved {
+  reviewInput: PolicyOcrReviewInput;
+  confirmInput: PolicyOcrConfirmDocument;
+}
+
+interface DocumentRowProps {
+  doc: PolicyOcrDocument;
+  customerIndex: Record<string, CustomerListItem>;
+  canReview: boolean;
+  onSave: (saved: RowSaved) => Promise<void>;
+  onReject: () => Promise<void>;
+}
+
+function DocumentRow({ doc, customerIndex, canReview, onSave, onReject }: DocumentRowProps) {
+  const [v, setV] = useState({
+    policyNumber: doc.extractedPolicyNumber ?? "",
+    insuredName: doc.extractedInsuredName ?? "",
+    additionalInsured: doc.extractedAdditionalInsured ?? "",
+    agentName: doc.extractedAgentName ?? "",
+    legalAddress: doc.extractedLegalAddress ?? "",
+    zip: doc.extractedZip ?? "",
+    policyFrom: doc.extractedPolicyFrom?.slice(0, 10) ?? "",
+    policyTo: doc.extractedPolicyTo?.slice(0, 10) ?? "",
+    policyDate: doc.extractedPolicyDate?.slice(0, 10) ?? "",
+    currency: doc.extractedCurrency ?? "USD",
+    netPremium: doc.extractedNetPremium ?? "",
+    total: doc.extractedTotal ?? "",
+    premiumPayment: doc.extractedPremiumPayment ?? "",
+    postPremium: doc.extractedNetPremium != null && Number(doc.extractedNetPremium) > 0,
+  });
+  const [customerId, setCustomerId] = useState(
+    doc.matchedCustomer?.id ?? doc.matchedPolicy?.customerId ?? "",
+  );
+  const [customerName, setCustomerName] = useState(
+    doc.matchedCustomer?.name ?? doc.matchedPolicy?.customer.name ?? "",
+  );
+  const [policyId, setPolicyId] = useState(doc.matchedPolicy?.id ?? "");
+  const [busy, setBusy] = useState(false);
+  const [err, setErr] = useState<string | null>(null);
+
+  function set<K extends keyof typeof v>(k: K, val: (typeof v)[K]) {
+    setV((p) => ({ ...p, [k]: val }));
+  }
+
+  async function save() {
+    setBusy(true);
+    setErr(null);
+    try {
+      const numOrUndef = (s: string) => (s.trim() === "" ? undefined : Number(s));
+      const trimOrUndef = (s: string) => (s.trim() === "" ? undefined : s.trim());
+      const currency = v.currency || undefined;
+      const reviewInput: PolicyOcrReviewInput = {
+        policyNumber: trimOrUndef(v.policyNumber),
+        insuredName: trimOrUndef(v.insuredName),
+        additionalInsured: trimOrUndef(v.additionalInsured),
+        agentName: trimOrUndef(v.agentName),
+        legalAddress: trimOrUndef(v.legalAddress),
+        zip: trimOrUndef(v.zip),
+        policyFrom: v.policyFrom || undefined,
+        policyTo: v.policyTo || undefined,
+        policyDate: v.policyDate || undefined,
+        currency,
+        netPremium: numOrUndef(v.netPremium),
+        total: numOrUndef(v.total),
+        premiumPayment: trimOrUndef(v.premiumPayment),
+        matchedPolicyId: policyId || undefined,
+        matchedCustomerId: !policyId && customerId ? customerId : undefined,
+        forceConfirm: true,
+      };
+      const confirmInput: PolicyOcrConfirmDocument = {
+        documentId: doc.id,
+        policyId: policyId || undefined,
+        customerId: !policyId && customerId ? customerId : undefined,
+        policyNumber: reviewInput.policyNumber,
+        insuredName: reviewInput.insuredName,
+        additionalInsured: reviewInput.additionalInsured,
+        agentName: reviewInput.agentName,
+        legalAddress: reviewInput.legalAddress,
+        zip: reviewInput.zip,
+        policyFrom: reviewInput.policyFrom,
+        policyTo: reviewInput.policyTo,
+        policyDate: reviewInput.policyDate,
+        currency: (currency as "MXN" | "USD" | "EUR" | undefined) ?? undefined,
+        netPremium: reviewInput.netPremium,
+        total: reviewInput.total,
+        premiumPayment: reviewInput.premiumPayment,
+        coveragesJson: (doc.extractedCoveragesJson ?? undefined) as
+          | PolicyOcrCoverage[]
+          | undefined,
+        postPremium: v.postPremium,
+      };
+      await onSave({ reviewInput, confirmInput });
+    } catch (e) {
+      setErr((e as Error)?.message ?? "No se pudo guardar.");
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  const locked = doc.status === "POSTED" || doc.status === "REJECTED";
+  const matchedExisting = !!doc.matchedPolicy;
+  const candidates = doc.matchCandidates ?? [];
+
+  return (
+    <article className="card" style={{ padding: 16 }}>
+      <header className="row" style={{ gap: 12, alignItems: "center" }}>
+        <span className="tag">{STATUS_LABEL[doc.status] ?? doc.status}</span>
+        <span className="page-sub">Página {doc.pageNumber}</span>
+        {doc.extractedPolicyNumber && (
+          <strong style={{ marginLeft: 8 }}>{doc.extractedPolicyNumber}</strong>
+        )}
+        {doc.extractedInsuredName && (
+          <span className="page-sub">· {doc.extractedInsuredName}</span>
+        )}
+      </header>
+
+      <div className="doc-detail">
+        {/*
+         * Embed the source PDF the office uploaded. One PDF = one parsed
+         * policy, so the browser's PDF viewer handles multi-page navigation
+         * natively; we don't need to render individual pages on the server.
+         */}
+        <iframe
+          src={policyOcrDocumentUrl(doc.id)}
+          title={`Póliza ${doc.extractedPolicyNumber ?? doc.pageNumber}`}
+          style={{
+            width: "100%",
+            height: 720,
+            border: "1px solid var(--border, #ddd)",
+            borderRadius: 6,
+            background: "#fff",
+          }}
+        />
+
+        <div className="stack" style={{ flex: 1, minWidth: 0 }}>
+          {doc.matchNote && <p className="page-sub">{doc.matchNote}</p>}
+
+          {matchedExisting ? (
+            <div className="state-box">
+              Coincide con la póliza{" "}
+              <strong>{doc.matchedPolicy?.policyNumber}</strong> del cliente{" "}
+              <strong>{doc.matchedPolicy?.customer.name}</strong>.
+            </div>
+          ) : candidates.length > 1 ? (
+            <div className="state-box state-warn">
+              {candidates.length} pólizas comparten este número. Elija
+              manualmente abajo.
+            </div>
+          ) : (
+            <div className="state-box">
+              No se encontró una póliza con este número. Se creará una nueva
+              bajo el cliente que elija abajo.
+            </div>
+          )}
+
+          <fieldset className="form-grid" disabled={locked || !canReview}>
+            <Field label="Número de póliza">
+              <input
+                className="input"
+                value={v.policyNumber}
+                onChange={(e) => set("policyNumber", e.target.value)}
+              />
+            </Field>
+            <Field label="Asegurado">
+              <input
+                className="input"
+                value={v.insuredName}
+                onChange={(e) => set("insuredName", e.target.value)}
+              />
+            </Field>
+            <Field label="Asegurado adicional">
+              <input
+                className="input"
+                value={v.additionalInsured}
+                onChange={(e) => set("additionalInsured", e.target.value)}
+              />
+            </Field>
+            <Field label="Agente">
+              <input
+                className="input"
+                value={v.agentName}
+                onChange={(e) => set("agentName", e.target.value)}
+              />
+            </Field>
+            <Field label="Desde">
+              <input
+                className="input"
+                type="date"
+                value={v.policyFrom}
+                onChange={(e) => set("policyFrom", e.target.value)}
+              />
+            </Field>
+            <Field label="Hasta">
+              <input
+                className="input"
+                type="date"
+                value={v.policyTo}
+                onChange={(e) => set("policyTo", e.target.value)}
+              />
+            </Field>
+            <Field label="Fecha de firma">
+              <input
+                className="input"
+                type="date"
+                value={v.policyDate}
+                onChange={(e) => set("policyDate", e.target.value)}
+              />
+            </Field>
+            <Field label="Moneda">
+              <select
+                className="input select"
+                value={v.currency}
+                onChange={(e) => set("currency", e.target.value)}
+              >
+                <option value="MXN">MXN</option>
+                <option value="USD">USD</option>
+                <option value="EUR">EUR</option>
+              </select>
+            </Field>
+            <Field label="Prima neta">
+              <input
+                className="input"
+                type="number"
+                step="0.01"
+                value={v.netPremium}
+                onChange={(e) => set("netPremium", e.target.value)}
+              />
+            </Field>
+            <Field label="Total">
+              <input
+                className="input"
+                type="number"
+                step="0.01"
+                value={v.total}
+                onChange={(e) => set("total", e.target.value)}
+              />
+            </Field>
+            <Field label="Pago de prima">
+              <input
+                className="input"
+                value={v.premiumPayment}
+                onChange={(e) => set("premiumPayment", e.target.value)}
+              />
+            </Field>
+            <Field label="Dirección">
+              <input
+                className="input"
+                value={v.legalAddress}
+                onChange={(e) => set("legalAddress", e.target.value)}
+              />
+            </Field>
+            <Field label="C.P.">
+              <input
+                className="input"
+                value={v.zip}
+                onChange={(e) => set("zip", e.target.value)}
+              />
+            </Field>
+          </fieldset>
+
+          {doc.extractedCoveragesJson && doc.extractedCoveragesJson.length > 0 && (
+            <details>
+              <summary>
+                Coberturas ({doc.extractedCoveragesJson.length}) ·{" "}
+                {formatMoney(
+                  doc.extractedCoveragesJson
+                    .map((c) => Number(c.insuredAmount ?? 0))
+                    .reduce((a, b) => a + b, 0)
+                    .toString(),
+                  v.currency,
+                )}
+              </summary>
+              <table className="tx-table" style={{ marginTop: 8 }}>
+                <thead>
+                  <tr>
+                    <th>Riesgo</th>
+                    <th className="num">Suma</th>
+                    <th>Deducible</th>
+                    <th>Participación</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  {doc.extractedCoveragesJson.map((c, i) => (
+                    <tr key={i}>
+                      <td>{c.risk}</td>
+                      <td className="num">
+                        {formatMoney(c.insuredAmount?.toString() ?? null, v.currency)}
+                      </td>
+                      <td>{c.deductible ?? "—"}</td>
+                      <td>{c.lossParticipation ?? "—"}</td>
+                    </tr>
+                  ))}
+                </tbody>
+              </table>
+            </details>
+          )}
+
+          {candidates.length > 1 && (
+            <Field label="Póliza destino">
+              <select
+                className="input select"
+                value={policyId}
+                onChange={(e) => {
+                  setPolicyId(e.target.value);
+                  const found = candidates.find((c) => c.policyId === e.target.value);
+                  if (found) {
+                    setCustomerId(found.customerId);
+                    setCustomerName(customerIndex[found.customerId]?.name ?? found.customerName);
+                  }
+                }}
+              >
+                <option value="">— elegir póliza —</option>
+                {candidates.map((c) => (
+                  <option key={c.policyId} value={c.policyId}>
+                    {c.policyNumber} · {c.customerName}
+                  </option>
+                ))}
+              </select>
+            </Field>
+          )}
+
+          {!policyId && (
+            <Field label={matchedExisting ? "Cliente" : "Cliente (póliza nueva)"}>
+              <CustomerPicker
+                value={customerId}
+                valueName={customerName}
+                onPick={(id, name) => {
+                  setCustomerId(id);
+                  setCustomerName(name);
+                }}
+              />
+            </Field>
+          )}
+
+          <label className="field">
+            <input
+              type="checkbox"
+              checked={v.postPremium}
+              onChange={(e) => set("postPremium", e.target.checked)}
+              disabled={!v.netPremium || Number(v.netPremium) <= 0}
+            />{" "}
+            Registrar prima en el estado de cuenta
+          </label>
+
+          {err && <div className="state-box state-error">{err}</div>}
+
+          {!locked && canReview && (
+            <div className="row" style={{ gap: 8 }}>
+              <button type="button" className="btn btn-primary" disabled={busy} onClick={save}>
+                {busy ? "Guardando…" : "Guardar revisión"}
+              </button>
+              <button
+                type="button"
+                className="btn btn-ghost"
+                onClick={() => void onReject()}
+              >
+                Rechazar
+              </button>
+            </div>
+          )}
+        </div>
+      </div>
+    </article>
+  );
+}
+
+function Field({ label, children }: { label: string; children: React.ReactNode }) {
+  return (
+    <label className="field">
+      <span className="field-label">{label}</span>
+      {children}
+    </label>
+  );
+}

apps/web/src/components/StatementIntake.tsx

@@ -28,9 +28,16 @@ import type { ServiceKind, StatementBatch, StatementBatchStatus } from "@/lib/ty
  */
 
 /** The kinds the parsers actually recognise today. */
-const SUPPORTED: ServiceKind[] = ["ELECTRIC", "WATER", "TELEPHONE"];
+const SUPPORTED: ServiceKind[] = [
+  "ELECTRIC",
+  "WATER",
+  "TELEPHONE",
+  "GAS",
+  "PROPERTY_TAX",
+  "FEDERAL_ZONE",
+];
 /** Uploadable, but every page will land in review until a parser learns it. */
-const OTHER_KINDS: ServiceKind[] = ["GAS", "PROPERTY_TAX", "FEDERAL_ZONE", "CABLE"];
+const OTHER_KINDS: ServiceKind[] = ["CABLE"];
 
 const STATUS_LABEL: Record<StatementBatchStatus, string> = {
   UPLOADED: "Recibido",
@@ -38,6 +45,7 @@ const STATUS_LABEL: Record<StatementBatchStatus, string> = {
   READY_FOR_REVIEW: "Listo para revisar",
   COMPLETED: "Registrado",
   FAILED: "Falló",
+  DISCARDED: "Descartado",
 };
 
 export function StatementIntake() {

apps/web/src/lib/api.ts

@@ -27,6 +27,7 @@ import type {
   CreateBankInput,
   CreateBankMovementInput,
   CreateMovementInput,
+  DiscardBatchResult,
   UpdateBankAccountInput,
   ResolveOutstandingInput,
   ReviewDocumentInput,
@@ -49,6 +50,12 @@ import type {
   PolicySort,
   PolicyStats,
   PolicyStatus,
+  PolicyOcrBatch,
+  PolicyOcrBatchDetail,
+  PolicyOcrDocument,
+  PolicyOcrReviewInput,
+  PolicyOcrConfirmInput,
+  PolicyOcrConfirmResult,
   LookupsResponse,
   OpsJob,
   OpsJobKind,
@@ -101,7 +108,7 @@ export class ApiError extends Error {
   }
 }
 
-async function apiFetch<T>(
+export async function apiFetch<T>(
   path: string,
   init?: RequestInit,
 ): Promise<T> {
@@ -966,6 +973,293 @@ export function runReport(
   return apiFetch<ReportRunResult>(`/reports/${slug}${tail ? `?${tail}` : ""}`);
 }
 
+/* ------------------------------------------------- Mass email notifications */
+
+export type NotificationType =
+  | "OUTSTANDING_PAYMENT"
+  | "PAYMENT_CONFIRMATION"
+  | "ACCOUNT_STATUS"
+  | "TRUST_PAYMENT_CONFIRMATION"
+  | "RENEWAL_NOTICE";
+
+export type NotificationServicio = "CUSTOMERS" | "TRUST" | "POLICIES";
+
+/** Which servicios each /notificaciones tab reads out of the shared log. */
+export const SERVICIOS_LOG_SCOPE: NotificationServicio[] = ["CUSTOMERS", "TRUST"];
+export const POLIZAS_LOG_SCOPE: NotificationServicio[] = ["POLICIES"];
+
+export type NotificationStatus =
+  | "SENT"
+  | "FAILED"
+  | "SKIPPED_NO_EMAIL"
+  | "SKIPPED_GATE";
+
+export interface NotificationLogRow {
+  id: string;
+  sendDate: string;
+  notificationType: NotificationType;
+  level: number | null;
+  servicio: NotificationServicio;
+  customerId: string | null;
+  customerName: string;
+  customerEmail: string;
+  subject: string;
+  debug: boolean;
+  status: NotificationStatus;
+  providerMessageId: string | null;
+  error: string | null;
+}
+
+export interface NotificationLogPage {
+  items: NotificationLogRow[];
+  total: number;
+  page: number;
+  pageSize: number;
+  pageCount: number;
+}
+
+export interface NotificationStats {
+  byType: { notificationType: NotificationType; status: NotificationStatus; _count: { _all: number } }[];
+  byStatus: { status: NotificationStatus; _count: { _all: number } }[];
+  byServicio: { servicio: NotificationServicio; status: NotificationStatus; _count: { _all: number } }[];
+  lastRun: { sendDate: string; notificationType: NotificationType } | null;
+  transport: { available: boolean; devFallback: boolean };
+}
+
+export type NotificationFlags = {
+  debug?: boolean;
+  ignoreDayRestriction?: boolean;
+  useEmailLimit?: boolean;
+};
+
+/** Job 1 (Outstanding) response — legacy `result` field. */
+export interface OutstandingResponse {
+  result: "success";
+  notificationType: "sendPaymentConfirmation";
+  reason: string;
+  statusCode: 200;
+  sent: number;
+  skipped: number;
+  failed: number;
+  debug: boolean;
+  type: "OUTSTANDING_PAYMENT";
+}
+
+/** Job 2 (Payment Confirmation) response. */
+export interface PaymentConfirmResponse {
+  request: "success";
+  notificationType: "sendPaymentConfirmation";
+  confirmationSent: string;
+  statusCode: 200;
+  sent: number;
+  skipped: number;
+  failed: number;
+  debug: boolean;
+  type: "PAYMENT_CONFIRMATION";
+}
+
+/** Job 3 (Account Status) response. */
+export interface AccountStatusResponse {
+  request: "success";
+  notificationType: "sendAccountStatus";
+  statusSent: string;
+  statusReport: string;
+  statusCode: 200;
+  red: number;
+  yellow: number;
+  total: number;
+  sent: number;
+  skipped: number;
+  failed: number;
+  debug: boolean;
+  type: "ACCOUNT_STATUS";
+}
+
+/** Job 4 (Trust Confirmation) response. */
+export interface TrustConfirmResponse {
+  request: "success";
+  notificationType: "sendTrustPaymentConfirmation";
+  confirmationSent: string;
+  statusCode: 200;
+  sent: number;
+  skipped: number;
+  failed: number;
+  debug: boolean;
+  type: "TRUST_PAYMENT_CONFIRMATION";
+}
+
+export type NotificationJobResponse =
+  | OutstandingResponse
+  | PaymentConfirmResponse
+  | AccountStatusResponse
+  | TrustConfirmResponse;
+
+export function runOutstandingPayments(
+  flags: NotificationFlags = {},
+): Promise<OutstandingResponse> {
+  return apiFetch<OutstandingResponse>("/notifications/outstanding-payments", {
+    method: "POST",
+    body: JSON.stringify(flags),
+  });
+}
+
+export function runPaymentConfirmation(
+  flags: NotificationFlags = {},
+): Promise<PaymentConfirmResponse> {
+  return apiFetch<PaymentConfirmResponse>("/notifications/payment-confirmation", {
+    method: "POST",
+    body: JSON.stringify(flags),
+  });
+}
+
+export function runAccountStatus(
+  flags: NotificationFlags = {},
+): Promise<AccountStatusResponse> {
+  return apiFetch<AccountStatusResponse>("/notifications/account-status", {
+    method: "POST",
+    body: JSON.stringify(flags),
+  });
+}
+
+export function runTrustConfirmation(
+  flags: NotificationFlags = {},
+): Promise<TrustConfirmResponse> {
+  return apiFetch<TrustConfirmResponse>("/notifications/trust-payment-confirmation", {
+    method: "POST",
+    body: JSON.stringify(flags),
+  });
+}
+
+export type NotificationJobKind = "outstanding" | "payment" | "account" | "trust";
+
+export interface NotificationRunAllJobResult {
+  kind: NotificationJobKind;
+  ok: boolean;
+  result?: NotificationJobResponse;
+  error?: string;
+}
+
+/** Aggregate response of the "Ejecutar todos" sweep. */
+export interface NotificationRunAllResponse {
+  request: "success";
+  notificationType: "runAllNotifications";
+  statusCode: 200;
+  debug: boolean;
+  sent: number;
+  skipped: number;
+  failed: number;
+  errors: number;
+  jobs: NotificationRunAllJobResult[];
+  type: "RUN_ALL";
+}
+
+export function runAllNotifications(
+  flags: NotificationFlags = {},
+): Promise<NotificationRunAllResponse> {
+  return apiFetch<NotificationRunAllResponse>("/notifications/run-all", {
+    method: "POST",
+    body: JSON.stringify(flags),
+  });
+}
+
+export interface NotificationLogQuery {
+  page?: number;
+  pageSize?: number;
+  type?: NotificationType;
+  /** One or more servicios; omitted = the whole log. */
+  servicio?: NotificationServicio[];
+  status?: NotificationStatus;
+  view?: "sent" | "failed" | "skipped" | "all";
+}
+
+export function listNotificationLog(
+  q: NotificationLogQuery = {},
+): Promise<NotificationLogPage> {
+  const qs = new URLSearchParams();
+  if (q.page) qs.set("page", String(q.page));
+  if (q.pageSize) qs.set("pageSize", String(q.pageSize));
+  if (q.type) qs.set("type", q.type);
+  if (q.servicio?.length) qs.set("servicio", q.servicio.join(","));
+  if (q.status) qs.set("status", q.status);
+  if (q.view) qs.set("view", q.view);
+  const tail = qs.toString();
+  return apiFetch<NotificationLogPage>(`/notifications/log${tail ? `?${tail}` : ""}`);
+}
+
+/** Where a setting's current value came from — shown so an operator can tell
+ *  "nobody has set this, you are seeing the deploy's value" from "somebody
+ *  set this on purpose". */
+export type SettingSource = "db" | "env" | "default";
+
+export interface NotificationAdminEmails {
+  value: string[];
+  source: SettingSource;
+  updatedAt: string | null;
+  updatedById: string | null;
+}
+
+export function getNotificationAdminEmails(): Promise<NotificationAdminEmails> {
+  return apiFetch<NotificationAdminEmails>("/notifications/settings/admin-emails");
+}
+
+export function setNotificationAdminEmails(
+  emails: string[],
+): Promise<NotificationAdminEmails> {
+  return apiFetch<NotificationAdminEmails>("/notifications/settings/admin-emails", {
+    method: "PUT",
+    body: JSON.stringify({ emails }),
+  });
+}
+
+/* ----------------------------------------------------- envío scheduling */
+
+/** The two automatic envíos, one per /notificaciones tab. */
+export type ScheduleKind = "servicios" | "polizas";
+
+export interface NotificationSchedule {
+  enabled: boolean;
+  /** Local hour/minute in America/Tijuana. */
+  hour: number;
+  minute: number;
+  /** 0 = domingo … 6 = sábado. Vacío = todos los días. */
+  weekdays: number[];
+}
+
+export interface ResolvedSchedule {
+  value: NotificationSchedule;
+  source: SettingSource;
+  updatedAt: string | null;
+  updatedById: string | null;
+  /** Expression the value compiles to, shown verbatim in the UI. */
+  cron: string;
+  nextRun: string | null;
+}
+
+export type NotificationSchedules = Record<ScheduleKind, ResolvedSchedule>;
+
+export function getNotificationSchedules(): Promise<NotificationSchedules> {
+  return apiFetch<NotificationSchedules>("/notifications/settings/schedule");
+}
+
+export function setNotificationSchedule(
+  kind: ScheduleKind,
+  schedule: NotificationSchedule,
+): Promise<ResolvedSchedule> {
+  return apiFetch<ResolvedSchedule>(`/notifications/settings/schedule/${kind}`, {
+    method: "PUT",
+    body: JSON.stringify(schedule),
+  });
+}
+
+export function getNotificationStats(
+  servicio?: NotificationServicio[],
+): Promise<NotificationStats> {
+  const tail = servicio?.length
+    ? `?servicio=${encodeURIComponent(servicio.join(","))}`
+    : "";
+  return apiFetch<NotificationStats>(`/notifications/stats${tail}`);
+}
+
 /** Build a download URL for a report's file output. The session cookie
  *  travels with the browser's same-origin navigation, so a plain `href`
  *  is enough — no fetch-with-credentials dance. */
@@ -1073,7 +1367,110 @@ export function confirmStatementBatch(
   });
 }
 
+/** Abandon a batch pending review; rejects every page that is not posted. */
+export function discardStatementBatch(batchId: string): Promise<DiscardBatchResult> {
+  return apiFetch(`/statements/batches/${batchId}/discard`, { method: "POST" });
+}
+
 /** The rendered page image. A plain <img src> — the cookie rides along. */
 export function statementPageUrl(documentId: string): string {
   return `${API_ORIGIN}/statements/documents/${documentId}/page`;
 }
+
+/* ----------------------------------------------------- Policy OCR (GMX) */
+
+export function getPolicyOcrStatus(): Promise<{
+  ocrAvailable: boolean;
+  storageAvailable: boolean;
+}> {
+  return apiFetch("/policy-ocr/status");
+}
+
+export function listPolicyOcrBatches(
+  page = 1,
+  pageSize = 25,
+): Promise<{
+  items: PolicyOcrBatch[];
+  total: number;
+  page: number;
+  pageSize: number;
+  pageCount: number;
+}> {
+  return apiFetch(`/policy-ocr/batches?page=${page}&pageSize=${pageSize}`);
+}
+
+export function getPolicyOcrBatch(id: string): Promise<PolicyOcrBatchDetail> {
+  return apiFetch(`/policy-ocr/batches/${id}`);
+}
+
+export function listPolicyOcrDocuments(batchId: string): Promise<PolicyOcrDocument[]> {
+  return apiFetch(`/policy-ocr/batches/${batchId}/documents`);
+}
+
+export async function uploadPolicyOcrBatch(
+  files: File[],
+  label?: string,
+): Promise<PolicyOcrBatch> {
+  const body = new FormData();
+  for (const f of files) body.append("files", f, f.name);
+  const qs = new URLSearchParams();
+  if (label) qs.set("label", label);
+
+  const res = await fetch(
+    `${API_ORIGIN}/policy-ocr/batches${qs.toString() ? `?${qs}` : ""}`,
+    {
+      method: "POST",
+      credentials: "include",
+      body,
+    },
+  );
+  if (!res.ok) {
+    let message = `Error ${res.status}`;
+    try {
+      const b = await res.json();
+      if (b?.message) message = b.message;
+    } catch {
+      /* non-JSON error body */
+    }
+    throw new Error(message);
+  }
+  return res.json();
+}
+
+export function reviewPolicyOcrDocument(
+  id: string,
+  input: PolicyOcrReviewInput,
+): Promise<PolicyOcrDocument> {
+  return apiFetch(`/policy-ocr/documents/${id}`, {
+    method: "PATCH",
+    body: JSON.stringify(input),
+  });
+}
+
+export function rejectPolicyOcrDocument(id: string): Promise<PolicyOcrDocument> {
+  return apiFetch(`/policy-ocr/documents/${id}/reject`, { method: "POST" });
+}
+
+export function confirmPolicyOcrBatch(
+  batchId: string,
+  input: PolicyOcrConfirmInput,
+): Promise<PolicyOcrConfirmResult> {
+  return apiFetch(`/policy-ocr/batches/${batchId}/confirm`, {
+    method: "POST",
+    body: JSON.stringify(input),
+  });
+}
+
+/** Abandon a batch pending review; rejects every page that is not applied. */
+export function discardPolicyOcrBatch(batchId: string): Promise<DiscardBatchResult> {
+  return apiFetch(`/policy-ocr/batches/${batchId}/discard`, { method: "POST" });
+}
+
+/**
+ * URL for the source PDF of a parsed policy document. The endpoint returns
+ * the original upload (one PDF = one parsed policy), not a rendered page
+ * image, so the review screen embeds it in an iframe.
+ */
+export function policyOcrDocumentUrl(documentId: string): string {
+  return `${API_ORIGIN}/policy-ocr/documents/${documentId}/page`;
+}

apps/web/src/lib/labels.ts

@@ -379,3 +379,59 @@ export function sourceSystemLabel(source: string): string {
   };
   return map[source] ?? source;
 }
+
+// ----- Mass email notifications -----
+
+import type {
+  NotificationStatus,
+  NotificationType,
+  NotificationServicio,
+} from "./api";
+
+export const NOTIFICATION_TYPE_LABELS: Record<NotificationType, string> = {
+  OUTSTANDING_PAYMENT: "Pagos pendientes",
+  PAYMENT_CONFIRMATION: "Confirmación de pago",
+  ACCOUNT_STATUS: "Estado de cuenta",
+  TRUST_PAYMENT_CONFIRMATION: "Confirmación fideicomiso",
+  RENEWAL_NOTICE: "Aviso de renovación",
+};
+
+export const NOTIFICATION_SERVICIO_LABELS: Record<NotificationServicio, string> = {
+  CUSTOMERS: "Clientes",
+  TRUST: "Fideicomiso",
+  POLICIES: "Pólizas",
+};
+
+/**
+ * The `level` column means something different per notification type, so it
+ * can only be read alongside one. ACCOUNT_STATUS uses it for the alert colour;
+ * RENEWAL_NOTICE for the aviso generation. Everything else leaves it null.
+ */
+export function notificationLevelLabel(
+  type: NotificationType,
+  level: number | null,
+): string {
+  if (level === null) return "";
+  if (type === "ACCOUNT_STATUS") return level === 0 ? " (amarilla)" : " (roja)";
+  if (type === "RENEWAL_NOTICE") {
+    if (level === 1) return " (1.º, 30 días antes)";
+    if (level === 2) return " (2.º, 15 días antes)";
+    if (level === 3) return " (3.º, 7 días después)";
+    return ` (aviso ${level})`;
+  }
+  return "";
+}
+
+export const NOTIFICATION_STATUS_LABELS: Record<NotificationStatus, string> = {
+  SENT: "Enviado",
+  FAILED: "Falló",
+  SKIPPED_NO_EMAIL: "Sin email",
+  SKIPPED_GATE: "Fuera de día",
+};
+
+export const NOTIFICATION_STATUS_COLORS: Record<NotificationStatus, string> = {
+  SENT: "var(--positive)",
+  FAILED: "var(--negative)",
+  SKIPPED_NO_EMAIL: "var(--muted)",
+  SKIPPED_GATE: "var(--muted-2)",
+};

apps/web/src/lib/types.ts

@@ -12,6 +12,9 @@ export type Ability =
   | "policy:create"
   | "policy:update"
   | "policy:delete"
+  | "policy:ingest"
+  | "policy:ocr-review"
+  | "renewal:send"
   | "property:create"
   | "property:update"
   | "property:delete"
@@ -24,7 +27,9 @@ export type Ability =
   | "statement:review"
   | "lookup:manage"
   | "user:manage"
-  | "db:manage";
+  | "db:manage"
+  | "notification:send"
+  | "setting:manage";
 
 export interface AuthUser {
   id: string;
@@ -961,6 +966,7 @@ export interface CustomerDetail {
   mobile: string | null;
   fax: string | null;
   email: string | null;
+  emailOptOut: boolean;
   notes: string | null;
   identificationType: string | null;
   identificationNumber: string | null;
@@ -991,6 +997,7 @@ export interface CustomerInput {
   mobile?: string;
   fax?: string;
   email?: string;
+  emailOptOut?: boolean;
   notes?: string;
   identificationType?: string;
   identificationNumber?: string;
@@ -1215,7 +1222,9 @@ export type StatementBatchStatus =
   | "PROCESSING"
   | "READY_FOR_REVIEW"
   | "COMPLETED"
-  | "FAILED";
+  | "FAILED"
+  /** Abandoned by staff before anything was posted. */
+  | "DISCARDED";
 
 export type StatementDocumentStatus =
   | "PENDING_OCR"
@@ -1293,3 +1302,148 @@ export interface ConfirmBatchResult {
   total: string;
   checkNumber: string;
 }
+
+/** Shared by both OCR domains: how many pages the discard rejected. */
+export interface DiscardBatchResult {
+  batchId: string;
+  rejected: number;
+}
+
+/* ------------------------------------------ Policy OCR intake (GMX) */
+
+export type PolicyOcrBatchStatus =
+  | "UPLOADED"
+  | "PROCESSING"
+  | "READY_FOR_REVIEW"
+  | "COMPLETED"
+  | "FAILED"
+  /** Abandoned by staff before anything was applied. */
+  | "DISCARDED";
+
+export type PolicyOcrDocumentStatus =
+  | "PENDING_OCR"
+  | "OCR_FAILED"
+  | "NEEDS_REVIEW"
+  | "MATCHED"
+  | "CONFIRMED"
+  | "POSTED"
+  | "REJECTED";
+
+export interface PolicyOcrBatch {
+  id: string;
+  provider: string;
+  status: PolicyOcrBatchStatus;
+  label: string | null;
+  fileCount: number;
+  error: string | null;
+  createdAt: string;
+  completedAt: string | null;
+  uploadedBy?: { name: string };
+  _count?: { documents: number };
+}
+
+export interface PolicyOcrBatchDetail extends PolicyOcrBatch {
+  byStatus: Partial<Record<PolicyOcrDocumentStatus, number>>;
+}
+
+export interface PolicyOcrCoverage {
+  risk: string;
+  insuredAmount: number | null;
+  deductible: string | null;
+  lossParticipation: string | null;
+}
+
+export interface PolicyOcrMatchCandidate {
+  policyId: string;
+  customerId: string;
+  customerName: string;
+  policyNumber: string;
+}
+
+export interface PolicyOcrDocument {
+  id: string;
+  pageNumber: number;
+  status: PolicyOcrDocumentStatus;
+  provider: string | null;
+  ocrConfidence: string | null;
+  extractedPolicyNumber: string | null;
+  extractedInsuredName: string | null;
+  extractedAdditionalInsured: string | null;
+  extractedAgentName: string | null;
+  extractedLegalAddress: string | null;
+  extractedZip: string | null;
+  extractedPolicyFrom: string | null;
+  extractedPolicyTo: string | null;
+  extractedPolicyDate: string | null;
+  extractedCurrency: string | null;
+  extractedNetPremium: string | null;
+  extractedPolicyFee: string | null;
+  extractedBrokerFee: string | null;
+  extractedTotal: string | null;
+  extractedCoveragesJson: PolicyOcrCoverage[] | null;
+  extractedPremiumPayment: string | null;
+  matchedPolicy: {
+    id: string;
+    policyNumber: string | null;
+    customerId: string;
+    customer: { name: string };
+  } | null;
+  matchedCustomer: { id: string; name: string } | null;
+  matchCandidates: PolicyOcrMatchCandidate[] | null;
+  matchNote: string | null;
+}
+
+export interface PolicyOcrReviewInput {
+  policyNumber?: string;
+  insuredName?: string;
+  additionalInsured?: string;
+  agentName?: string;
+  legalAddress?: string;
+  zip?: string;
+  policyFrom?: string;
+  policyTo?: string;
+  policyDate?: string;
+  currency?: string;
+  netPremium?: number;
+  policyFee?: number;
+  brokerFee?: number;
+  total?: number;
+  premiumPayment?: string;
+  coveragesJson?: PolicyOcrCoverage[];
+  matchedPolicyId?: string;
+  matchedCustomerId?: string;
+  forceConfirm?: boolean;
+}
+
+export interface PolicyOcrConfirmDocument {
+  documentId: string;
+  policyId?: string;
+  customerId?: string;
+  policyNumber?: string;
+  insuredName?: string;
+  additionalInsured?: string;
+  agentName?: string;
+  legalAddress?: string;
+  zip?: string;
+  policyFrom?: string;
+  policyTo?: string;
+  policyDate?: string;
+  currency?: string;
+  netPremium?: number;
+  policyFee?: number;
+  brokerFee?: number;
+  total?: number;
+  premiumPayment?: string;
+  coveragesJson?: PolicyOcrCoverage[];
+  postPremium?: boolean;
+}
+
+export interface PolicyOcrConfirmInput {
+  documents: PolicyOcrConfirmDocument[];
+}
+
+export interface PolicyOcrConfirmResult {
+  applied: number;
+  policies: string[];
+  postedTransactions: number;
+}

deploy/galactus/jorgecuadros-app.compose.yml

@@ -73,6 +73,25 @@ services:
       S3_BUCKET: ${S3_BUCKET:-jorgecuadros-documents}
       MINIO_ROOT_USER: ${MINIO_ROOT_USER:?MINIO_ROOT_USER must be set}
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD must be set}
+      # Outbound mail (SES). Runtime config — read at container boot, never
+      # baked into the image; the build does not send mail, this container
+      # does. Values arrive the same way DATABASE_URL does: as Gitea repo
+      # secrets, injected into this stack's env by the `env_data` block of
+      # .gitea/workflows/deploy-galactus.yml.
+      #
+      # The image sets NODE_ENV=production, which disables MailService's
+      # stdout dev fallback: leave these blank and every notification and
+      # renewal aviso fails with "El envío de correo no está configurado."
+      # rather than silently going nowhere.
+      SES_REGION: ${SES_REGION:-}
+      SES_FROM: ${SES_FROM:-}
+      SES_FROM_NAME: ${SES_FROM_NAME:-}
+      SES_ACCESS_KEY: ${SES_ACCESS_KEY:-}
+      SES_SECRET_KEY: ${SES_SECRET_KEY:-}
+      SES_CONFIGURATION_SET: ${SES_CONFIGURATION_SET:-}
+      # Who gets the per-job summary mail. Falls back to the two hardcoded
+      # defaults in NotificationsService when unset.
+      NOTIFICATION_ADMIN_EMAILS: ${NOTIFICATION_ADMIN_EMAILS:-}
     ports:
       - "${API_PORT:-3001}:3001"
     volumes:

deploy/jorgecuadros-app.env.example

@@ -32,3 +32,32 @@ S3_ENDPOINT=http://192.168.4.212:9000
 S3_BUCKET=jorgecuadros-documents
 MINIO_ROOT_USER=jc_minio
 MINIO_ROOT_PASSWORD=CHANGE_ME
+
+# --- Outbound mail (Amazon SES) ----------------------------------------------
+# NOTE: for the Portainer-deployed stacks these do NOT come from a file on the
+# host — the deploy workflows build the stack env from Gitea repo secrets (see
+# the `env_data` blocks in .gitea/workflows/deploy*.yml). This file documents
+# the full variable set and is what you fill in for a hand-run stack.
+#
+# Either way they are RUNTIME config, read at container boot
+# (apps/api/src/mail/mail.service.ts) — never baked into the image.
+#
+# The production image sets NODE_ENV=production, which turns OFF the stdout dev
+# fallback. Leaving these blank does not silently swallow mail — every send
+# fails with "El envío de correo no está configurado.", and the failure is
+# recorded in the notification log. Fill them in before enabling any envío.
+#
+# SES_FROM must be a verified SES sending identity.
+SES_REGION=us-west-2
+SES_FROM=mail@jorgecuadros.com
+SES_FROM_NAME=Information Server
+SES_ACCESS_KEY=
+SES_SECRET_KEY=
+# Optional — only needed to publish bounce/complaint events.
+SES_CONFIGURATION_SET=
+
+# Recipients of the per-job summary email. NOW EDITABLE IN THE UI
+# (/notificaciones > Servicios > "Destinatarios del resumen", ADMIN only), so
+# this is only the fallback for a deployment where nobody has set it there.
+# A saved value takes precedence and this var is ignored from then on.
+NOTIFICATION_ADMIN_EMAILS=rmancinas@freakma.net,mpulido@freakma.net

deploy/jorgecuadros-app.stack.yml

@@ -55,6 +55,14 @@ services:
       S3_BUCKET: ${S3_BUCKET:-jorgecuadros-documents}
       MINIO_ROOT_USER: ${MINIO_ROOT_USER:?MINIO_ROOT_USER must be set}
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD must be set}
+      # Outbound mail (SES) — runtime config, not a build-time CI secret.
+      SES_REGION: ${SES_REGION:-}
+      SES_FROM: ${SES_FROM:-}
+      SES_FROM_NAME: ${SES_FROM_NAME:-}
+      SES_ACCESS_KEY: ${SES_ACCESS_KEY:-}
+      SES_SECRET_KEY: ${SES_SECRET_KEY:-}
+      SES_CONFIGURATION_SET: ${SES_CONFIGURATION_SET:-}
+      NOTIFICATION_ADMIN_EMAILS: ${NOTIFICATION_ADMIN_EMAILS:-}
     ports:
       - target: 3001
         published: ${API_PORT:-3001}

docs/BACKLOG.md

@@ -0,0 +1,217 @@
+# Backlog — what is pending, missing, and not yet built
+
+One place for work that is known-outstanding. Compiled 2026-08-02 from
+`PLAN.md`, `RESUME.md`, the four specs and the two OCR docs, then **checked
+against the code and the dev database** rather than trusted — several items in
+those documents had already been closed, and two defects they describe are
+still live.
+
+This file is an index, not a replacement. Each item points at the document that
+carries the reasoning. Close an item *there* as well as here, or the two drift.
+
+**Verified against dev at compile time** (re-run before trusting the numbers):
+
+```
+policy_types: AUTO, LICENCIAS, MULT
+policies NULL policyTypeId: 5
+policies pending liquidación: 226
+customers: 1536
+last tag: v1.0.6 (2026-08-02 02:06 UTC) — 14 commits, 5 migrations behind HEAD
+```
+
+---
+
+## 0. Ship-blocked — read before the next deploy
+
+**Everything from the notificaciones arc is unreleased.** `v1.0.6` predates it.
+Five migrations are waiting:
+
+```
+20260801120000_ocr_batch_discarded
+20260801130000_renewal_email_notifications
+20260801200000_mass_email_notifications
+20260802120000_renewal_notices_unified_log
+20260802140000_app_settings
+```
+
+Plus three backup-pipeline fixes that have never reached prod (`860d483`,
+`567b033`, `898cf48` — the last prod run went green through the whole chain and
+died on the final step wanting `deploy/.env.prod`).
+
+> ### `SES_*` secrets created in Gitea 2026-08-02 — unblocked, unverified
+>
+> The variables were wired through both deploy workflows and the app stack but
+> had never been set. **They now exist.** What that clears: the production
+> image runs `NODE_ENV=production`, which disables the stdout dev fallback, so
+> a blank config made every send fail and log `FAILED` — and the pólizas sweep
+> defaults to **enabled, 06:00 America/Tijuana**, so the failure would have
+> repeated nightly.
+>
+> **Not yet confirmed, and the first deploy is what confirms it:**
+>
+> 1. **Names match.** The preflight checks `SES_REGION`, `SES_FROM`,
+>    `SES_ACCESS_KEY`, `SES_SECRET_KEY` and warns by name if any is blank —
+>    read that warning on the next run. No `_GALACTUS` suffix on any of them;
+>    one SES identity serves every deployment.
+> 2. **`SES_FROM` is a verified identity in `SES_REGION`.** An unverified
+>    sender is rejected per-send, which looks identical to a missing config in
+>    the log.
+> 3. **The AWS account is out of the SES sandbox.** This is the one that would
+>    hurt: in sandbox, SES only delivers to *verified* recipients, so a renewal
+>    sweep across 815 policyholders would fail almost every send while the
+>    config looks entirely correct. Check before letting a real sweep run.
+>
+> Until 2 and 3 are confirmed, run the first sweep with `debug` on — it diverts
+> every recipient to the override inbox, and on the pólizas side it also leaves
+> the avisos pending, so nothing is consumed by a failed test. See
+> [`MASS_EMAIL_NOTIFICATIONS.md`](MASS_EMAIL_NOTIFICATIONS.md) "Send flags".
+
+Also outstanding on the deploy path: every pre-existing database still needs
+its one-time `prisma migrate resolve --applied 0000_init`.
+
+---
+
+## 1. Blocked on a decision from Jorge
+
+Nothing here is a build problem. Each one makes the work either impossible or a
+guess.
+
+| # | Question | Blocks | Source |
+|---|---|---|---|
+| 1.1 | What "garantías" refers to | §2 liquidación's exclusion filter | INSURANCE §2 |
+| 1.2 | What "Solicitud Atlas" is — application form or certificate | §3 entirely | INSURANCE §3 |
+| 1.3 | Carrier API **direction**: outbound quote/issue (ANA supports today) or inbound portfolio sync (no evidence either carrier offers it) | whether §4 is buildable at all | INSURANCE §4 |
+| 1.4 | CFE amount: the rounded barcode figure (`$268`, what is paid at the window) or the exact breakdown total (`$268.88`) | the parser currently takes the barcode | STATEMENT_OCR / RECEIPT §2 |
+| 1.5 | The Seguros USD bank's name, currency and details | multi-bank is built; that account does not exist yet | RECEIPT §3 |
+| 1.6 | Recycling triggers — exact "1 year inactive" / "cancelled" definitions, and whether recycling ever means true data purge | §4 recycling | RECEIPT §4 |
+| 1.7 | Notice body in Spanish or English | `Customer` carries no language preference | INSURANCE §1 |
+| 1.8 | How to model `TRASPASOS PAYPAL` — a clearing account, not a customer, carrying −7.03M MXN over 309 movements and therefore topping the adeudo worklist | deliberately not special-cased in code | RESUME §6 |
+| 1.9 | The 78 policyholders with no email — skip silently or produce a print worklist | recommendation is the worklist | INSURANCE §1 |
+
+1.3 also needs the practical half: WSDL + credentials for
+`server.anaseguros.com.mx/ananetws/service.asmx`, whether a cartera download
+exists for an agent's own book, whether GMX daños has any machine interface at
+all, and whether one Grupo Valore credential spans both carriers. All four go
+in the same phone call — (55) 5480-4000.
+
+---
+
+## 2. Live data defects — open, and confirmed open today
+
+### 2.1 `policy_types` is missing `INCENDIO` and `M_EMPR`, and 5 policies are orphaned
+
+`policyTypeId` is `String?` with a plain relation, so Prisma's default is
+`SetNull`. The spec's recommended `onDelete: Restrict` was **never applied**.
+Five `m_empr` policies lost their ramo; four of them are pending liquidación
+and are invisible to every ramo-filtered query — including the pending report
+§2 is supposed to produce.
+
+Fix alongside the liquidación work (3.1), since it distorts that feature's own
+report. Source: INSURANCE "Two defects found while verifying this spec".
+
+### 2.2 ≤41 MULT second settlements were dropped in migration
+
+`MULT`/`INCENDIO` carry two settlement slots and `M EMPR` carries four; `Policy`
+collapses to one. Spec recommends moving settlement onto
+`PolicyPaymentInstallment` rather than adding a second slot. Open sub-question:
+whether to backfill the lost rows.
+
+### 2.3 Three dead tables
+
+`EmailTemplate`, `EmailCampaign` and `EmailLog` exist in the schema with
+**zero references anywhere in `apps/api/src` or `apps/web/src`**. They were
+scaffolded for plan step 10's "email campaigns"; notificaciones shipped against
+`email_notification_log` instead. Either wire them or drop them — a schema that
+carries tables nothing writes teaches the next reader the wrong thing.
+
+---
+
+## 3. Spec'd, not built
+
+| # | Item | State | Source |
+|---|---|---|---|
+| 3.1 | **Liquidación batch workflow** | ~70% of the fields already wired end to end. **226 policies pending.** Needs the ramo-parameterized pending report + `POST /policies/liquidate-batch` under a new `policy:liquidate` (MANAGER). Smallest remaining piece of step 12 | INSURANCE §2 |
+| 3.2 | **Certificate rendering** | The report half is buildable now off the same `format: "letter"` machinery as `aviso-renovacion`. Portal delivery waits on steps 8/9. Whole section waits on 1.2 | INSURANCE §3 |
+| 3.3 | **Carrier API integration** | Blocked on 1.3. ANA's SOAP service is real with a known operation list; GMX publishes nothing machine-readable and writes the larger half of this book | INSURANCE §4 |
+| 3.4 | **Customer-number recycling** | Not started. `Customer.customerNumber` **does not exist in the schema**. Backfill needs care: ~140 utilities rows and all insurance-only customers carry synthetic `rownum_N`/`insrow_N` placeholders, not real `NUM id`s. Last unbuilt piece of step 11 | RECEIPT §4 |
+
+Note 3.3 partly overlaps what [`POLICY_OCR.md`](POLICY_OCR.md) already does —
+an OCR path that turns a carrier PDF into a `Policy` row covers some of what
+the API was wanted for, and unlike the API it is not waiting on a phone call.
+
+---
+
+## 4. Roadmap steps with no spec
+
+| # | Item | State |
+|---|---|---|
+| 4.1 | **Step 8 — VPS provisioning** | Not started. Provider undecided (Hetzner vs DigitalOcean), size, Tailscale + MySQL replica. Pure ops; the design is settled. RESUME calls this *the only genuinely blocking item left on the roadmap* |
+| 4.2 | **Step 9 — sync worker** | Not built. Unblocked now that `utility_dbo` and the portal code are on disk, but depends on 4.1. Portal write points to poll: `peticion_gas`, PayPal payments, `notifications_settings`, `verification_codes` |
+| 4.3 | **Step 10 — reports / campaigns / admin** | Mostly done by other work. `/reportes` exists; "email campaigns" landed as `/notificaciones` against a different table (see 2.3) |
+| 4.4 | **Phase B sync in production** | Verified 32/32 against dev, never run from the `/operaciones` UI (the `OpsService` path) nor against a prod-shaped database |
+
+---
+
+## 5. Gaps in features that already shipped
+
+Each of these is a known, deliberate stopping point rather than a bug.
+
+**Notificaciones** — [`MASS_EMAIL_NOTIFICATIONS.md`](MASS_EMAIL_NOTIFICATIONS.md)
+- No multi-replica lock on the servicios sweep (pólizas has one via
+  `scheduled_job_states`). Safe only while the deployment stays single-replica.
+- No per-recipient preview of a sent body in the UI.
+- No SNS bounce/complaint webhook. `providerMessageId` is captured so one can
+  be added.
+- No `SKIPPED_NO_EMAIL` worklist (see 1.9).
+
+**Policy OCR** — [`POLICY_OCR.md`](POLICY_OCR.md)
+- **GMX only.** The dispatcher is a `[provider, pattern]` table plus a parser
+  map, so a second carrier is one function and two entries — but no other
+  layout has been seen, and guessing produces a parser nobody can verify.
+- **The `recibo` PDF is unread.** The GMX certificate carries no premium at
+  all; reading the separate receipt and pairing it to its certificate is what
+  would let `postPremium` stop being a manual tick.
+- **No versioning.** A re-issued policy arrives as a new certificate with the
+  same number and confirm updates the existing row. Nothing records that this
+  is the 2027 issue of that policy.
+
+**Statement OCR** — [`STATEMENT_OCR.md`](STATEMENT_OCR.md)
+- **CFE / CESPT / Telnor have no unit suite.** They predate the gas/predial
+  extension and were verified end to end against the 46-page corpus only.
+  Close this if those parsers are ever touched.
+- No way to re-run a corrected parser over a stored batch, though the source
+  PDFs are kept precisely so it is possible.
+- Handwritten folder numbers are deliberately not an input to matching
+  (Tesseract read `405` as `205`).
+
+**Bank** — the concept→ramo classifier is **won't-build**, not pending.
+`concepto` is a payee name (0 of 22,354 match a category) and TABLA RAMODOS is
+a property-management expense chart, not the business-line split it was assumed
+to be. `/banco` intentionally has no category dimension. Recorded here only
+because `bank_transactions.categoryId` being null on every row otherwise reads
+as unfinished work.
+
+---
+
+## 6. Security / hygiene
+
+- **The old repo's `dbConnection.php` has a plaintext MySQL password committed
+  to git history.** Not carried into this platform, but the credential is
+  already exposed and has not been rotated. Rotate regardless of this repo.
+- The pre-migrate backup step sets `NODE_TLS_REJECT_UNAUTHORIZED=0` because
+  Portainer serves a self-signed certificate. Scoped to that one step; the real
+  fix is replacing the certificate.
+
+---
+
+## Source documents
+
+| Document | What it carries |
+|---|---|
+| [`../PLAN.md`](../PLAN.md) | build sequencing, locked decisions, per-step status |
+| [`../RESUME.md`](../RESUME.md) | session history and §6 open items |
+| [`INSURANCE_FEATURES_SPEC.md`](INSURANCE_FEATURES_SPEC.md) | §1 renewal emails (built), §2 liquidación, §3 certificate, §4 carrier APIs |
+| [`RECEIPT_CAPTURE_SPEC.md`](RECEIPT_CAPTURE_SPEC.md) | §1 Editor (built), §2 OCR (built), §3 multi-bank (built), §4 recycling |
+| [`MASS_EMAIL_NOTIFICATIONS.md`](MASS_EMAIL_NOTIFICATIONS.md) | mass email + schedules, as built |
+| [`STATEMENT_OCR.md`](STATEMENT_OCR.md) · [`POLICY_OCR.md`](POLICY_OCR.md) | the two OCR intakes, as built |
+| [`DEPLOY_AND_MIGRATIONS.md`](DEPLOY_AND_MIGRATIONS.md) | release chain, galactus, known caveats |

docs/DEPLOY_AND_MIGRATIONS.md

@@ -325,3 +325,20 @@ backup does them (see `deploy/scripts/pre-migrate-backup.mjs`):
 - `bootstrap: true` lets the pre-migrate backup be skipped when no API container
   exists yet. Use it for a first-ever deploy only — it is the one switch that
   lets a migration run with no restore point.
+- **The API container sends mail on a timer.** Two sweeps run inside it
+  (renewal avisos, on by default at 06:00 America/Tijuana; the servicios
+  run-all, off by default) — see
+  [`MASS_EMAIL_NOTIFICATIONS.md`](MASS_EMAIL_NOTIFICATIONS.md). Two
+  consequences for deploys: the cadence lives in `app_settings`, so it
+  **survives a redeploy and is not restored by rolling back an image**, and
+  running more than one API replica would double-fire the servicios sweep,
+  which has no DB lock (the pólizas one does). Keep it single-replica.
+- `SES_*` is optional to deploy — the preflight only warns — but the production
+  image sets `NODE_ENV=production`, which disables the stdout dev fallback. A
+  blank SES config therefore makes every send fail and log `FAILED`. The
+  secrets were created 2026-08-02; the preflight warning on the next run is
+  what confirms the names are right. Two things it cannot check: that
+  `SES_FROM` is a **verified identity** in `SES_REGION`, and that the account
+  is **out of the SES sandbox** (in sandbox, delivery is restricted to verified
+  recipients, which would fail a real sweep while looking correctly
+  configured).

docs/INSURANCE_FEATURES_SPEC.md

@@ -11,6 +11,15 @@ Companion doc: [`RECEIPT_CAPTURE_SPEC.md`](RECEIPT_CAPTURE_SPEC.md) covers the
 Utility Management half of the same meeting (PLAN.md step 11). This doc is the
 insurance half (PLAN.md step 12).
 
+> **A fifth insurance feature exists that this spec never proposed.**
+> [`POLICY_OCR.md`](POLICY_OCR.md) — OCR capture of carrier policy PDFs into
+> `Policy` rows, built 2026-08-01. It came out of the *utility* statement OCR
+> work in [`RECEIPT_CAPTURE_SPEC.md`](RECEIPT_CAPTURE_SPEC.md) §2, not from
+> this meeting, which is why it is documented on its own rather than folded in
+> here. It is relevant to §4: an OCR path that turns a carrier PDF into a
+> `Policy` row already covers part of what a carrier API was wanted for, and
+> unlike the API it is not blocked on Grupo Valore returning a phone call.
+
 ## Why these four features are one spec
 
 The meeting produced four insurance asks. They are specified together because
@@ -199,6 +208,35 @@ recycling backfill that consulted `UTILSEG` would merge unrelated people.
 
 ## 1. Renewal notification emails
 
+> **BUILT — 2026-08-01, extended 2026-08-02.** `apps/api/src/renewals/`
+> (sweep, `sendOne`, the `scheduled_job_states` lock) plus
+> `apps/api/src/mail/` (SES). Web: the **Pólizas** tab of `/notificaciones`;
+> `/renovaciones` is an alias that lands on it. Ability `renewal:send`
+> (MANAGER), as specced.
+>
+> Three things in the sections below were **superseded**, each noted inline:
+>
+> - **§1.1** — the `@Cron("0 6 * * *")` literal is gone. Both this sweep and
+>   the servicios jobs take their cadence from `NotificationScheduleService`,
+>   which stores it in `app_settings` and reinstalls the job on save. The
+>   default is still 06:00 daily, so behaviour is unchanged until an operator
+>   edits it. See [`MASS_EMAIL_NOTIFICATIONS.md`](MASS_EMAIL_NOTIFICATIONS.md),
+>   "Scheduled runs".
+> - **§1.4 manual mark-as-sent — dropped, deliberately.** Sending from the
+>   list is what marks a notice sent; there is no way to claim a letter went
+>   out when no mail was sent. `RenewalNoticeChannel.MAIL` still exists for a
+>   future paper path, but nothing writes it.
+> - **The send log is not renewal-specific.** Every attempt — including the
+>   failures and no-email skips a `RenewalNotice` row cannot represent — also
+>   writes `email_notification_log` as `RENEWAL_NOTICE` / `POLICIES`, shared
+>   with the four bulk jobs. `RenewalNotice` stays the *gating* state; the log
+>   is *history*.
+>
+> Also added 2026-08-02: the platform-wide `debug` flag reaches this path. A
+> debug send diverts the mail, skips the `RenewalNotice` upsert **and** does
+> not advance `lastSuccessfulAt` — see that doc's "Send flags" for why all
+> three are required together.
+
 ### What Jorge asked for
 
 Automatic notice to the customer at **30 days before expiry, 15 days before,
@@ -223,6 +261,13 @@ and 7 days after** — replacing the manual monthly run of the legacy
 
 ### 1.1 The scheduler
 
+> **Superseded — the cadence is operator-editable, not a literal.**
+> `RenewalsService` registers its handler with `NotificationScheduleService`
+> in `onModuleInit`; that service compiles the stored
+> `{hour, minute, weekdays}` to a cron expression and installs it in
+> `SchedulerRegistry`. Default `0 6 * * *` / `America/Tijuana`, i.e. exactly
+> what the literal below did. The rest of this section still holds.
+
 Add `@nestjs/schedule`. One `@Cron` job, daily, early morning local time.
 
 ```
@@ -302,6 +347,12 @@ traced back to the notice that caused it. (`notes` stays free-text for staff.)
 
 ### 1.4 Manual mark-as-sent
 
+> **Not built, and deliberately so.** A button that marks a notice sent
+> without sending anything is a button that lets the list claim a customer
+> was told when they were not — the exact failure the log exists to make
+> visible. `POST /renewals/send` replaced it: sending *is* the marking.
+> Revisit only when a real paper-mail workflow exists to record.
+
 The `aviso-renovacion` doc comment (`reports.registry.ts:617-621`) already
 anticipates this: staff who *mail* a paper notice need to record it.
 `RenewalNoticeChannel` (`MAIL` | `EMAIL`) exists for exactly this distinction.
@@ -321,12 +372,19 @@ customer to stop the mail.
 
 ### API surface
 
+As built (the `/policies/:id/renewal-notices` mark-as-sent mutation was
+dropped — see §1.4):
+
 | Method | Route | Ability |
 |---|---|---|
-| `POST` | `/policies/:id/renewal-notices` | `renewal:send` |
+| `POST` | `/renewals/sweep` (manual trigger of the scheduled body; body `{ debug? }`) | `renewal:send` |
-| `POST` | `/renewals/sweep` (manual trigger of the cron body) | `renewal:send` |
+| `POST` | `/renewals/send` (one notice; body `{ policyId, generation, debug? }`) | `renewal:send` |
 | `GET` | `/renewals/pending?days=` (what the next sweep would send) | read (AuthenticatedGuard) |
 
+The cadence itself is edited through the notifications module
+(`GET`/`PUT /notifications/settings/schedule[/:kind]`, `setting:manage`),
+because one editor covers both sweeps.
+
 ### Abilities (new)
 
 | Ability | Min role | Notes |
@@ -706,9 +764,8 @@ equivalent is `InsuranceProvider`, which today holds only a name.
 
 ## Build sequencing
 
-1. **§1 renewal emails** — highest value, schema already ready, no blocker
+1. ~~**§1 renewal emails**~~ — **DONE 2026-08-01/02.** See §1's BUILT note.
-   beyond the SES sending account. ≈260 mails/month against a 91%-reachable
+   ≈260 mails/month against a 91%-reachable policyholder base.
-   policyholder base.
 2. **§2 liquidación batch** — small, builds on fields already wired. Do the two
    defect fixes (missing `policy_types` rows + FK `ON DELETE RESTRICT`) as part
    of it, since both distort its own report.
@@ -739,11 +796,18 @@ No collision with the abilities proposed in `RECEIPT_CAPTURE_SPEC.md`
 
 ## Open questions to take back to Jorge (collected)
 
-**§1 — renewal emails**
+**§1 — renewal emails** (feature built; these three are still open)
-- Which SES region + verified identity/configuration set, and whether to reuse
+- ~~Which SES region + verified identity/configuration set, and whether to
-  existing IAM credentials or create a scoped `ses:SendEmail` user.
+  reuse existing IAM credentials or create a scoped `ses:SendEmail` user.~~
+  **Answered in practice 2026-08-02** — the Gitea secrets were created. Two
+  things the deploy preflight cannot verify and that decide whether mail
+  actually goes out: `SES_FROM` must be a verified identity in `SES_REGION`,
+  and the account must be out of the SES sandbox (which restricts delivery to
+  verified recipients). See [`BACKLOG.md`](BACKLOG.md) §0.
 - The 78 policyholders with no email: skip silently, or produce a print
-  worklist? (Recommend the worklist.)
+  worklist? Currently they are **logged as `SKIPPED_NO_EMAIL`** in
+  `email_notification_log` — visible in "Registro de envíos", but not yet a
+  printable worklist. (Recommend the worklist.)
 - Spanish or English notice body?
 
 **§2 — liquidación**

docs/MASS_EMAIL_NOTIFICATIONS.md

@@ -0,0 +1,342 @@
+# Mass Email Notifications
+
+Modern replacement for the four PHP scripts under
+`email.notifications/send*.php` that fired bulk emails off the legacy
+`utility_dbo.email_alert_log` table. Lives in this codebase from
+`massive-email-notification` onward; the PHP scripts stay operational
+until the office flips over.
+
+## Why
+
+The legacy scripts did three things this app needed to keep doing: send
+outstanding-payment reminders, send payment-confirmation letters, and
+fire account-status alerts (red and yellow). They also sent a fourth
+trust-payment confirmation tied to `TRUSTHFEE`. Each was a separate CGI
+script the office hit manually or via cron, talking to `utility_dbo` over
+the same `mysqli` connection as the rest of the portal.
+
+The unified schema (see [`PLAN.md`](../PLAN.md) and
+[`docs/INSURANCE_FEATURES_SPEC.md`](INSURANCE_FEATURES_SPEC.md)) folded
+`datosfreak` and `TRUSTHFEE` into `customers` + `transactions` +
+`trust_accounts`, so the scripts' SQL no longer maps to anything. Rather
+than maintain parallel sync code to keep `utility_dbo` populated, this
+feature ports the four jobs onto the unified data and writes its own log.
+
+## What ships
+
+- `apps/api/src/mail/` — outbound mail transport. Amazon SES (matches
+  the `StorageService` env-driven optional-client pattern). Dev falls
+  back to stdout logging so a fresh checkout can exercise the jobs
+  without SES credentials.
+- `apps/api/src/notifications/` — the four jobs (`outstanding`,
+  `payment-confirm`, `account-status`, `trust-confirm`), each a public
+  service method + a `POST /notifications/{slug}` HTTP endpoint gated on
+  the new `notification:send` ability (MANAGER).
+- `apps/api/src/notifications/notification-schedule.service.ts` (+ its own
+  module) — the cadence of **both** automatic sweeps, stored in
+  `app_settings` and installed into `SchedulerRegistry` at boot. See
+  "Scheduled runs" below.
+- `packages/database/prisma/migrations/20260801200000_mass_email_notifications/migration.sql`
+  — two new tables (`email_notification_log`, `account_status_history`)
+  with enums and FKs to `customers`.
+- `apps/web/src/app/notificaciones/` — admin page: a shared flags panel and
+  schedule editor above the tabs, then per-tab trigger cards, a
+  transport-status header, and a paginated log browser.
+
+## Job semantics
+
+Preserved from the PHP originals (see
+`~/Documents/Claude-Memory/email-notifications-spec.md`):
+
+| Job | Recipients | Subject | Response key |
+|---|---|---|---|
+| 1. Outstanding payments | Customers with ≥1 outstanding Transaction (amount<0) | "Jorge Cuadros - Outstanding Payments" | `result:"success", notificationType:"sendPaymentConfirmation"` |
+| 2. Payment confirmation | Customers with a credit in last 24h | "Jorge Cuadros - Payment Confirmation" | `request:"success", notificationType:"sendPaymentConfirmation"` |
+| 3. Account status | All customers with a balance; yellow/red thresholds | "Jorge Cuadros - Account Status Alert" | `request:"success", notificationType:"sendAccountStatus"` |
+| 4. Trust confirmation | Customers with TrustAccount + recent TRUST-domain credit | "Jorge Cuadros - Trust Payment Confirmation" | `request:"success", notificationType:"sendTrustPaymentConfirmation"` |
+
+Wire shapes match the PHP originals byte-for-byte so anything downstream
+that scrapes `notificationType:"sendPaymentConfirmation"` keeps working.
+Job 1 reports `result` (not `request`) and `notificationType` literally
+`sendPaymentConfirmation` — these are the legacy quirks, preserved.
+
+### Day gates (Job 3 only)
+
+- **Yellow** ("DEBAJO DEL TIPO"): Wed only (or `ignoreDayRestriction`).
+- **Red** ("EN ROJO"): Mon/Wed/Fri only (or `ignoreDayRestriction`).
+- A customer who is red on Tuesday is logged as `SKIPPED_GATE` until
+  Wed, when both checks can fire on the same row.
+
+### Threshold logic (Job 3)
+
+The PHP used `datosfreak.TIPO` (50/100/200/300/500) and a hardcoded
+threshold table. The new schema encodes this as `Customer.minimumBalance`:
+
+- Yellow: `0 ≤ balance < minimumBalance`
+- Red: `balance < 0`
+
+Per-currency balance uses `BillingService.balances()` semantics (signed
+`SUM(transactions.amount)`, voided + outstanding excluded), so a
+yellow/red alert always lines up with what the receivables worklist shows
+staff. The customer-servicing letter reports in USD because the legacy
+letter was always USD; the union of `balanceUsd` and `balanceMxn` is
+reported per-customer, never collapsed (see `BillingService.balances()`).
+
+### Rate limit (Job 3 only)
+
+`useEmailLimit=true` enables a vestigial throttle: pause the sweep 1h
+after 100 sends. Off by default; SES does not need it.
+
+## Send flags
+
+The three flags are **platform-wide**, not per-tab. They live in the
+`/notificaciones` shell above the tabs (`NotificationFlagsCard`), and the
+shell passes them to both halves.
+
+| Flag | Applies to | Effect |
+|---|---|---|
+| `debug` | everything | Rewrites every recipient to `DEBUG_RECIPIENT` (`rmancinas@freakma.net`), tags the log row `debug: true`, sends with `xTracking: "debug"`. |
+| `ignoreDayRestriction` | Job 3 only | Bypasses the Wed / Mon-Wed-Fri gates. |
+| `useEmailLimit` | Job 3 only | The vestigial throttle above. |
+
+`debug` used to exist only on the servicios side, which meant there was no
+way to test a renewal aviso without mailing a real customer. On the pólizas
+path it now does three things beyond diverting the mail, all for the same
+reason — *the customer was not notified, so nothing may claim they were*:
+
+1. no `RenewalNotice` row is written, so the aviso stays in the pending list;
+2. the sweep's `lastSuccessfulAt` is not advanced, because `renewalWindow()`
+   uses it to widen the window over missed days — advancing it after a test
+   run would narrow tomorrow's window and drop those candidates for good;
+3. the send response carries `debug: true` and the address actually used, so
+   the UI says "prueba enviada … el cliente no ha recibido nada" rather than
+   claiming a delivery.
+
+Flags are **per-visit UI state and are never persisted.** A stored `debug`
+would survive a reload and silently swallow real customer mail for as long
+as nobody noticed. For the same reason the automatic runs below ignore them
+entirely and always send for real.
+
+## Tables
+
+### `email_notification_log`
+
+One row per send attempt (sent, failed, skipped). Carries the rendered
+body verbatim so a customer reply quoting an old email can be traced to
+the exact letter sent. SES MessageId stored for bounce/complaint
+correlation.
+
+Indexes: `(sendDate)`, `(notificationType, sendDate)`, `(customerId, sendDate)`.
+
+**This table is not job-specific.** Insurance renewal avisos
+(`RenewalsService`, see [`RENEWAL_NOTICES.md`](RENEWAL_NOTICES.md)) write
+here too, as `notificationType = RENEWAL_NOTICE` /
+`servicio = POLICIES` — one send history for the whole platform rather
+than one per feature. `NotificationLogService` is the only writer;
+anything that sends mail goes through it.
+
+`level` is therefore per-type and cannot be read without its
+`notificationType`: 0/1 (yellow/red) on `ACCOUNT_STATUS`, the aviso
+generation 1/2/3 on `RENEWAL_NOTICE`, null elsewhere. On the web side
+`notificationLevelLabel()` is the only place that branch lives.
+
+Renewals keep their own `renewal_notices` row as well. The two are not
+redundant: `renewal_notices` is *gating* state (one row per
+policy+generation, "already notified" — it drives the pending list),
+while this log is *history* (every attempt, including the failures and
+no-email skips a gating row cannot represent).
+
+### `account_status_history`
+
+Mirrors the legacy `utility_dbo.send_account_status_history` table:
+`(customerId, customerName, customerEmail, tipo, tCambio, balance,
+solicitado, level)`. `tipo` is the literal `"DEBAJO DEL TIPO"` or
+`"EN ROJO"` string the PHP used. `solicitado` keeps the legacy formula
+(`0 - TIPO - BALANCE`) even though it double-subtracts; downstream
+reports depend on the exact figure.
+
+Indexes: `(sendDate)`, `(customerId, sendDate)`, `(level, sendDate)`.
+
+## Environment
+
+```
+SES_REGION=us-east-1
+SES_ACCESS_KEY=...
+SES_SECRET_KEY=...
+SES_FROM=mail@jorgecuadros.com
+SES_FROM_NAME=Information Server
+SES_CONFIGURATION_SET=...      # optional
+NOTIFICATION_ADMIN_EMAILS=rmancinas@freakma.net,mpulido@freakma.net  # fallback only
+```
+
+`NOTIFICATION_ADMIN_EMAILS` is no longer the source of truth. The summary
+recipients are edited in the UI and stored in `app_settings`; the env var
+is the fallback for a deployment where nobody has saved them yet. See
+"Operator settings" below.
+
+Without SES_* the API still boots and `MailService` falls back to stdout
+in dev (`NODE_ENV !== "production"`). In production every send throws
+`ServiceUnavailableException` and the row is recorded as `FAILED`.
+
+These are **runtime** config — read at container boot, never baked into the
+image. For the Portainer deployments they are set as **Gitea repo secrets**
+and injected into the stack env by the `env_data` block of
+`.gitea/workflows/deploy-galactus.yml` (and `deploy.yml`), exactly like
+`DATABASE_URL` and `SESSION_SECRET`. Unlike most secrets there they carry no
+`_GALACTUS` suffix: one SES identity serves every deployment.
+
+They are optional to *deploy* — the preflight only warns — but the
+production image sets `NODE_ENV=production`, which disables the stdout dev
+fallback, so a blank SES config makes every send fail loudly rather than
+quietly going nowhere.
+
+## UI
+
+`/notificaciones`, two tabs over the one log.
+
+Above the tabs, owned by the shell because both halves are subject to them:
+
+- **Flags del envío** — the three flags above.
+- **Programación de envíos** — the cadence of both automatic sweeps
+  (`setting:manage` to edit; everyone can see when the next run is).
+
+Then per tab:
+
+- **Servicios** (`notification:send`) — an "Ejecutar todos" card, four
+  trigger cards, a transport status header, and the summary-recipients
+  setting. Reads the `CUSTOMERS` + `TRUST` slice.
+- **Pólizas** (`renewal:send`) — pending avisos and the manual sweep.
+  Reads the `POLICIES` slice.
+
+Both render the same `NotificationLogPanel` ("Registro de envíos"), which
+filters by servicio and by view (todos / enviados / fallidos / omitidos).
+STAFF users see the Servicios log read-only.
+
+Both mass actions ("Ejecutar todos" and the pólizas sweep) confirm before
+firing **only when `debug` is off** — that is the case where real customers
+receive mail, and a confirm on every click trains people to dismiss it.
+
+## API surface
+
+| Method | Route | Ability |
+|---|---|---|
+| `POST` | `/notifications/outstanding-payments` | `notification:send` |
+| `POST` | `/notifications/payment-confirmation` | `notification:send` |
+| `POST` | `/notifications/account-status` | `notification:send` |
+| `POST` | `/notifications/trust-payment-confirmation` | `notification:send` |
+| `POST` | `/notifications/run-all` | `notification:send` |
+| `GET` | `/notifications/log`, `/notifications/stats` | authenticated |
+| `GET` | `/notifications/settings/admin-emails` | authenticated |
+| `PUT` | `/notifications/settings/admin-emails` | `setting:manage` |
+| `GET` | `/notifications/settings/schedule` | authenticated |
+| `PUT` | `/notifications/settings/schedule/:kind` | `setting:manage` |
+
+Every trigger accepts the flags as **body or query string** — the PHP
+scripts took both (STDIN vs HTTP-CGI) and parity was cheap. The pólizas
+endpoints (`POST /renewals/sweep`, `POST /renewals/send`) accept `debug`
+only; the other two flags are estado-de-cuenta concepts and are not
+accepted there rather than being silently ignored.
+
+## Operator settings
+
+`app_settings` holds the configuration staff change without a redeploy.
+`SettingsService` resolves every key **db → env → default**, and reports
+which of the three a value came from so the UI can say so. Adding a key
+means adding a typed accessor there, not a generic getter.
+
+Keys today:
+
+| Key | Edited on | Notes |
+|---|---|---|
+| `notification.adminEmails` | Servicios tab | Summary recipients, comma-separated. |
+| `notification.schedule.servicios` | shell | JSON cadence of the automatic run-all. |
+| `notification.schedule.polizas` | shell | JSON cadence of the renewal sweep. |
+
+All three are gated on `setting:manage` (ADMIN — above `notification:send`,
+because redirecting the audit summaries is how someone would stop them being
+read).
+
+`notification.adminEmails` is read on every job rather than cached, so an
+edit takes effect on the next sweep with no restart. An empty saved list
+means "nobody" and deliberately does **not** fall through to the env.
+
+The two schedule keys have **no env rung** on the db → env → default ladder:
+a cadence was never an environment variable (it was a `@Cron` literal in the
+source), so the only two sources are the operator's row and the shipped
+default. A row that fails to parse is logged and treated as absent — a bad
+JSON blob must not take the scheduler down with it.
+
+Credentials do not belong here. SES keys, `DATABASE_URL` and S3 config stay
+in the environment: they are deployment identity, they must exist before
+the app can reach its own database, and a table only widens who can read
+them.
+
+## Scheduled runs
+
+Both halves run themselves on an **operator-editable** cadence. Nothing
+about the schedule is in the source any more:
+
+| Kind | Handler | Default | Was |
+|---|---|---|---|
+| `servicios` | `NotificationsService.scheduledRunAll()` → all four jobs in order | **off**, 07:00 Mon/Wed/Fri when enabled | nothing — the four jobs were click-only |
+| `polizas` | `RenewalsService.scheduledSweep()` | **on**, 06:00 daily | `@Cron("0 6 * * *")` in `renewals.service.ts` |
+
+The defaults preserve exactly what each half did before: pólizas keeps its
+06:00 sweep, servicios stays off. A default that starts mailing 260
+customers on its own after a deploy is not a default, it's an incident.
+
+### How it works
+
+`NotificationScheduleService` owns both cadences. The services that own the
+sweeps register a handler in `onModuleInit`:
+
+```ts
+await this.schedule.register("polizas", () => this.scheduledSweep());
+```
+
+The schedule service then compiles the stored value to a cron expression
+(`{hour, minute, weekdays}` → `m h * * dow`, empty weekdays = `*`) and
+installs a `CronJob` in `SchedulerRegistry` under
+`notification-schedule:<kind>`, in `America/Tijuana`. Saving from the UI
+re-reads the row, removes the old job and installs the new one — **no
+restart**, which was the whole point.
+
+Handlers are registered rather than injected because
+`NotificationsModule` and `RenewalsModule` both need this service and
+neither may import the other. It lives in its own
+`NotificationScheduleModule` for the same reason as
+`NotificationLogModule`.
+
+`cron` is a **direct dependency of `apps/api`**, not just a transitive one
+of `@nestjs/schedule`: pnpm's strict layout does not hoist it, so
+`import { CronJob } from "cron"` fails to resolve without it.
+
+### What a scheduled run does not do
+
+- **It never uses the UI flags.** No `debug` (so a forgotten test toggle
+  cannot silently stop customer mail), and no `ignoreDayRestriction` — an
+  automatic run on the operator's own cadence is exactly the case the
+  Mon/Wed/Fri gate was written for, so bypassing it would mail the red list
+  every scheduled day.
+- **It does not guard against multi-replica double-fire.** The pólizas sweep
+  has always had its own DB lock (`scheduled_job_states`, taken in
+  `RenewalsService.acquireLock`); the servicios run-all has no equivalent
+  and relies on the deployment being single-replica, which it is today on
+  galactus. Adding one means the `OpsService` single-running-job pattern —
+  a DB row, not an in-process flag.
+
+## What is intentionally NOT in scope
+
+- Per-recipient preview / HTML view in the UI. The log table shows what
+  was sent; previewing one requires fetching `bodySnapshot` and rendering
+  HTML in the browser, deferred until a customer-service need surfaces.
+- Bounce / complaint webhooks. `providerMessageId` is captured so a future
+  SNS topic can write back; the integration itself is a separate piece
+  of work.
+- Spanish / English body toggle. Legacy letters are English; the legacy
+  customer base is bilingual. `Customer` has no language preference.
+  Add one when the need is concrete (same open question as
+  [`INSURANCE_FEATURES_SPEC.md`](INSURANCE_FEATURES_SPEC.md) §1.6).
+- Importing the legacy `utility_dbo.email_alert_log` rows. They reference
+  the old `NUMid` (a stringified double) which no longer maps to a
+  unified customer; an import would be destructive.

docs/POLICY_OCR.md

@@ -0,0 +1,248 @@
+# Insurance Policy OCR Capture
+
+Reads an insurance policy PDF the office downloads from a carrier portal,
+proposes the `Policy` row it should become, and lets staff confirm. Built
+2026-08-01 (`5e9cb12`), live under `/polizas/captura`.
+
+## Why this exists — it was not planned
+
+This feature is **not in any spec**. It came out of building the utility
+statement OCR intake in [`RECEIPT_CAPTURE_SPEC.md`](RECEIPT_CAPTURE_SPEC.md)
+§2: once there was a working render → OCR → parse → match → review pipeline
+for CFE/CESPT/Telnor receipts, it was obvious the same shape applies to the
+*other* stack of paper this office keys in by hand every week — the carrier
+policy PDFs behind every `Policy` row.
+
+The two are the same job with a different document on the scanner. Keeping
+that recognition cheap is the whole point of how it was built: the pipeline
+was **reused, not copied**.
+
+- `OcrModule` (`apps/api/src/ocr/ocr.module.ts`) was extracted out of
+  `StatementsModule` in this same commit, purely so `PolicyOcrModule` can
+  inject `OCR_PROVIDER` without dragging in the statement pipeline.
+  `StatementsModule` now imports it and binds nothing itself. That extraction
+  was **blocking**: without it the policy module could not resolve the
+  provider at all.
+- The engine stays Tesseract behind the same swappable seam, so a managed
+  extraction API remains a one-line change in one file for both features.
+- The intake screen is a *mode of* the existing policy-creation screen, the
+  same way OCR receipt capture is a mode of Captura — not a new menu entry.
+
+## What ships
+
+| Piece | Path |
+|---|---|
+| API module | `apps/api/src/policy-ocr/` (service, controller, DTOs, matcher, parser) |
+| Shared OCR seam | `apps/api/src/ocr/ocr.module.ts` |
+| Tables | `policy_ocr_batches`, `policy_ocr_documents` (`20260801000000_policy_ocr_intake`) |
+| Web | `components/PolicyCaptura.tsx` (tab shell), `PolicyOcrIntake.tsx` (upload), `PolicyOcrReview.tsx` (review queue) |
+| Abilities | `policy:ingest`, `policy:ocr-review` — both **STAFF** |
+
+Abilities are STAFF for the same reason statement OCR is: nothing reaches the
+books unconfirmed, and the review step is what makes machine capture safe at
+that tier.
+
+## The screen
+
+`PolicyCaptura` is one screen with two ways in, mirroring `Captura.tsx`:
+
+- `/polizas/nuevo` → **manual** tab (`PolicyForm`, every field by hand)
+- `/polizas/captura` → **automática** tab (`PolicyOcrIntake`, drop a PDF)
+- `/polizas/captura/[id]` → the batch review queue
+
+Both modes end at the same place — a `Policy` row on a customer's file — so
+they are modes of one screen rather than two menu entries. Either URL renders
+the same component, so the tab toggle works from either entry point and old
+bookmarks land on the right tab.
+
+## Pipeline
+
+```
+upload PDF → store source → render pages → text layer? → parse → match → review → confirm
+```
+
+1. **Store the source.** `policy-ocr/{batchId}/source-N.pdf`, before anything
+   else touches it.
+2. **Render + read.** Every page is rendered to
+   `policy-ocr/{batchId}/page-M.png`. Text-layer wins when the PDF has one
+   (cheap, exact); the rendered image is OCR'd only when it does not — the
+   same precedence rule as the statement pipeline. Carrier-portal PDFs are
+   usually born-digital, so most of the time no OCR runs at all.
+3. **Parse.** Provider detected by brand signal first
+   (`GMX`, `Grupo Mexicano de Seguros`, `gmx.com.mx`,
+   `JUNTOS EL RIESGO ES MENOR`), layout patterns only as fallback — the same
+   ordering rule the statement parser needed.
+4. **Match.** Against `Policy.policyNumber`.
+5. **Review + confirm.** Nothing is written to `Policy` until a human
+   confirms.
+
+### One PDF = one policy
+
+This is the sharpest difference from statement OCR, and it inverts that
+feature's core assumption.
+
+Utility statements arrive **bundled, one customer per page** — so there, one
+page is one document and the parser runs per page. A policy PDF is the
+opposite: the GMX certificate is a 2-page document where page 1 carries the
+contract header and page 2 carries the per-coverage table, and **both pages
+describe the same policy**. So the pipeline concatenates every page's text
+(`\n\n` between pages, which also keeps `ocrRawText` readable for debugging)
+and runs the parser and the matcher exactly **once per file**.
+
+Consequences worth knowing before touching this code:
+
+- `PolicyOcrDocument.pageNumber` is repurposed as the **file ordinal within
+  the batch** (1, 2, 3…), not a page index. The
+  `(batchId, pageNumber)` unique constraint still holds, and one batch still
+  carries many policies — one per uploaded file.
+- Parser regexes are anchored across the whole concatenated text (`^From$`,
+  `^Currency\s+…`), which is why the page-boundary blank line matters.
+- `ocrConfidence` on the row is the **mean** across the file's pages.
+- A file that fails to parse produces exactly one `OCR_FAILED` row — the right
+  granularity, and the page PNGs stay on disk for a re-run after a parser fix.
+
+### `storageKey` is the source PDF, not a page image
+
+`PolicyOcrDocument.storageKey` points at `source-N.pdf`. The review screen
+embeds that file directly, so the reviewer looks at the **exact artifact the
+office received** and gets the browser's native PDF scrolling, zoom and text
+selection for free. Rendered PNGs are still written for future re-OCR or an
+image-based audit, but nothing points at them as the document's identity.
+
+(The statement side does the opposite — there `storageKey` is the page image,
+because a page *is* the document.)
+
+## Matching: policy number only, never the insured name
+
+`PolicyMatcherService` matches on `Policy.policyNumber` and nothing else.
+
+The certificate's "Insured" line is the account's registrant, which drifts
+from the customer the office actually holds the file under — the same finding
+the statement matcher is built around (a CESPT receipt reading
+`ARNAIZ ROSAS ELSA AURORA` for a customer this office holds as `CATT, RANDY`).
+Names are shown to the reviewer as a sanity check and never feed matching.
+
+| Rows on `policyNumber` | Result |
+|---|---|
+| exactly 1 | `MATCHED`, confident — the only unambiguous hit |
+| 0 | new policy: review offers a customer picker, confirm **creates** the row |
+| >1 | surfaced as candidates, human picks |
+
+More than one hit is never auto-resolved. Duplicate policy numbers across
+customers do occur (one group policy bound by two related parties), and
+picking arbitrarily would silently book the wrong coverage against the wrong
+person.
+
+## What the parser reads, and the field it cannot
+
+`ParsedPolicy` fields are all nullable on purpose: each carrier prints a
+different subset, and the matcher and review queue both work better with
+"field was read" vs "field was not" than with a guess.
+
+Read from the GMX certificate: policy number, insured name, additional
+insured, broker (→ `Policy.agentName`), legal address, ZIP, `policyFrom` /
+`policyTo` / `policyDate`, currency, premium-payment cadence, and the full
+per-coverage table (risk, insured amount, deductible, loss participation)
+preserved verbatim.
+
+> **The GMX certificate carries no premium.** Not "sometimes missing" — the
+> document does not have the figure. It lives on GMX's **separate `recibo`
+> PDF**. The parser leaves `netPremium` / `policyFee` / `brokerFee` / `total`
+> null and pushes a note onto the row —
+> *"esta página no trae prima; revisar el recibo de GMX por separado"* — so
+> the reviewer sees why the field is empty rather than assuming a read
+> failure.
+
+This is also why confirm never overwrites an existing `Policy.netPremium`
+with null: the certificate not carrying a premium is not evidence that the
+premium is gone.
+
+Deductible and loss participation are stored as **strings** (`"5%"`, `"20%"`,
+`"USD 1,000"`) — they are printed as a mix of percentages, currency amounts
+and free text, and normalising them would lose the distinction.
+
+## Confirm: what actually gets written
+
+Per confirmed document, in order:
+
+1. **The `Policy` row** — updated if a policy was matched, created under the
+   picked customer if not. Only non-null `extracted*` fields are written; null
+   never overwrites existing data.
+2. **A `PolicyDocument`** — the source PDF is streamed into the policy's
+   storage namespace and attached, so the paperwork stays with the policy.
+3. **Optionally a `Transaction`** — `INSURANCE` domain, negative amount
+   (a charge), `captureSource: "OCR"`, `captureRef` = the document id.
+
+The ledger write is **opt-in twice over**: staff must tick `postPremium`
+*and* a premium must have parsed to a positive number. Without that gate the
+premium-less certificate above would silently book a $0 charge on every
+confirm.
+
+`createdPolicyId` and `postedTransactionId` are unique columns on the
+document row, so a double-confirm cannot re-apply — and a `POSTED` document
+is refused outright.
+
+Discarding a batch is refused once any page is `POSTED`: a partly-applied
+batch has already written `Policy` (and possibly `Transaction`) rows, and
+hiding the paperwork behind a "discarded" label would leave those rows
+unexplained. Reject the remaining pages individually instead.
+
+## API surface
+
+| Method | Route | Ability |
+|---|---|---|
+| `GET` | `/policy-ocr/status` (is OCR + storage available) | authenticated |
+| `GET` | `/policy-ocr/batches`, `/batches/:id`, `/batches/:id/documents` | authenticated |
+| `GET` | `/policy-ocr/documents/:id/page` (streams the source PDF) | authenticated |
+| `POST` | `/policy-ocr/batches` (upload) | `policy:ingest` |
+| `PATCH` | `/policy-ocr/documents/:id` (edit the extracted fields) | `policy:ocr-review` |
+| `POST` | `/policy-ocr/documents/:id/reject` | `policy:ocr-review` |
+| `POST` | `/policy-ocr/batches/:id/discard` | `policy:ocr-review` |
+| `POST` | `/policy-ocr/batches/:id/confirm` | `policy:ocr-review` |
+
+## Requirements
+
+Same as statement OCR: object storage (`S3_ENDPOINT` + credentials) for the
+source PDFs and page images, and `tesseract-ocr` / `tesseract-ocr-data-spa` /
+`poppler-utils` in the API image. `GET /policy-ocr/status` reports both; if
+either is missing the feature reports itself unavailable and only this
+feature is disabled.
+
+## Tests
+
+`apps/api/src/policy-ocr/parsers/policy-parser.spec.ts` — 8 cases, all
+against verbatim text extracted from one real document,
+`HC_Folio_000767_Traduccion.pdf`: provider detection from the wordmark and
+from the footer URL, the header fields, every coverage row off the second
+page, the deductible/loss-participation strings, the missing-premium note,
+the broker line with the agent-number parens absent, and a page with no GMX
+signal at all (which must yield no provider rather than a bad guess).
+
+## Not built
+
+- **Only GMX.** The dispatcher (`detectPolicyProvider`) is a table of
+  `[provider, pattern]` pairs plus a `parsers` map, so adding ANA or Qualitas
+  is a parser function and two entries — but no other carrier's layout has
+  been seen yet, and guessing at one produces a parser nobody can verify.
+- **The `recibo` PDF.** Reading the premium off GMX's separate receipt
+  document, and pairing it to the certificate it belongs to, is the obvious
+  next piece. It is what would let `postPremium` stop being a manual tick.
+- **Renewals from OCR.** A re-issued policy arrives as a new certificate with
+  the same number; confirm updates the existing row rather than versioning
+  it. Nothing tracks "this is the 2027 issue of that policy".
+
+## Related
+
+- [`STATEMENT_OCR.md`](STATEMENT_OCR.md) — the utility statement pipeline this
+  was lifted from, as built. [`RECEIPT_CAPTURE_SPEC.md`](RECEIPT_CAPTURE_SPEC.md)
+  §2 is its design and the measured evidence behind it. Between them they are
+  the origin of three rules the policy parser applies: detect the provider by brand before layout, only
+  ever apply the Tesseract digit-confusion map (`O→0`, `S→5`, `B→8`, …) to
+  fields known to be digits, and parse amounts by separator *position* rather
+  than assuming `,` is thousands.
+
+  Those last two are **duplicated on purpose**, not imported: the module is
+  kept self-contained, since sharing a helper would couple two unrelated
+  domains through it. If you fix a bug in one, check the other.
+- [`INSURANCE_FEATURES_SPEC.md`](INSURANCE_FEATURES_SPEC.md) — the four
+  insurance features that *were* planned. This is not one of them.

docs/RECEIPT_CAPTURE_SPEC.md

@@ -131,10 +131,16 @@ single-movement form.
 
 ## 2. PDF / OCR auto-capture
 
-> **BUILT — 2026-08-01.** Implemented and verified end to end against real
+> **BUILT — 2026-08-01.** As-built reference:
+> [`STATEMENT_OCR.md`](STATEMENT_OCR.md) — what the shipped feature does, its
+> parsers, matcher rules and API surface. This section stays the *design* and
+> the evidence behind it; go there for what is in the code today.
+>
+> Implemented and verified end to end against real
 > scanned statements. `apps/api/src/statements/` holds the module: a swappable
 > `OcrProvider` seam with a self-hosted Tesseract implementation, per-provider
-> parsers for CFE / CESPT / Telnor, a scoped matcher, and a review queue that
+> parsers for CFE / CESPT / Telnor / gas / predial, a scoped matcher, and a
+> review queue that
 > posts through `BillingService.createBatch` with `source: "OCR"`. Web:
 > the "Captura automática (OCR)" tab of the Captura screen (upload + batch
 > list) and `/recibos/:id` (review queue with the page image beside the
@@ -150,6 +156,21 @@ single-movement form.
 > blobs. `GET /statements/status` reports `ocrAvailable` and `storageAvailable`,
 > and the upload card hides itself unless both hold.
 >
+> **This pipeline turned out to generalise, and a second feature came out of
+> it.** Once render → OCR → parse → match → review existed for utility
+> receipts, the same shape obviously fit the *other* stack of paper this
+> office keys in by hand — carrier policy PDFs. That is
+> [`POLICY_OCR.md`](POLICY_OCR.md), built 2026-08-01, and it is **not in any
+> spec**; it was a revelation from doing this one. The `OcrProvider` seam was
+> lifted out of `StatementsModule` into its own `OcrModule` so the policy
+> module could inject it without taking on the statement pipeline —
+> `StatementsModule` imports it now and binds nothing itself. The engine
+> choice stays a one-line change in one file, for both features.
+>
+> One assumption does **not** carry over: statements arrive bundled *one
+> customer per page*, so here a page is a document. A policy PDF is one
+> document across several pages. See that doc's "One PDF = one policy".
+>
 > **Measured, not assumed.** Ten real scans (46 pages of CFE, CESPT and Telnor
 > bills) drove every decision below. Against them the shipped parser identifies
 > the provider on **46/46**, reads an account reference on **43/46**, an amount
@@ -207,6 +228,102 @@ single-movement form.
 > each bill (`9`, `405`, `406`); Tesseract read `405` as `205`. Handwriting is
 > a review hint at best and is deliberately not an input to matching.
 
+> **EXTENDED — gas and predial, 2026-08-01.** A second corpus (14 documents,
+> 29 pages: five municipal predial batches and ten gas invoices) added four
+> parsers — `GAS TIJUANA` plus one per municipality, because Tijuana, Rosarito
+> and Ensenada issue three completely different documents. End to end against
+> the dev database that is **21/29 auto-matched, 22/29 identified**, with the
+> provider read on 29/29 and an amount on 26/29.
+>
+> The eight review cases are all legitimate: five Tijuana pages whose municipal
+> account is not yet on file (see below), one clave not in the book, one page
+> too poorly scanned to read a clave at all, and one gas account shared by two
+> services. Excluding the structural Tijuana case, that is 21/24.
+>
+> **Five things this corpus proved:**
+>
+> 1. **Not every statement is a scan.** The gas company sends born-digital CFDI
+>    invoices whose text layer is exact. Rasterising and re-recognising those
+>    can only lose information — one sample turned `MEDIDOR: VM01014426` into
+>    `ar (LTR): 014420` — so `OcrProvider.textPages` reads the embedded layer
+>    first (`pdftotext -bbox-layout`, same poppler package as `pdftoppm`) and
+>    OCR stays the fallback for real scans. Page images are still rendered and
+>    stored either way, because the reviewer needs to see the paper.
+> 2. **The clave catastral is not two letters and six digits.** Positions four
+>    through eight are digits in all 932 stored claves, but the third is a
+>    letter in fifteen of them (`MMB01041`, `CGH52121`). Digitising the whole
+>    tail maps that `B` to an `8` and produces a key matching no property.
+> 3. **Tijuana predial prints no clave catastral at all.** Its only identifier
+>    is an 8-digit municipal account, carried in a 32-digit payment barcode
+>    (`account(8) + DDMMYY + amount(9) + folio(9)`) that the legacy database
+>    never held. It goes in `PROPERTY_TAX.meterNumber` — the same column gas
+>    uses, and for the same reason: `accountNumber` holds `DATMEX.predial`,
+>    which is not a per-property key and overwriting it would destroy the only
+>    link back to the original records. So Tijuana pages start cold and are
+>    taught by the first confirm, exactly like gas.
+> 4. **On Rosarito and Ensenada the clave is the primary key, not a fallback.**
+>    Those receipts print nothing else, so a unique clave hit there is a real
+>    match and auto-matches; on a utility bill that merely happens to print one
+>    it stays a review hint, as before.
+> 5. **A misread `$` is the dangerous failure, not a missing one.** An Ensenada
+>    receipt for `$2,203.00` OCR'd as `82,203.00` — the dollar sign read as an
+>    8, which would post a charge 37× too large and look entirely ordinary in
+>    the ledger. Every predial amount therefore requires a literal `$`, and a
+>    page that cannot produce one reports no amount and goes to review. Two of
+>    the 29 pages take that path, which is the correct outcome for both.
+>
+> Regression cover for all of the above lives in
+> `statement-parser.spec.ts` and `tesseract.provider.spec.ts`; every fixture in
+> them is a verbatim OCR excerpt from a real receipt.
+
+> **EXTENDED — zona federal, 2026-08-01.** A third corpus (one document, 8
+> pages of Tijuana "Zona Federal Marítimo Terrestre" receipts — the federal
+> maritime-zone occupancy fee billed on beachfront lots) added the
+> `ZONA FEDERAL TIJUANA` parser. Provider read on 8/8, amount on 8/8 (all
+> eight verified against the paper), concession clave on 6/8, period on 8/8,
+> payment deadline on 2/8. Nothing auto-matched, and nothing could have — see
+> point 2.
+>
+> **Four things this corpus proved:**
+>
+> 1. **Tijuana bills predial and zona federal from the same treasury.** Same
+>    "Ayuntamiento de Tijuana" header, same Paseo del Centenario address, same
+>    `ATB-541201` RFC — every discriminator the predial parser uses matches a
+>    zona federal page too, so whichever rule is asked first wins. The words
+>    only this layout prints are `Marítimo Terrestre`, so its brand rule is
+>    asked ahead of all three predial ones.
+> 2. **`FEDERAL_ZONE.accountNumber` is an amount, not a reference.** It holds
+>    `DATMEX.zfed`, whose 77 values include `246.06`, `2369.09`, `22653.94` and
+>    a negative `-1679`; the concession claves the receipts are keyed by
+>    (`12-T -012`, `14-D -014`) appear nowhere in the database. Matching on that
+>    column could never hit — and because every row already has a value, the
+>    `[field]: null` guards on learning and on the blank-service fill would
+>    never fire either, so every page would return to review every bimester
+>    forever. The clave moves to `meterNumber`, joining gas and Tijuana predial,
+>    and the first confirm teaches the match. This is the same trap as
+>    `policies.total` and `PROPERTY_TAX.accountNumber`: a legacy column whose
+>    name promises an identifier and whose contents are something else.
+> 3. **The payable figure is not the printed subtotal.** The municipality rounds
+>    to whole pesos and prints the difference as its own `Ajuste Ley Hacienda
+>    Mpal` line — `-$0.05` against a 591.05 subtotal, `$0.21` against 2,872.79.
+>    The "Total a pagar" box that carries the rounded figure sits on a grey fill
+>    and OCR'd on 1 of 8 pages; the SubTotal row read on 8 of 8. So the amount
+>    is the rounded subtotal, cross-checked against the printed box wherever it
+>    survives (it agreed).
+> 4. **The office's own highlighter is an OCR failure mode.** Both pages that
+>    lost their clave lost it to a marker stroke drawn across the `Clave:` line
+>    — not to scan quality, which was otherwise fine. The clave is printed twice
+>    (receipt and stub), which rescued a third page whose heading was struck
+>    but whose stub was not; where both copies are struck, the page reports no
+>    clave and goes to review rather than guessing.
+>
+> **Not attempted:** deriving the payment deadline from the bimester. It is the
+> 17th of the month after the bimester closes on a current bill, but four of
+> these eight are late — they carry a $1,000 `Multa` — and print a
+> recalculated deadline a month out. A derived date would be wrong on exactly
+> the pages a human most wants to look at, so an unreadable deadline stays
+> null.
+
 ### Motivation (from the meeting)
 
 Each utility company (CFE, water, phone, gas...) sends 300+ individual
@@ -330,8 +447,8 @@ Per the meeting notes' own field list:
 | Agua — Número de cuenta | `WATER` | `accountNumber` | `AGUA` | ✅ populated today |
 | Zona Fed — Número de Zona Federal | `FEDERAL_ZONE` | `accountNumber` | `ZFED` | ✅ populated today |
 | Tel — Número de teléfono | `TELEPHONE` *(new)* | `accountNumber` | `Property.phone1/2/3` (currently on `Property`, not `PropertyService`) | ⚠️ schema gap — see below |
-| Impuesto — Clave Catastral | `PROPERTY_TAX` | `accountNumber` | migrated from `PREDIAL`, **not** `CLAVE` | ⚠️ needs verification — see below |
+| Impuesto — Clave Catastral | `PROPERTY_TAX` | `Property.cadastralKey`, plus `meterNumber` for Tijuana's municipal account | `CLAVE`; `PREDIAL` is left on `accountNumber` and never matched against | ✅ built — see the 2026-08-01 extension note |
-| Gas — Número de medidor | `GAS` | `meterNumber` | not populated — folded into free-text `notes` today | ⚠️ data gap — see below |
+| Gas — Número de medidor | `GAS` | `meterNumber` | not populated — folded into free-text `notes` today | ✅ 160/334 recovered from `notes` |
 
 Confidence rule of thumb once a field is confirmed populated, tune after
 seeing real statements:

docs/RENEWAL_NOTICES.md

@@ -126,6 +126,16 @@ from data (one parameterized template), not from report design text. See
 `RenewalNotice` in `schema.prisma` and the `aviso-renovacion` entry in
 `apps/api/src/reports/reports.registry.ts` for the first cut at this.
 
+> **Built 2026-08-01/02.** The three generations above are now
+> `RenewalNotice.generation` 1/2/3, mailed by `apps/api/src/renewals/` on an
+> operator-editable cadence (default 06:00 daily) and driven from the
+> **Pólizas** tab of `/notificaciones`. The `CONTROL … X MES` companion
+> reports have no equivalent and need none: every attempt — sent, failed, or
+> skipped for a missing address — lands in `email_notification_log`. See
+> [`MASS_EMAIL_NOTIFICATIONS.md`](MASS_EMAIL_NOTIFICATIONS.md) and
+> [`INSURANCE_FEATURES_SPEC.md`](INSURANCE_FEATURES_SPEC.md) §1. This document
+> stays a record of the **legacy** report chain, not of what shipped.
+
 ## Caveats
 
 - Only the ATLAS variants were extracted verbatim; the QUALITAS and

docs/STATEMENT_OCR.md

@@ -0,0 +1,315 @@
+# Utility Statement OCR Capture (receipt capture)
+
+Reads the stack of scanned utility bills the office pays every month, proposes
+the customer and the amount for each page, and posts the confirmed pages to the
+ledger as one batch against one check. Built 2026-08-01, live under `/recibos`.
+
+This is the **as-built** record. The design and the reasoning behind it are
+[`RECEIPT_CAPTURE_SPEC.md`](RECEIPT_CAPTURE_SPEC.md) §2, which also carries the
+measured results and the four spec corrections the real scans forced. Read that
+for *why*; read this for *what is there*.
+
+## The job it replaces
+
+Staff receive 300+ pages per month per service provider — CFE electricity,
+CESPT water, Telnor phone, gas, municipal predial, federal zone — and key each
+one into the ledger by hand, as a charge against the customer whose property
+the bill belongs to. The whole stack is paid with one office check, so the
+capture is naturally a batch.
+
+Auto-capture is a **mode of** the existing capture screen, not a separate
+feature: it is the same daily job with a scanner instead of a keyboard, and
+both modes post through the same ledger path.
+
+## What ships
+
+| Piece | Path |
+|---|---|
+| API module | `apps/api/src/statements/` (service, controller, DTOs, matcher, parsers) |
+| OCR seam | `apps/api/src/statements/ocr/` (interface + Tesseract), bound in `apps/api/src/ocr/ocr.module.ts` |
+| Tables | `statement_batches`, `statement_documents` (`20260731235721_statement_ocr_intake`) |
+| Web | `components/Captura.tsx` (tab shell), `StatementIntake.tsx` (upload + batch list), `/recibos/:id` (review queue) |
+| Abilities | `statement:ingest`, `statement:review` — both **STAFF** |
+
+STAFF is deliberate: the review step is what makes machine capture safe at that
+tier, since nothing reaches the ledger unconfirmed.
+
+## The screen
+
+`Captura` is one screen with two ways in:
+
+- `/estado-cuenta/lote` → **manual** tab (`ManualCheckCapture`, key each
+  receipt against one check by hand)
+- `/recibos` → **automática (OCR)** tab (`StatementIntake`, upload the scans)
+- `/recibos/:id` → the batch review queue, page image beside the extracted
+  fields
+
+Both end in the same place — charges on customers' ledgers posted against one
+check — so they are modes of one screen. Staff pick by what is on the desk that
+morning. Either URL renders the same component, so old bookmarks land on the
+right tab.
+
+## Pipeline
+
+```
+upload PDFs (+ service kind) → store source → render pages → text layer? → parse → match → review → confirm → ledger
+```
+
+**A batch is one service kind.** The uploader labels it (ELECTRIC, WATER,
+TELEPHONE, GAS, PROPERTY_TAX, FEDERAL_ZONE) and that label is enforced: if the
+parser reads a page as a different provider, the page is rejected as
+mis-sorted rather than matched. Posting a phone bill as a water charge is the
+failure being prevented.
+
+**Processing is not awaited.** 300 pages of OCR is minutes of CPU, far past any
+HTTP timeout, so `POST /statements/batches` returns the batch id immediately and
+the client polls. That is also what lets the review queue show partial progress.
+
+**One page = one document.** Statements arrive **bundled, one customer per
+page** — Telnor's own `Pág 3 de 6` is its internal pagination, not the office's
+scan — so every rendered page becomes its own `StatementDocument` and the
+parser runs per page. (The policy OCR feature inverts this; see "Sibling
+feature" below.)
+
+**One unreadable page must not abandon the other 299.** A page that throws
+becomes a single `OCR_FAILED` row and the loop continues.
+
+Both the source PDFs (`statement/{batchId}/source-N.pdf`) and every rendered
+page image (`page-N.png`) are stored. The source is the artifact the office
+received and the only way to re-run a corrected parser over the original; the
+page image is what the reviewer looks at, because "what the parser read" is
+only checkable against a picture of the paper.
+
+## The OCR seam
+
+`OcrProvider` (`ocr/ocr.provider.ts`) is the swap point. Four methods:
+`available()`, `renderPages()`, `recognize()`, `textPages()`.
+
+Everything above it works in terms of page text and word boxes, so the engine
+is replaceable without touching the parsers, the matcher or the schema. The
+shipped implementation is **self-hosted Tesseract**, and that choice is
+evidence-based rather than assumed — see the spec's measured results. A managed
+API (Textract, Document Intelligence, Document AI) fits behind the same
+interface with no schema change; at 300+ pages/month/company it would carry
+real recurring cost for accuracy that is not the bottleneck.
+
+The binding lives in `apps/api/src/ocr/ocr.module.ts`, extracted out of
+`StatementsModule` when [`POLICY_OCR.md`](POLICY_OCR.md) needed the same seam.
+`StatementsModule` imports it and binds nothing itself, so the engine decision
+is one line in one file for both features.
+
+### Text layer first, OCR as the fallback
+
+**Not every statement is a scan.** The gas company sends born-digital CFDI
+invoices whose text layer is already exact and already positioned.
+`textPages()` reads it (`pdftotext -bbox-layout`, same poppler package as
+`pdftoppm`) and OCR runs only where there is none.
+
+Rasterising a born-digital page and re-recognising it can only lose
+information — one sample turned `MEDIDOR: VM01014426` into
+`ar (LTR): 014420` — while costing about a minute of CPU for the privilege.
+Positions come back in the same pixel space `recognize()` uses, so the parsers'
+geometric helpers work unchanged on either source. When the text layer is used
+the document's notes say so verbatim: *"texto leído del PDF original, sin
+OCR"*.
+
+### Word boxes, not just text
+
+`OcrPage` carries `words[]` with pixel boxes because several real layouts are
+**tables**: the CESPT "RECIBO" prints `No. DE CUENTA` as a column header with
+the value in the row beneath it, which line-oriented text cannot associate.
+Parsers fall back to geometry for exactly those fields.
+
+## Parsers
+
+Eight providers, dispatched by a `BRAND` table checked before a `LAYOUT` table:
+
+| Provider | Service kind |
+|---|---|
+| `CFE` | ELECTRIC |
+| `CESPT` | WATER |
+| `TELNOR` | TELEPHONE |
+| `GAS TIJUANA` | GAS |
+| `PREDIAL TIJUANA` / `PREDIAL ROSARITO` / `PREDIAL ENSENADA` | PROPERTY_TAX |
+| `ZONA FEDERAL TIJUANA` | FEDERAL_ZONE |
+
+Three predial parsers rather than one because Tijuana, Rosarito and Ensenada
+issue three completely different documents — same tax, nothing else in common.
+
+Rules that are load-bearing and easy to break:
+
+- **Brand before layout, and never interleaved.** Scanned logos read badly (a
+  CESPT header came back as `E BAJA ES PAGO / EALIFORNIA`), which is why the
+  layout fallback exists — but *every* brand rule runs first, because a Telnor
+  page contains words a CFE structural rule would otherwise claim.
+- **Tijuana bills predial and zona federal from the same treasury.** Same
+  header, same address, same `ATB-541201` RFC, so every predial discriminator
+  matches a zona federal page too. The words only that layout prints are
+  `Marítimo Terrestre`, so its rule is asked ahead of all three predial ones.
+  **Order matters here in a way that is invisible from the code shape.**
+- **Parse amounts by separator position.** A real Telnor bill OCR'd as
+  `$ 649,00`; stripping commas as thousands separators makes that $64,900.
+- **A misread `$` is the dangerous failure, not a missing one.** An Ensenada
+  receipt for `$2,203.00` OCR'd as `82,203.00` — the sign read as an 8, which
+  would post a charge 37× too large and look entirely ordinary in the ledger.
+  Every predial amount therefore requires a literal `$`; a page that cannot
+  produce one reports no amount and goes to review.
+- **Digit-confusion repair only on fields known to be digits** (`O→0`, `S→5`,
+  `B→8`, …), never on free text.
+- **The clave catastral is not `[A-Z]{2}[0-9]{6}`.** Position three is a letter
+  in fifteen of the 932 stored claves (`MMB01041`, `CGH52121`). Digitising the
+  whole tail maps that `B` to an `8` and yields a key matching no property.
+- **Barcodes beat printed labels.** Where a provider prints a payment barcode
+  it is preferred and the two are cross-checked; disagreement sets
+  `crossChecked: false` and forces review, because which of the two was
+  misread is a judgement call.
+
+## Matching
+
+`StatementMatcherService`. Two rules govern everything:
+
+**Match on one scoped field, never fuzzily across all identifiers.** Each
+service kind has exactly one column its statements print, and only that column
+is consulted. A blanket search over accountNumber/meterNumber/route would let a
+water account number collide with an unrelated phone number, and the mis-post
+would look perfectly ordinary in the ledger.
+
+**Never match on the customer name.** A CESPT receipt for account `5365218`
+prints `ARNAIZ ROSAS ELSA AURORA`; the office's book, corroborated by the
+clave, has `CATT, RANDY`. The name on a utility bill is the registrant, not the
+current owner. Names are shown to the reviewer and are never an input.
+
+### `scopedRefField` — which column each kind actually prints
+
+| Kind | Column | Why |
+|---|---|---|
+| ELECTRIC, WATER, TELEPHONE, CABLE | `accountNumber` | the legacy column holds the printed number |
+| GAS | `meterNumber` | the number lived in free-text notes; `accountNumber` was never populated |
+| PROPERTY_TAX | `meterNumber` | `accountNumber` holds `DATMEX.predial`, an office file number that is neither unique nor printed anywhere |
+| FEDERAL_ZONE | `meterNumber` | `accountNumber` holds `DATMEX.zfed`, which is a **peso amount**, not a reference |
+
+`scopedRefField` is exported because three places must agree on the answer: the
+lookup, the blank-service fill on review, and the write-back on confirm. When
+they disagree a reference gets learned into a column nothing searches, and the
+same page returns to the review queue every month forever.
+
+The `FEDERAL_ZONE` case is the sharpest instance of a trap this codebase hits
+repeatedly (see also `policies.total`): a legacy column whose *name* promises
+an identifier and whose *contents* are something else. Three of its 77 values
+carry cents and one is negative. Worse than never matching — because every row
+already has a value, the `[field]: null` guards on learning and on the
+blank-service fill would never fire either.
+
+### The clave catastral is a rescue on some layouts and the primary key on others
+
+CESPT bills print the clave as well as an account number, so it rescues a page
+whose account number did not OCR — which happened on real samples. There it
+stays a hint.
+
+On Rosarito and Ensenada predial the receipt prints **nothing else**, so a
+unique clave hit is a real match and auto-matches. Tijuana predial prints no
+clave at all; its only identifier is an 8-digit municipal account carried in a
+32-digit payment barcode (`account(8) + DDMMYY + amount(9) + folio(9)`) that
+the legacy database never held, so those pages start cold and are taught by the
+first confirm.
+
+Multiple hits are always surfaced, never auto-picked — duplicate account
+numbers do occur in the legacy data, and the office's own `DUPLICADOS` report
+existed for a reason.
+
+## Confirm: what gets written
+
+`confirmBatch` posts through **`BillingService.createBatch`** — the same method
+the manual Editor screen uses — rather than writing `Transaction` rows
+directly, so OCR-sourced and hand-keyed receipts share one write path, one
+validation path and one audit trail.
+
+- `source: "OCR"` and a per-line `captureRef` of the document id feed the
+  duplicate-post guard, so a batch confirmed twice cannot double-charge.
+- `items[i]` is positionally parallel to `lines[i]` (a documented seam
+  guarantee), so the created rows zip straight back onto the documents that
+  produced them via `postedTransactionId`.
+- **The sign is applied here.** Charges are negative in this ledger; the parser
+  reads the printed positive figure, and `-Math.abs()` is applied at the single
+  point where a statement becomes a ledger row.
+- A missing amount blocks the confirm with the offending page numbers, rather
+  than silently posting zero.
+
+### Learning: the cold start is a one-time cost
+
+After posting, `learnAccountRefs` writes each confirmed reference back onto the
+`PropertyService` that matched — **only where the field was null**. Never
+overwrites a number already on file, which would let one misread page rewrite
+good reference data.
+
+This is what turns gas (whose numbers the migration never populated) and
+Tijuana predial (whose municipal account the legacy database never held) from a
+permanent review queue into a one-time cost: next month's statement for the
+same account matches on its own.
+
+### Discarding
+
+Refused once any page is `POSTED` — those pages already wrote ledger rows
+against a check, and a "discarded" label on the batch would leave the charges
+unexplained. Reject the remaining pages individually instead.
+
+## API surface
+
+| Method | Route | Ability |
+|---|---|---|
+| `GET` | `/statements/status` (is OCR + storage available) | authenticated |
+| `GET` | `/statements/batches`, `/batches/:id`, `/batches/:id/documents` | authenticated |
+| `GET` | `/statements/documents/:id/page` (streams the page image) | authenticated |
+| `POST` | `/statements/batches` (upload + service kind) | `statement:ingest` |
+| `PATCH` | `/statements/documents/:id` (correct a field or the match) | `statement:review` |
+| `POST` | `/statements/documents/:id/reject` | `statement:review` |
+| `POST` | `/statements/batches/:id/discard` | `statement:review` |
+| `POST` | `/statements/batches/:id/confirm` | `statement:review` |
+
+## Requirements
+
+Object storage (`S3_ENDPOINT` + credentials) for the scans, and `tesseract-ocr`
+/ `tesseract-ocr-data-spa` / `poppler-utils` in the API image. Both are checked
+at upload rather than at the first write — a missing dependency should be a 400
+on the request, not a `FAILED` batch minutes later. `GET /statements/status`
+reports both and the upload card hides itself unless both hold.
+
+## Tests
+
+- `parsers/statement-parser.spec.ts` — `detectProvider`,
+  `normalizeCadastralKey`, and one suite per newer parser
+  (`parsePredialTijuana`, `parsePredialRosarito`, `parsePredialEnsenada`,
+  `parseGas`, `parseZonaFederal`). Every fixture is a **verbatim OCR excerpt
+  from a real receipt**, including the ones that bit: the `82,203.00` Ensenada
+  dollar sign, the three-letter clave, the CESPT logo garbage.
+- `ocr/tesseract.provider.spec.ts` — `parseBboxLayout`, the
+  `pdftotext -bbox-layout` reader that produces the text-layer `OcrPage`
+  (positions included, which is what lets the geometric helpers work on
+  born-digital input).
+
+Note the CFE / CESPT / Telnor parsers themselves have **no unit suite** — they
+predate the gas/predial extension and were verified against the 46-page corpus
+end to end rather than in isolation. Worth closing if they are touched.
+
+## Not built
+
+- **Handwritten folder numbers.** Staff pencil a customer number on each bill
+  (`9`, `405`); Tesseract read `405` as `205`. Handwriting is a review hint at
+  best and is deliberately not an input to matching.
+- **Re-running a corrected parser over a stored batch.** The source PDFs are
+  kept precisely so this is possible, but nothing exposes it yet.
+- **Providers beyond the eight above.** Adding one is a `BRAND` entry, an
+  optional `LAYOUT` entry, and a parser function.
+
+## Sibling feature
+
+[`POLICY_OCR.md`](POLICY_OCR.md) — the same pipeline reading carrier policy
+PDFs into `Policy` rows, built out of this one. It reuses the seam, the
+provider-detection ordering, the digit-confusion map and the
+amount-by-separator rule.
+
+**One assumption does not carry over.** Here a page *is* a document, because
+statements arrive one customer per page. A policy PDF is one document across
+several pages, so that feature concatenates the pages and parses once per file.
+If you are porting a change between the two, that is the difference to check
+first.

migration/transform_customers.py

@@ -189,6 +189,11 @@ def customer_from_utilities(row, name_index) -> dict:
         customerSince=as_date(row["cliente_desde"]),
         status=as_bool(row["status"]),
         feeAmount=as_decimal(row["fee"]),
+        # DATGRAL.TIPO is the minimum-balance threshold (100/200/300/500 —
+        # 1,017 of 1,172 customers carry one), NOT an identification or account
+        # type as the column name suggests. It reaches the website as
+        # datosfreak.TIPO and is returned to the customer app as `minBalance`.
+        minimumBalance=as_decimal(row["tipo"]),
         updatedAt=NOW,
     )
 
@@ -217,6 +222,7 @@ def customer_from_insurance(row, name_index) -> dict:
         customerSince=None,
         status=1,
         feeAmount=None,
+        minimumBalance=None,
         updatedAt=NOW,
     )
 
@@ -225,7 +231,7 @@ _CUST_COLS = [
     "id", "name", "nameSource", "nameMissing", "addressLine1", "addressLine2", "city", "state", "zipCode",
     "country", "phone", "mobile", "fax", "email", "notes", "identificationType",
     "identificationNumber", "identificationExpiration", "customerSince",
-    "status", "feeAmount", "updatedAt",
+    "status", "feeAmount", "minimumBalance", "updatedAt",
 ]
 
 
@@ -316,7 +322,7 @@ def main() -> None:
             remap[rec["id"]] = stable or rec["id"]
         for rec in customers:
             rec["id"] = remap[rec["id"]]
-            cur.execute(f"INSERT INTO customers ({','.join(f'`{c}`' for c in _CUST_COLS)}) VALUES ({placeholders}) ON DUPLICATE KEY UPDATE name=VALUES(name),nameSource=VALUES(nameSource),nameMissing=VALUES(nameMissing),addressLine1=VALUES(addressLine1),addressLine2=VALUES(addressLine2),city=VALUES(city),state=VALUES(state),zipCode=VALUES(zipCode),country=VALUES(country),phone=VALUES(phone),mobile=VALUES(mobile),fax=VALUES(fax),email=VALUES(email),notes=VALUES(notes),identificationType=VALUES(identificationType),identificationNumber=VALUES(identificationNumber),identificationExpiration=VALUES(identificationExpiration),customerSince=VALUES(customerSince),status=VALUES(status),feeAmount=VALUES(feeAmount),updatedAt=VALUES(updatedAt)", tuple(rec[c] for c in _CUST_COLS))
+            cur.execute(f"INSERT INTO customers ({','.join(f'`{c}`' for c in _CUST_COLS)}) VALUES ({placeholders}) ON DUPLICATE KEY UPDATE name=VALUES(name),nameSource=VALUES(nameSource),nameMissing=VALUES(nameMissing),addressLine1=VALUES(addressLine1),addressLine2=VALUES(addressLine2),city=VALUES(city),state=VALUES(state),zipCode=VALUES(zipCode),country=VALUES(country),phone=VALUES(phone),mobile=VALUES(mobile),fax=VALUES(fax),email=VALUES(email),notes=VALUES(notes),identificationType=VALUES(identificationType),identificationNumber=VALUES(identificationNumber),identificationExpiration=VALUES(identificationExpiration),customerSince=VALUES(customerSince),status=VALUES(status),feeAmount=VALUES(feeAmount),minimumBalance=VALUES(minimumBalance),updatedAt=VALUES(updatedAt)", tuple(rec[c] for c in _CUST_COLS))
         for ref in refs:
             cur.execute("INSERT INTO customer_legacy_refs (id,customerId,sourceSystem,sourceTable,legacyId) VALUES (%s,%s,%s,%s,%s) ON DUPLICATE KEY UPDATE customerId=VALUES(customerId)",
                         (ref[0], remap[ref[1]], ref[2], ref[3], ref[4]))

migration/transform_transactions.py

@@ -112,6 +112,29 @@ def main():
         type_rows.append((tid, en, s(r["espa_ol"]), 0))
         type_map[en.upper()] = tid
 
+    def type_id_for(raw) -> str | None:
+        """Resolve a transaction type, minting one when the lookup lacks it.
+
+        The Access `TYPE OF TRX` table is a stale pick-list, not a constraint —
+        staff free-text straight into DATOS2, so 78 values covering 3,939 rows
+        (BALANCE FORWARD 1,188, ANNUAL FEE 1,116, IZZI 367, ...) appear in the
+        ledger but not the lookup. Leaving those unmapped stored typeId NULL and
+        lost the label outright: nothing else on `transactions` carries the type
+        text, so the row rendered blank and was unrecoverable after migration.
+        Minting from the literal keeps the display string; nameEs stays NULL
+        because only the lookup has translations.
+        """
+        en = s(raw)
+        if not en:
+            return None
+        key = en.upper()
+        tid = type_map.get(key)
+        if tid is None:
+            tid = str(uuid.uuid4())
+            type_rows.append((tid, en, None, 0))
+            type_map[key] = tid
+        return tid
+
     xr = load("stg_utilities", "tipo_hist")
     xr_rows = []
     for _, r in xr.iterrows():
@@ -193,7 +216,7 @@ def main():
             td = dt(r["date"])
             if td is None:
                 skip_date += 1; continue
-            tid = type_map.get((s(r["type_of_trx"]) or "").upper())
+            tid = type_id_for(r["type_of_trx"])
             add(cid, "UTILITY", td, dec(r["chargecredit"], Decimal(0)), "MXN",
                 period=s(r["period"]), reference=s(r["refer"]), typeid=tid,
                 check=s(r["cheque"]), src_db="UTILITIES", src_tbl=legacy_tbl,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgecuadros-platform",
-  "version": "1.0.5",
+  "version": "1.0.8",
   "private": true,
   "workspaces": [
     "apps/*",

packages/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jorgecuadros/database",
-  "version": "1.0.5",
+  "version": "1.0.8",
   "private": true,
   "main": "generated/client/index.js",
   "types": "generated/client/index.d.ts",